deepcodex 0.1.0

package/scripts/credentials.js

@@ -0,0 +1,102 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { emitKeypressEvents } from 'node:readline';
+import { loadConfig } from './worker.js';
+
+export function readSecret(input = process.stdin, output = process.stderr) {
+  if (!input.isTTY || !output.isTTY) throw new Error('Configure requires an interactive terminal; do not pass the key as an argument.');
+  return new Promise((resolve, reject) => {
+    let secret = '';
+    const wasRaw = Boolean(input.isRaw);
+    const finish = error => {
+      input.removeListener('keypress', onKey);
+      input.removeListener('end', onEnd);
+      input.removeListener('error', onError);
+      input.setRawMode(wasRaw);
+      input.pause();
+      output.write('\n');
+      if (error) reject(error);
+      else resolve(secret);
+      secret = '';
+    };
+    const onEnd = () => finish(new Error('Key entry cancelled.'));
+    const onError = () => finish(new Error('Unable to read the key from the terminal.'));
+    const onKey = (text, key = {}) => {
+      if ((key.ctrl && ['c', 'd'].includes(key.name)) || key.name === 'escape') return onEnd();
+      if (key.name === 'return' || key.name === 'enter') {
+        return finish(secret ? null : new Error('The key cannot be empty.'));
+      }
+      if (key.name === 'backspace') secret = secret.slice(0, -1);
+      else if (text && !key.ctrl && !key.meta) {
+        if (!/^[\x21-\x7e]+$/.test(text)) return finish(new Error('The key must contain only printable characters without spaces.'));
+        secret += text;
+      }
+    };
+    emitKeypressEvents(input);
+    input.setRawMode(true);
+    input.on('keypress', onKey);
+    input.once('end', onEnd);
+    input.once('error', onError);
+    output.write('DeepSeek API key (hidden): ');
+    input.resume();
+  });
+}
+
+export function saveCredentials(file, name, secret) {
+  if (!/^[A-Z_][A-Z0-9_]*$/.test(name) || !/^[\x21-\x7e]+$/.test(secret)) {
+    throw new Error('Invalid credential name or key.');
+  }
+  const directory = path.dirname(file);
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  const directoryStat = fs.lstatSync(directory);
+  if (!directoryStat.isDirectory() || directoryStat.uid !== process.getuid()) {
+    throw new Error('Credentials directory must be owned by this user and cannot be a symlink.');
+  }
+  fs.chmodSync(directory, 0o700);
+  let existing = '';
+  let fd;
+  try {
+    fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK);
+    const stat = fs.fstatSync(fd);
+    if (!stat.isFile() || stat.uid !== process.getuid()) throw new Error('Credentials must be a regular file owned by this user.');
+    existing = fs.readFileSync(fd, 'utf8');
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw new Error('Cannot safely open the credentials file.');
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+  }
+  const assignment = `${name}=${JSON.stringify(secret)}`;
+  const lines = existing.split(/\r\n|\r|\n/);
+  const matches = lines.flatMap((line, index) => new RegExp(`^\\s*(?:export\\s+)?${name}\\s*=`).test(line) ? [index] : []);
+  if (matches.length > 1) throw new Error('Duplicate key entries in the credentials file; resolve them before configuring.');
+  if (matches.length) lines[matches[0]] = assignment;
+  else {
+    if (lines.at(-1) === '') lines.pop();
+    lines.push(assignment, '');
+  }
+  const temporary = path.join(directory, `.credentials-${randomUUID()}.tmp`);
+  try {
+    fs.writeFileSync(temporary, lines.join('\n'), { flag: 'wx', mode: 0o600 });
+    fs.renameSync(temporary, file);
+  } finally {
+    fs.rmSync(temporary, { force: true });
+  }
+}
+
+export async function main(args) {
+  if (args.length === 2 && ['--help', '-h'].includes(args[1])) {
+    console.log('Usage: opencodex configure\nEnter the DeepSeek key in a hidden terminal prompt. Saves a private plaintext file outside the repository.');
+    return 0;
+  }
+  if (args.length !== 1 || args[0] !== 'configure') throw new Error('Usage: opencodex configure (no key arguments accepted)');
+  const config = loadConfig();
+  const name = config.codex.model_providers[config.codex.model_provider].env_key;
+  const configured = config.credentials.env_file;
+  const file = configured.startsWith('~/') ? path.join(os.homedir(), configured.slice(2)) : configured;
+  const secret = await readSecret();
+  saveCredentials(file, name, secret);
+  console.log('DeepSeek key saved with owner-only permissions. Run opencodex install to activate it or reload an existing router.');
+  return 0;
+}

package/scripts/desktop.js

@@ -0,0 +1,199 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { isDeepStrictEqual } from 'node:util';
+import { setTimeout as sleep } from 'node:timers/promises';
+import { ROOT, loadConfig, workerEnvironment, loadCredentials, doctor } from './worker.js';
+import { parseToml } from './toml.js';
+import { startPilot } from './pilot-router.js';
+
+const STATE = path.join(os.homedir(), '.config/opencodex/desktop');
+const readJson = filename => JSON.parse(fs.readFileSync(filename, 'utf8'));
+const expandHome = filename => filename.startsWith('~/') ? path.join(os.homedir(), filename.slice(2)) : filename;
+
+export function privateWrite(filename, content) {
+  const temporary = filename + '.tmp';
+  const fd = fs.openSync(temporary, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_TRUNC | fs.constants.O_NOFOLLOW, 0o600);
+  try {
+    fs.fchmodSync(fd, 0o600);
+    fs.writeFileSync(fd, content);
+  } finally { fs.closeSync(fd); }
+  fs.renameSync(temporary, filename);
+}
+
+export function mergeConfig(text, sections) {
+  const expected = parseToml(text);
+  const lines = text.match(/[^\n]*\n|[^\n]+$/g) || [];
+  if (lines.length && !lines.at(-1).endsWith('\n')) lines[lines.length - 1] += '\n';
+  for (const [section, values] of Object.entries(sections)) {
+    let target = expected;
+    for (const key of section ? section.split('.') : []) {
+      if (!Object.hasOwn(target, key)) target[key] = {};
+      target = target[key];
+    }
+    Object.assign(target, values);
+    let start = 0;
+    if (section) {
+      const match = lines.findIndex(line => line.trim() === `[${section}]`);
+      if (match < 0) {
+        lines.push(`\n[${section}]\n`);
+        start = lines.length;
+      } else start = match + 1;
+    }
+    let end = lines.findIndex((line, i) => i >= start && line.trimStart().startsWith('['));
+    if (end < 0) end = lines.length;
+    const block = lines.slice(start, end);
+    for (const [key, value] of Object.entries(values)) {
+      const assignment = `${key} = ${JSON.stringify(value)}\n`;
+      const indices = block.flatMap((line, i) => line.trimStart().startsWith(key) && line.trimStart().slice(key.length).trimStart().startsWith('=') ? [i] : []);
+      if (indices.length > 1) throw new Error(`Duplicate managed field: ${section}.${key}`);
+      if (indices.length) block[indices[0]] = assignment;
+      else block.push(assignment);
+    }
+    lines.splice(start, end - start, ...block);
+  }
+  const result = lines.join('');
+  if (!isDeepStrictEqual(parseToml(result), expected)) throw new Error('Configuration merge changed unrelated settings');
+  return result;
+}
+
+function xml(value) {
+  return String(value).replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;').replaceAll('"', '&quot;').replaceAll("'", '&apos;');
+}
+
+export function plistDocument(value) {
+  const encode = item => {
+    if (typeof item === 'boolean') return item ? '<true/>' : '<false/>';
+    if (typeof item === 'number' && Number.isInteger(item)) return `<integer>${item}</integer>`;
+    if (typeof item === 'string') return `<string>${xml(item)}</string>`;
+    if (Array.isArray(item)) return `<array>${item.map(encode).join('')}</array>`;
+    if (item && typeof item === 'object') return `<dict>${Object.entries(item).map(([key, entry]) => `<key>${xml(key)}</key>${encode(entry)}`).join('')}</dict>`;
+    throw new Error('Unsupported LaunchAgent value');
+  };
+  return `<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0">${encode(value)}</plist>\n`;
+}
+
+export function copyRuntime(root, runtime) {
+  fs.mkdirSync(runtime, { recursive: true, mode: 0o700 });
+  for (const directory of ['scripts', 'config', 'prompts', 'vendor']) {
+    fs.cpSync(path.join(root, directory), path.join(runtime, directory), { recursive: true,
+      filter: source => !['__pycache__', '.env', '.DS_Store'].includes(path.basename(source)) && !/\.py[cod]?$/.test(source) });
+  }
+  fs.copyFileSync(path.join(root, 'package.json'), path.join(runtime, 'package.json'));
+  const dependency = path.dirname(path.dirname(fileURLToPath(import.meta.resolve('smol-toml'))));
+  fs.cpSync(dependency, path.join(runtime, 'node_modules/smol-toml'), { recursive: true });
+}
+
+export async function health(state) {
+  const response = await fetch(`http://127.0.0.1:${state.config.port}/health`, {
+    headers: { 'x-opencodex-pilot': state.capability },
+    signal: AbortSignal.timeout(state.config.startup_timeout_seconds * 1000),
+  });
+  if (!response.ok) throw new Error(`Router health HTTP ${response.status}`);
+  return response.json();
+}
+
+export async function install() {
+  if (process.platform !== 'darwin') throw new Error('The Desktop installer requires macOS');
+  const config = { ...readJson(path.join(ROOT, 'config/pilot.json')), ...readJson(path.join(ROOT, 'config/desktop.json')) };
+  const original = loadConfig();
+  const env = workerEnvironment(process.env);
+  loadCredentials(env, original);
+  const diagnosis = doctor(original, env);
+  if (diagnosis.status !== 'ready') throw new Error('OpenCodex worker doctor must be ready before installation');
+  const configPath = path.join(env.CODEX_HOME || path.join(os.homedir(), '.codex'), 'config.toml');
+  const before = fs.readFileSync(configPath, 'utf8');
+  const parsed = parseToml(before);
+  if (!['openai', 'opencodex'].includes(parsed.model_provider ?? 'openai')) throw new Error('An unrelated custom provider is active; refusing to replace it');
+  if (parsed.openai_base_url || parsed.chatgpt_base_url) throw new Error('An existing endpoint override needs an explicit integration plan');
+  fs.mkdirSync(STATE, { recursive: true, mode: 0o700 });
+  fs.chmodSync(STATE, 0o700);
+  const runtime = path.join(os.homedir(), '.local/share/opencodex/runtime');
+  copyRuntime(ROOT, runtime);
+  let catalog;
+  if (parsed.model_catalog_json && path.resolve(expandHome(parsed.model_catalog_json)) !== path.join(STATE, 'models.json')) {
+    catalog = readJson(expandHome(parsed.model_catalog_json));
+  } else {
+    const result = spawnSync(diagnosis.codex, ['debug', 'models', '--bundled'], { encoding: 'utf8' });
+    if (result.error || result.status !== 0) throw new Error('Cannot read the bundled Codex model catalog');
+    catalog = JSON.parse(result.stdout);
+  }
+  const nativeModels = catalog.models.filter(entry => entry.slug !== original.codex.model);
+  const child = { ...original.model_metadata, slug: original.codex.model, multi_agent_version: 'v2',
+    base_instructions: fs.readFileSync(path.join(ROOT, 'prompts/worker.md'), 'utf8') };
+  privateWrite(path.join(STATE, 'models.json'), JSON.stringify({ models: [...nativeModels, child] }));
+  Object.assign(config, { native_models: nativeModels.map(entry => entry.slug), child_model: child.slug,
+    deepseek_url: original.codex.model_providers['opencodex-deepseek'].base_url + '/responses',
+    receipts: path.join(STATE, 'receipts.jsonl'), markers: [] });
+  const statePath = path.join(STATE, 'state.json');
+  const capability = fs.existsSync(statePath) ? readJson(statePath).capability : randomBytes(32).toString('base64url');
+  const state = { config, capability, node: process.execPath, runtime };
+  const sections = {
+    '': { model_provider: 'opencodex', model_catalog_json: path.join(STATE, 'models.json') },
+    agents: { enabled: true, default_subagent_model: child.slug, default_subagent_reasoning_effort: 'high' },
+    features: { multi_agent: true, multi_agent_v2: true },
+    'model_providers.opencodex': { name: 'OpenCodex', base_url: `http://127.0.0.1:${config.port}`, wire_api: 'responses',
+      requires_openai_auth: true, supports_websockets: false, request_max_retries: 0, stream_max_retries: 0, stream_idle_timeout_ms: config.request_timeout_ms },
+    'model_providers.opencodex.http_headers': { 'x-opencodex-pilot': capability },
+  };
+  const updated = mergeConfig(before, sections);
+  privateWrite(path.join(STATE, 'config.proposed.toml'), updated);
+  if (!fs.existsSync(path.join(STATE, 'config.before.toml'))) privateWrite(path.join(STATE, 'config.before.toml'), before);
+  privateWrite(statePath, JSON.stringify(state));
+  const label = config.service_label;
+  const plist = path.join(os.homedir(), 'Library/LaunchAgents', label + '.plist');
+  fs.mkdirSync(path.dirname(plist), { recursive: true });
+  privateWrite(plist, plistDocument({ Label: label, ProgramArguments: [process.execPath, path.join(runtime, 'scripts/desktop.js'), 'serve'],
+    WorkingDirectory: runtime, RunAtLoad: true, KeepAlive: true, ThrottleInterval: config.service_throttle_seconds,
+    StandardOutPath: path.join(STATE, 'service.log'), StandardErrorPath: path.join(STATE, 'service-errors.log'),
+    EnvironmentVariables: { HOME: os.homedir(), PATH: env.PATH } }));
+  const domain = `gui/${process.getuid()}`;
+  spawnSync('launchctl', ['bootout', `${domain}/${label}`]);
+  const bootstrap = spawnSync('launchctl', ['bootstrap', domain, plist]);
+  if (bootstrap.error || bootstrap.status !== 0) throw new Error('Cannot start OpenCodex LaunchAgent');
+  const deadline = Date.now() + config.startup_timeout_seconds * 1000;
+  let report;
+  while (!report) {
+    try { report = await health(state); }
+    catch {
+      if (Date.now() >= deadline) {
+        spawnSync('launchctl', ['bootout', `${domain}/${label}`]);
+        throw new Error('Desktop router did not become healthy; user config unchanged');
+      }
+      await sleep(original.limits.poll_interval_seconds * 1000);
+    }
+  }
+  if (fs.readFileSync(configPath, 'utf8') !== before) throw new Error('Codex config changed during installation; proposed config was not applied');
+  privateWrite(configPath, updated);
+  console.log(JSON.stringify({ ...report, service: label, port: config.port, cwd: runtime, owner: 'OpenCodex LaunchAgent',
+    native_models: nativeModels.length, subagent_model: child.slug, backup: path.join(STATE, 'config.before.toml'), restart_desktop_required: true }));
+}
+
+export async function main(args = process.argv.slice(2)) {
+  if (args.includes('--help') || args.includes('-h')) {
+    console.log('Usage: opencodex <install|status>\nActivate or inspect the local macOS Desktop router.');
+    return 0;
+  }
+  if (args.length !== 1 || !['install', 'serve', 'status'].includes(args[0])) throw new Error('Expected install, serve or status');
+  if (args[0] === 'install') await install();
+  else {
+    const state = readJson(path.join(STATE, 'state.json'));
+    if (args[0] === 'status') console.log(JSON.stringify({ ...await health(state), port: state.config.port, cwd: state.runtime }));
+    else {
+      const env = workerEnvironment(process.env);
+      loadCredentials(env, loadConfig());
+      if (!env.DEEPSEEK_API_KEY) throw new Error('DeepSeek credential unavailable');
+      const server = await startPilot(state.config, env.DEEPSEEK_API_KEY, state.capability);
+      console.log(JSON.stringify({ status: 'ready', pid: process.pid, port: server.address().port }));
+    }
+  }
+  return 0;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  try { process.exitCode = await main(); }
+  catch (error) { console.error(error.message); process.exitCode = 1; }
+}

package/scripts/pilot-router.js

@@ -0,0 +1,241 @@
+import http from 'node:http';
+import { once } from 'node:events';
+import { pathToFileURL } from 'node:url';
+import { createHash, timingSafeEqual } from 'node:crypto';
+import { appendFileSync, existsSync, renameSync, statSync } from 'node:fs';
+import { Readable } from 'node:stream';
+import { zstdDecompressSync } from 'node:zlib';
+import { deepSeekCustomToolNames, deepSeekResponsesEffort, deepSeekResponsesInput } from '../vendor/codex-router/deepseek-responses.js';
+import { bridgeCustomTools, flattenNamespaceTools, flattenNamespacedHistory, flattenToolChoice,
+  NamespaceToolCallTransform } from '../vendor/codex-router/namespace-relay.js';
+
+// Relay adaptation: codex-router/src/router.mjs at 63ec1f3602c28f2a28ccb7e9edaf7b4f7d191c6c.
+// Copyright (c) 2026 codex-router contributors; see ../vendor/codex-router/LICENSE.
+// Same native collaboration token predicate as codex-router at the vendored revision.
+const encryptedToken = /^gAAAAA[A-Za-z0-9_-]+={0,2}$/;
+const nativeHeaderNames = [
+  'authorization', 'chatgpt-account-id', 'openai-beta', 'originator', 'session_id',
+  'session-id', 'thread-id', 'x-client-request-id', 'x-codex-beta-features',
+  'x-codex-installation-id', 'x-codex-parent-thread-id', 'x-codex-turn-metadata',
+  'x-codex-turn-state', 'x-codex-window-id', 'x-oai-attestation',
+  'x-openai-internal-codex-responses-lite', 'x-openai-subagent',
+];
+
+export function nativeHeaders(headers) {
+  const result = { 'content-type': 'application/json', accept: 'text/event-stream' };
+  for (const key of nativeHeaderNames) if (headers[key]) result[key] = headers[key];
+  return result;
+}
+
+export function sseEvents(text) {
+  return text.split(/\r?\n\r?\n/).flatMap(frame => {
+    const data = frame.split(/\r?\n/).filter(line => line.startsWith('data:'))
+      .map(line => line.slice(5).trimStart()).join('\n');
+    return !data || data === '[DONE]' ? [] : [JSON.parse(data)];
+  });
+}
+
+export function completedOutput(events) {
+  const items = new Map();
+  for (const event of events) {
+    if (event.type === 'response.output_item.done') items.set(event.item.id, event.item);
+    if (event.type === 'response.completed') {
+      for (const item of event.response.output || []) items.set(item.id, item);
+    }
+  }
+  return [...items.values()];
+}
+
+export function plaintextHandoffs(input) {
+  if (!Array.isArray(input)) return input;
+  return input.map(item => item.type !== 'agent_message' ? item : {
+    ...item,
+    content: item.content.map(part => part.type === 'encrypted_content' && !encryptedToken.test(part.encrypted_content)
+      ? { type: 'input_text', text: part.encrypted_content } : part),
+  });
+}
+
+export function prepareDeepseek(payload, input) {
+  const flattened = flattenNamespaceTools(payload.tools, { maxNameLength: 64, aliasCollisions: true });
+  const bridged = bridgeCustomTools(flattened.tools, input, flattened.namespaces, payload.tool_choice,
+    deepSeekCustomToolNames(flattened.tools, input, payload.tool_choice), { maxNameLength: 64 });
+  return {
+    namespaces: flattened.namespaces,
+    payload: {
+      ...payload, input: flattenNamespacedHistory(deepSeekResponsesInput(bridged.input), flattened.namespaces),
+      tools: bridged.tools, tool_choice: flattenToolChoice(bridged.toolChoice, flattened.namespaces),
+      reasoning: { effort: deepSeekResponsesEffort(payload.reasoning?.effort) },
+    },
+  };
+}
+
+export async function startPilot(config, deepseekKey, capability) {
+  const relayCache = new Map();
+  let requestCount = 0;
+  const receipt = entry => {
+    if (existsSync(config.receipts) && statSync(config.receipts).size >= config.log_max_bytes) {
+      renameSync(config.receipts, config.receipts + '.1');
+    }
+    appendFileSync(config.receipts, JSON.stringify(entry) + '\n', { mode: 0o600 });
+  };
+  async function boundedText(response) {
+    let size = 0;
+    const parts = [];
+    for await (const part of response.body) {
+      size += part.length;
+      if (size > config.max_response_bytes) throw new Error('Response size limit exceeded');
+      parts.push(Buffer.from(part));
+    }
+    return Buffer.concat(parts).toString('utf8');
+  }
+  async function upstream(url, headers, body, signal) {
+    if (++requestCount > config.max_requests && config.max_requests !== null) throw new Error('Pilot request limit exceeded');
+    return fetch(url, { method: 'POST', headers, body: JSON.stringify(body), signal, redirect: 'error' });
+  }
+  async function handoff(item, headers, signal) {
+    const token = item.content.find(part => part.type === 'encrypted_content')?.encrypted_content;
+    if (!token || !encryptedToken.test(token)) return plaintextHandoffs([item])[0];
+    const cacheKey = createHash('sha256').update(headers.authorization).update(token).digest('hex');
+    if (relayCache.get(cacheKey)?.expires < Date.now()) relayCache.delete(cacheKey);
+    if (!relayCache.has(cacheKey)) {
+      // Adapted from relayEncryptedAgentPayloadOnce in codex-router/src/router.mjs.
+      const result = await upstream(config.native_url, headers, {
+        model: config.relay_model, stream: true, store: false,
+        instructions: 'You are a transport relay. Do not execute or answer the delegated task. Call relay_external_agent_payload exactly once with the exact plaintext after the Payload: label in the supplied collaboration message. Preserve every character.',
+        input: [item],
+        tools: [{ type: 'function', name: 'relay_external_agent_payload', strict: true,
+          parameters: { type: 'object', properties: { payload: { type: 'string' } }, required: ['payload'], additionalProperties: false } }],
+        tool_choice: { type: 'function', name: 'relay_external_agent_payload' },
+      }, signal);
+      const body = await boundedText(result);
+      receipt({ route: 'relay', model: config.relay_model, http_status: result.status });
+      if (!result.ok) throw new Error(`Native relay HTTP ${result.status}`);
+      const events = sseEvents(body);
+      if (!events.some(event => event.type === 'response.completed')) throw new Error('Native relay did not complete');
+      const calls = completedOutput(events).filter(item => item.type === 'function_call' && item.name === 'relay_external_agent_payload');
+      if (calls?.length !== 1) throw new Error('Native relay did not complete with one task payload');
+      const text = JSON.parse(calls[0].arguments).payload;
+      if (typeof text !== 'string' || !text.trim()) throw new Error('Native relay returned no task');
+      if (relayCache.size >= config.relay_cache_entries) relayCache.delete(relayCache.keys().next().value);
+      relayCache.set(cacheKey, { text, expires: Date.now() + config.relay_cache_ttl_ms });
+    }
+    return { ...item, content: item.content.map(part => part.type === 'encrypted_content'
+      ? { type: 'input_text', text: relayCache.get(cacheKey).text } : part) };
+  }
+  const server = http.createServer(async (request, response) => {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), config.request_timeout_ms);
+    let clientCancelled = false;
+    let route;
+    let model;
+    response.on('close', () => {
+      if (!response.writableFinished && !controller.signal.aborted) {
+        clientCancelled = true;
+        controller.abort();
+      }
+    });
+    try {
+      const supplied = Buffer.from(request.headers['x-opencodex-pilot'] || '');
+      const expected = Buffer.from(capability);
+      if (supplied.length !== expected.length || !timingSafeEqual(supplied, expected)) {
+        response.writeHead(403).end(); return;
+      }
+      if (request.method === 'GET' && request.url === '/health') {
+        response.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ status: 'ready', pid: process.pid })); return;
+      }
+      const path = new URL(request.url, 'http://localhost').pathname;
+      const nativePaths = ['/responses', '/responses/compact', '/responses/lite', '/alpha/search'];
+      if (request.method !== 'POST' || !nativePaths.includes(path)) {
+        response.writeHead(404).end(); return;
+      }
+      const parts = []; let size = 0;
+      for await (const part of request) {
+        size += part.length;
+        if (size > config.max_request_bytes) throw new Error('Request size limit exceeded');
+        parts.push(part);
+      }
+      let bytes = Buffer.concat(parts);
+      const encoding = request.headers['content-encoding'];
+      if (encoding === 'zstd') bytes = zstdDecompressSync(bytes, { maxOutputLength: config.max_request_bytes });
+      else if (encoding) throw new Error('Unsupported request compression');
+      const payload = JSON.parse(bytes.toString('utf8'));
+      const isChild = payload.model === config.child_model;
+      route = isChild ? 'deepseek' : 'native';
+      model = payload.model;
+      if (!isChild && payload.model && !config.native_models.includes(payload.model)) throw new Error('Model outside configured catalog');
+      if (isChild && path !== '/responses') throw new Error('DeepSeek supports only the Responses endpoint');
+      const headers = nativeHeaders(request.headers);
+      if (!headers.authorization) throw new Error('Missing Codex authentication');
+      let body = payload;
+      let namespaces;
+      if (isChild) {
+        const input = [];
+        for (const item of payload.input) input.push(item.type === 'agent_message' ? await handoff(item, headers, controller.signal) : item);
+        const prepared = prepareDeepseek(payload, input);
+        body = prepared.payload;
+        namespaces = prepared.namespaces;
+      } else body = { ...payload, input: plaintextHandoffs(payload.input) };
+      const nativeUrl = config.native_url.replace(/\/responses$/, '') + path;
+      const result = await upstream(isChild ? config.deepseek_url : nativeUrl,
+        isChild ? { 'content-type': 'application/json', authorization: `Bearer ${deepseekKey}` } : headers,
+        body, controller.signal);
+      const entry = {
+        route: isChild ? 'deepseek' : 'native', model: payload.model, http_status: result.status,
+        recipients: Array.isArray(payload.input) ? payload.input.filter(item => item.type === 'agent_message').map(item => item.recipient) : [],
+        task_count: Array.isArray(payload.input) ? payload.input.filter(item => item.type === 'agent_message').length : 0,
+        tool_results: config.markers.map(marker => Array.isArray(payload.input) && payload.input.some(item => item.type === 'function_call_output' && JSON.stringify(item.output).includes(marker))),
+      };
+      const contentType = result.headers.get('content-type') || 'application/octet-stream';
+      const responseHeaders = { 'content-type': contentType };
+      for (const name of ['x-codex-turn-state', 'x-request-id', 'retry-after']) {
+        if (result.headers.has(name)) responseHeaders[name] = result.headers.get(name);
+      }
+      response.writeHead(result.status, responseHeaders);
+      const source = Readable.fromWeb(result.body);
+      const stream = isChild && result.ok ? source.pipe(new NamespaceToolCallTransform(namespaces, contentType)) : source;
+      if (stream !== source) source.on('error', error => stream.destroy(error));
+      const chunks = []; let length = 0;
+      for await (const chunk of stream) {
+        length += chunk.length;
+        if (length > config.max_response_bytes) throw new Error('Response size limit exceeded');
+        chunks.push(Buffer.from(chunk));
+        if (!response.write(chunk)) await once(response, 'drain', { signal: controller.signal });
+      }
+      const text = Buffer.concat(chunks).toString('utf8');
+      if (result.ok && (contentType.includes('text/event-stream') || /^(?:event:|data:)/.test(text))) {
+        const events = sseEvents(text);
+        const completed = events.find(event => event.type === 'response.completed');
+        entry.completed = !!completed;
+        entry.response_model = completed?.response?.model;
+        const usage = completed?.response?.usage;
+        entry.usage = usage && { input_tokens: usage.input_tokens, output_tokens: usage.output_tokens,
+          cached_tokens: usage.input_tokens_details?.cached_tokens };
+        const output = completedOutput(events);
+        entry.calls = output.filter(item => item.type === 'function_call' || item.type === 'custom_tool_call').map(item => ({ name: item.name, namespace: item.namespace }));
+        const visible = output.filter(item => item.type === 'message').flatMap(item => item.content || []).filter(part => part.type === 'output_text').map(part => part.text).join('\n');
+        entry.answers = config.markers.map(marker => visible.includes(marker));
+      }
+      receipt(entry);
+      response.end();
+    } catch (error) {
+      if (clientCancelled) {
+        receipt({ route: 'cancelled', upstream_route: route, model, reason: 'codex_disconnected' });
+        return;
+      }
+      receipt({ route: 'error', message: String(error.message).replaceAll(deepseekKey, '[REDACTED]').replaceAll(capability, '[REDACTED]') });
+      if (!response.headersSent) response.writeHead(502, { 'content-type': 'application/json' }).end(JSON.stringify({ error: { message: 'OpenCodex request failed; inspect local receipts.' } }));
+      else response.destroy();
+    } finally { clearTimeout(timer); }
+  });
+  server.listen(config.port, '127.0.0.1');
+  await once(server, 'listening');
+  return server;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  let input = '';
+  for await (const chunk of process.stdin) input += chunk;
+  const { config, capability } = JSON.parse(input);
+  const server = await startPilot(config, process.env.DEEPSEEK_API_KEY, capability);
+  process.stdout.write(JSON.stringify({ pid: process.pid, port: server.address().port }) + '\n');
+}