dsh-codex-community 0.0.1

package/CHANGELOG.md

@@ -0,0 +1,90 @@
+# 更新日志 / Changelog
+
+本项目遵循 Keep a Changelog 的结构；`0.0.x` 为技术预览。
+This project follows the Keep a Changelog structure; `0.0.x` is a technical preview.
+
+## [0.0.1] - 2026-08-29
+
+### 中文
+
+#### 新增
+
+- `dsh-codex` route、Host 插件和 Web 登录页。
+- 与同一 profile 中其他 pi-ai provider 共存，不改写通用 `llm-pi-ai` 配置。
+- 插件专用的设置命名空间与 OAuth 凭据范围，只接受 ChatGPT OAuth。
+- Codex 模型启用管理、最近额度观测卡，以及 `/codex-login` 和 `/codex-usage` 命令。
+- `/codex` 当前会话偏好：Fast 开关和 `auto`、SSE、WebSocket 传输选择。
+- pi-ai Codex 模型目录、流式内容、reasoning、工具、图片和 replay 接线。
+- 安全 HTTP(S) 图片读取、图片预算、2 个活动任务与 32 个排队任务的有界调度、账户配额规范化与半段回复恢复模块。
+- 带 `dsh-codex:` 命名空间的 transport/cache session，以及 reset、agent dispose 和 runtime dispose 的精确资源清理。
+- 中英文 Web 设置页的操作互斥、卸载安全、长文本换行与 320 像素窄屏布局。
+- 覆盖单元、SDK 合同、真实 attachment seam、真实 DSH `LlmRuntime` waterfall、Web client 与 Host 加载的测试套件。
+- 冻结的 DSH 兼容性 smoke 运行时夹具，提交独立 `pnpm-lock.yaml` 并在 CI、兼容性监测与发布候选中使用 `--frozen-lockfile --ignore-scripts` 安装。
+- 发布候选在 Web/profile smoke 成功后记录 DSH 版本、夹具 lock SHA-256、Node、pnpm、平台、架构与生命周期脚本状态，并由严格门禁重新验证。
+- 中英文文档、社区治理、Issue/PR、跨平台 CI，以及最小权限、SHA 固定、离线确定性 SBOM 和可恢复重跑的发布流程。
+- 发布候选生成双语审批摘要，并在受保护环境审批前后各执行一次严格门禁；npm Trusted Publisher/OIDC 与 GitHub Release 写权限分属独立 job，Registry 回读证据通过不可变 Actions artifact 交接。
+- `0.0.1` 使用 npm `latest` 与正式 GitHub Release；发布前三平台 CI/profile smoke 必须 `3/3` 通过，供应链证据必须完整且必须经维护者批准。真实账号验证允许以 `0/13` 如实发布并在发布后持续记录；发现的问题进入 `0.0.2` 迭代。
+- 不发布、不读取凭据的 `pnpm run release:candidate -- 0.0.1` 本地/CI 候选复演：要求干净提交与 Node 24、pnpm `10.34.5`、npm `11.16.0`，精确执行 frozen install、完整检查、仅一次生成候选 tarball、dry-run、SBOM、DSH profile smoke、隔离导入和生产依赖 audit，写入 `release/`，已有输出时在写前失败。普通 CI 的独立只读 Ubuntu/Node 24 `candidate-replay` job 动态读取版本后调用该命令一次，并把完整证据上传为保留 14 天的 `dsh-codex-community-${{ github.sha }}-ci-replay` artifact；权威候选仍由 `main` 发布 workflow 生成，该复演不替代三平台 CI/profile smoke、真实账号验收或审批。
+- 幂等且离线的 `release:prepare` 命令，用于生成下一版本的双语 CHANGELOG/Release 草稿和全新 schema v3 验收记录；它会保护人工内容、在冲突发生时写入前失败，并拒绝受管文件或父目录符号链接。
+- 不联网、不读取凭据的 `release:acceptance` 离线证据记录器；新增 `pass-platform <linux|macos|windows>`，只记录维护者已核验的 CI/profile smoke，不检查提交是否存在；平台与真实网络证据必须绑定同一候选 SHA，已通过项只允许相同证据的幂等重放，不能覆盖不同证据；真实检查只有明确列齐固定断言才记录通过，`status` 不显示证据值，提交存在性/祖先关系仍由严格门禁验证，审批仍由维护者人工作出。
+- draft 专用的离线 `pnpm run release:acceptance -- reset-candidate --from-commit=<旧SHA> --to-commit=<新SHA>`：源码变化后清空全部旧平台/live 证据与审批并绑定新候选，再运行新 CI/profile smoke 并用 `pass-platform` 记录；它不检查提交存在性，通过受管路径检查、写锁和原子替换安全写入，拒绝重置 approved 记录，并把 fresh 状态下同一命令的重放保持为 `unchanged`。
+
+#### 修复
+
+- `Image request maxPixels must be a positive integer.`
+- `AccountQuotaExceeded` 被误判为可重试 `RATE_LIMIT`，直接抛出的配额错误绕过恢复层，DSH canonical `QUOTA` 绕过脱敏输出，无结构证据的通用 429 被误报为已确认账户配额，以及 request metadata/其他 JSON envelope 污染 provider 配额事实；只有 canonical `QUOTA`、顶层或一个自身匹配的 `error` envelope 可以确认账户配额和提供 reset/request ID/status，其他通用 429 使用非重试 `QUOTA_OR_RATE_LIMIT`。
+- `STREAM_CLOSED`、WebSocket 中断、直接抛错或缺少终止 chunk 的 EOF 导致半段回复丢失，或在已产生可见输出/工具调用后整次重放造成重复内容和工具副作用；纯工具流现在也失败关闭，`onRecovery` 观察者异常被隔离，不再破坏恢复文本、提示与终态。
+- OAuth 取消后的补偿删除可能误删另一 DSH 进程已排队的新登录；取消现在以串行 mutate 回调为线性化点，提交阶段由无凭据 generation tracker 阻止误报取消，退出仍通过同一记录锁保证最终状态；真实 Cordis flow owner 卸载会在提交选择前取消，或在提交选择后等待最终写入完成。
+- 已结束的保留 attempt 误取消新登录、排队图片取消后仍开始持久化、插件卸载后仍启动排队图片、模型能力预检在限流器外绕过活动/排队上限，以及保存阶段取消仍向调用方返回成功。
+- 不支持类型或结构损坏的已存 OAuth 记录被显示为已登录；现在会返回独立的 `invalid` 状态，且凭据 secret 不跨 RPC。
+- Web 登录操作竞态、异步完成后更新已卸载组件、热重载后残留旧样式节点，以及窄屏设置页横向溢出。
+- CI 与发布 smoke 直接通过 npm 解算 DSH peer 图可能产生不确定依赖结果和内存失控；现在只安装已提交的冻结 pnpm 运行时图，并要求依赖升级同步更新两套 lockfile 后重跑 CI 与验收。
+- 跨平台维护门禁在 Linux 区分 PR 模板文件名大小写、在 Windows 误判 CRLF 工作流文本并无法可靠启动 `pnpm.cmd` 或 npm 打包检查；模板路径、换行读取与包管理器调用现已跨平台一致。
+- Windows DSH profile smoke 结束后短暂的目录锁可能让临时目录清理报 `EBUSY`，并由 `finally` 覆盖真正的 smoke 失败；清理现在有限重试，若 smoke 与清理同时失败则保留两个错误。
+- 模型可选字段的显式 `null` 与非有限流空闲超时可能穿过基础 Schema；配置现在会在适配器 profile 与设置保存边界拒绝这些不可服务值。
+- 发布候选过早获得写权限、可变 Action 引用、未 smoke 精确候选、把参考 SBOM 当成实际安装树、缺少生产依赖高危审计、exact SRI 与签名/attestation 校验、GitHub Release 资产未回读、draft/tag 目标未在公开前验证和重复发布恢复不完整；直接依赖声明、贡献许可、双语隐私模板和协调依赖升级新增本地门禁，候选证据保留 90 天，并支持只重跑失败 job。
+- 发布阶段曾在同一 job 同时持有 npm OIDC 与 GitHub contents 写权限、provenance 未绑定候选仓库/工作流/ref/源码提交，且 Release 转为公开后缺少最终全量回读；现已拆分权限，逐项绑定来源，并在公开动作后重新校验标题、正文、标签、资产与字节摘要。
+- GitHub Actions 审核门禁现在逐条校验每个 `uses:` 是否属于明确审核的完整提交 allowlist，避免新增未审核 Action 借用其他位置的已审核 SHA 通过测试。
+- 发布工作流从错误分支触发时不再静默跳过；首次 `0.0.1` 根据 Registry 状态自动进入受限引导，后续版本自动使用 OIDC。候选会用固定 npm 对 `./` 本地 tarball 做 dry-run，发布后按 npm 11 的 `attestationBundles` 结构验证 SLSA provenance，并绑定包摘要、仓库、发布工作流、`main` ref 与候选源码提交；所有 Actions 已更新到审核过的 Node 24 版本。
+
+### English
+
+#### Added
+
+- A `dsh-codex` route, Host plugin, and Web sign-in page.
+- Coexistence with other pi-ai providers in the same profile without rewriting the general `llm-pi-ai` configuration.
+- A plugin-scoped settings namespace and OAuth credential scope that accepts ChatGPT OAuth only.
+- Codex model enablement, a recent quota-observation card, and `/codex-login` and `/codex-usage` commands.
+- Per-session `/codex` preferences for Fast and `auto`, SSE, or WebSocket transport.
+- pi-ai Codex catalog, streaming content, reasoning, tools, images, and replay wiring.
+- Safe HTTP(S) image reading, image policy, bounded scheduling with two active and 32 queued jobs, account-quota normalization, and partial-response recovery modules.
+- `dsh-codex:`-namespaced transport/cache sessions with exact cleanup on reset, agent disposal, and runtime disposal.
+- Mutually exclusive actions, unmount safety, long-text wrapping, and a 320-pixel narrow-screen layout in the Chinese and English Web settings page.
+- A test suite covering units, SDK contracts, the real attachment seam, the real DSH `LlmRuntime` waterfall, the Web client, and Host loading.
+- A frozen DSH compatibility-smoke runtime fixture with its own committed `pnpm-lock.yaml`, installed through `--frozen-lockfile --ignore-scripts` in CI, compatibility monitoring, and release candidates.
+- Release candidates record the DSH version, fixture-lock SHA-256, Node, pnpm, platform, architecture, and lifecycle-script state only after Web/profile smoke succeeds, and the strict gate re-verifies them.
+- Chinese and English documentation, governance, issue/PR templates, cross-platform CI, and a least-privilege release flow with pinned Actions, an offline deterministic SBOM, and recoverable reruns.
+- Release candidates produce a bilingual approval summary and run the strict gate both before and after protected-environment approval. npm Trusted Publisher/OIDC and GitHub Release write access live in separate jobs, with Registry readback evidence handed off through an immutable Actions artifact.
+- `0.0.1` uses npm `latest` and a full GitHub Release. Before publication, all three CI/profile-smoke platform gates must pass, supply-chain evidence must be complete, and a maintainer must approve the release. Controlled-account validation may be disclosed at `0/13` and continue after release; findings are iterated in `0.0.2`.
+- A non-publishing, credential-free `pnpm run release:candidate -- 0.0.1` local/CI replay requires a clean committed checkout plus Node 24, pnpm `10.34.5`, and npm `11.16.0`. It performs frozen installs, the complete checks, exactly one artifact-producing pack, dry-run, SBOM, DSH profile smoke, isolated import, and production-dependency audit into `release/`, failing before any write when output already exists. Regular CI's separate read-only Ubuntu/Node 24 `candidate-replay` job reads the version dynamically, invokes the command once, and uploads the complete evidence as the 14-day `dsh-codex-community-${{ github.sha }}-ci-replay` artifact. The authoritative candidate still comes from the release workflow on `main`; this replay does not replace three-platform CI/profile smoke, live-account acceptance, or approval.
+- An idempotent offline `release:prepare` command that creates the next bilingual CHANGELOG/Release drafts and a fresh schema-v3 acceptance record, preserves human-authored content, fails before writing on conflicts, and rejects managed-file or parent-directory symlinks.
+- An offline `release:acceptance` evidence recorder that neither accesses the network nor reads credentials, now with `pass-platform <linux|macos|windows>` to record only maintainer-verified CI/profile smoke without checking that the commit exists. Platform and live-network evidence must bind to one candidate SHA; a passed item permits only an idempotent replay of identical evidence and cannot be overwritten with different evidence. Live checks pass only when every fixed assertion is explicitly listed, `status` hides evidence values, the strict gate still checks commit existence/ancestry, and approval remains a maintainer decision.
+- A draft-only offline `pnpm run release:acceptance -- reset-candidate --from-commit=<old-SHA> --to-commit=<new-SHA>` command that clears all old platform/live evidence and approval fields after source changes, binds the new candidate, and precedes new CI/profile smoke recorded with `pass-platform`. It does not check commit existence, writes safely through managed-path checks, a write lock, and atomic replacement, rejects approved records, and keeps a replay of the same command against fresh state `unchanged`.
+
+#### Fixed
+
+- `Image request maxPixels must be a positive integer.`
+- `AccountQuotaExceeded` being mistaken for retryable `RATE_LIMIT`, directly thrown quota bypassing recovery, canonical DSH `QUOTA` bypassing sanitized output, generic 429 text without structured evidence being mislabeled as confirmed account quota, and request metadata/another JSON envelope contaminating provider quota facts. Only canonical `QUOTA`, the top level, or one independently matching `error` envelope can confirm quota and provide reset/request ID/status; other generic 429 failures use non-retryable `QUOTA_OR_RATE_LIMIT`.
+- Lost partial responses after `STREAM_CLOSED`, WebSocket interruption, a direct throw, or EOF without a terminal chunk, plus full-request replay after visible output or a tool call that could duplicate content or tool side effects. Tool-only streams now fail closed, and exceptions from the `onRecovery` observer cannot break recovered text, the notice, or the terminal event.
+- A compensating delete after OAuth cancellation could erase a newer sign-in already queued by another DSH process; cancellation now linearizes at the serialized mutate callback, a credential-free generation tracker prevents a commit from being misreported as cancelled, and sign-out still establishes its final state through the same record lock. Real Cordis flow-owner disposal now cancels before commit selection or waits for the final write after selection.
+- A retained completed attempt cancelling a newer sign-in, a cancelled or post-disposal queued image starting persistence, model-capability preflight bypassing active/queued bounds outside the limiter, and persistence-stage cancellation still returning success.
+- Unsupported or malformed stored OAuth records being presented as signed in; they now produce a distinct `invalid` state, and credential secrets never cross RPC.
+- Web sign-in action races, state updates after unmount, stale style nodes after hot reload, and horizontal overflow in narrow settings dialogs.
+- CI and release smoke resolving the DSH peer graph directly through npm, which could produce nondeterministic dependency results and uncontrolled memory use. They now install only the committed frozen pnpm runtime graph, and dependency upgrades must update both lockfiles before CI and acceptance are repeated.
+- Cross-platform maintenance gates failing on Linux due to pull-request-template filename casing, and on Windows due to CRLF-sensitive workflow assertions or unreliable direct spawning of `pnpm.cmd` and the npm pack check. Template paths, text normalization, and package-manager invocation are now portable.
+- A transient Windows directory lock after DSH profile smoke could make temporary cleanup fail with `EBUSY`, while `finally` masked the real smoke failure. Cleanup now retries within a fixed bound and preserves both errors when smoke and cleanup fail together.
+- Explicit `null` model overrides and non-finite stream idle timeouts could pass the basic Schema. Configuration now rejects these unserviceable values at the adapter-profile and settings-save boundaries.
+- Release candidates receiving write permission too early, mutable Action references, a missing exact-candidate smoke, reference SBOMs being treated as actual install trees, missing high-severity production-dependency audit, exact SRI and signature/attestation checks, missing GitHub asset readback, missing pre-publication draft/tag target verification, and incomplete recovery after a partial publication. Local gates now cover direct-dependency notices, contribution licensing, bilingual privacy templates, and coordinated dependency updates. Candidate evidence is retained for 90 days and supports rerunning only failed jobs.
+- A publication job previously held npm OIDC and GitHub contents write access together, provenance was not bound to the candidate repository/workflow/ref/source commit, and a Release lacked a final full readback after becoming public. Permissions are now split, every source field is bound, and the public title, body, tag, assets, and byte digests are revalidated after publication.
+- The GitHub Actions review gate now checks every `uses:` entry against an explicit allowlist of reviewed full commits, preventing an unreviewed Action from passing merely because a reviewed SHA appears elsewhere.
+- A release dispatch from the wrong branch now fails instead of silently skipping. The first `0.0.1` automatically enters a Registry-state-gated bootstrap, while later versions automatically use OIDC. The candidate dry-runs the `./` local tarball with the pinned npm; post-publication checks use npm 11's `attestationBundles` shape for SLSA provenance and bind the package digest, repository, release workflow, `main` ref, and candidate source commit. Every Action is pinned to a reviewed Node 24 release.

package/CONTRIBUTING.en.md

@@ -0,0 +1,54 @@
+# Contributing guide
+
+[简体中文](CONTRIBUTING.md) | [English](CONTRIBUTING.en.md)
+
+Thank you for helping maintain `dsh-codex-community`. Credential safety, protocol accuracy, recoverable failure, and cross-platform maintainability take priority.
+
+## Filing an issue
+
+Include:
+
+- exact plugin, DSH, and Node.js versions;
+- operating system and architecture;
+- a minimal reproduction, expected result, and actual result;
+- a sanitized error code, reset/request ID, or necessary stack;
+- whether image history, a tool call, partial output, or a profile override was involved.
+
+Never submit a token, OAuth code, cookie, credential file, complete raw response, private prompt, tool arguments, source image, or unreviewed diagnostic bundle. Follow [SECURITY.md](SECURITY.md) for security issues.
+
+## Development flow
+
+1. Read [Contribution sources and licensing](docs/contribution-sources.en.md) plus the relevant architecture and compatibility documents.
+2. Create a clearly named, single-purpose branch from current `main`.
+3. Add a failing reproduction first, then the smallest implementation that fixes it.
+4. Keep Chinese and English documentation plus the changelog synchronized.
+5. Run:
+
+```sh
+corepack enable
+pnpm install --frozen-lockfile
+pnpm --dir test/fixtures/dsh-runtime install --frozen-lockfile --ignore-scripts
+pnpm run check
+pnpm run verify:release
+```
+
+The complete test suite loads the exact DSH runtime, AgentLoop, and Retry plugin from the frozen fixture. Install that fixture first; tests must not rely on a machine-wide DSH installation.
+
+## Contribution license
+
+Contributions intentionally submitted for inclusion in this repository are provided under the project's Apache-2.0 license unless different terms are stated in writing with the submission and accepted by a maintainer. By submitting, you confirm that you have the right to submit the material and grant that license. This is not a copyright assignment, and no separate CLA is required.
+
+## Pull-request checklist
+
+- [ ] The change is focused and contains no unrelated refactor or formatting churn.
+- [ ] Behavior derives from public DSH/pi-ai/OpenAI contracts or reproducible black-box observation.
+- [ ] The change is authored by the contributor or derived from clearly identified public interfaces and specifications.
+- [ ] I have the right to submit every included item and agree to provide the contribution under Apache-2.0.
+- [ ] No code, tests, documentation, or media with unclear origin or licensing are included.
+- [ ] New behavior has regression coverage and failures are bounded or fail closed.
+- [ ] No secret, account data, real private response, or machine-specific path appears in a fixture.
+- [ ] Every dependency explains necessity, size, license, and supply-chain impact.
+- [ ] Both languages of README/docs/CHANGELOG are synchronized.
+- [ ] `pnpm run check` passes and real-network/platform evidence boundaries are stated.
+
+Merge is not release authorization. Tags, npm publication, GitHub Releases, and community submissions are separate maintainer actions under the release document.

package/CONTRIBUTING.md

@@ -0,0 +1,54 @@
+# 贡献指南
+
+[简体中文](CONTRIBUTING.md) | [English](CONTRIBUTING.en.md)
+
+感谢你帮助维护 `dsh-codex-community`。项目优先保证凭据安全、协议准确、失败可恢复和跨平台可维护性。
+
+## 提交 Issue
+
+Bug 报告请提供：
+
+- 插件、DSH、Node.js 的精确版本；
+- 操作系统与架构；
+- 最小复现、预期与实际结果；
+- 脱敏错误 code、reset/request ID 或必要 stack；
+- 是否涉及图片历史、工具调用、部分回复或 profile 覆盖。
+
+不要提交 token、OAuth code、cookie、凭据文件、完整原始响应、私人提示词、工具参数、原图或未经检查的诊断包。安全问题遵循 [SECURITY.md](SECURITY.md)。
+
+## 开发流程
+
+1. 阅读 [贡献来源与许可](docs/contribution-sources.md) 和相关架构、兼容性文档；
+2. 从最新 `main` 创建名称清晰、范围单一的分支；
+3. 先加入能复现问题的失败测试，再实现最小修复；
+4. 同步维护中文、英文文档和 CHANGELOG；
+5. 运行：
+
+```sh
+corepack enable
+pnpm install --frozen-lockfile
+pnpm --dir test/fixtures/dsh-runtime install --frozen-lockfile --ignore-scripts
+pnpm run check
+pnpm run verify:release
+```
+
+全量测试会从冻结夹具加载精确 DSH runtime、AgentLoop 与 Retry 插件，因此必须先安装夹具依赖；不要让测试隐式使用机器上已有的 DSH 安装。
+
+## 贡献许可
+
+有意提交到本仓库的贡献将按本项目的 Apache-2.0 许可证提供，除非提交时明确书面说明并由维护者接受其他条款。提交贡献即表示你有权提交该内容，并有权按上述许可授予使用权；这不构成版权转让，也不要求额外 CLA。
+
+## PR 检查表
+
+- [ ] 变更范围单一，没有无关重构或格式噪音；
+- [ ] 行为通过公开 DSH/pi-ai/OpenAI 合同或可复现黑盒观察推导；
+- [ ] 变更由本人编写，或来自明确列出的公开接口与规范；
+- [ ] 我有权提交全部内容，并同意该贡献按 Apache-2.0 许可提供；
+- [ ] 没有提交来源不明或许可不清晰的代码、测试、文档或媒体；
+- [ ] 新行为有回归，失败路径为有界或失败关闭；
+- [ ] 没有秘密、账号数据、真实私有响应或机器专属路径 fixture；
+- [ ] 新依赖说明了必要性、体积、license 与供应链影响；
+- [ ] 中英文 README/docs/CHANGELOG 已同步；
+- [ ] `pnpm run check` 通过，且说明真实网络/平台验收边界。
+
+PR 合并不等于发布授权。tag、npm publish、GitHub Release 和社区收录由维护者按发布文档单独执行。

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 YukiRyou
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,12 @@
+dsh-codex-community
+Copyright 2026 YukiRyou
+
+This project is a community integration for interoperability
+with DeepSeek Harness. It is not affiliated with or endorsed by OpenAI or
+DeepSeek.
+
+Project source, tests, documentation, and media are authored in this
+repository or included from declared dependencies under their licenses.
+
+OpenAI, ChatGPT, Codex, DeepSeek, and related marks belong to their respective
+owners. Use of those names describes interoperability only.

package/README.en.md

@@ -0,0 +1,98 @@
+# dsh-codex
+
+[简体中文](README.md) | [English](README.en.md)
+
+A Codex plugin for DeepSeek Harness with ChatGPT OAuth sign-in, Codex models, image input, and reliable streaming responses.
+
+> Current version: `0.0.1` technical preview, published under npm `latest` with a full GitHub Release. npm package: `dsh-codex-community`.
+
+## Features
+
+- Sign in, sign in again, or sign out of ChatGPT OAuth from DSH Web;
+- select and enable Codex models with streaming text, reasoning, usage, tool calls, and session replay;
+- use DSH Web's native image paste, drag-and-drop, and attachment flow;
+- let `read_image` safely read HTTP(S) images with address, redirect, format, size, and timeout limits;
+- provide valid pixel and byte budgets for request images, preventing invalid `maxPixels` values;
+- classify `AccountQuotaExceeded` as non-retryable account quota and show a sanitized reset time;
+- preserve safe partial text after a stream failure, while incomplete tool calls stop without replaying the request;
+- use `/codex` to choose Fast and transport for the current session, with Fast off and transport automatic by default.
+
+## Requirements
+
+- DeepSeek Harness `0.1.1-rc.2`
+- Node.js `>=22.19.0 <25`
+
+## Installation
+
+Install an exact version:
+
+```sh
+dsh plugin --profile web add dsh-codex-community@0.0.1
+dsh web
+```
+
+## Sign in and use
+
+1. Open **Settings → OpenAI Codex** and complete the ChatGPT OAuth prompts.
+2. Enable models on the same page.
+3. Choose a Codex model from the conversation model selector.
+
+Available commands:
+
+```text
+/codex-login status
+/codex-login cancel
+/codex-login logout
+/codex-usage
+/codex status
+/codex reset
+/codex set fast on|off
+/codex set transport auto|sse|websocket|websocket-cached
+```
+
+Fast and transport preferences are kept only for the current session in the current process; they are not persisted. Fast requests the priority service tier, whose availability depends on the account and service; a failure is not automatically replayed on a lower tier.
+
+Update:
+
+```sh
+dsh plugin --profile web update dsh-codex-community@0.0.1
+dsh web
+```
+
+Before removal, sign out under **Settings → OpenAI Codex**, then run:
+
+```sh
+dsh plugin --profile web remove dsh-codex-community
+dsh web
+```
+
+## Error handling
+
+- `Image request maxPixels must be a positive integer.`: omitted or `null` image budgets receive safe defaults; zero, negative, fractional, and other explicitly invalid values are rejected while loading configuration.
+- `AccountQuotaExceeded`: the plugin stops automatic retries and preserves safe visible text. A reset time is shown only when present and validated. It does not try to bypass account quota by changing transport.
+- `QUOTA_OR_RATE_LIMIT`: when only generic 429 text remains and structured evidence is unavailable, the plugin neither reports confirmed account quota nor retries automatically. Retry manually later or check the account surface.
+- A response stops halfway: plain text can be preserved safely; an incomplete tool call is not replayed, avoiding duplicate side effects.
+
+See [Troubleshooting](docs/troubleshooting.en.md) for diagnostic steps.
+
+## Support boundaries
+
+- The `0.0.x` line does not promise a stable API; pin the exact version.
+- Before publication, `0.0.1` must pass the Linux, macOS, and Windows platform gates, the complete supply-chain verification, and maintainer approval. It may be formally published with controlled-account validation at `0/13`, provided every unverified capability remains clearly disclosed and validation continues after release.
+- Problems found after publication are fixed and iterated in `0.0.2`; the published `0.0.1` is never overwritten.
+- Quota state comes from recent requests; it is not a live balance or proactive account query.
+- Fast is an explicitly enabled experimental capability; controlled post-release validation continues to confirm real-account entitlement.
+- Image generation and editing are not provided.
+- See [Compatibility](docs/compatibility.en.md) for Windows, Linux, real OAuth, and real Codex network acceptance status.
+
+## Documentation and contribution
+
+- [Documentation index](docs/README.en.md)
+- [Configuration reference](docs/configuration.en.md)
+- [Contributing](CONTRIBUTING.en.md)
+- [Security reports](SECURITY.md)
+- [Support scope](SUPPORT.md)
+
+Never attach a token, OAuth code, cookie, credential file, or complete private conversation to an issue.
+
+Apache-2.0; see [LICENSE](LICENSE). This project is community-maintained and is not affiliated with or endorsed by OpenAI or DeepSeek.

package/README.md

@@ -0,0 +1,98 @@
+# dsh-codex
+
+[简体中文](README.md) | [English](README.en.md)
+
+面向 DeepSeek Harness 的 Codex 插件，提供 ChatGPT OAuth 登录、Codex 模型、图片输入和可靠的流式回复。
+
+> 当前版本：`0.0.1` 技术预览，使用 npm `latest` 与正式 GitHub Release 发布。npm 包名：`dsh-codex-community`。
+
+## 功能
+
+- 在 DSH Web 中完成 ChatGPT OAuth 登录、重新登录和退出；
+- 选择并启用 Codex 模型，支持流式文本、reasoning、usage、工具调用和会话 replay；
+- 使用 DSH Web 原生的图片粘贴、拖放和 attachment 流程；
+- 让 `read_image` 安全读取 HTTP(S) 图片，并限制地址、重定向、格式、大小和超时；
+- 为请求图片补全有效的像素与字节预算，避免无效 `maxPixels`；
+- 将 `AccountQuotaExceeded` 识别为不可重试的账户配额错误，并显示脱敏后的重置时间；
+- 流中断时保留安全的半段纯文本；涉及未完成工具调用时停止，不自动重放请求；
+- 使用 `/codex` 为当前会话选择 Fast 和传输方式，默认关闭 Fast、自动选择传输。
+
+## 运行要求
+
+- DeepSeek Harness `0.1.1-rc.2`
+- Node.js `>=22.19.0 <25`
+
+## 安装
+
+请固定安装精确版本：
+
+```sh
+dsh plugin --profile web add dsh-codex-community@0.0.1
+dsh web
+```
+
+## 登录与使用
+
+1. 打开 **设置 → OpenAI Codex**，按页面提示完成 ChatGPT OAuth；
+2. 在同一页面启用模型；
+3. 从会话模型选择器中选择 Codex 模型开始使用。
+
+可用命令：
+
+```text
+/codex-login status
+/codex-login cancel
+/codex-login logout
+/codex-usage
+/codex status
+/codex reset
+/codex set fast on|off
+/codex set transport auto|sse|websocket|websocket-cached
+```
+
+Fast 和传输偏好只保存在当前进程的当前会话中，不会持久化。Fast 请求 priority service tier，但是否可用取决于账号和服务端；失败后不会自动降级重放请求。
+
+更新：
+
+```sh
+dsh plugin --profile web update dsh-codex-community@0.0.1
+dsh web
+```
+
+卸载前请先在 **设置 → OpenAI Codex** 中退出，然后执行：
+
+```sh
+dsh plugin --profile web remove dsh-codex-community
+dsh web
+```
+
+## 错误处理
+
+- `Image request maxPixels must be a positive integer.`：图片预算缺省或为 `null` 时会回填安全默认值；零、负数、浮点和其他显式非法值会在配置加载时被拒绝。
+- `AccountQuotaExceeded`：插件会停止自动重试并保留安全的已显示文本；重置时间存在且通过校验时才会显示。它不会通过切换传输方式绕过账户配额。
+- `QUOTA_OR_RATE_LIMIT`：服务只返回通用 429 文案、缺少结构化证据时，插件不会把它误报为已确认账户配额，也不会自动重试；请稍后手动重试或检查账户页面。
+- 回复到一半中断：纯文本可安全保存；未完成工具调用不会自动重放，以免重复产生副作用。
+
+排查步骤见[故障排查](docs/troubleshooting.md)。
+
+## 支持边界
+
+- `0.0.x` 不承诺稳定 API，请固定版本；
+- `0.0.1` 发布前必须通过 Linux、macOS 和 Windows 三平台门禁、完整供应链校验与维护者批准；真实账号验证允许以 `0/13` 状态正式发布，未验证能力必须如实展示并在发布后持续补齐；
+- 发布后发现的问题在 `0.0.2` 中修复和迭代，不覆盖已发布的 `0.0.1`；
+- 额度状态来自最近请求，不是实时余额或主动账户查询；
+- Fast 是显式开启的实验能力，真实账号权限会在发布后的受控验证中继续确认；
+- 不提供图片生成或编辑；
+- Windows、Linux、真实 OAuth 与真实 Codex 网络验收状态见[兼容性文档](docs/compatibility.md)。
+
+## 文档与贡献
+
+- [文档索引](docs/README.md)
+- [配置参考](docs/configuration.md)
+- [参与贡献](CONTRIBUTING.md)
+- [安全报告](SECURITY.md)
+- [支持范围](SUPPORT.md)
+
+提交 Issue 时不要附带 token、OAuth code、cookie、凭据文件或完整私人会话。
+
+Apache-2.0，详见 [LICENSE](LICENSE)。本项目由社区维护，与 OpenAI 或 DeepSeek 无隶属或背书关系。