dsh-codex-community 0.0.1

package/SECURITY.md

@@ -0,0 +1,41 @@
+# 安全策略 / Security Policy
+
+## 中文
+
+### 支持范围
+
+`0.0.1` 发布后，仅最新 `0.0.x` 获得安全修复。支持范围以 [兼容性矩阵](docs/compatibility.md) 的精确 DSH/pi-ai/Node 版本为准；尚未完成的真实账号或平台验收不应被视为安全保证。
+
+高优先级问题包括：OAuth grant/token 泄漏、浏览器端收到凭据、错误或日志回显敏感 JSON、未授权网络目标、图片预算绕过、账户 quota 无限重试，以及流重放造成重复工具副作用。
+
+### 私下报告
+
+优先使用 GitHub **Private vulnerability reporting**。若入口不可用，请使用[安全私下联络回退表单](https://github.com/yoshino-xiao7/dsh-codex/issues/new?template=security-contact.yml)；公开 Issue 只请求私下渠道，不得包含技术细节或秘密。
+
+报告应包含受影响精确版本、平台、最小复现条件、影响和脱敏 code/shape。绝对不要发送 access/refresh token、OAuth code、cookie、credentials 文件、账户 ID、完整提示词、工具参数、私人路径、原图或完整 provider 响应。
+
+如果秘密已经暴露，请先在 ChatGPT/DSH 设置中退出并撤销相关会话，再联系维护者。不要等待插件修复后才撤销。
+
+### 披露
+
+维护者会确认边界与复现，准备修复和新版本，再协调披露。npm 版本不可覆盖；安全修复使用递增版本。
+
+## English
+
+### Supported versions
+
+After `0.0.1` is released, only the latest `0.0.x` receives security fixes. Support is limited to the exact DSH/pi-ai/Node versions in the [compatibility matrix](docs/compatibility.en.md). Pending real-account or platform acceptance is not a security guarantee.
+
+High-priority issues include OAuth grant/token exposure, credentials reaching the browser, sensitive JSON echoed in errors or logs, unauthorized network targets, image-limit bypass, infinite account-quota retry, and stream replay that duplicates tool side effects.
+
+### Private reporting
+
+Use GitHub **Private vulnerability reporting** whenever available. If unavailable, use the [private security contact fallback form](https://github.com/yoshino-xiao7/dsh-codex/issues/new?template=security-contact.yml). The public issue may only request a private channel and must contain no technical details or secrets.
+
+Include the exact affected version, platform, minimal preconditions, impact, and a sanitized code/shape. Never send an access/refresh token, OAuth code, cookie, credentials file, account ID, complete prompt, tool arguments, private path, source image, or complete provider response.
+
+If a secret was exposed, sign out and revoke the affected ChatGPT/DSH session before contacting maintainers. Do not wait for a plugin release before revocation.
+
+### Disclosure
+
+Maintainers confirm scope and reproduction, prepare a fix and incremented release, and then coordinate disclosure. Published npm versions are immutable and are never overwritten.

package/SUPPORT.md

@@ -0,0 +1,17 @@
+# 支持 / Support
+
+- 使用问题：[使用支持表单](https://github.com/yoshino-xiao7/dsh-codex/issues/new?template=support.yml)；可复现 Bug 与功能建议使用对应 Issue 表单。
+- 安全问题：按 [SECURITY.md](SECURITY.md) 私下报告。
+- 贡献与来源要求：[CONTRIBUTING.md](CONTRIBUTING.md)。
+- 不提供：账户额度申诉、ChatGPT 订阅退款、OpenAI/DeepSeek 官方支持、秘密恢复或私下代管凭据。
+
+提交前请先阅读 [故障排查](docs/troubleshooting.md)，并始终附精确版本与脱敏最小复现。
+
+---
+
+- Usage questions: [usage support form](https://github.com/yoshino-xiao7/dsh-codex/issues/new?template=support.yml); use the matching Issue form for reproducible bugs or feature requests.
+- Security issues: private reporting under [SECURITY.md](SECURITY.md).
+- Contribution and source requirements: [CONTRIBUTING.en.md](CONTRIBUTING.en.md).
+- Not provided: account-quota appeals, ChatGPT subscription refunds, official OpenAI/DeepSeek support, secret recovery, or private custody of credentials.
+
+Read [Troubleshooting](docs/troubleshooting.en.md) first and always include exact versions plus a sanitized minimal reproduction.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,25 @@
+# 第三方声明 / Third-party notices
+
+本项目的运行时组合依赖下列独立发布包。每次发布附带的 CycloneDX SBOM 是从已提交 lockfile 与 package manifest 离线生成的锁定参考依赖图，不代表某次安装实际得到的完整传递依赖树。发布证据会另存精确 DSH runtime 与隔离安装的实际依赖树；许可证仍以各依赖发布包内的 manifest 与许可证文件为准。
+
+This project composes the following independently published packages. Each release's CycloneDX SBOM is a locked reference dependency graph generated offline from the committed lockfile and package manifest; it is not a claim about the complete transitive tree produced by a particular installation. Release evidence separately records the actual trees installed with the exact DSH runtime and in the isolated import environment. Each published dependency's manifest and license files remain authoritative for its license terms.
+
+| Package | Role | License |
+| --- | --- | --- |
+| `@deepseek-ai/cordis` | Plugin runtime | MIT |
+| `@deepseek-ai/dsh-authorization` | OAuth flow registry and interaction seam | MIT |
+| `@deepseek-ai/dsh-client-connection` | Web client connection injection | MIT |
+| `@deepseek-ai/dsh-client-locale` | Web client locale service | MIT |
+| `@deepseek-ai/dsh-client-runtime` | Web client plugin runtime | MIT |
+| `@deepseek-ai/dsh-client-ui-settings` | Web settings-page integration | MIT |
+| `@deepseek-ai/dsh-commands` | Harness command registration | MIT |
+| `@deepseek-ai/dsh-credentials` | Credential-store contracts | MIT |
+| `@deepseek-ai/dsh-llm` | Harness LLM contracts | MIT |
+| `@deepseek-ai/dsh-llm-pi-ai` | Published DSH/pi-ai adapter | MIT |
+| `@deepseek-ai/dsh-settings` | Harness settings service | MIT |
+| `@deepseek-ai/schemastery` | Plugin configuration schema | MIT |
+| `@earendil-works/pi-ai` | Public Codex provider, OAuth, model catalog, transport | MIT |
+
+项目使用这些公开依赖不表示其作者对本项目背书。任何依赖 license、版本或来源变化都必须更新锁文件、SBOM、本文件和发布证据。
+
+Use of these public dependencies does not imply endorsement by their authors. Any dependency license, version, or source change requires an updated lockfile, SBOM, this notice, and release evidence.

package/codex-community.patch.yml

@@ -0,0 +1,13 @@
+- insert:
+    - id: authorization
+      name: '@deepseek-ai/dsh-authorization'
+
+    - id: dsh-codex
+      name: 'dsh-codex-community'
+      config:
+        partialResponseRecovery: true
+        cacheRetention: short
+        streamIdleTimeoutMs: 300000
+        maxRequestImageBytes: 20971520
+        requestImagePixelBudget: 4194304
+        requestImageMaxBytes: 1048576