dsh-codex-community 0.0.1

package/dist/internal/codex-authorization.mjs

@@ -0,0 +1,202 @@
+import {
+  CODEX_CREDENTIAL_KEY,
+  CODEX_PROVIDER_ID,
+} from "./codex-credential-store.mjs"
+
+const MAX_MESSAGE_CHARS = 2_048
+const MAX_PLACEHOLDER_CHARS = 512
+const MAX_CODE_CHARS = 256
+const MAX_URL_CHARS = 2_048
+const MAX_OPTIONS = 64
+
+/** Register the sole OAuth flow that writes the plugin-owned Codex grant. */
+export function registerCodexAuthorizationFlow({
+  ownerContext,
+  authorization,
+  credentialStore,
+  authContext,
+  provider,
+  commitTracker,
+}) {
+  void authContext
+  if (provider?.id !== CODEX_PROVIDER_ID || provider.auth?.oauth === undefined) {
+    throw new TypeError("provider must be the OAuth-capable Codex provider")
+  }
+
+  let closing = false
+  const flow = {
+    key: CODEX_CREDENTIAL_KEY,
+    label: "Codex (ChatGPT OAuth)",
+    methods: [{ id: "oauth", label: "使用 ChatGPT 登录 / Sign in with ChatGPT" }],
+    async run(session) {
+      if (closing) {
+        await waitForAbort(session.signal)
+        return
+      }
+      const trackedAttempt = commitTracker?.begin()
+      try {
+        const credential = await provider.auth.oauth.login({
+          signal: session.signal,
+          notify(event) {
+            const notice = authorizationNotice(event)
+            if (notice !== undefined) session.notify(notice)
+          },
+          prompt(prompt) {
+            return session.prompt(authorizationPrompt(prompt))
+          },
+        })
+        if (session.signal.aborted) return
+
+        // The serialized mutate callback is the cancellation linearization point.
+        // Before it selects a replacement, abort is a no-op. After it selects one,
+        // this write owns the lock and must finish: a later compensating delete
+        // cannot distinguish this attempt from a sign-in already queued by another
+        // DSH process and could erase that newer grant. The tracker lets plugin
+        // surfaces reject a too-late cancel until authorization/settled fires.
+        await credentialStore.modify(CODEX_PROVIDER_ID, () => {
+          if (session.signal.aborted) return undefined
+          if (trackedAttempt !== undefined && !trackedAttempt.selectCommit()) return undefined
+          return credential
+        })
+      } finally {
+        trackedAttempt?.finish()
+      }
+    },
+  }
+
+  const rootContext = ownerContext?.root
+  if (rootContext === undefined || rootContext === ownerContext) {
+    return authorization.registerFlow(flow)
+  }
+
+  // DSH rc.2 withdraws a flow and aborts its running controller in the same
+  // disposer. A selected credential write is already irreversible, so keep
+  // the flow under the app root and give the plugin one ordered cleanup that
+  // waits for the public authorization settlement before withdrawing it.
+  const rootAuthorization = rootContext.authorization
+  const settlementWaiters = new Set()
+  const disposeSettlementListener = rootContext.on(
+    "authorization/settled",
+    (key) => {
+      if (key !== CODEX_CREDENTIAL_KEY) return
+      commitTracker?.settle()
+      for (const resolve of settlementWaiters) resolve()
+      settlementWaiters.clear()
+    },
+    { global: true },
+  )
+  let disposeFlow
+  let disposeLifecycle
+  try {
+    disposeFlow = rootAuthorization.registerFlow(flow)
+    disposeLifecycle = ownerContext.effect(
+      () => async () => {
+        closing = true
+        try {
+          while (rootAuthorization.describe(CODEX_CREDENTIAL_KEY)?.inFlight === true) {
+            const settled = new Promise((resolve) => { settlementWaiters.add(resolve) })
+            if (commitTracker?.isCommitPending() !== true) {
+              rootAuthorization.cancel(CODEX_CREDENTIAL_KEY)
+            }
+            await settled
+          }
+        } finally {
+          disposeFlow()
+          disposeSettlementListener()
+          for (const resolve of settlementWaiters) resolve()
+          settlementWaiters.clear()
+        }
+      },
+      "dsh-codex: quiescent authorization flow",
+    )
+  } catch (error) {
+    disposeFlow?.()
+    disposeSettlementListener()
+    throw error
+  }
+  return disposeLifecycle
+}
+
+function waitForAbort(signal) {
+  if (signal.aborted) return Promise.resolve()
+  return new Promise((resolve) => signal.addEventListener("abort", resolve, { once: true }))
+}
+
+function authorizationNotice(event) {
+  switch (event?.type) {
+    case "auth_url":
+      return compact({
+        message: bounded(event.instructions ?? "在浏览器中继续授权。 / Continue authorization in your browser.", MAX_MESSAGE_CHARS),
+        url: safeAuthorizationUrl(event.url),
+      })
+    case "device_code":
+      return compact({
+        message: "在浏览器中继续授权。 / Continue authorization in your browser.",
+        url: safeAuthorizationUrl(event.verificationUri),
+        code: bounded(event.userCode, MAX_CODE_CHARS),
+      })
+    case "info":
+      return compact({
+        message: bounded(event.message, MAX_MESSAGE_CHARS),
+        url: safeAuthorizationUrl(event.links?.[0]?.url),
+      })
+    case "progress":
+      return { message: bounded(event.message, MAX_MESSAGE_CHARS) }
+    default:
+      return undefined
+  }
+}
+
+function authorizationPrompt(prompt) {
+  const signal = prompt.signal === undefined ? {} : { signal: prompt.signal }
+  if (prompt.type === "select") {
+    return {
+      ...signal,
+      kind: "select",
+      message: bounded(prompt.message, MAX_MESSAGE_CHARS),
+      options: prompt.options.slice(0, MAX_OPTIONS).map((option) => compact({
+        id: bounded(option.id, MAX_CODE_CHARS),
+        label: bounded(option.label, MAX_MESSAGE_CHARS),
+        description: option.description === undefined
+          ? undefined
+          : bounded(option.description, MAX_MESSAGE_CHARS),
+      })),
+    }
+  }
+  return compact({
+    ...signal,
+    kind: prompt.type === "secret" ? "secret" : "text",
+    message: bounded(prompt.message, MAX_MESSAGE_CHARS),
+    placeholder: prompt.placeholder === undefined
+      ? undefined
+      : bounded(prompt.placeholder, MAX_PLACEHOLDER_CHARS),
+  })
+}
+
+function safeAuthorizationUrl(value) {
+  if (typeof value !== "string" || value.length === 0 || value.length > MAX_URL_CHARS) return undefined
+  try {
+    const url = new URL(value)
+    if (url.username !== "" || url.password !== "") return undefined
+    if (url.protocol === "https:") return url.href
+    if (url.protocol === "http:" && isLoopback(url.hostname)) return url.href
+  } catch {
+    // Invalid URLs are omitted from the neutral notice.
+  }
+  return undefined
+}
+
+function isLoopback(hostname) {
+  return hostname === "localhost"
+    || hostname === "[::1]"
+    || /^127(?:\.\d{1,3}){3}$/u.test(hostname)
+}
+
+function bounded(value, maxLength) {
+  const text = String(value)
+  return text.length <= maxLength ? text : text.slice(0, maxLength)
+}
+
+function compact(value) {
+  return Object.fromEntries(Object.entries(value).filter(([, item]) => item !== undefined))
+}

package/dist/internal/codex-credential-store.mjs

@@ -0,0 +1,164 @@
+import {
+  CODEX_CREDENTIAL_KEY,
+  CODEX_PROVIDER_ID,
+} from "./codex-identifiers.mjs"
+
+export {
+  CODEX_CREDENTIAL_KEY,
+  CODEX_PROVIDER_ID,
+} from "./codex-identifiers.mjs"
+
+const MAX_JSON_DEPTH = 24
+const MAX_JSON_NODES = 8_192
+const MAX_STRING_CHARS = 1_048_576
+
+export class CodexCredentialStoreError extends Error {
+  constructor(message, code = "INVALID_CODEX_CREDENTIAL", options) {
+    super(message, options)
+    this.name = "CodexCredentialStoreError"
+    this.code = code
+  }
+}
+
+/**
+ * Adapt the Harness credential-record seam to pi-ai's provider-scoped store.
+ *
+ * The adapter owns exactly one record. It never enumerates or interprets any
+ * other plugin's records, and it accepts OAuth grants only: an API key cannot
+ * accidentally become an alternate authentication path for this provider.
+ */
+export function createCodexCredentialStore(credentials) {
+  if (credentials === null || typeof credentials !== "object") {
+    throw new TypeError("credentials must be a credential provider")
+  }
+
+  return Object.freeze({
+    async read(providerId) {
+      if (providerId !== CODEX_PROVIDER_ID) return undefined
+      return credentialFromRecord(await credentials.readRecord(CODEX_CREDENTIAL_KEY), true)
+    },
+
+    async list() {
+      const info = await credentials.describeRecord(CODEX_CREDENTIAL_KEY)
+      if (info.configured !== true) return []
+      if (info.kind !== "grant") {
+        throw invalidCredential("stored Codex credential is not an OAuth grant")
+      }
+      return [{ providerId: CODEX_PROVIDER_ID, type: "oauth" }]
+    },
+
+    async modify(providerId, mutate) {
+      if (providerId !== CODEX_PROVIDER_ID) {
+        throw new CodexCredentialStoreError(
+          "the Codex credential store does not own this provider",
+          "UNOWNED_PROVIDER",
+        )
+      }
+      if (typeof mutate !== "function") throw new TypeError("mutate must be a function")
+
+      const result = await credentials.modifyRecord(CODEX_CREDENTIAL_KEY, async (current) => {
+        // An explicit sign-in may repair an incompatible record. Request-time
+        // refresh still fails closed because a callback returning undefined
+        // leaves the incompatible record untouched and the final decode rejects.
+        const decoded = credentialFromRecord(current, false)
+        const next = await mutate(decoded)
+        return next === undefined ? undefined : recordFromCredential(next)
+      })
+      return credentialFromRecord(result, true)
+    },
+
+    async delete(providerId) {
+      if (providerId !== CODEX_PROVIDER_ID) return
+      await credentials.deleteRecord(CODEX_CREDENTIAL_KEY)
+    },
+  })
+}
+
+function credentialFromRecord(record, strict) {
+  if (record === undefined) return undefined
+  if (record?.kind !== "grant") {
+    if (!strict) return undefined
+    throw invalidCredential("stored Codex credential is not an OAuth grant")
+  }
+
+  try {
+    return oauthCredential(record.payload)
+  } catch (error) {
+    if (!strict) return undefined
+    if (error instanceof CodexCredentialStoreError) throw error
+    throw invalidCredential("stored Codex OAuth grant is invalid", error)
+  }
+}
+
+function recordFromCredential(credential) {
+  return { kind: "grant", payload: oauthCredential(credential) }
+}
+
+function oauthCredential(value) {
+  const payload = cloneJson(value)
+  if (!plainRecord(payload) || payload.type !== "oauth") {
+    throw invalidCredential("Codex credentials must use OAuth")
+  }
+  for (const field of ["access", "refresh"]) {
+    if (typeof payload[field] !== "string" || payload[field].length === 0) {
+      throw invalidCredential(`Codex OAuth credential is missing ${field}`)
+    }
+  }
+  if (!Number.isSafeInteger(payload.expires) || payload.expires <= 0) {
+    throw invalidCredential("Codex OAuth credential has an invalid expiry")
+  }
+  return payload
+}
+
+function cloneJson(value) {
+  const state = { nodes: 0, stack: new Set() }
+  validateJson(value, state, 0)
+  try {
+    return JSON.parse(JSON.stringify(value))
+  } catch (error) {
+    throw invalidCredential("Codex OAuth credential is not JSON compatible", error)
+  }
+}
+
+function validateJson(value, state, depth) {
+  state.nodes += 1
+  if (state.nodes > MAX_JSON_NODES || depth > MAX_JSON_DEPTH) {
+    throw invalidCredential("Codex OAuth credential exceeds structural limits")
+  }
+  if (value === null || typeof value === "boolean") return
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw invalidCredential("Codex OAuth credential contains an invalid number")
+    return
+  }
+  if (typeof value === "string") {
+    if (value.length > MAX_STRING_CHARS) throw invalidCredential("Codex OAuth credential contains an oversized string")
+    return
+  }
+  if (typeof value !== "object") {
+    throw invalidCredential("Codex OAuth credential contains a non-JSON value")
+  }
+  if (state.stack.has(value)) throw invalidCredential("Codex OAuth credential contains a cycle")
+  const prototype = Object.getPrototypeOf(value)
+  if (!Array.isArray(value) && prototype !== Object.prototype && prototype !== null) {
+    throw invalidCredential("Codex OAuth credential contains a non-plain object")
+  }
+
+  state.stack.add(value)
+  if (Array.isArray(value)) {
+    for (const item of value) validateJson(item, state, depth + 1)
+  } else {
+    for (const [key, item] of Object.entries(value)) {
+      if (key.length > MAX_STRING_CHARS) throw invalidCredential("Codex OAuth credential contains an oversized key")
+      validateJson(item, state, depth + 1)
+    }
+  }
+  state.stack.delete(value)
+}
+
+function plainRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+}
+
+function invalidCredential(message, cause) {
+  return new CodexCredentialStoreError(message, "INVALID_CODEX_CREDENTIAL", cause === undefined ? undefined : { cause })
+}

package/dist/internal/codex-identifiers.mjs

@@ -0,0 +1,4 @@
+/** Stable public-facing route and private provider/credential identities. */
+export const CODEX_ROUTE_ID = "dsh-codex"
+export const CODEX_PROVIDER_ID = "openai-codex"
+export const CODEX_CREDENTIAL_KEY = "dsh-codex/openai-codex"

package/dist/internal/codex-pi-provider.mjs

@@ -0,0 +1,137 @@
+import {
+  clampThinkingLevel,
+  createProvider,
+} from "@earendil-works/pi-ai"
+import { buildBaseOptions } from "@earendil-works/pi-ai/api/simple-options"
+import { stream as streamCodexResponses } from "@earendil-works/pi-ai/api/openai-codex-responses"
+import { openaiCodexProvider } from "@earendil-works/pi-ai/providers/openai-codex"
+
+import { codexTransportSessionId } from "./codex-session-resources.mjs"
+
+const FACTORY_OPTION_KEYS = new Set([
+  "resolveSessionPreferences",
+  "resolveTransportSessionId",
+  "serviceTier",
+])
+const TRANSPORTS = new Set([
+  "auto",
+  "sse",
+  "websocket",
+  "websocket-cached",
+])
+
+function plainObject(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false
+  const prototype = Object.getPrototypeOf(value)
+  return prototype === Object.prototype || prototype === null
+}
+
+function validateFactoryOptions(options) {
+  if (!plainObject(options)) throw new TypeError("options must be a plain object")
+  for (const key of Object.keys(options)) {
+    if (!FACTORY_OPTION_KEYS.has(key)) throw new TypeError(`unknown option: ${key}`)
+  }
+  if (options.serviceTier !== undefined && options.serviceTier !== "priority") {
+    throw new TypeError("serviceTier must be priority when provided")
+  }
+  if (
+    options.resolveSessionPreferences !== undefined
+    && typeof options.resolveSessionPreferences !== "function"
+  ) {
+    throw new TypeError("resolveSessionPreferences must be a function")
+  }
+  if (
+    options.resolveTransportSessionId !== undefined
+    && typeof options.resolveTransportSessionId !== "function"
+  ) {
+    throw new TypeError("resolveTransportSessionId must be a function")
+  }
+}
+
+function resolveSessionPreferenceOptions(resolver, sessionId) {
+  const preferences = resolver(sessionId) ?? { fast: false }
+  if (!plainObject(preferences)) {
+    throw new TypeError("session preferences must be a plain object")
+  }
+  for (const key of Object.keys(preferences)) {
+    if (key !== "fast" && key !== "transport") {
+      throw new TypeError(`unknown session preference: ${key}`)
+    }
+  }
+  const fast = preferences.fast ?? false
+  if (typeof fast !== "boolean") {
+    throw new TypeError("session preferences fast must be a boolean")
+  }
+  const transport = preferences.transport
+  if (transport !== undefined && !TRANSPORTS.has(transport)) {
+    throw new TypeError("session preferences transport is invalid")
+  }
+  return { fast, transport }
+}
+
+function reasoningOptions(model, reasoning) {
+  if (reasoning === undefined) return {}
+  const effort = clampThinkingLevel(model, reasoning)
+  return effort === "off" ? {} : { reasoningEffort: effort }
+}
+
+/**
+ * Build the public pi-ai Codex provider with an optional per-session Fast policy.
+ * Authentication, models, transports, and response conversion remain owned by
+ * the published provider and PiAiAdapter; only the documented service tier is
+ * added to the provider-specific request options.
+ */
+export function createCodexPiProvider(options = {}) {
+  validateFactoryOptions(options)
+  const source = openaiCodexProvider()
+  const resolveSessionPreferences = options.resolveSessionPreferences
+  const resolveTransportSessionId = options.resolveTransportSessionId
+    ?? codexTransportSessionId
+
+  return createProvider({
+    id: source.id,
+    name: source.name,
+    baseUrl: source.baseUrl,
+    headers: source.headers,
+    auth: source.auth,
+    models: source.getModels(),
+    ...(source.filterModels === undefined
+      ? {}
+      : {
+          filterModels: (models, credential) => source.filterModels(models, credential),
+        }),
+    api: {
+      stream: streamCodexResponses,
+      streamSimple(model, context, streamOptions = {}) {
+        const sessionPreferences = resolveSessionPreferences === undefined
+          ? undefined
+          : resolveSessionPreferenceOptions(
+              resolveSessionPreferences,
+              streamOptions.sessionId,
+            )
+        const serviceTier = sessionPreferences === undefined
+          ? options.serviceTier
+          : sessionPreferences.fast
+            ? "priority"
+            : undefined
+        const transportSessionId = resolveTransportSessionId(streamOptions.sessionId)
+        if (
+          transportSessionId !== undefined
+          && (typeof transportSessionId !== "string" || transportSessionId.length === 0)
+        ) {
+          throw new TypeError("resolved transport session id must be a non-empty string")
+        }
+
+        return streamCodexResponses(model, context, {
+          ...buildBaseOptions(model, context, streamOptions),
+          sessionId: transportSessionId,
+          ...reasoningOptions(model, streamOptions.reasoning),
+          ...(serviceTier === undefined ? {} : { serviceTier }),
+          ...(sessionPreferences?.transport === undefined
+            ? {}
+            : { transport: sessionPreferences.transport }),
+        })
+      },
+    },
+  })
+}