dsh-codex-connect 0.1.0-alpha.4.19 → 0.1.0-alpha.4.20

package/INSTALL.md

@@ -12,7 +12,7 @@ Install `dsh-codex-connect` into one requested DeepSeek Harness profile without
 
 ## Install and validate
 
-The only verified combination is DSH plugin API packages `0.1.1-rc.2`, `@earendil-works/pi-ai` `0.82.1`, and Node.js `^22.19.0 || >=24.0.0`. Alpha 4.19 uses the rc.2 keyed Plugin configuration slot; users of older DSH API packages should upgrade the DSH API packages and pi-ai together, then rerun `dsh-codex-connect doctor --json` and `pnpm --silent run check:compatibility`; the contract does not make claims about future versions.
+The only verified combination is DSH plugin API packages `0.1.1-rc.2`, `@earendil-works/pi-ai` `0.82.1`, and Node.js `^22.19.0 || >=24.0.0`. Alpha 4.20 uses the rc.2 keyed Plugin configuration slot; users of older DSH API packages should upgrade the DSH API packages and pi-ai together, then rerun `dsh-codex-connect doctor --json` and `pnpm --silent run check:compatibility`; the contract does not make claims about future versions.
 
 1. Check `dsh --version` or `dsh --help`. From a Harness checkout use `pnpm dsh`.
 2. Install the package:
@@ -21,7 +21,7 @@ The only verified combination is DSH plugin API packages `0.1.1-rc.2`, `@earendi
    dsh plugin --profile web add dsh-codex-connect@alpha
    ```
 
-   After `0.1.0-alpha.4.19` is published, pin it exactly with `dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.19`. If npm is unavailable after its matching GitHub prerelease is created, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.19'`.
+   After `0.1.0-alpha.4.20` is published, pin it exactly with `dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.20`. If npm is unavailable after its matching GitHub prerelease is created, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.20'`.
 
 3. Run `dsh --profile web --dump-config` and require exactly one `llm-openai-codex` row loading `dsh-codex-connect`.
 4. Confirm the effective `agent-default-model` and `web.searchProvider` values are unchanged from before installation.

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   git hash-object README.md docs/README.zh.md
-README.md: ecad858eb993cfc54b97eb8d8d0518feb0b23f17
-docs/README.zh.md: 2d61465cfd3fde855d912ed39363563b46730a23
+README.md: 29729f3c078749ca04dc1d648c496c7b57bf3b17
+docs/README.zh.md: a7141cd531059e44771f763a8e5b75d529fc3f83

package/README.md

@@ -28,7 +28,7 @@ dsh plugin --profile web add dsh-codex-connect@alpha
 
 Expected result: the package is added to that profile. This does not change the profile's default model or global search route.
 
-To reproduce this release exactly, use `dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.19`. If npm is unavailable after the matching GitHub prerelease exists, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.19'`. A local checkout can be installed as `link:/absolute/path/to/dsh-codex-connect`.
+To reproduce this release exactly, use `dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.20`. If npm is unavailable after the matching GitHub prerelease exists, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.20'`. A local checkout can be installed as `link:/absolute/path/to/dsh-codex-connect`.
 
 ### Version updates
 
@@ -139,6 +139,7 @@ The installed bundle is intentionally inert beyond model-provider registration:
 ```yaml
 - id: llm-openai-codex
   config:
+    enableProxy: false
     enableSearch: false
     enableImageTool: false
     enableImageGeneration: false
@@ -146,6 +147,14 @@ The installed bundle is intentionally inert beyond model-provider registration:
 
 Open **Settings → Plugins → Plugin configuration → Codex Connect** to manage the account and these options in one card. **Save changes** affects only this plugin's capability section and applies live. It never selects a default model or a global search route.
 
+### Network connection and proxy detection
+
+Codex Connect uses a **Direct connection** by default. A proxy is optional and applies only to this plugin's Codex requests: model streaming, OAuth login and token refresh, usage, standalone search, and image generation. Other providers and unscoped network requests keep the process's original dispatcher.
+
+Select **Detect proxy** to test only the standard proxy environment variables and the documented loopback candidates `127.0.0.1:7890`, `127.0.0.1:7897`, and `127.0.0.1:10809`. Detection makes no model call, consumes no quota, and does not write settings. A response from the canonical Codex endpoint proves network reachability; `401/403`, proxy `407`, DNS, refused connection, timeout, TLS, and CONNECT failures remain separate diagnostics.
+
+Choose **Use this proxy** only after reviewing a candidate, then click **Save changes**. **Configure manually** lets you test a credential-free HTTP(S) proxy origin before activation. **Disable proxy** is always available. A failed probe leaves the previous mode unchanged, and an enabled proxy failure is shown as an actionable error; Codex Connect never silently retries the request through a direct connection.
+
 ### Enable only the capability you intend to use
 
 - `enableSearch: true` registers Codex as an available search provider. It does not select the profile's global search route.
@@ -210,6 +219,8 @@ Selecting Codex as the profile's global search route is another explicit change:
 | Field | Default | Values |
 |---|---:|---|
 | `models` | full catalog | Codex model id array; empty hides all entries |
+| `enableProxy` | `false` | boolean; direct connection unless explicitly enabled |
+| `proxyUrl` | `http://127.0.0.1:7890` (inactive placeholder) | Credential-free HTTP(S) proxy origin |
 | `enableSearch` | `false` | boolean |
 | `enableImageTool` | `false` | boolean |
 | `enableImageGeneration` | `false` | boolean |
@@ -239,7 +250,7 @@ Selecting Codex as the profile's global search route is another explicit change:
 
 ## Compatibility and security boundary
 
-- The only verified compatibility combination is DSH plugin API packages `0.1.1-rc.2`, `@earendil-works/pi-ai` `0.82.1`, and Node.js `^22.19.0 || >=24.0.0`; see [compatibility.json](compatibility.json). Alpha 4.19 uses the rc.2 keyed Plugin configuration slot; users of older DSH API packages should upgrade to the rc.2 API packages.
+- The only verified compatibility combination is DSH plugin API packages `0.1.1-rc.2`, `@earendil-works/pi-ai` `0.82.1`, and Node.js `^22.19.0 || >=24.0.0`; see [compatibility.json](compatibility.json). Alpha 4.20 uses the rc.2 keyed Plugin configuration slot; users of older DSH API packages should upgrade to the rc.2 API packages.
 - Upgrade the DSH plugin API packages and `@earendil-works/pi-ai` as one group, then run `dsh-codex-connect doctor --json` and the compatibility check again. This contract does not make claims about future versions.
 - When the daily upstream check finds a new `latest` or `next` DSH candidate, it installs Codex Connect into an isolated profile, boots the installed model runtime without OAuth credentials, verifies model and reasoning-effort discovery, and confirms provider disposal. Live sign-in, quota, and model requests still require manual validation in the test profile.
 - ChatGPT plan eligibility, model access, quotas, and backend behavior are controlled by OpenAI and may change.

package/cordis.patch.yml

@@ -4,6 +4,7 @@
     - id: llm-openai-codex
       name: dsh-codex-connect
       config:
+        enableProxy: false
         enableSearch: false
         enableImageTool: false
         enableImageGeneration: false

package/docs/README.zh.md

@@ -28,7 +28,7 @@ dsh plugin --profile web add dsh-codex-connect@alpha
 
 预期结果：包被加入该 profile。这个动作不会更改 profile 的默认模型或全局搜索路由。
 
-如需精确复现这个版本，使用 `dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.19`。对应 GitHub prerelease 已创建但 npm 不可用时，可使用 `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.19'`。本地 checkout 可安装为 `link:/absolute/path/to/dsh-codex-connect`。
+如需精确复现这个版本，使用 `dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.20`。对应 GitHub prerelease 已创建但 npm 不可用时，可使用 `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.20'`。本地 checkout 可安装为 `link:/absolute/path/to/dsh-codex-connect`。
 
 ### 版本更新提醒
 
@@ -139,6 +139,7 @@ dsh plugin --profile web exec dsh-codex-connect doctor --json
 ```yaml
 - id: llm-openai-codex
   config:
+    enableProxy: false
     enableSearch: false
     enableImageTool: false
     enableImageGeneration: false
@@ -146,6 +147,14 @@ dsh plugin --profile web exec dsh-codex-connect doctor --json
 
 打开 **设置 → 插件 → 插件配置 → Codex Connect**，即可在同一张卡片中管理账户和这些选项。**保存更改**只影响本插件的能力配置并即时生效，绝不会选择默认模型或全局搜索路由。
 
+### 网络连接与代理检测
+
+Codex Connect 默认使用**直连**。代理是可选项，只作用于本插件的 Codex 请求：模型流式请求、OAuth 登录和 token 刷新、额度、独立搜索以及图片生成。其他提供方和未进入插件作用域的网络请求仍使用进程原来的 dispatcher。
+
+点击 **检测代理** 时，只会测试标准代理环境变量，以及文档列出的本机候选地址：`127.0.0.1:7890`、`127.0.0.1:7897` 和 `127.0.0.1:10809`。检测不调用模型、不消耗额度，也不会写入设置。规范 Codex 端点返回任何 HTTP 响应都表示网络可达；`401/403`、代理 `407`、DNS、连接被拒绝、超时、TLS 和 CONNECT 失败会分别显示为诊断类别。
+
+请先检查候选地址，再选择 **使用此代理**，最后点击 **保存更改**。**手动配置**可以先测试一个不带凭据的 HTTP(S) proxy origin，再启用它。**停用代理**始终可用。检测失败会保留原来的模式；代理已启用但请求失败时，界面会给出可操作的错误，绝不会静默改走直连。
+
 ### 只开启你准备使用的能力
 
 - `enableSearch: true` 会把 Codex 注册为可选择的搜索提供方，不会把它选为 profile 的全局搜索路由。
@@ -210,6 +219,8 @@ dsh plugin --profile web exec dsh-codex-connect doctor --json
 | 字段 | 默认值 | 可选值 |
 |---|---:|---|
 | `models` | 完整目录 | Codex model id 数组；空数组隐藏全部条目 |
+| `enableProxy` | `false` | boolean；除非显式启用，否则使用直连 |
+| `proxyUrl` | `http://127.0.0.1:7890`（未启用的占位值） | 不带凭据的 HTTP(S) proxy origin |
 | `enableSearch` | `false` | boolean |
 | `enableImageTool` | `false` | boolean |
 | `enableImageGeneration` | `false` | boolean |
@@ -239,7 +250,7 @@ dsh plugin --profile web exec dsh-codex-connect doctor --json
 
 ## 兼容性与安全边界
 
-- 当前唯一已验证的兼容组合是 DSH 插件 API packages `0.1.1-rc.2`、`@earendil-works/pi-ai` `0.82.1` 和 Node.js `^22.19.0 || >=24.0.0`；详见 [compatibility.json](../compatibility.json)。Alpha 4.19 使用 rc.2 的 keyed 插件配置 slot；旧版 DSH API packages 用户应升级到 rc.2 API packages。
+- 当前唯一已验证的兼容组合是 DSH 插件 API packages `0.1.1-rc.2`、`@earendil-works/pi-ai` `0.82.1` 和 Node.js `^22.19.0 || >=24.0.0`；详见 [compatibility.json](../compatibility.json)。Alpha 4.20 使用 rc.2 的 keyed 插件配置 slot；旧版 DSH API packages 用户应升级到 rc.2 API packages。
 - 升级时请将 DSH 插件 API packages 与 `@earendil-works/pi-ai` 作为一组升级，再运行 `dsh-codex-connect doctor --json` 和兼容性检查。本契约不对未来版本作判断。
 - 每日上游检查发现新的 DSH `latest` 或 `next` 候选版本时，会把 Codex Connect 安装到隔离 Profile 中，在没有 OAuth 凭据的情况下启动已安装的模型运行时，验证模型与推理强度发现，并确认提供方可被正确卸载。真实登录、额度和模型请求仍需在测试 Profile 中人工验证。
 - ChatGPT 套餐资格、模型权限、额度和后端行为由 OpenAI 控制，可能变化。

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { L as diagnoseOpenAICodex, c as migrateOpenAICodexSearchHistory, ct as normalizeTrustedOrigin, ft as loginOpenAICodex, mt as openAICodexAuthStatus, pt as logoutOpenAICodex, st as OpenAICodexTrustedOriginsStore, vt as openAICodexAuthPath, z as CODEX_CONNECT_VERSION } from "./src-CiOi4nFr.js";
+import { At as openAICodexAuthPath, Et as openAICodexAuthStatus, Tt as logoutOpenAICodex, bt as normalizeTrustedOrigin, c as migrateOpenAICodexSearchHistory, j as CODEX_CONNECT_VERSION, k as diagnoseOpenAICodex, wt as loginOpenAICodex, yt as OpenAICodexTrustedOriginsStore } from "./src-B2d5HLN5.js";
 import { fileURLToPath } from "node:url";
 import { realpathSync } from "node:fs";
 import { spawn } from "node:child_process";

package/lib/client.js

@@ -11,8 +11,35 @@ window.__ModuleLoader__.load({
 		/** Node-free settings contract shared by the Host plugin and browser card. */
 		/** Stable Harness settings namespace owned by this plugin. */
 		const OPENAI_CODEX_SETTINGS_NAMESPACE = "llm-openai-codex";
+		/** Suggested local HTTP proxy shown by the settings UI; it is never enabled by default. */
+		const DEFAULT_OPENAI_CODEX_PROXY_URL = "http://127.0.0.1:7890";
+		/**
+		* Normalize the credential-free HTTP proxy URL accepted by Codex Connect.
+		* Paths, query strings, fragments, and embedded credentials are rejected so
+		* the value remains an origin rather than an opaque request target.
+		*/
+		function normalizeOpenAICodexProxyUrl(value) {
+			if (typeof value !== "string" || value.trim().length === 0) return void 0;
+			try {
+				const parsed = new URL(value.trim());
+				if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return void 0;
+				if (parsed.username !== "" || parsed.password !== "") return void 0;
+				if (parsed.pathname !== "/" || parsed.search !== "" || parsed.hash !== "") return void 0;
+				if (parsed.hostname.length === 0) return void 0;
+				if (parsed.port !== "" && (!/^\d+$/u.test(parsed.port) || Number(parsed.port) < 1 || Number(parsed.port) > 65535)) return void 0;
+				return parsed.origin;
+			} catch {
+				return;
+			}
+		}
+		/** Whether a value is a supported, canonical HTTP(S) proxy origin. */
+		function isValidOpenAICodexProxyUrl(value) {
+			return normalizeOpenAICodexProxyUrl(value) !== void 0;
+		}
 		Object.freeze({
 			models: void 0,
+			enableProxy: false,
+			proxyUrl: DEFAULT_OPENAI_CODEX_PROXY_URL,
 			enableSearch: false,
 			enableImageTool: false,
 			enableImageGeneration: false,
@@ -28,6 +55,8 @@ window.__ModuleLoader__.load({
 		function decodeOpenAICodexSettings(value) {
 			if (!isRecord$2(value)) return void 0;
 			const models = value["models"];
+			const enableProxy = value["enableProxy"];
+			const proxyUrl = value["proxyUrl"];
 			const enableSearch = value["enableSearch"];
 			const enableImageTool = value["enableImageTool"];
 			const enableImageGeneration = value["enableImageGeneration"];
@@ -36,6 +65,8 @@ window.__ModuleLoader__.load({
 			const searchContextSize = value["searchContextSize"];
 			const searchMaxOutputTokens = value["searchMaxOutputTokens"];
 			if (models !== void 0 && (!Array.isArray(models) || models.some((model) => typeof model !== "string"))) return void 0;
+			if (enableProxy !== void 0 && typeof enableProxy !== "boolean") return void 0;
+			if (proxyUrl !== void 0 && (typeof proxyUrl !== "string" || !isValidOpenAICodexProxyUrl(proxyUrl))) return void 0;
 			if (typeof enableSearch !== "boolean" || typeof enableImageTool !== "boolean") return void 0;
 			if (enableImageGeneration !== void 0 && typeof enableImageGeneration !== "boolean") return void 0;
 			if (typeof searchModel !== "string" || searchModel.trim().length === 0) return void 0;
@@ -44,6 +75,8 @@ window.__ModuleLoader__.load({
 			if (typeof searchMaxOutputTokens !== "number" || !Number.isInteger(searchMaxOutputTokens) || searchMaxOutputTokens < 1) return void 0;
 			return {
 				models: models === void 0 ? void 0 : [...new Set(models)],
+				enableProxy: enableProxy ?? false,
+				proxyUrl: proxyUrl === void 0 ? DEFAULT_OPENAI_CODEX_PROXY_URL : normalizeOpenAICodexProxyUrl(proxyUrl),
 				enableSearch,
 				enableImageTool,
 				enableImageGeneration: enableImageGeneration ?? false,
@@ -87,6 +120,13 @@ window.__ModuleLoader__.load({
 			return catalog;
 		}
 		//#endregion
+		//#region src/proxy-paths.ts
+		/** Node-free route constants shared by the Host and browser plugin halves. */
+		/** Detect bounded local/environment proxy candidates without changing settings. */
+		const OPENAI_CODEX_PROXY_DETECT_PATH = "/plugins/dsh-openai-codex/proxy/detect";
+		/** Test one manually entered proxy origin without changing settings. */
+		const OPENAI_CODEX_PROXY_TEST_PATH = "/plugins/dsh-openai-codex/proxy/test";
+		//#endregion
 		//#region src/client/OpenAICodexConfiguration.tsx
 		/** Staged optional-capability editor inside the OpenAI Codex plugin card. */
 		const sectionStyle$1 = {
@@ -223,6 +263,8 @@ window.__ModuleLoader__.load({
 		};
 		const CONFIG_FIELDS = [
 			"models",
+			"enableProxy",
+			"proxyUrl",
 			"enableSearch",
 			"enableImageTool",
 			"enableImageGeneration",
@@ -250,6 +292,10 @@ window.__ModuleLoader__.load({
 			const [feedback, setFeedback] = (0, react.useState)("idle");
 			const [modelCatalog, setModelCatalog] = (0, react.useState)();
 			const [modelCatalogError, setModelCatalogError] = (0, react.useState)(false);
+			const [proxyDetection, setProxyDetection] = (0, react.useState)({ status: "idle" });
+			const [manualProxy, setManualProxy] = (0, react.useState)(false);
+			const [manualProbe, setManualProbe] = (0, react.useState)();
+			const [manualProbeBusy, setManualProbeBusy] = (0, react.useState)(false);
 			(0, react.useEffect)(() => {
 				if (scope === void 0) return;
 				const controller = new AbortController();
@@ -291,10 +337,73 @@ window.__ModuleLoader__.load({
 				setDraft(scope?.getSnapshot().value);
 				setDirty(false);
 				setFeedback("idle");
+				setProxyDetection({ status: "idle" });
+				setManualProbe(void 0);
+			};
+			const detectProxy = async () => {
+				setProxyDetection({ status: "detecting" });
+				try {
+					const response = await fetch(OPENAI_CODEX_PROXY_DETECT_PATH, {
+						method: "POST",
+						credentials: "same-origin",
+						headers: { accept: "application/json" }
+					});
+					if (!response.ok) throw new Error(`proxy detection failed: ${String(response.status)}`);
+					const value = await response.json();
+					if (!Array.isArray(value.candidates) || !Array.isArray(value.results)) throw new Error("proxy detection response was invalid");
+					setProxyDetection(value.candidates.length > 0 ? {
+						status: "candidate",
+						candidates: value.candidates
+					} : {
+						status: "failed",
+						results: value.results
+					});
+				} catch {
+					setProxyDetection({
+						status: "failed",
+						results: []
+					});
+				}
+			};
+			const useProxy = (proxyUrl) => {
+				if (draft === void 0 || !isValidOpenAICodexProxyUrl(proxyUrl)) return;
+				setDraft({
+					...draft,
+					proxyUrl,
+					enableProxy: true
+				});
+				setDirty(true);
+				setFeedback("idle");
+				setManualProxy(true);
+				setManualProbe(void 0);
+				setProxyDetection({ status: "idle" });
+			};
+			const testManualProxy = async () => {
+				if (draft === void 0 || !isValidOpenAICodexProxyUrl(draft.proxyUrl)) return;
+				setManualProbeBusy(true);
+				try {
+					const path = `${OPENAI_CODEX_PROXY_TEST_PATH}?proxyUrl=${encodeURIComponent(draft.proxyUrl)}`;
+					const response = await fetch(path, {
+						method: "POST",
+						credentials: "same-origin",
+						headers: { accept: "application/json" }
+					});
+					if (!response.ok) throw new Error(`proxy test failed: ${String(response.status)}`);
+					setManualProbe(await response.json());
+				} catch {
+					setManualProbe({
+						proxyUrl: draft.proxyUrl,
+						reachable: false,
+						classification: "connect-failure"
+					});
+				} finally {
+					setManualProbeBusy(false);
+				}
 			};
 			const validModel = draft !== void 0 && draft.searchModel.trim().length > 0;
 			const validTokens = draft !== void 0 && Number.isInteger(draft.searchMaxOutputTokens) && draft.searchMaxOutputTokens > 0;
-			const valid = validModel && validTokens;
+			const validProxy = draft !== void 0 && isValidOpenAICodexProxyUrl(draft.proxyUrl);
+			const valid = validModel && validTokens && validProxy;
 			const save = async () => {
 				if (scope === void 0 || draft === void 0 || !snapshot.writable || !valid) return;
 				const desired = {
@@ -398,6 +507,135 @@ window.__ModuleLoader__.load({
 									}, model.id);
 								})
 							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								style: { paddingTop: 4 },
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h3", {
+									style: headingStyle,
+									children: t("networkHeading")
+								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+									style: {
+										...bodyStyle$2,
+										marginTop: 4
+									},
+									children: t("networkIntro")
+								})]
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								style: bodyStyle$2,
+								role: "status",
+								children: draft.enableProxy ? t("customProxyActive", { proxyUrl: draft.proxyUrl }) : t("directConnection")
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								style: buttonsStyle,
+								children: [
+									!draft.enableProxy ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										type: "button",
+										style: buttonStyle$2,
+										onClick: () => {
+											detectProxy();
+										},
+										disabled: proxyDetection.status === "detecting",
+										children: proxyDetection.status === "detecting" ? t("detectingProxy") : t("detectProxy")
+									}) : null,
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										type: "button",
+										style: buttonStyle$2,
+										onClick: () => {
+											setManualProxy(true);
+										},
+										children: t("configureProxyManually")
+									}),
+									draft.enableProxy ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										type: "button",
+										style: buttonStyle$2,
+										onClick: () => {
+											update("enableProxy", false);
+										},
+										children: t("disableProxy")
+									}) : null
+								]
+							}),
+							proxyDetection.status === "candidate" ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								style: fieldsetStyle,
+								role: "status",
+								children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+										style: bodyStyle$2,
+										children: t("proxyCandidatesFound")
+									}),
+									proxyDetection.candidates.map((candidate) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+										style: actionsStyle,
+										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("code", {
+											style: modelIdStyle,
+											children: candidate.proxyUrl
+										}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+											type: "button",
+											style: primaryButtonStyle$2,
+											onClick: () => {
+												useProxy(candidate.proxyUrl);
+											},
+											children: t("useThisProxy")
+										})]
+									}, candidate.proxyUrl)),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										type: "button",
+										style: buttonStyle$2,
+										onClick: () => {
+											setProxyDetection({ status: "idle" });
+										},
+										children: t("keepDirectConnection")
+									})
+								]
+							}) : null,
+							proxyDetection.status === "failed" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								style: errorStyle$2,
+								role: "alert",
+								children: t("proxyDetectionFailed")
+							}) : null,
+							manualProxy ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								style: fieldsetStyle,
+								children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+										style: formFieldStyle,
+										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											style: labelStyle,
+											children: t("proxyAddress")
+										}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+											style: controlStyle,
+											value: draft.proxyUrl,
+											"aria-invalid": !isValidOpenAICodexProxyUrl(draft.proxyUrl),
+											onChange: (event) => {
+												update("proxyUrl", event.currentTarget.value);
+											}
+										})]
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+										style: buttonsStyle,
+										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+											type: "button",
+											style: buttonStyle$2,
+											disabled: !isValidOpenAICodexProxyUrl(draft.proxyUrl) || manualProbeBusy,
+											onClick: () => {
+												testManualProxy();
+											},
+											children: manualProbeBusy ? t("testingProxy") : t("testProxy")
+										}), !draft.enableProxy ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+											type: "button",
+											style: primaryButtonStyle$2,
+											disabled: !isValidOpenAICodexProxyUrl(draft.proxyUrl),
+											onClick: () => {
+												useProxy(draft.proxyUrl);
+											},
+											children: t("useThisProxy")
+										}) : null]
+									}),
+									manualProbe === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+										style: manualProbe.reachable ? successStyle : errorStyle$2,
+										role: "status",
+										children: manualProbe.reachable ? t("proxyTestSucceeded", { status: manualProbe.status ?? manualProbe.classification }) : t("proxyTestFailed", { reason: manualProbe.classification })
+									})
+								]
+							}) : null,
 							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 								style: { paddingTop: 4 },
 								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h3", {
@@ -575,6 +813,11 @@ window.__ModuleLoader__.load({
 						role: "alert",
 						children: t("invalidSearchTokens")
 					}) : null,
+					!validProxy && draft !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						style: errorStyle$2,
+						role: "alert",
+						children: t("invalidProxyUrl")
+					}) : null,
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 						style: bodyStyle$2,
 						children: t("routingNote")
@@ -621,7 +864,8 @@ window.__ModuleLoader__.load({
 			"search-stability",
 			"image-generation",
 			"oauth-history",
-			"model-visibility"
+			"model-visibility",
+			"proxy-connection"
 		];
 		function isHighlightKind(value) {
 			return typeof value === "string" && HIGHLIGHT_KINDS.includes(value);
@@ -1125,7 +1369,8 @@ window.__ModuleLoader__.load({
 			"search-stability": "updateHighlightSearchStability",
 			"image-generation": "updateHighlightImageGeneration",
 			"oauth-history": "updateHighlightOauthHistory",
-			"model-visibility": "updateHighlightModelVisibility"
+			"model-visibility": "updateHighlightModelVisibility",
+			"proxy-connection": "updateHighlightProxyConnection"
 		};
 		const compatibilityTitleKeys = {
 			compatible: "compatibilityCompatibleTitle",
@@ -2567,6 +2812,24 @@ window.__ModuleLoader__.load({
 			modelCatalogFailed: "Available models could not be loaded.",
 			capabilitiesHeading: "Optional capabilities",
 			capabilitiesIntro: "Choose which extra Codex capabilities this dsh profile may register.",
+			networkHeading: "Network connection",
+			networkIntro: "Direct connection is the default. Proxy detection only tests a bounded set of local and environment candidates; nothing is saved until you choose Use this proxy and save.",
+			directConnection: "Direct connection",
+			customProxyActive: "Custom proxy selected: {proxyUrl}",
+			detectProxy: "Detect proxy",
+			detectingProxy: "Detecting…",
+			configureProxyManually: "Configure manually",
+			disableProxy: "Disable proxy",
+			proxyCandidatesFound: "Working proxy candidates found. Choose one to stage it for activation.",
+			keepDirectConnection: "Keep direct connection",
+			useThisProxy: "Use this proxy",
+			proxyDetectionFailed: "No working proxy candidate was found. Check DNS, connection refused, timeout, TLS, or proxy authentication errors, then try again.",
+			proxyAddress: "Custom proxy address",
+			testProxy: "Test proxy",
+			testingProxy: "Testing…",
+			proxyTestSucceeded: "Proxy reached the Codex endpoint (HTTP {status}).",
+			proxyTestFailed: "Proxy test failed: {reason}.",
+			invalidProxyUrl: "Enter an HTTP(S) proxy origin without credentials or a path.",
 			enableSearch: "Enable Codex search provider",
 			enableSearchHelp: "Makes OpenAI Codex available as a search provider. It does not select the global search route.",
 			searchModel: "Search model",
@@ -2675,6 +2938,7 @@ window.__ModuleLoader__.load({
 			updateHighlightImageGeneration: "Added optional GPT Image generation in the Codex Connect settings and a preview card in the conversation.",
 			updateHighlightOauthHistory: "Added safer session-history migration and a sign-in fallback when the account needs to reconnect.",
 			updateHighlightModelVisibility: "You can now choose which Codex models appear in model selectors.",
+			updateHighlightProxyConnection: "Added opt-in Codex proxy detection with explicit confirmation and a visible direct-connection fallback.",
 			viewTechnicalDetails: "View technical details",
 			hideTechnicalDetails: "Hide technical details",
 			technicalDetailsHeading: "Technical changes",
@@ -2751,6 +3015,24 @@ window.__ModuleLoader__.load({
 			modelCatalogFailed: "无法加载可用模型。",
 			capabilitiesHeading: "可选能力",
 			capabilitiesIntro: "选择允许此 dsh profile 注册哪些额外的 Codex 能力。",
+			networkHeading: "网络连接",
+			networkIntro: "默认使用直连。代理检测只测试有限的本机和环境变量候选地址；只有你选择“使用此代理”并保存后才会写入设置。",
+			directConnection: "直连",
+			customProxyActive: "已选择自定义代理：{proxyUrl}",
+			detectProxy: "检测代理",
+			detectingProxy: "正在检测…",
+			configureProxyManually: "手动配置",
+			disableProxy: "停用代理",
+			proxyCandidatesFound: "找到了可用的代理候选地址。请选择一个，将其暂存以便启用。",
+			keepDirectConnection: "保持直连",
+			useThisProxy: "使用此代理",
+			proxyDetectionFailed: "没有找到可用代理。请检查 DNS、连接被拒绝、超时、TLS 或代理认证错误后重试。",
+			proxyAddress: "自定义代理地址",
+			testProxy: "测试代理",
+			testingProxy: "正在测试…",
+			proxyTestSucceeded: "代理已到达 Codex 端点（HTTP {status}）。",
+			proxyTestFailed: "代理测试失败：{reason}。",
+			invalidProxyUrl: "请输入不含凭据或路径的 HTTP(S) 代理 origin。",
 			enableSearch: "启用 Codex 搜索提供方",
 			enableSearchHelp: "让 OpenAI Codex 可被选作搜索提供方，但不会自动改动全局搜索路由。",
 			searchModel: "搜索模型",
@@ -2859,6 +3141,7 @@ window.__ModuleLoader__.load({
 			updateHighlightImageGeneration: "在 Codex Connect 设置中加入可选的 GPT Image 生图，并在对话里展示生成结果卡片。",
 			updateHighlightOauthHistory: "增加更安全的会话历史迁移，并在账号需要重新登录时提供备用登录路径。",
 			updateHighlightModelVisibility: "现在可以选择哪些 Codex 模型显示在模型选择菜单中。",
+			updateHighlightProxyConnection: "增加可选的 Codex 代理检测，启用前需要明确确认，并始终保留直连回退入口。",
 			viewTechnicalDetails: "查看完整技术说明",
 			hideTechnicalDetails: "收起技术说明",
 			technicalDetailsHeading: "技术变更",
@@ -3947,7 +4230,7 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 		//#region src/version.ts
-		const CODEX_CONNECT_VERSION = "0.1.0-alpha.4.19";
+		const CODEX_CONNECT_VERSION = "0.1.0-alpha.4.20";
 		//#endregion
 		//#region src/client/index.tsx
 		/** Stable browser-plugin name. */