dsh-codex-connect 0.1.0-alpha.4.19 → 0.1.0-alpha.4.21

package/lib/bin.js

@@ -1,9 +1,374 @@
 #!/usr/bin/env node
-import { L as diagnoseOpenAICodex, c as migrateOpenAICodexSearchHistory, ct as normalizeTrustedOrigin, ft as loginOpenAICodex, mt as openAICodexAuthStatus, pt as logoutOpenAICodex, st as OpenAICodexTrustedOriginsStore, vt as openAICodexAuthPath, z as CODEX_CONNECT_VERSION } from "./src-CiOi4nFr.js";
+import { B as DSH_PLUGIN_API_PACKAGES, Dt as logoutOpenAICodex, Et as loginOpenAICodex, J as readInstalledPackageVersion, Mt as OpenAICodexCredentialStore, Nt as openAICodexAuthPath, Ot as openAICodexAuthStatus, St as normalizeTrustedOrigin, c as migrateOpenAICodexSearchHistory, j as CODEX_CONNECT_VERSION, jt as OPENAI_CODEX_PROVIDER, k as diagnoseOpenAICodex, kt as openAICodexModelCatalog, l as OPENAI_CODEX_BASE_URL, pt as normalizeOpenAICodexProxyUrl, q as evaluateCompatibility, xt as OpenAICodexTrustedOriginsStore } from "./src-Cxq99TvF.js";
+import { createHash } from "node:crypto";
+import { Agent, ProxyAgent, fetch } from "undici";
 import { fileURLToPath } from "node:url";
 import { realpathSync } from "node:fs";
 import { spawn } from "node:child_process";
 import { createInterface } from "node:readline/promises";
+//#region src/capability-probe.ts
+/** Bounded, standalone Responses probe; never used by conversation routing. */
+/** A security limit, not a model output-token setting. */
+const MAX_PROBE_RESPONSE_BYTES = 65536;
+function record(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function completedResponse(value, model) {
+	if (!record(value) || value["status"] !== "completed" || !Array.isArray(value["output"])) return false;
+	if (value["model"] !== model) return false;
+	return value["output"].some((item) => record(item) && item["type"] === "message" && item["role"] === "assistant" && Array.isArray(item["content"]) && item["content"].some((part) => record(part) && part["type"] === "output_text" && typeof part["text"] === "string" && part["text"].trim().length > 0));
+}
+/** Inspect complete SSE frames, not substrings inside error text or schema errors. */
+function completedStream(text, model) {
+	let completed = false;
+	let data = [];
+	for (const line of text.split(/\r\n|\r|\n/u)) if (line === "") {
+		if (data.length === 0) continue;
+		const payload = data.join("\n");
+		data = [];
+		if (payload === "[DONE]") continue;
+		let event;
+		try {
+			event = JSON.parse(payload);
+		} catch {
+			return false;
+		}
+		if (!record(event)) return false;
+		if (event["type"] === "error" || event["type"] === "response.failed" || event["type"] === "response.incomplete") return false;
+		if (event["type"] === "response.completed" || event["type"] === "response.done") {
+			if (completed || !completedResponse(event["response"], model)) return false;
+			completed = true;
+		}
+	} else if (line.startsWith("data:")) data.push(line.slice(5).replace(/^ /u, ""));
+	return completed && data.length === 0;
+}
+/**
+* Send one fixed, stateless prompt to the first-party Responses endpoint.
+* No refresh, redirects, retries, session ids, or optional capabilities are used.
+* The deadline covers headers and EOF; owned sockets are destroyed before return.
+* @param request - resolved model, OAuth credential, and network policy.
+* @param createDispatcher - owned connection factory; tests use an offline dispatcher.
+* @returns bounded evidence, never upstream body text or exception messages.
+*/
+async function probeCodexResponses(request, createDispatcher = (proxyUrl) => proxyUrl === void 0 ? new Agent() : new ProxyAgent(proxyUrl)) {
+	const dispatcher = createDispatcher(request.proxyUrl);
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(), request.timeoutMs);
+	let httpStatus;
+	try {
+		const response = await fetch(`${OPENAI_CODEX_BASE_URL}/responses`, {
+			dispatcher,
+			method: "POST",
+			redirect: "manual",
+			signal: controller.signal,
+			headers: {
+				authorization: `Bearer ${request.access}`,
+				"chatgpt-account-id": request.accountId,
+				"content-type": "application/json",
+				accept: "text/event-stream",
+				originator: "deepseek-harness"
+			},
+			body: JSON.stringify({
+				model: request.model,
+				instructions: "You are a connectivity diagnostic. Reply with only ok.",
+				input: [{
+					role: "user",
+					content: [{
+						type: "input_text",
+						text: "Reply with only ok."
+					}]
+				}],
+				stream: true,
+				store: false
+			})
+		});
+		httpStatus = response.status;
+		if (!response.ok) {
+			await response.body?.cancel();
+			return {
+				outcome: [
+					400,
+					401,
+					403,
+					404,
+					405,
+					422
+				].includes(httpStatus) ? "http-rejected" : "transient",
+				httpStatus
+			};
+		}
+		if (httpStatus !== 200 || !response.headers.get("content-type")?.toLowerCase().startsWith("text/event-stream") || response.body === null) {
+			await response.body?.cancel();
+			return {
+				outcome: "incomplete",
+				httpStatus
+			};
+		}
+		const reader = response.body.getReader();
+		const chunks = [];
+		let size = 0;
+		try {
+			while (true) {
+				const { value, done } = await reader.read();
+				if (done) break;
+				size += value.byteLength;
+				if (size > MAX_PROBE_RESPONSE_BYTES) {
+					await reader.cancel();
+					return {
+						outcome: "incomplete",
+						httpStatus
+					};
+				}
+				chunks.push(value);
+			}
+		} finally {
+			reader.releaseLock();
+		}
+		return {
+			outcome: completedStream(new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks)), request.model) ? "completed" : "incomplete",
+			httpStatus
+		};
+	} catch {
+		return {
+			outcome: controller.signal.aborted ? "timeout" : "network-error",
+			...httpStatus === void 0 ? {} : { httpStatus }
+		};
+	} finally {
+		clearTimeout(timer);
+		await dispatcher.destroy();
+	}
+}
+//#endregion
+//#region src/capability-diagnostics.ts
+/** Evidence-scoped diagnostics, separate from model routing and durable sessions. */
+function result(status, reason, action) {
+	return {
+		status,
+		reason,
+		action
+	};
+}
+function safeVersion(value) {
+	return value !== null && value !== void 0 && /^v?\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/u.test(value) ? value : null;
+}
+function observed(evidence) {
+	switch (evidence.outcome) {
+		case "completed": return result("supported", "completed-response-for-selected-model", "This proves only the fixed standalone prompt; test the active Harness profile separately.");
+		case "http-rejected": switch (evidence.httpStatus) {
+			case 401: return result("rejected", "http-401", "Sign in again, then explicitly repeat the probe.");
+			case 403: return result("rejected", "http-403", "Check account, model, and network access policy; signing in may not resolve a policy denial.");
+			case 404: return result("rejected", "http-404", "The selected route was not found; check endpoint availability and plugin updates.");
+			default: return result("rejected", "request-rejected", "The server rejected this diagnostic request; check the selected model and request compatibility. No optional capability was tested.");
+		}
+		case "transient": return result("unknown", "transient-or-redirect-response", "Check network, proxy, quota, or server availability before retrying; no provider fallback was attempted.");
+		case "incomplete": return result("unknown", "no-complete-matching-response", "HTTP success or schema recognition is insufficient; repeat the probe after checking the endpoint and selected model.");
+		case "timeout": return result("unknown", "probe-deadline", "The probe exceeded its deadline and may have consumed quota; check the network before retrying.");
+		case "network-error": return result("unknown", "network-or-stream-error", "Check the network or pass an explicit --proxy; no server rejection was confirmed.");
+	}
+}
+/**
+* Reusable diagnostic operation with a single-entry, lazy-expiring memory cache.
+* It registers no background hooks, expiry timers, or model-visible session events.
+* The network provider owns its request deadline and connection cleanup.
+* Cache identity includes credentials, model, network policy, and installed versions.
+*/
+var CodexCapabilityDiagnostics = class {
+	cacheTtlMs;
+	deps;
+	cache;
+	/**
+	* @param cacheTtlMs - finite cache lifetime; zero disables reuse, maximum 60 seconds.
+	* @param deps - owned metadata and probe operations; defaults perform local reads only until requested.
+	*/
+	constructor(cacheTtlMs, deps = {
+		diagnose: diagnoseOpenAICodex,
+		readVersion: readInstalledPackageVersion,
+		catalog: openAICodexModelCatalog,
+		credentials: new OpenAICodexCredentialStore(),
+		probe: probeCodexResponses,
+		now: Date.now
+	}) {
+		this.cacheTtlMs = cacheTtlMs;
+		this.deps = deps;
+		if (!Number.isFinite(cacheTtlMs) || cacheTtlMs < 0 || cacheTtlMs > 6e4) throw new TypeError("Diagnostic cache lifetime must be between 0 and 60000 ms");
+	}
+	/**
+	* Read metadata; optionally send one fixed request using an unexpired stored token.
+	* No credential refresh/write occurs. Unsupported local versions prevent probing.
+	* @param request - resolved command arguments, with explicit network consent.
+	* @returns a secret-free report whose unknown entries never authorize a capability.
+	*/
+	async inspect(request) {
+		const local = await this.deps.diagnose();
+		const versions = { node: safeVersion(local.node) };
+		for (const [name, entry] of Object.entries(local.compatibility.packages)) versions[name] = safeVersion(entry.installed);
+		for (const name of DSH_PLUGIN_API_PACKAGES) versions[name] = safeVersion(await this.deps.readVersion(name));
+		const compatibility = evaluateCompatibility({
+			nodeVersion: versions["node"] ?? null,
+			packageVersions: versions
+		});
+		const missing = Object.values(versions).some((value) => value === null) || !/^v?\d+\.\d+\.\d+$/u.test(versions["node"] ?? "");
+		const runtime = DSH_PLUGIN_API_PACKAGES.some((name) => versions[name] !== null && versions[name] !== "0.1.1-rc.2") || compatibility.status === "incompatible" ? result("rejected", "declared-version-mismatch", "Use DSH API 0.1.1-rc.2 and pi-ai 0.82.1 together. DSH 0.1.0-rc.7 requires Codex Connect 0.1.0-alpha.4.14.") : missing || compatibility.status === "unknown" ? result("unknown", "version-metadata-unavailable", "Run this command from the plugin installation in the intended profile.") : result("supported", "declared-host-versions-match", "Host package versions satisfy the declared requirements; this is not a live profile or browser compatibility test.");
+		const model = this.deps.catalog().find((item) => item.id === request.model)?.id ?? null;
+		const unknownNetwork = result("unknown", "not-probed", "Run capabilities --model <catalog-id> --probe explicitly; this sends a fixed short request and may consume quota.");
+		const checks = {
+			runtime,
+			oauth: local.credentialFile.state === "owner-only" ? result("unknown", "credential-metadata-only", "A private credential file does not prove authorization; use an explicit probe.") : result("rejected", "credential-file-unusable", "Sign in or repair owner-only credential-file permissions; no credential content was read."),
+			responses: { ...unknownNetwork },
+			transport: result("unknown", `configured-sse-not-probed`, unknownNetwork.action),
+			model: model === null ? result(request.model === void 0 ? "unknown" : "rejected", "model-not-selected-from-catalog", "Select an exact model id from the installed Codex provider catalog; unknown ids are not probed.") : result("unknown", "catalog-is-not-entitlement", unknownNetwork.action),
+			providerFallback: result("rejected", "no-automatic-provider-failover", "Select another provider explicitly. SSE is already selected; WebSocket-to-SSE fallback is inactive. Authentication, request, and partial-stream errors do not authorize provider switching."),
+			contextManagement: result("unknown", "no-successful-optional-operation", "Schema recognition is not capability evidence; keep optional context management disabled."),
+			continuation: result("unknown", "no-continuation-round-trip", "A stateless probe does not verify continuation, Fork, or restart; retain Harness-owned history."),
+			nativeCompaction: result("rejected", "no-native-compaction-integration", "Keep Harness text-summary compaction; track the typed-operation and durable-replay prerequisites in Issue #65."),
+			websocketReuse: result("rejected", "finite-sse-policy", "Keep finite SSE selected; cached WebSocket lifecycle work is outside this diagnostic.")
+		};
+		const report = {
+			schemaVersion: 1,
+			package: "dsh-codex-connect",
+			version: CODEX_CONNECT_VERSION,
+			scope: "standalone-route-only",
+			model,
+			network: request.proxyUrl === void 0 ? "direct" : "explicit-proxy",
+			versions,
+			checks,
+			probe: { state: request.probe ? "skipped" : "not-requested" }
+		};
+		if (runtime.status !== "supported" || model === null || checks.oauth.status === "rejected") {
+			this.cache = void 0;
+			return report;
+		}
+		if (!request.probe) return report;
+		let credential;
+		try {
+			credential = await this.deps.credentials.read(OPENAI_CODEX_PROVIDER);
+		} catch {
+			checks.oauth = result("rejected", "credential-unreadable", "Repair the credential file or sign in again; diagnostic output omits parser details.");
+			this.cache = void 0;
+			return report;
+		}
+		if (credential?.type !== "oauth" || typeof credential.accountId !== "string") {
+			checks.oauth = result("rejected", "credential-missing", "Sign in before explicitly probing the route.");
+			this.cache = void 0;
+			return report;
+		}
+		if (credential.expires <= this.deps.now()) {
+			checks.oauth = result("unknown", "access-token-expired", "Use the normal sign-in or refresh flow, then repeat the probe; diagnostics never refresh or write credentials.");
+			this.cache = void 0;
+			return report;
+		}
+		const key = createHash("sha256").update(JSON.stringify([
+			credential.access,
+			credential.accountId,
+			model,
+			request.proxyUrl,
+			request.timeoutMs,
+			versions
+		])).digest("hex");
+		const cached = this.cache;
+		const age = cached === void 0 ? Infinity : this.deps.now() - cached.observedAt;
+		let evidence;
+		if (cached?.key === key && age >= 0 && age < this.cacheTtlMs) {
+			evidence = cached.evidence;
+			report.probe = {
+				state: "cached",
+				observedAt: cached.observedAt
+			};
+		} else {
+			this.cache = void 0;
+			evidence = await this.deps.probe({
+				model,
+				access: credential.access,
+				accountId: credential.accountId,
+				proxyUrl: request.proxyUrl,
+				timeoutMs: request.timeoutMs
+			});
+			const observedAt = this.deps.now();
+			report.probe = {
+				state: "fresh",
+				observedAt
+			};
+			if (evidence.outcome === "completed" || evidence.outcome === "http-rejected") this.cache = {
+				key,
+				observedAt,
+				evidence
+			};
+		}
+		if (evidence.httpStatus !== void 0) report.probe.httpStatus = evidence.httpStatus;
+		checks.responses = observed(evidence);
+		checks.transport = { ...checks.responses };
+		if (evidence.outcome === "completed") {
+			checks.oauth = result("supported", "authorized-completed-response", "Authorization succeeded for this model and fixed request at the recorded time only.");
+			checks.model = { ...checks.responses };
+		} else if (evidence.httpStatus === 401 || evidence.httpStatus === 403) checks.oauth = { ...checks.responses };
+		return report;
+	}
+};
+//#endregion
+//#region src/capability-cli.ts
+/** Opt-in standalone capability diagnostics; ordinary doctor output stays unchanged. */
+/**
+* Run the separate capability command without booting Harness or changing settings.
+* @param args - flags after capabilities; unknown or unsafe flags are not echoed.
+* @returns 0 for supported primary checks, 1 for rejection, or 2 for unknown/invalid input.
+*/
+async function runCapabilityCommand(args) {
+	const request = {
+		model: void 0,
+		probe: false,
+		proxyUrl: void 0,
+		timeoutMs: 3e4
+	};
+	let json = false;
+	const seen = /* @__PURE__ */ new Set();
+	const invalid = () => {
+		process.stderr.write("Usage: dsh-codex-connect capabilities [--model <catalog-id>] [--probe] [--proxy <http(s)-origin>] [--timeout-ms <1..60000>] [--json]\n");
+		return 2;
+	};
+	for (let index = 0; index < args.length; index += 1) {
+		const flag = args[index];
+		if (seen.has(flag)) return invalid();
+		seen.add(flag);
+		if (flag === "--json") json = true;
+		else if (flag === "--probe") request.probe = true;
+		else if (flag === "--model" || flag === "--proxy" || flag === "--timeout-ms") {
+			const value = args[++index];
+			if (value === void 0 || value.startsWith("--")) return invalid();
+			if (flag === "--model") request.model = value;
+			if (flag === "--proxy") {
+				request.proxyUrl = normalizeOpenAICodexProxyUrl(value);
+				if (request.proxyUrl === void 0) return invalid();
+			}
+			if (flag === "--timeout-ms") {
+				if (!/^\d+$/u.test(value) || Number(value) < 1 || Number(value) > 6e4) return invalid();
+				request.timeoutMs = Number(value);
+			}
+		} else return invalid();
+	}
+	if (request.probe && request.model === void 0) return invalid();
+	try {
+		const report = await new CodexCapabilityDiagnostics(6e4).inspect(request);
+		process.stdout.write(json ? `${JSON.stringify(report)}\n` : [
+			`Codex Connect ${report.version}: standalone route diagnostics`,
+			"Scope: local host versions and the selected standalone route; not the active Harness profile.",
+			`Model: ${report.model ?? "not selected from catalog"}; network: ${report.network}; probe: ${report.probe.state}`,
+			...Object.entries(report.checks).map(([id, check]) => `${id}: ${check.status} (${check.reason})\n  ${check.action}`),
+			""
+		].join("\n"));
+		const primary = [
+			report.checks.runtime,
+			report.checks.oauth,
+			report.checks.responses,
+			report.checks.transport,
+			report.checks.model
+		];
+		return primary.some((check) => check.status === "rejected") ? 1 : primary.some((check) => check.status === "unknown") ? 2 : 0;
+	} catch {
+		process.stderr.write("Codex Connect diagnostics could not inspect this installation. Check local package and credential-file access.\n");
+		return 2;
+	}
+}
+//#endregion
 //#region src/bin.ts
 /** Standalone credential CLI for the optional OpenAI Codex bundle. */
 const JSON_SCHEMA_VERSION = 1;
@@ -69,6 +434,7 @@ function printHelp() {
 		"       dsh-codex-connect trust-origin <origin>",
 		"       dsh-codex-connect trusted-origins [--json]",
 		"       dsh-codex-connect untrust-origin <origin>",
+		"       dsh-codex-connect capabilities [--model <catalog-id>] [--probe] [--proxy <http(s)-origin>] [--timeout-ms <1..60000>] [--json]",
 		"",
 		"  doctor         inspect secret-free runtime and OAuth file metadata",
 		"  login          sign in with a separate ChatGPT OAuth session",
@@ -116,6 +482,7 @@ async function run(argv) {
 		return 0;
 	}
 	const [rawAction, ...flags] = argv;
+	if (rawAction === "capabilities") return runCapabilityCommand(flags);
 	if (![
 		"doctor",
 		"login",