dsh-codex-connect 0.1.0-alpha.4.19 → 0.1.0-alpha.4.21

package/lib/{src-CiOi4nFr.js → src-Cxq99TvF.js}

@@ -1,4 +1,4 @@
-import { randomBytes, randomUUID } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { basename, dirname, join, parse, resolve } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import { deepEqualJson, installSettingsSection, settingsNamespace } from "@deepseek-ai/dsh-settings";
@@ -9,7 +9,10 @@ import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import { link, lstat, mkdir, open, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
 import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { Dispatcher, ProxyAgent, getGlobalDispatcher, setGlobalDispatcher } from "undici";
 import { fileURLToPath } from "node:url";
+import { SessionId } from "@deepseek-ai/dsh-session";
 import { AttachmentId } from "@deepseek-ai/dsh-attachment";
 import { TOOL_ABORTED, defineTool } from "@deepseek-ai/dsh-tools";
 import { lookup } from "node:dns/promises";
@@ -17,8 +20,8 @@ import { request } from "node:http";
 import { request as request$1 } from "node:https";
 import { BlockList, isIP } from "node:net";
 import { Service } from "@deepseek-ai/cordis";
-import { WebError } from "@deepseek-ai/dsh-web";
 import { constants } from "node:fs";
+import { WebError } from "@deepseek-ai/dsh-web";
 import { constants as constants$1, zstdCompressSync, zstdDecompressSync } from "node:zlib";
 //#region src/store.ts
 /**
@@ -51,7 +54,7 @@ async function assertOwnerOnly$1(filename) {
 	/* v8 ignore stop */
 }
 /** Validate the strict JSON document without quoting token-bearing input. */
-function parseDocument$1(text, filename) {
+function parseDocument$2(text, filename) {
 	let value;
 	try {
 		value = JSON.parse(text);
@@ -116,7 +119,7 @@ var OpenAICodexCredentialStore = class {
 			if (isENOENT$1(error)) return void 0;
 			throw error;
 		}
-		return cloneCredential(parseDocument$1(text, this.filename).credential);
+		return cloneCredential(parseDocument$2(text, this.filename).credential);
 	}
 	/** @inheritdoc */
 	async read(providerId) {
@@ -140,7 +143,7 @@ var OpenAICodexCredentialStore = class {
 			const current = await this.readCurrent();
 			const candidate = await fn(current);
 			if (candidate === void 0) return current;
-			const document = parseDocument$1(JSON.stringify({
+			const document = parseDocument$2(JSON.stringify({
 				version: AUTH_FORMAT_VERSION,
 				credential: candidate
 			}), this.filename);
@@ -212,9 +215,16 @@ function withOpenAICodexFastMode(provider, fastMode) {
 		}
 	};
 }
-function requestProvider(provider, fastMode) {
+function requestProvider(provider, fastMode, proxyManager, resolveProxyUrl) {
+	const configured = withOpenAICodexFastMode(provider, fastMode);
+	const streamSimple = configured.streamSimple;
 	return {
-		...withOpenAICodexFastMode(provider, fastMode),
+		...configured,
+		streamSimple(model, context, options) {
+			const proxyUrl = resolveProxyUrl?.();
+			const operation = () => streamSimple.call(configured, model, context, options);
+			return proxyManager?.runStream(proxyUrl, operation) ?? operation();
+		},
 		auth: {
 			...provider.auth,
 			apiKey: {
@@ -231,17 +241,18 @@ function requestProvider(provider, fastMode) {
 	};
 }
 /** Build the immutable profile consumed by the rc.2 pi-ai adapter. */
-function createOpenAICodexProfile(provider, fastMode) {
+function createOpenAICodexProfile(provider, fastMode, proxyManager, resolveProxyUrl) {
 	return {
 		provider: OPENAI_CODEX_PROVIDER,
 		displayName: "OpenAI Codex",
+		transport: "sse",
 		streamIdleTimeoutMs: OPENAI_CODEX_STREAM_IDLE_TIMEOUT_MS,
 		maxRequestImageBytes: OPENAI_CODEX_MAX_REQUEST_IMAGE_BYTES,
 		requestImagePixelBudget: OPENAI_CODEX_REQUEST_IMAGE_PIXEL_BUDGET,
 		requestImageMaxBytes: OPENAI_CODEX_REQUEST_IMAGE_MAX_BYTES,
 		retryPolicy: resolveRetryPolicy(void 0, "dsh-codex-connect retryPolicy"),
 		configuredMaxTokens: /* @__PURE__ */ new Map(),
-		piProvider: requestProvider(provider, fastMode)
+		piProvider: requestProvider(provider, fastMode, proxyManager, resolveProxyUrl)
 	};
 }
 /**
@@ -250,9 +261,9 @@ function createOpenAICodexProfile(provider, fastMode) {
 * resolution, streaming, reasoning metadata, and compaction behavior; this
 * plugin supplies its provider-native OAuth token for each request.
 */
-function createOpenAICodexAdapter(credentials, resolveAttachments, fastMode, visibleModelIds) {
+function createOpenAICodexAdapter(credentials, resolveAttachments, fastMode, visibleModelIds, proxyManager, resolveProxyUrl) {
 	const provider = openaiCodexProvider();
-	const profiles = /* @__PURE__ */ new Map([[OPENAI_CODEX_PROVIDER, createOpenAICodexProfile(provider, fastMode)]]);
+	const profiles = /* @__PURE__ */ new Map([[OPENAI_CODEX_PROVIDER, createOpenAICodexProfile(provider, fastMode, proxyManager, resolveProxyUrl)]]);
 	const models = createModels({ credentials });
 	models.setProvider(provider);
 	class OpenAICodexAdapter extends PiAiAdapter {
@@ -266,7 +277,10 @@ function createOpenAICodexAdapter(credentials, resolveAttachments, fastMode, vis
 	}
 	return new OpenAICodexAdapter({
 		profiles: () => profiles,
-		resolveApiKey: async () => (await models.getAuth(OPENAI_CODEX_PROVIDER))?.auth.apiKey,
+		resolveApiKey: async () => {
+			const operation = async () => (await models.getAuth(OPENAI_CODEX_PROVIDER))?.auth.apiKey;
+			return proxyManager?.run(resolveProxyUrl?.(), operation) ?? operation();
+		},
 		auth: {
 			credentials,
 			authContext: defaultProviderAuthContext()
@@ -508,7 +522,7 @@ async function assertOwnerOnly(filename) {
 	/* v8 ignore stop */
 }
 /** Reject malformed input without echoing its contents into an error. */
-function parseDocument(text, filename) {
+function parseDocument$1(text, filename) {
 	let value;
 	try {
 		value = JSON.parse(text);
@@ -588,7 +602,7 @@ var OpenAICodexTrustedOriginsStore = class {
 			};
 			throw error;
 		}
-		return parseDocument(text, this.filename);
+		return parseDocument$1(text, this.filename);
 	}
 	/** Read the current canonical list without acquiring the writer lock. */
 	async list() {
@@ -750,9 +764,13 @@ var OpenAICodexWebAuth = class {
 	challengeWaiters = [];
 	challengeTimer;
 	challengeTimeoutMs;
+	proxyManager;
+	resolveProxyUrl;
 	constructor(store, options = {}) {
 		this.store = store;
 		this.challengeTimeoutMs = options.challengeTimeoutMs ?? 3e4;
+		this.proxyManager = options.proxyManager;
+		this.resolveProxyUrl = options.resolveProxyUrl ?? (() => void 0);
 		if (!Number.isFinite(this.challengeTimeoutMs) || this.challengeTimeoutMs <= 0) throw new TypeError("OpenAI Codex auth URL timeout must be a positive finite number");
 	}
 	/** Read current public state, consulting durable storage while idle. */
@@ -794,13 +812,14 @@ var OpenAICodexWebAuth = class {
 			this.cancelSignIn(/* @__PURE__ */ new Error(`OpenAI Codex did not provide an authorization URL within ${String(this.challengeTimeoutMs)}ms`));
 		}, this.challengeTimeoutMs);
 		this.challengeTimer.unref();
-		this.operation = loginOpenAICodex({
+		const login = () => loginOpenAICodex({
 			signal: cancellation.signal,
 			prompt: (prompt) => prompt.type === "select" ? Promise.resolve("browser") : waitForPromptAbort(prompt),
 			notify: (event) => {
 				this.onEvent(event);
 			}
-		}, this.store).then(async () => {
+		}, this.store);
+		this.operation = (this.proxyManager?.run(this.resolveProxyUrl(), login) ?? login()).then(async () => {
 			if (this.challenge === void 0) {
 				const error = /* @__PURE__ */ new Error("OpenAI Codex sign-in finished without an authorization URL");
 				this.rejectChallenge(error);
@@ -846,9 +865,10 @@ var OpenAICodexWebAuth = class {
 	async readStoredStatus() {
 		if (!(await openAICodexAuthStatus(this.store)).authenticated) return { status: "signed-out" };
 		try {
+			const readUsage = () => readOpenAICodexRateLimits(this.store);
 			return {
 				status: "signed-in",
-				usage: await readOpenAICodexRateLimits(this.store)
+				usage: await (this.proxyManager?.run(this.resolveProxyUrl(), readUsage) ?? readUsage())
 			};
 		} catch (error) {
 			if (isOpenAICodexReauthRequiredError(error)) return {
@@ -944,7 +964,7 @@ async function trustedRequestDecision(req, trustedOrigins = new OpenAICodexTrust
 		error: REMOTE_WEB_ORIGIN_NOT_TRUSTED
 	};
 }
-function json$2(res, status, value) {
+function json$4(res, status, value) {
 	res.writeHead(status, {
 		"content-type": "application/json; charset=utf-8",
 		"cache-control": "no-store",
@@ -1025,8 +1045,11 @@ function fastModeBody(value) {
 	} : void 0;
 }
 /** Register the plugin-owned OAuth routes when the Web server is composed. */
-function registerOpenAICodexAuthRoutes(ctx, store, trustedOriginsOverride, fastModeOverride) {
-	const auth = new OpenAICodexWebAuth(store);
+function registerOpenAICodexAuthRoutes(ctx, store, trustedOriginsOverride, fastModeOverride, proxyManager, resolveProxyUrl) {
+	const auth = new OpenAICodexWebAuth(store, {
+		proxyManager,
+		resolveProxyUrl
+	});
 	const storedFilename = store.filename;
 	const fastMode = fastModeOverride ?? new FastModeRegistry();
 	const trustedOrigins = trustedOriginsOverride ?? (typeof storedFilename === "string" ? new OpenAICodexTrustedOriginsStore(join(dirname(storedFilename), ".openai-codex-trusted-origins.json")) : new OpenAICodexTrustedOriginsStore());
@@ -1034,7 +1057,7 @@ function registerOpenAICodexAuthRoutes(ctx, store, trustedOriginsOverride, fastM
 		const authorize = async (req, res) => {
 			const decision = await trustedRequestDecision(req, trustedOrigins);
 			if (decision.trusted) return true;
-			json$2(res, 403, { error: decision.error });
+			json$4(res, 403, { error: decision.error });
 			return false;
 		};
 		const routes = [
@@ -1042,21 +1065,21 @@ function registerOpenAICodexAuthRoutes(ctx, store, trustedOriginsOverride, fastM
 				kind: "exact",
 				path: OPENAI_CODEX_AUTH_STATUS_PATH,
 				handler: async (req, res) => {
-					if (req.method !== "GET") return json$2(res, 405, { error: "method not allowed" });
+					if (req.method !== "GET") return json$4(res, 405, { error: "method not allowed" });
 					if (!await authorize(req, res)) return;
-					json$2(res, 200, await auth.status());
+					json$4(res, 200, await auth.status());
 				}
 			}),
 			ctx.webServer.register({
 				kind: "exact",
 				path: OPENAI_CODEX_AUTH_LOGIN_PATH,
 				handler: async (req, res) => {
-					if (req.method !== "POST") return json$2(res, 405, { error: "method not allowed" });
+					if (req.method !== "POST") return json$4(res, 405, { error: "method not allowed" });
 					if (!await authorize(req, res)) return;
 					try {
-						json$2(res, 200, await auth.signIn());
+						json$4(res, 200, await auth.signIn());
 					} catch (error) {
-						json$2(res, 500, { error: safeMessage(error) });
+						json$4(res, 500, { error: safeMessage(error) });
 					}
 				}
 			}),
@@ -1064,13 +1087,13 @@ function registerOpenAICodexAuthRoutes(ctx, store, trustedOriginsOverride, fastM
 				kind: "exact",
 				path: OPENAI_CODEX_AUTH_LOGOUT_PATH,
 				handler: async (req, res) => {
-					if (req.method !== "POST") return json$2(res, 405, { error: "method not allowed" });
+					if (req.method !== "POST") return json$4(res, 405, { error: "method not allowed" });
 					if (!await authorize(req, res)) return;
 					try {
 						await auth.signOut();
-						json$2(res, 200, { ok: true });
+						json$4(res, 200, { ok: true });
 					} catch (error) {
-						json$2(res, 500, { error: safeMessage(error) });
+						json$4(res, 500, { error: safeMessage(error) });
 					}
 				}
 			}),
@@ -1078,22 +1101,22 @@ function registerOpenAICodexAuthRoutes(ctx, store, trustedOriginsOverride, fastM
 				kind: "exact",
 				path: OPENAI_CODEX_FAST_MODE_PATH,
 				handler: async (req, res) => {
-					if (req.method !== "GET" && req.method !== "POST") return json$2(res, 405, { error: "method not allowed" });
+					if (req.method !== "GET" && req.method !== "POST") return json$4(res, 405, { error: "method not allowed" });
 					if (!await authorize(req, res)) return;
 					if (req.method === "GET") {
 						const sessionId = fastModeSessionIdFromQuery(req);
-						if (sessionId === void 0) return json$2(res, 400, { error: "invalid input" });
-						return json$2(res, 200, { enabled: fastMode.isEnabled(sessionId) });
+						if (sessionId === void 0) return json$4(res, 400, { error: "invalid input" });
+						return json$4(res, 200, { enabled: fastMode.isEnabled(sessionId) });
 					}
 					const type = header(req, "content-type");
-					if (type === void 0 || !/^application\/json(?:\s*;|$)/iu.test(type.trim())) return json$2(res, 415, { error: "unsupported content type" });
+					if (type === void 0 || !/^application\/json(?:\s*;|$)/iu.test(type.trim())) return json$4(res, 415, { error: "unsupported content type" });
 					try {
 						const body = fastModeBody(await readFastModeBody(req));
-						if (body === void 0) return json$2(res, 400, { error: "invalid input" });
+						if (body === void 0) return json$4(res, 400, { error: "invalid input" });
 						fastMode.set(body.sessionId, body.enabled);
-						return json$2(res, 200, { enabled: fastMode.isEnabled(body.sessionId) });
+						return json$4(res, 200, { enabled: fastMode.isEnabled(body.sessionId) });
 					} catch (error) {
-						return json$2(res, error instanceof RangeError ? 413 : 400, { error: error instanceof RangeError ? "request body too large" : "invalid input" });
+						return json$4(res, error instanceof RangeError ? 413 : 400, { error: error instanceof RangeError ? "request body too large" : "invalid input" });
 					}
 				}
 			})
@@ -1105,6 +1128,389 @@ function registerOpenAICodexAuthRoutes(ctx, store, trustedOriginsOverride, fastM
 	}, "dsh-codex-connect: Web OAuth routes");
 }
 //#endregion
+//#region src/settings-contract.ts
+/** Node-free settings contract shared by the Host plugin and browser card. */
+/** Stable Harness settings namespace owned by this plugin. */
+const OPENAI_CODEX_SETTINGS_NAMESPACE = "llm-openai-codex";
+/** Suggested local HTTP proxy shown by the settings UI; it is never enabled by default. */
+const DEFAULT_OPENAI_CODEX_PROXY_URL = "http://127.0.0.1:7890";
+/**
+* Normalize the credential-free HTTP proxy URL accepted by Codex Connect.
+* Paths, query strings, fragments, and embedded credentials are rejected so
+* the value remains an origin rather than an opaque request target.
+*/
+function normalizeOpenAICodexProxyUrl(value) {
+	if (typeof value !== "string" || value.trim().length === 0) return void 0;
+	try {
+		const parsed = new URL(value.trim());
+		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return void 0;
+		if (parsed.username !== "" || parsed.password !== "") return void 0;
+		if (parsed.pathname !== "/" || parsed.search !== "" || parsed.hash !== "") return void 0;
+		if (parsed.hostname.length === 0) return void 0;
+		if (parsed.port !== "" && (!/^\d+$/u.test(parsed.port) || Number(parsed.port) < 1 || Number(parsed.port) > 65535)) return void 0;
+		return parsed.origin;
+	} catch {
+		return;
+	}
+}
+/** Whether a value is a supported, canonical HTTP(S) proxy origin. */
+function isValidOpenAICodexProxyUrl(value) {
+	return normalizeOpenAICodexProxyUrl(value) !== void 0;
+}
+/** Default model used by the standalone search endpoint. */
+const DEFAULT_OPENAI_CODEX_SEARCH_MODEL = "gpt-5.6-sol";
+/** Default search mode, matching the official local Codex client. */
+const DEFAULT_OPENAI_CODEX_SEARCH_MODE = "cached";
+/** Default provider search-context size. */
+const DEFAULT_OPENAI_CODEX_SEARCH_CONTEXT_SIZE = "medium";
+/** Default output budget for the standalone search response. */
+const DEFAULT_OPENAI_CODEX_SEARCH_MAX_OUTPUT_TOKENS = 1e4;
+const DEFAULT_OPENAI_CODEX_SETTINGS = Object.freeze({
+	models: void 0,
+	enableProxy: false,
+	proxyUrl: DEFAULT_OPENAI_CODEX_PROXY_URL,
+	enableSearch: false,
+	enableImageTool: false,
+	enableImageGeneration: false,
+	searchModel: DEFAULT_OPENAI_CODEX_SEARCH_MODEL,
+	searchMode: DEFAULT_OPENAI_CODEX_SEARCH_MODE,
+	searchContextSize: DEFAULT_OPENAI_CODEX_SEARCH_CONTEXT_SIZE,
+	searchMaxOutputTokens: DEFAULT_OPENAI_CODEX_SEARCH_MAX_OUTPUT_TOKENS
+});
+/** Fill the schema defaults even when called without Cordis validation. */
+function resolveOpenAICodexSettings(value) {
+	const resolved = {
+		...DEFAULT_OPENAI_CODEX_SETTINGS,
+		...value
+	};
+	if (!isValidOpenAICodexProxyUrl(resolved.proxyUrl)) throw new TypeError("OpenAI Codex proxyUrl must be an HTTP(S) origin without credentials or a path");
+	return resolved;
+}
+/** Resolve the active proxy without treating a disabled value as a route. */
+function resolveOpenAICodexProxyUrl(value) {
+	const resolved = resolveOpenAICodexSettings(value);
+	return resolved.enableProxy ? normalizeOpenAICodexProxyUrl(resolved.proxyUrl) : void 0;
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Narrow the redacted settings wire payload before it enters React state. */
+function decodeOpenAICodexSettings(value) {
+	if (!isRecord$1(value)) return void 0;
+	const models = value["models"];
+	const enableProxy = value["enableProxy"];
+	const proxyUrl = value["proxyUrl"];
+	const enableSearch = value["enableSearch"];
+	const enableImageTool = value["enableImageTool"];
+	const enableImageGeneration = value["enableImageGeneration"];
+	const searchModel = value["searchModel"];
+	const searchMode = value["searchMode"];
+	const searchContextSize = value["searchContextSize"];
+	const searchMaxOutputTokens = value["searchMaxOutputTokens"];
+	if (models !== void 0 && (!Array.isArray(models) || models.some((model) => typeof model !== "string"))) return void 0;
+	if (enableProxy !== void 0 && typeof enableProxy !== "boolean") return void 0;
+	if (proxyUrl !== void 0 && (typeof proxyUrl !== "string" || !isValidOpenAICodexProxyUrl(proxyUrl))) return void 0;
+	if (typeof enableSearch !== "boolean" || typeof enableImageTool !== "boolean") return void 0;
+	if (enableImageGeneration !== void 0 && typeof enableImageGeneration !== "boolean") return void 0;
+	if (typeof searchModel !== "string" || searchModel.trim().length === 0) return void 0;
+	if (searchMode !== "cached" && searchMode !== "indexed" && searchMode !== "live") return void 0;
+	if (searchContextSize !== "low" && searchContextSize !== "medium" && searchContextSize !== "high") return void 0;
+	if (typeof searchMaxOutputTokens !== "number" || !Number.isInteger(searchMaxOutputTokens) || searchMaxOutputTokens < 1) return void 0;
+	return {
+		models: models === void 0 ? void 0 : [...new Set(models)],
+		enableProxy: enableProxy ?? false,
+		proxyUrl: proxyUrl === void 0 ? DEFAULT_OPENAI_CODEX_PROXY_URL : normalizeOpenAICodexProxyUrl(proxyUrl),
+		enableSearch,
+		enableImageTool,
+		enableImageGeneration: enableImageGeneration ?? false,
+		searchModel,
+		searchMode,
+		searchContextSize,
+		searchMaxOutputTokens
+	};
+}
+//#endregion
+//#region src/provider-proxy.ts
+/** Explicit Codex-only HTTP(S) proxying, probing, and lifecycle ownership. */
+/** Canonical first-party endpoint used for a no-auth, no-model reachability probe. */
+const OPENAI_CODEX_PROXY_PROBE_URL = "https://chatgpt.com/backend-api/codex";
+/** Upper bound for one candidate probe, including CONNECT and response headers. */
+const OPENAI_CODEX_PROXY_PROBE_TIMEOUT_MS = 3e3;
+/** Maximum number of candidates considered by automatic detection. */
+const OPENAI_CODEX_PROXY_CANDIDATE_LIMIT = 8;
+/** Bounded local candidates documented by the settings UI. */
+const OPENAI_CODEX_LOCAL_PROXY_CANDIDATES = [
+	"http://127.0.0.1:7890",
+	"http://127.0.0.1:7897",
+	"http://127.0.0.1:10809"
+];
+const proxyScope = new AsyncLocalStorage();
+const activeOwners = /* @__PURE__ */ new Set();
+var ScopedProxyDispatcher = class extends Dispatcher {
+	fallback;
+	constructor(fallback) {
+		super();
+		this.fallback = fallback;
+	}
+	setFallback(fallback) {
+		this.fallback = fallback;
+	}
+	dispatch(options, handler) {
+		return (proxyScope.getStore() ?? this.fallback).dispatch(options, handler);
+	}
+};
+let installedDispatcher;
+let previousDispatcher;
+function ensureInstalled(owner) {
+	if (activeOwners.has(owner)) return;
+	const current = getGlobalDispatcher();
+	if (installedDispatcher === void 0) {
+		previousDispatcher = current;
+		installedDispatcher = new ScopedProxyDispatcher(current);
+		setGlobalDispatcher(installedDispatcher);
+	} else if (current !== installedDispatcher) {
+		installedDispatcher.setFallback(current);
+		setGlobalDispatcher(installedDispatcher);
+	}
+	activeOwners.add(owner);
+}
+function removeOwner(owner) {
+	activeOwners.delete(owner);
+	if (activeOwners.size !== 0 || installedDispatcher === void 0) return;
+	const installed = installedDispatcher;
+	const previous = previousDispatcher;
+	installedDispatcher = void 0;
+	previousDispatcher = void 0;
+	if (getGlobalDispatcher() === installed && previous !== void 0) setGlobalDispatcher(previous);
+}
+function isPromiseLike(value) {
+	return typeof value === "object" && value !== null && "then" in value && typeof value.then === "function";
+}
+function errorCode(error) {
+	if (typeof error !== "object" || error === null) return void 0;
+	const record = error;
+	return typeof record["code"] === "string" ? record["code"] : errorCode(record["cause"]);
+}
+function classifyProbeError(error) {
+	const code = errorCode(error);
+	if (code === "ENOTFOUND" || code === "EAI_AGAIN") return "dns-failure";
+	if (code === "ECONNREFUSED") return "connection-refused";
+	if (code === "ETIMEDOUT" || code === "UND_ERR_CONNECT_TIMEOUT" || code === "ABORT_ERR") return "timeout";
+	if (code === "ERR_TLS_CERT_ALTNAME_INVALID" || code === "UNABLE_TO_VERIFY_LEAF_SIGNATURE" || code === "DEPTH_ZERO_SELF_SIGNED_CERT" || code === "ERR_TLS_CERT_SIGNATURE_ALGORITHM_UNSUPPORTED") return "tls-failure";
+	return "connect-failure";
+}
+function classifyResponse(status) {
+	if (status === 407) return "proxy-authentication-required";
+	if (status === 401 || status === 403) return "upstream-authentication-required";
+	return "reachable";
+}
+function candidateEnvironmentValues() {
+	return [
+		process.env["HTTPS_PROXY"],
+		process.env["https_proxy"],
+		process.env["HTTP_PROXY"],
+		process.env["http_proxy"],
+		process.env["ALL_PROXY"],
+		process.env["all_proxy"]
+	].filter((value) => value !== void 0);
+}
+/** Return a small, deterministic candidate set; this never scans LAN hosts or ports. */
+function listOpenAICodexProxyCandidates() {
+	const candidates = [];
+	for (const value of [...candidateEnvironmentValues(), ...OPENAI_CODEX_LOCAL_PROXY_CANDIDATES]) {
+		const normalized = normalizeOpenAICodexProxyUrl(value);
+		if (normalized !== void 0 && !candidates.includes(normalized)) candidates.push(normalized);
+		if (candidates.length >= 8) break;
+	}
+	return candidates;
+}
+/** One plugin instance owns its proxy agents and contributes one global wrapper owner. */
+var OpenAICodexProxyManager = class {
+	agents = /* @__PURE__ */ new Map();
+	activeOperations = 0;
+	idleWaiters = [];
+	disposed = false;
+	disposePromise;
+	async waitForIdle() {
+		if (this.activeOperations === 0) return;
+		await new Promise((resolve) => {
+			this.idleWaiters.push(resolve);
+		});
+	}
+	async closeAgents() {
+		removeOwner(this);
+		const agents = [...this.agents.values()];
+		this.agents.clear();
+		await Promise.allSettled(agents.map((agent) => agent.close()));
+	}
+	agentFor(proxyUrl) {
+		let agent = this.agents.get(proxyUrl);
+		if (agent !== void 0) return agent;
+		agent = new ProxyAgent(proxyUrl);
+		this.agents.set(proxyUrl, agent);
+		return agent;
+	}
+	acquire(proxyUrl) {
+		if (this.disposed) throw new Error("OpenAI Codex proxy manager has been disposed");
+		ensureInstalled(this);
+		this.activeOperations += 1;
+		let released = false;
+		return {
+			agent: this.agentFor(proxyUrl),
+			release: () => {
+				if (released) return;
+				released = true;
+				this.activeOperations -= 1;
+				if (this.activeOperations === 0) for (const resolve of this.idleWaiters.splice(0)) resolve();
+			}
+		};
+	}
+	/** Run a synchronous or asynchronous Codex operation in the selected proxy scope. */
+	run(proxyUrl, operation) {
+		if (proxyUrl === void 0) return operation();
+		const normalized = normalizeOpenAICodexProxyUrl(proxyUrl);
+		if (!isValidOpenAICodexProxyUrl(normalized)) throw new TypeError("OpenAI Codex proxy URL is invalid");
+		const lease = this.acquire(normalized);
+		try {
+			const value = proxyScope.run(lease.agent, operation);
+			if (isPromiseLike(value)) return Promise.resolve(value).finally(lease.release);
+			lease.release();
+			return value;
+		} catch (error) {
+			lease.release();
+			throw error;
+		}
+	}
+	/** Run a streaming operation and keep the proxy lease until its final event. */
+	runStream(proxyUrl, operation) {
+		if (proxyUrl === void 0) return operation();
+		const normalized = normalizeOpenAICodexProxyUrl(proxyUrl);
+		if (!isValidOpenAICodexProxyUrl(normalized)) throw new TypeError("OpenAI Codex proxy URL is invalid");
+		const lease = this.acquire(normalized);
+		try {
+			const stream = proxyScope.run(lease.agent, operation);
+			Promise.resolve(stream.result()).finally(lease.release);
+			return stream;
+		} catch (error) {
+			lease.release();
+			throw error;
+		}
+	}
+	/** Probe one proxy without credentials, model calls, quota calls, or settings writes. */
+	async probe(proxyUrl) {
+		const normalized = normalizeOpenAICodexProxyUrl(proxyUrl);
+		if (normalized === void 0) return {
+			proxyUrl,
+			reachable: false,
+			classification: "invalid"
+		};
+		try {
+			const response = await this.run(normalized, () => fetch(OPENAI_CODEX_PROXY_PROBE_URL, {
+				method: "GET",
+				redirect: "manual",
+				headers: { accept: "application/json" },
+				signal: AbortSignal.timeout(OPENAI_CODEX_PROXY_PROBE_TIMEOUT_MS)
+			}));
+			await response.body?.cancel();
+			return {
+				proxyUrl: normalized,
+				reachable: true,
+				classification: classifyResponse(response.status),
+				status: response.status
+			};
+		} catch (error) {
+			return {
+				proxyUrl: normalized,
+				reachable: false,
+				classification: classifyProbeError(error)
+			};
+		}
+	}
+	/** Close owned pools only after all scoped operations have become quiescent. */
+	async dispose() {
+		if (this.disposePromise !== void 0) return this.disposePromise;
+		this.disposed = true;
+		this.disposePromise = (async () => {
+			await this.waitForIdle();
+			await this.closeAgents();
+		})();
+		return this.disposePromise;
+	}
+	/** Release the process wrapper and pools after the user disables the proxy. */
+	async deactivate() {
+		if (this.disposed) return;
+		await this.waitForIdle();
+		await this.closeAgents();
+	}
+};
+/** Probe the bounded automatic candidate set in parallel. */
+async function detectOpenAICodexProxies(manager) {
+	return Promise.all(listOpenAICodexProxyCandidates().map((candidate) => manager.probe(candidate)));
+}
+//#endregion
+//#region src/proxy-paths.ts
+/** Node-free route constants shared by the Host and browser plugin halves. */
+/** Detect bounded local/environment proxy candidates without changing settings. */
+const OPENAI_CODEX_PROXY_DETECT_PATH = "/plugins/dsh-openai-codex/proxy/detect";
+/** Test one manually entered proxy origin without changing settings. */
+const OPENAI_CODEX_PROXY_TEST_PATH = "/plugins/dsh-openai-codex/proxy/test";
+//#endregion
+//#region src/proxy-routes.ts
+function json$3(res, status, value) {
+	res.writeHead(status, {
+		"content-type": "application/json; charset=utf-8",
+		"cache-control": "no-store",
+		"x-content-type-options": "nosniff"
+	});
+	res.end(JSON.stringify(value));
+}
+function proxyUrlFromQuery(req) {
+	if (typeof req.url !== "string") return void 0;
+	try {
+		const values = new URL(req.url, "http://dsh.invalid").searchParams.getAll("proxyUrl");
+		return values.length === 1 && values[0].length <= 2e3 ? values[0] : void 0;
+	} catch {
+		return;
+	}
+}
+/** Register bounded detection and draft-probe routes; neither route mutates settings. */
+function registerOpenAICodexProxyRoutes(ctx, trustedOrigins, manager) {
+	ctx.effect(() => {
+		const authorize = async (req, res) => {
+			const decision = await trustedRequestDecision(req, trustedOrigins);
+			if (decision.trusted) return true;
+			json$3(res, 403, { error: decision.error });
+			return false;
+		};
+		const routes = [ctx.webServer.register({
+			kind: "exact",
+			path: OPENAI_CODEX_PROXY_DETECT_PATH,
+			handler: async (req, res) => {
+				if (req.method !== "POST") return json$3(res, 405, { error: "method not allowed" });
+				if (!await authorize(req, res)) return;
+				const results = await detectOpenAICodexProxies(manager);
+				return json$3(res, 200, {
+					candidates: results.filter((result) => result.reachable),
+					results
+				});
+			}
+		}), ctx.webServer.register({
+			kind: "exact",
+			path: OPENAI_CODEX_PROXY_TEST_PATH,
+			handler: async (req, res) => {
+				if (req.method !== "POST") return json$3(res, 405, { error: "method not allowed" });
+				if (!await authorize(req, res)) return;
+				const proxyUrl = proxyUrlFromQuery(req);
+				if (proxyUrl === void 0) return json$3(res, 400, { error: "invalid proxy URL" });
+				return json$3(res, 200, await manager.probe(proxyUrl));
+			}
+		})];
+		return () => {
+			for (const dispose of routes) dispose();
+		};
+	}, "dsh-codex-connect: proxy detection routes");
+}
+//#endregion
 //#region src/compatibility.ts
 const COMPATIBILITY_SCHEMA_VERSION = 1;
 const SUPPORTED_NODE_RANGE = "^22.19.0 || >=24.0.0";
@@ -1211,7 +1617,12 @@ function evaluateCompatibility(input = {}) {
 }
 /** Alias for callers that prefer assessment terminology. */
 const assessCompatibility = evaluateCompatibility;
-async function readPackageVersionFromEntry(name) {
+/**
+* Resolve installed package metadata without returning a filesystem path.
+* @param name - package to resolve from this plugin installation.
+* @returns its version, or undefined when metadata cannot be read.
+*/
+async function readInstalledPackageVersion(name) {
 	let entry;
 	try {
 		const resolved = import.meta.resolve(name);
@@ -1234,7 +1645,7 @@ async function readPackageVersionFromEntry(name) {
 }
 /** Read installed package metadata and return only versions and statuses. */
 async function detectCompatibility(options = {}) {
-	const readVersion = options.readPackageVersion ?? readPackageVersionFromEntry;
+	const readVersion = options.readPackageVersion ?? readInstalledPackageVersion;
 	const packageVersions = options.packageVersions ?? options.packages ?? options.installed?.packages;
 	const resolvedPackages = packageVersions === void 0 ? Object.fromEntries(await Promise.all(COMPATIBILITY_PACKAGES.map(async (name) => [name, await readVersion(name)]))) : packageVersions;
 	return evaluateCompatibility({
@@ -1259,7 +1670,8 @@ const HIGHLIGHT_KINDS = [
 	"search-stability",
 	"image-generation",
 	"oauth-history",
-	"model-visibility"
+	"model-visibility",
+	"proxy-connection"
 ];
 function isHighlightKind(value) {
 	return typeof value === "string" && HIGHLIGHT_KINDS.includes(value);
@@ -1688,7 +2100,7 @@ async function detectCurrentDshVersion() {
 	const adapter = report.packages["@deepseek-ai/dsh-llm-pi-ai"].installed;
 	return llm !== null && llm === adapter ? llm : void 0;
 }
-function json$1(res, status, value) {
+function json$2(res, status, value) {
 	res.writeHead(status, {
 		"content-type": "application/json; charset=utf-8",
 		"cache-control": "no-store",
@@ -1703,14 +2115,14 @@ function registerOpenAICodexUpdateRoutes(ctx, options, trustedOrigins) {
 			kind: "exact",
 			path: OPENAI_CODEX_RUNTIME_PATH,
 			handler: async (req, res) => {
-				if (req.method !== "GET") return json$1(res, 405, { error: "method not allowed" });
+				if (req.method !== "GET") return json$2(res, 405, { error: "method not allowed" });
 				const decision = await trustedRequestDecision(req, trustedOrigins);
-				if (!decision.trusted) return json$1(res, 403, { error: decision.error });
+				if (!decision.trusted) return json$2(res, 403, { error: decision.error });
 				try {
 					const currentDshVersion = await (options.resolveCurrentDshVersion ?? detectCurrentDshVersion)();
-					return json$1(res, 200, currentDshVersion === void 0 ? {} : { currentDshVersion });
+					return json$2(res, 200, currentDshVersion === void 0 ? {} : { currentDshVersion });
 				} catch {
-					return json$1(res, 200, {});
+					return json$2(res, 200, {});
 				}
 			}
 		});
@@ -1718,9 +2130,9 @@ function registerOpenAICodexUpdateRoutes(ctx, options, trustedOrigins) {
 			kind: "exact",
 			path: OPENAI_CODEX_UPDATE_PATH,
 			handler: async (req, res) => {
-				if (req.method !== "GET") return json$1(res, 405, { error: "method not allowed" });
+				if (req.method !== "GET") return json$2(res, 405, { error: "method not allowed" });
 				const decision = await trustedRequestDecision(req, trustedOrigins);
-				if (!decision.trusted) return json$1(res, 403, { error: decision.error });
+				if (!decision.trusted) return json$2(res, 403, { error: decision.error });
 				let result;
 				let currentDshVersion;
 				try {
@@ -1743,7 +2155,7 @@ function registerOpenAICodexUpdateRoutes(ctx, options, trustedOrigins) {
 						reason: "registry-unavailable"
 					};
 				}
-				return json$1(res, 200, result);
+				return json$2(res, 200, result);
 			}
 		});
 		return () => {
@@ -1759,7 +2171,7 @@ function registerOpenAICodexUpdateRoutes(ctx, options, trustedOrigins) {
 const OPENAI_CODEX_MODEL_CATALOG_PATH = "/plugins/dsh-codex-connect/models";
 //#endregion
 //#region src/model-routes.ts
-function json(res, status, value) {
+function json$1(res, status, value) {
 	res.writeHead(status, {
 		"content-type": "application/json; charset=utf-8",
 		"cache-control": "no-store",
@@ -1772,17 +2184,162 @@ function registerOpenAICodexModelCatalogRoute(ctx, resolveCatalog, trustedOrigin
 	ctx.effect(() => ctx.webServer.register({
 		kind: "exact",
 		path: OPENAI_CODEX_MODEL_CATALOG_PATH,
+		handler: async (req, res) => {
+			if (req.method !== "GET") return json$1(res, 405, { error: "method not allowed" });
+			const decision = await trustedRequestDecision(req, trustedOrigins);
+			if (!decision.trusted) return json$1(res, 403, { error: decision.error });
+			return json$1(res, 200, resolveCatalog());
+		}
+	}), "dsh-codex-connect: model catalog route");
+}
+//#endregion
+//#region src/image-assets-contract.ts
+/** Same-origin endpoint serving one session-owned original generated image. */
+const OPENAI_CODEX_ORIGINAL_IMAGE_PATH = "/plugins/dsh-codex-connect/images/original";
+/** Opaque identifier format for one plugin-owned original image. */
+const OPENAI_CODEX_IMAGE_ASSET_ID_PATTERN = /^img_[0-9a-f]{32}$/u;
+function positiveSafeInteger$3(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+/** Decode session-log metadata without trusting an asset id, filename, or media type. */
+function decodeOpenAICodexOriginalImageRef(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const candidate = value;
+	if (typeof candidate.assetId !== "string" || !OPENAI_CODEX_IMAGE_ASSET_ID_PATTERN.test(candidate.assetId) || candidate.mediaType !== "image/png" && candidate.mediaType !== "image/jpeg" && candidate.mediaType !== "image/webp" || !positiveSafeInteger$3(candidate.width) || !positiveSafeInteger$3(candidate.height) || !positiveSafeInteger$3(candidate.bytes) || candidate.bytes > 50331648 || typeof candidate.name !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(candidate.name) || typeof candidate.sha256 !== "string" || !/^[0-9a-f]{64}$/u.test(candidate.sha256)) return void 0;
+	return {
+		assetId: candidate.assetId,
+		mediaType: candidate.mediaType,
+		width: candidate.width,
+		height: candidate.height,
+		bytes: candidate.bytes,
+		name: candidate.name,
+		sha256: candidate.sha256
+	};
+}
+//#endregion
+//#region src/image-presentation.ts
+/** Stable metadata marker for generated image result views. */
+const IMAGE_PRESENTATION_KIND = "codex-connect-images";
+function positiveSafeInteger$2(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+function mediaType$1(value) {
+	return value === "image/png" || value === "image/jpeg" || value === "image/webp";
+}
+function imageRef(value) {
+	if (typeof value !== "object" || value === null) return void 0;
+	const candidate = value;
+	if (typeof candidate.attachmentId !== "string" || candidate.attachmentId.length === 0 || !mediaType$1(candidate.mediaType) || !positiveSafeInteger$2(candidate.bytes) || !positiveSafeInteger$2(candidate.width) || !positiveSafeInteger$2(candidate.height) || candidate.name !== void 0 && (typeof candidate.name !== "string" || candidate.name.length === 0)) return void 0;
+	return {
+		attachmentId: candidate.attachmentId,
+		mediaType: candidate.mediaType,
+		bytes: candidate.bytes,
+		width: candidate.width,
+		height: candidate.height,
+		...candidate.name === void 0 ? {} : { name: candidate.name }
+	};
+}
+/** Decode durable tool-result metadata without trusting arbitrary session JSON. */
+function decodeImagePresentationMeta(value) {
+	if (typeof value !== "object" || value === null) return void 0;
+	const candidate = value;
+	if (candidate.kind !== "codex-connect-images" || typeof candidate.prompt !== "string" || candidate.prompt.length < 1 || candidate.prompt.length > 32e3 || !Array.isArray(candidate.images) || candidate.images.length < 1 || candidate.images.length > 4) return void 0;
+	if (candidate.schemaVersion === void 0) {
+		const previews = candidate.images.map(imageRef);
+		if (previews.some((image) => image === void 0)) return void 0;
+		return {
+			kind: IMAGE_PRESENTATION_KIND,
+			schemaVersion: 1,
+			prompt: candidate.prompt,
+			images: previews.map((preview) => ({ preview }))
+		};
+	}
+	if (candidate.schemaVersion !== 1) return void 0;
+	const images = [];
+	for (const value of candidate.images) {
+		if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+		const entry = value;
+		const preview = imageRef(entry.preview);
+		const original = decodeOpenAICodexOriginalImageRef(entry.original);
+		if (preview === void 0 || original === void 0) return void 0;
+		images.push({
+			preview,
+			original
+		});
+	}
+	return {
+		kind: IMAGE_PRESENTATION_KIND,
+		schemaVersion: 1,
+		prompt: candidate.prompt,
+		images
+	};
+}
+//#endregion
+//#region src/image-asset-routes.ts
+/** Fork access follows copied result events, not every asset owned by an ancestor. */
+function inheritedOriginal(session, assetId) {
+	if (session?.header.parentSession === void 0) return void 0;
+	const seedLength = session.header.seedLength ?? 0;
+	for (const event of session.events) {
+		if (event.seq >= seedLength) break;
+		if (event.type !== "tool/result") continue;
+		const original = decodeImagePresentationMeta(event.data.meta)?.images.find((image) => image.original?.assetId === assetId)?.original;
+		if (original !== void 0) return original;
+	}
+}
+function json(res, status, value) {
+	res.writeHead(status, {
+		"content-type": "application/json; charset=utf-8",
+		"cache-control": "no-store",
+		"x-content-type-options": "nosniff"
+	});
+	res.end(JSON.stringify(value));
+}
+function query(req) {
+	if (typeof req.url !== "string") return void 0;
+	try {
+		const parsed = new URL(req.url, "http://dsh.invalid");
+		const sessionIds = parsed.searchParams.getAll("sessionId");
+		const assetIds = parsed.searchParams.getAll("assetId");
+		const sessionId = sessionIds[0];
+		const assetId = assetIds[0];
+		if (sessionIds.length !== 1 || assetIds.length !== 1 || sessionId === void 0 || sessionId.length < 1 || sessionId.length > 512 || assetId === void 0 || !OPENAI_CODEX_IMAGE_ASSET_ID_PATTERN.test(assetId)) return void 0;
+		return {
+			sessionId,
+			assetId
+		};
+	} catch {
+		return;
+	}
+}
+/** Register a history-safe route even while new image generation is disabled. */
+function registerOpenAICodexOriginalImageRoute(ctx, trustedOrigins, assets) {
+	ctx.effect(() => ctx.webServer.register({
+		kind: "exact",
+		path: OPENAI_CODEX_ORIGINAL_IMAGE_PATH,
 		handler: async (req, res) => {
 			if (req.method !== "GET") return json(res, 405, { error: "method not allowed" });
 			const decision = await trustedRequestDecision(req, trustedOrigins);
 			if (!decision.trusted) return json(res, 403, { error: decision.error });
-			return json(res, 200, resolveCatalog());
+			const requested = query(req);
+			if (requested === void 0) return json(res, 400, { error: "invalid input" });
+			const session = ctx.get("sessions")?.get(SessionId(requested.sessionId));
+			const stored = await assets.read(requested.sessionId, requested.assetId, inheritedOriginal(session, requested.assetId));
+			if (stored === void 0) return json(res, 404, { error: "original image not found" });
+			res.writeHead(200, {
+				"content-type": stored.ref.mediaType,
+				"content-length": String(stored.ref.bytes),
+				"content-disposition": `attachment; filename="${stored.ref.name}"`,
+				"cache-control": "private, no-store",
+				"x-content-type-options": "nosniff"
+			});
+			res.end(Buffer.from(stored.data));
 		}
-	}), "dsh-codex-connect: model catalog route");
+	}), "dsh-codex-connect: original image download route");
 }
 //#endregion
 //#region src/version.ts
-const CODEX_CONNECT_VERSION = "0.1.0-alpha.4.19";
+const CODEX_CONNECT_VERSION = "0.1.0-alpha.4.21";
 //#endregion
 //#region src/doctor.ts
 /** Secret-free diagnostics and duplicate-provider guidance. */
@@ -1964,10 +2521,6 @@ function detectEncodedImage(data) {
 	}
 }
 //#endregion
-//#region src/image-presentation.ts
-/** Stable metadata marker for generated image result views. */
-const IMAGE_PRESENTATION_KIND = "codex-connect-images";
-//#endregion
 //#region src/image-tool.ts
 /** Stable model-callable tool name. */
 const IMAGE_GENERATE_TOOL_NAME = "codex_connect_image_generate";
@@ -1999,29 +2552,41 @@ function extension(mediaType) {
 	return mediaType === "image/jpeg" ? "jpg" : mediaType.slice(6);
 }
 function outputContent(value) {
-	const lines = value.images.map((image, index) => `${String(index + 1)}. ${image.mediaType}, ${String(image.width)}x${String(image.height)} px, ${String(image.bytes)} bytes, attachment ${image.attachmentId}`);
+	const lines = value.images.map(({ original, preview }, index) => `${String(index + 1)}. original ${original.mediaType}, ${String(original.width)}x${String(original.height)} px, ${String(original.bytes)} bytes; preview ${String(preview.width)}x${String(preview.height)} px, attachment ${preview.attachmentId}`);
 	return [{
 		type: "text",
 		text: `Generated ${String(value.images.length)} image${value.images.length === 1 ? "" : "s"}:\n${lines.join("\n")}`
-	}, ...value.images.map((image) => ({
+	}, ...value.images.map(({ preview }) => ({
 		type: "image",
 		attachment: {
-			attachmentId: AttachmentId(image.attachmentId),
-			mediaType: image.mediaType,
-			width: image.width,
-			height: image.height,
-			bytes: image.bytes,
-			name: image.name
+			attachmentId: AttachmentId(preview.attachmentId),
+			mediaType: preview.mediaType,
+			width: preview.width,
+			height: preview.height,
+			bytes: preview.bytes,
+			name: preview.name
 		}
 	}))];
 }
-function validateRef(ref, parsed, input, name) {
-	if (typeof ref.attachmentId !== "string" || ref.attachmentId.length === 0 || ref.mediaType !== parsed.mediaType || ref.bytes !== input.data.byteLength || ref.width !== parsed.width || ref.height !== parsed.height || ref.name !== name) failure("The attachment store returned inconsistent image metadata.");
+function positiveSafeInteger$1(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+function previewValue(ref, fallbackName) {
+	if (typeof ref.attachmentId !== "string" || ref.attachmentId.length === 0 || ref.mediaType !== "image/png" && ref.mediaType !== "image/jpeg" && ref.mediaType !== "image/webp" || !positiveSafeInteger$1(ref.bytes) || !positiveSafeInteger$1(ref.width) || !positiveSafeInteger$1(ref.height)) failure("The attachment store returned invalid preview metadata.");
+	const name = typeof ref.name === "string" && /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(ref.name) ? ref.name : fallbackName;
+	return {
+		attachmentId: ref.attachmentId,
+		mediaType: ref.mediaType,
+		width: ref.width,
+		height: ref.height,
+		bytes: ref.bytes,
+		name
+	};
 }
 function executionKey(exec) {
 	return `${String(exec.agent?.id ?? "<no-agent>")}\u0000${String(exec.rootCallId)}\u0000${String(exec.callId)}`;
 }
-async function generate(ctx, transport, prompt, exec) {
+async function generate(ctx, transport, assets, prompt, exec) {
 	let response;
 	try {
 		response = await transport.generateImages({ prompt }, { signal: exec.signal });
@@ -2057,28 +2622,49 @@ async function generate(ctx, transport, prompt, exec) {
 			name
 		});
 	}
+	const sessionId = exec.agent?.id;
+	if (sessionId === void 0) failure("Image generation requires a session-owned tool call.");
+	let originals;
+	try {
+		originals = await assets.saveImages(String(sessionId), inputs.map((input, index) => {
+			const parsed = parsedImages[index];
+			if (parsed === void 0 || input.name === void 0) failure("The generated image batch is incomplete.");
+			return {
+				data: input.data,
+				mediaType: parsed.mediaType,
+				width: parsed.width,
+				height: parsed.height,
+				name: input.name
+			};
+		}));
+	} catch {
+		failure("The generated original images could not be saved.");
+	}
 	let refs;
 	try {
 		refs = await ctx.attachments.saveImages(inputs);
 	} catch {
+		await assets.removeImages(originals);
 		failure("The generated images could not be saved; no attachment references were returned.");
 	}
-	if (refs.length !== inputs.length) failure("The attachment store returned an incomplete image batch.");
-	return { images: refs.map((ref, index) => {
-		const parsed = parsedImages[index];
-		const input = inputs[index];
-		const name = input?.name;
-		if (parsed === void 0 || input === void 0 || name === void 0) failure("The attachment store returned an incomplete image batch.");
-		validateRef(ref, parsed, input, name);
-		return {
-			attachmentId: ref.attachmentId,
-			mediaType: parsed.mediaType,
-			width: parsed.width,
-			height: parsed.height,
-			bytes: input.data.byteLength,
-			name
-		};
-	}) };
+	if (refs.length !== inputs.length || originals.length !== inputs.length) {
+		await assets.removeImages(originals);
+		failure("The image stores returned an incomplete image batch.");
+	}
+	try {
+		return { images: refs.map((ref, index) => {
+			const original = originals[index];
+			const name = inputs[index]?.name;
+			if (original === void 0 || name === void 0) failure("The image stores returned an incomplete image batch.");
+			return {
+				original,
+				preview: previewValue(ref, name)
+			};
+		}) };
+	} catch (error) {
+		await assets.removeImages(originals);
+		throw error;
+	}
 }
 function appendAbortNote(result) {
 	if (!result.isError || result.error.info?.code !== TOOL_ABORTED) return void 0;
@@ -2089,11 +2675,11 @@ function appendAbortNote(result) {
 	}];
 }
 /** Build one fiber-owned image tool, including in-flight call deduplication. */
-function imageGenerateTool(ctx) {
+function imageGenerateTool(ctx, assets) {
 	const inFlight = /* @__PURE__ */ new Map();
 	return defineTool({
 		name: IMAGE_GENERATE_TOOL_NAME,
-		description: "Generate an image from a text prompt and save it as a durable DSH attachment. Supports one prompt only; output size and style are service defaults.",
+		description: "Generate an image from a text prompt, preserve the exact original, and save a DSH conversation preview. Supports one prompt only; output size and style are service defaults.",
 		parameters: { prompt: {
 			type: "string",
 			required: true,
@@ -2110,34 +2696,81 @@ function imageGenerateTool(ctx) {
 						type: "object",
 						additionalProperties: false,
 						properties: {
-							attachmentId: {
-								type: "string",
-								required: true
-							},
-							mediaType: {
-								type: "string",
+							original: {
+								type: "object",
 								required: true,
-								enum: [
-									"image/png",
-									"image/jpeg",
-									"image/webp"
-								]
-							},
-							width: {
-								type: "integer",
-								required: true
-							},
-							height: {
-								type: "integer",
-								required: true
-							},
-							bytes: {
-								type: "integer",
-								required: true
+								additionalProperties: false,
+								properties: {
+									assetId: {
+										type: "string",
+										required: true
+									},
+									mediaType: {
+										type: "string",
+										required: true,
+										enum: [
+											"image/png",
+											"image/jpeg",
+											"image/webp"
+										]
+									},
+									width: {
+										type: "integer",
+										required: true
+									},
+									height: {
+										type: "integer",
+										required: true
+									},
+									bytes: {
+										type: "integer",
+										required: true
+									},
+									name: {
+										type: "string",
+										required: true
+									},
+									sha256: {
+										type: "string",
+										required: true
+									}
+								}
 							},
-							name: {
-								type: "string",
-								required: true
+							preview: {
+								type: "object",
+								required: true,
+								additionalProperties: false,
+								properties: {
+									attachmentId: {
+										type: "string",
+										required: true
+									},
+									mediaType: {
+										type: "string",
+										required: true,
+										enum: [
+											"image/png",
+											"image/jpeg",
+											"image/webp"
+										]
+									},
+									width: {
+										type: "integer",
+										required: true
+									},
+									height: {
+										type: "integer",
+										required: true
+									},
+									bytes: {
+										type: "integer",
+										required: true
+									},
+									name: {
+										type: "string",
+										required: true
+									}
+								}
 							}
 						}
 					}
@@ -2146,6 +2779,7 @@ function imageGenerateTool(ctx) {
 			render: (_args, value) => outputContent(value),
 			presentationMeta: (args, value) => ({
 				kind: IMAGE_PRESENTATION_KIND,
+				schemaVersion: 1,
 				prompt: args.prompt.trim(),
 				images: value.images
 			})
@@ -2161,7 +2795,7 @@ function imageGenerateTool(ctx) {
 			const key = executionKey(exec);
 			const current = inFlight.get(key);
 			if (current !== void 0) return current;
-			const pending = generate(ctx, transport, prompt, exec).catch((error) => {
+			const pending = generate(ctx, transport, assets, prompt, exec).catch((error) => {
 				if (error instanceof SafeToolError) throw error;
 				failure(fixedTransportMessage(error));
 			}).finally(() => {
@@ -2692,15 +3326,23 @@ function parseSuccess(bytes) {
 /** Core-owned Cordis service for the optional image package. */
 var OpenAICodexTransport = class extends Service {
 	credentials;
+	proxyManager;
+	resolveProxyUrl;
 	apiVersion = 1;
 	models;
-	constructor(ctx, credentials) {
+	constructor(ctx, credentials, proxyManager, resolveProxyUrl = () => void 0) {
 		super(ctx, OPENAI_CODEX_TRANSPORT_SERVICE);
 		this.credentials = credentials;
+		this.proxyManager = proxyManager;
+		this.resolveProxyUrl = resolveProxyUrl;
 		this.models = createModels({ credentials });
 		this.models.setProvider(openaiCodexProvider());
 	}
 	async generateImages(input, context) {
+		const operation = () => this.generateImagesWithoutProxy(input, context);
+		return this.proxyManager?.run(this.resolveProxyUrl(), operation) ?? operation();
+	}
+	async generateImagesWithoutProxy(input, context) {
 		if (typeof input?.prompt !== "string" || input.prompt.trim().length === 0 || input.prompt.length > 32e3) throw new OpenAICodexTransportError(OPENAI_CODEX_TRANSPORT_ERROR_CODES.invalidRequest);
 		if (isAborted(context.signal)) throw new OpenAICodexTransportError(OPENAI_CODEX_TRANSPORT_ERROR_CODES.canceled);
 		if ((await this.credentials.read("openai-codex"))?.type !== "oauth") throw new OpenAICodexTransportError(OPENAI_CODEX_TRANSPORT_ERROR_CODES.signedOut);
@@ -2771,67 +3413,168 @@ var OpenAICodexTransport = class extends Service {
 	}
 };
 //#endregion
-//#region src/settings-contract.ts
-/** Node-free settings contract shared by the Host plugin and browser card. */
-/** Stable Harness settings namespace owned by this plugin. */
-const OPENAI_CODEX_SETTINGS_NAMESPACE = "llm-openai-codex";
-/** Default model used by the standalone search endpoint. */
-const DEFAULT_OPENAI_CODEX_SEARCH_MODEL = "gpt-5.6-sol";
-/** Default search mode, matching the official local Codex client. */
-const DEFAULT_OPENAI_CODEX_SEARCH_MODE = "cached";
-/** Default provider search-context size. */
-const DEFAULT_OPENAI_CODEX_SEARCH_CONTEXT_SIZE = "medium";
-/** Default output budget for the standalone search response. */
-const DEFAULT_OPENAI_CODEX_SEARCH_MAX_OUTPUT_TOKENS = 1e4;
-const DEFAULT_OPENAI_CODEX_SETTINGS = Object.freeze({
-	models: void 0,
-	enableSearch: false,
-	enableImageTool: false,
-	enableImageGeneration: false,
-	searchModel: DEFAULT_OPENAI_CODEX_SEARCH_MODEL,
-	searchMode: DEFAULT_OPENAI_CODEX_SEARCH_MODE,
-	searchContextSize: DEFAULT_OPENAI_CODEX_SEARCH_CONTEXT_SIZE,
-	searchMaxOutputTokens: DEFAULT_OPENAI_CODEX_SEARCH_MAX_OUTPUT_TOKENS
-});
-/** Fill the schema defaults even when called without Cordis validation. */
-function resolveOpenAICodexSettings(value) {
-	return {
-		...DEFAULT_OPENAI_CODEX_SETTINGS,
-		...value
+//#region src/image-assets.ts
+/** Owner-only storage for exact GPT Image output bytes. */
+/** Versioned plugin-owned root below DSH_HOME; this is not the DSH attachment store. */
+const OPENAI_CODEX_IMAGE_ASSET_DIRECTORY = "dsh-codex-connect/images/v1";
+const METADATA_VERSION = 1;
+const ORIGINAL_FILENAME = "original";
+const METADATA_FILENAME = "metadata.json";
+const SAFE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
+function digest(data) {
+	return createHash("sha256").update(data).digest("hex");
+}
+function positiveSafeInteger(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+function mediaType(value) {
+	return value === "image/png" || value === "image/jpeg" || value === "image/webp";
+}
+function validSessionId(value) {
+	return typeof value === "string" && value.length > 0 && value.length <= 512;
+}
+function parseDocument(text) {
+	let value;
+	try {
+		value = JSON.parse(text);
+	} catch {
+		return;
+	}
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const candidate = value;
+	if (candidate.version !== METADATA_VERSION || !validSessionId(candidate.sessionId)) return void 0;
+	const image = decodeOpenAICodexOriginalImageRef(candidate.image);
+	return image === void 0 ? void 0 : {
+		version: METADATA_VERSION,
+		sessionId: candidate.sessionId,
+		image
 	};
 }
-function isRecord$1(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
+async function assertOwnerFile(filename) {
+	const metadata = await lstat(filename);
+	if (!metadata.isFile()) throw new Error("original image object is not a regular file");
+	/* v8 ignore next -- native Windows does not expose POSIX permission semantics. */
+	if (process.platform !== "win32" && (metadata.mode & 63) !== 0) throw new Error("original image object is readable beyond its owner");
 }
-/** Narrow the redacted settings wire payload before it enters React state. */
-function decodeOpenAICodexSettings(value) {
-	if (!isRecord$1(value)) return void 0;
-	const models = value["models"];
-	const enableSearch = value["enableSearch"];
-	const enableImageTool = value["enableImageTool"];
-	const enableImageGeneration = value["enableImageGeneration"];
-	const searchModel = value["searchModel"];
-	const searchMode = value["searchMode"];
-	const searchContextSize = value["searchContextSize"];
-	const searchMaxOutputTokens = value["searchMaxOutputTokens"];
-	if (models !== void 0 && (!Array.isArray(models) || models.some((model) => typeof model !== "string"))) return void 0;
-	if (typeof enableSearch !== "boolean" || typeof enableImageTool !== "boolean") return void 0;
-	if (enableImageGeneration !== void 0 && typeof enableImageGeneration !== "boolean") return void 0;
-	if (typeof searchModel !== "string" || searchModel.trim().length === 0) return void 0;
-	if (searchMode !== "cached" && searchMode !== "indexed" && searchMode !== "live") return void 0;
-	if (searchContextSize !== "low" && searchContextSize !== "medium" && searchContextSize !== "high") return void 0;
-	if (typeof searchMaxOutputTokens !== "number" || !Number.isInteger(searchMaxOutputTokens) || searchMaxOutputTokens < 1) return void 0;
-	return {
-		models: models === void 0 ? void 0 : [...new Set(models)],
-		enableSearch,
-		enableImageTool,
-		enableImageGeneration: enableImageGeneration ?? false,
-		searchModel,
-		searchMode,
-		searchContextSize,
-		searchMaxOutputTokens
-	};
+async function writeBinaryFile(filename, data) {
+	await mkdir(dirname(filename), {
+		recursive: true,
+		mode: 448
+	});
+	const handle = await open(filename, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 384);
+	try {
+		await handle.writeFile(data);
+		await handle.sync();
+	} finally {
+		await handle.close();
+	}
 }
+/** Exact-byte image store kept separate from DSH's deliberately normalized attachments. */
+var OpenAICodexImageAssetStore = class {
+	root;
+	constructor(dshHome) {
+		this.root = resolve(join(resolveDshHome(dshHome), OPENAI_CODEX_IMAGE_ASSET_DIRECTORY));
+	}
+	directory(assetId) {
+		if (!OPENAI_CODEX_IMAGE_ASSET_ID_PATTERN.test(assetId)) throw new TypeError("invalid original image asset id");
+		return join(this.root, assetId.slice(4, 6), assetId);
+	}
+	async saveOne(sessionId, input) {
+		if (!validSessionId(sessionId)) throw new TypeError("invalid original image session id");
+		if (!(input.data instanceof Uint8Array) || input.data.byteLength < 1 || input.data.byteLength > 50331648 || !mediaType(input.mediaType) || !positiveSafeInteger(input.width) || !positiveSafeInteger(input.height) || !SAFE_NAME_PATTERN.test(input.name)) throw new TypeError("invalid original image input");
+		const detected = detectEncodedImage(input.data);
+		if (detected === void 0 || detected.mediaType !== input.mediaType || detected.width !== input.width || detected.height !== input.height) throw new TypeError("original image bytes do not match their declared metadata");
+		const assetId = `img_${randomUUID().replaceAll("-", "")}`;
+		const directory = this.directory(assetId);
+		const ref = {
+			assetId,
+			mediaType: input.mediaType,
+			width: input.width,
+			height: input.height,
+			bytes: input.data.byteLength,
+			name: input.name,
+			sha256: digest(input.data)
+		};
+		try {
+			await mkdir(dirname(directory), {
+				recursive: true,
+				mode: 448
+			});
+			await mkdir(directory, {
+				recursive: false,
+				mode: 448
+			});
+			await writeBinaryFile(join(directory, ORIGINAL_FILENAME), input.data);
+			const document = {
+				version: METADATA_VERSION,
+				sessionId,
+				image: ref
+			};
+			await writeFileAtomic(join(directory, METADATA_FILENAME), `${JSON.stringify(document, null, 2)}\n`, {
+				mode: 384,
+				dirMode: 448
+			});
+			return ref;
+		} catch (error) {
+			await rm(directory, {
+				recursive: true,
+				force: true
+			}).catch(() => void 0);
+			throw error;
+		}
+	}
+	/** Save one complete response batch and remove already-written members if a later write fails. */
+	async saveImages(sessionId, inputs) {
+		if (inputs.length < 1 || inputs.length > 4) throw new TypeError("original image batch must contain 1 to 4 images");
+		const refs = [];
+		try {
+			for (const input of inputs) refs.push(await this.saveOne(sessionId, input));
+			return refs;
+		} catch (error) {
+			await this.removeImages(refs);
+			throw error;
+		}
+	}
+	/** Remove exact assets created by a failed cross-store operation. */
+	async removeImages(refs) {
+		await Promise.all(refs.map(async (ref) => {
+			try {
+				await rm(this.directory(ref.assetId), {
+					recursive: true,
+					force: true
+				});
+			} catch {}
+		}));
+	}
+	/**
+	* Read verified bytes for the owner or a server-authorized inherited reference.
+	* @param sessionId - requesting session.
+	* @param assetId - opaque original identifier.
+	* @param inherited - reference resolved from the session's immutable fork prefix, never request data.
+	* @returns the exact original, or undefined for denied access or invalid files.
+	*/
+	async read(sessionId, assetId, inherited) {
+		if (!validSessionId(sessionId) || !OPENAI_CODEX_IMAGE_ASSET_ID_PATTERN.test(assetId)) return void 0;
+		const directory = this.directory(assetId);
+		const metadataPath = join(directory, METADATA_FILENAME);
+		const originalPath = join(directory, ORIGINAL_FILENAME);
+		try {
+			await Promise.all([assertOwnerFile(metadataPath), assertOwnerFile(originalPath)]);
+			const document = parseDocument(await readFile(metadataPath, "utf8"));
+			if (document === void 0 || document.image.assetId !== assetId) return void 0;
+			if (document.sessionId !== sessionId && (inherited === void 0 || inherited.assetId !== document.image.assetId || inherited.sha256 !== document.image.sha256 || inherited.mediaType !== document.image.mediaType || inherited.width !== document.image.width || inherited.height !== document.image.height || inherited.bytes !== document.image.bytes || inherited.name !== document.image.name)) return void 0;
+			const data = new Uint8Array(await readFile(originalPath));
+			const detected = detectEncodedImage(data);
+			if (data.byteLength !== document.image.bytes || digest(data) !== document.image.sha256 || detected === void 0 || detected.mediaType !== document.image.mediaType || detected.width !== document.image.width || detected.height !== document.image.height) return void 0;
+			return {
+				ref: document.image,
+				data
+			};
+		} catch {
+			return;
+		}
+	}
+};
 //#endregion
 //#region src/search.ts
 /**
@@ -2974,6 +3717,10 @@ var OpenAICodexSearchProvider = class {
 	}
 	/** @inheritdoc */
 	async search(request, signal) {
+		const operation = () => this.searchWithoutProxy(request, signal);
+		return this.options.proxyManager?.run(this.options.resolveProxyUrl?.(), operation) ?? operation();
+	}
+	async searchWithoutProxy(request, signal) {
 		throwIfSearchAborted(signal);
 		let auth;
 		try {
@@ -3319,6 +4066,8 @@ const inject = ["llm"];
 const OPENAI_CODEX_SETTINGS_NS = settingsNamespace(OPENAI_CODEX_SETTINGS_NAMESPACE);
 const Config = z.object({
 	models: z.union([z.const(void 0), z.array(z.string())]),
+	enableProxy: z.boolean().default(false),
+	proxyUrl: z.string().default(DEFAULT_OPENAI_CODEX_PROXY_URL),
 	enableSearch: z.boolean().default(false),
 	enableImageTool: z.boolean().default(false),
 	enableImageGeneration: z.boolean().default(false),
@@ -3344,16 +4093,22 @@ const Config = z.object({
 */
 function apply(ctx, config) {
 	let current = () => config;
+	const proxyManager = new OpenAICodexProxyManager();
+	const resolveProviderProxyUrl = () => resolveOpenAICodexProxyUrl(resolveOpenAICodexSettings(current()));
+	let proxyWasActive = resolveProviderProxyUrl() !== void 0;
 	const credentials = new OpenAICodexCredentialStore();
+	const imageAssets = new OpenAICodexImageAssetStore();
 	const trustedOrigins = new OpenAICodexTrustedOriginsStore(join(dirname(credentials.filename), OPENAI_CODEX_TRUSTED_ORIGINS_FILENAME));
 	const fastMode = new FastModeRegistry();
 	assertNoOpenAICodexProviderConflict(ctx.llm.listProviders().map((provider) => provider.id));
-	new OpenAICodexTransport(ctx, credentials);
-	ctx.llm.registerAdapter([OPENAI_CODEX_PROVIDER], createOpenAICodexAdapter(credentials, () => ctx.get("attachments"), fastMode, () => resolveOpenAICodexSettings(current()).models));
+	new OpenAICodexTransport(ctx, credentials, proxyManager, resolveProviderProxyUrl);
+	ctx.llm.registerAdapter([OPENAI_CODEX_PROVIDER], createOpenAICodexAdapter(credentials, () => ctx.get("attachments"), fastMode, () => resolveOpenAICodexSettings(current()).models, proxyManager, resolveProviderProxyUrl));
 	ctx.inject(["webServer"], (webCtx) => {
-		registerOpenAICodexAuthRoutes(webCtx, credentials, trustedOrigins, fastMode);
+		registerOpenAICodexAuthRoutes(webCtx, credentials, trustedOrigins, fastMode, proxyManager, resolveProviderProxyUrl);
+		registerOpenAICodexProxyRoutes(webCtx, trustedOrigins, proxyManager);
 		registerOpenAICodexUpdateRoutes(webCtx, { currentVersion: CODEX_CONNECT_VERSION }, trustedOrigins);
 		registerOpenAICodexModelCatalogRoute(webCtx, openAICodexModelCatalog, trustedOrigins);
+		registerOpenAICodexOriginalImageRoute(webCtx, trustedOrigins, imageAssets);
 	});
 	let stopped = false;
 	let searchFiber;
@@ -3384,7 +4139,9 @@ function apply(ctx, config) {
 			mode: nextRegistration.mode,
 			contextSize: nextRegistration.contextSize,
 			maxOutputTokens: nextRegistration.maxOutputTokens,
-			resolveRequestId: () => String(webCtx.get("agents")?.currentInitiator()?.session.id ?? randomUUID())
+			resolveRequestId: () => String(webCtx.get("agents")?.currentInitiator()?.session.id ?? randomUUID()),
+			proxyManager,
+			resolveProxyUrl: resolveProviderProxyUrl
 		})));
 		searchFiber = fiber;
 		searchRegistration = nextRegistration;
@@ -3425,7 +4182,7 @@ function apply(ctx, config) {
 		imageGenerationFiber = void 0;
 		if (previous !== void 0) await previous.dispose();
 		if (stopped || !enabled) return;
-		const fiber = ctx.inject(["tools", "attachments"], (toolCtx) => toolCtx.tools.register(imageGenerateTool(toolCtx)));
+		const fiber = ctx.inject(["tools", "attachments"], (toolCtx) => toolCtx.tools.register(imageGenerateTool(toolCtx, imageAssets)));
 		imageGenerationFiber = fiber;
 		Promise.resolve(fiber).catch((error) => {
 			if (imageGenerationFiber === fiber) imageGenerationFiber = void 0;
@@ -3465,14 +4222,27 @@ function apply(ctx, config) {
 			image?.dispose() ?? Promise.resolve(),
 			imageGeneration?.dispose() ?? Promise.resolve()
 		]);
+		await proxyManager.dispose();
 	}, "dsh-codex-connect: optional capability lifecycle");
 	installSettingsSection(ctx, OPENAI_CODEX_SETTINGS_NS, Config, config, {
+		validate(value) {
+			resolveOpenAICodexSettings(value);
+			if (value.enableProxy === true && !isValidOpenAICodexProxyUrl(value.proxyUrl)) throw new TypeError("OpenAI Codex proxyUrl must be an HTTP(S) origin without credentials or a path");
+		},
 		setSource(source) {
 			current = source;
 		},
-		onChange: scheduleCapabilities
+		onChange() {
+			const proxyIsActive = resolveProviderProxyUrl() !== void 0;
+			if (proxyWasActive && !proxyIsActive) proxyManager.deactivate().catch((error) => {
+				ctx.logger.error("dsh-codex-connect: could not deactivate the provider proxy");
+				ctx.logger.error(error);
+			});
+			proxyWasActive = proxyIsActive;
+			scheduleCapabilities();
+		}
 	});
 	scheduleCapabilities();
 }
 //#endregion
-export { assessCompatibility as $, OPENAI_CODEX_TRANSPORT_SERVICE as A, OPENAI_CODEX_UPDATE_PATH as B, OPENAI_CODEX_IMAGE_MAX_COUNT as C, OPENAI_CODEX_IMAGE_REQUEST_TIMEOUT_MS as D, OPENAI_CODEX_IMAGE_PROMPT_MAX_LENGTH as E, IMAGE_GENERATE_TOOL_NAME as F, COMPATIBILITY_CONTRACT as G, compareOpenAICodexVersions as H, assertNoOpenAICodexProviderConflict as I, DSH_PLUGIN_API_PACKAGES as J, COMPATIBILITY_PACKAGES as K, diagnoseOpenAICodex as L, OpenAICodexTransportError as M, isOpenAICodexTransportError as N, OPENAI_CODEX_TRANSPORT_API_VERSION as O, VIEW_IMAGE_TOOL_NAME as P, SUPPORTED_PI_AI_VERSION as Q, openAICodexConflictMessage as R, OPENAI_CODEX_IMAGE_GENERATION_URL as S, OPENAI_CODEX_IMAGE_MAX_RESPONSE_BYTES as T, parseOpenAICodexUpdateResult as U, checkForOpenAICodexUpdate as V, parseOpenAICodexVersion as W, SUPPORTED_DSH_PLUGIN_API_VERSION as X, PI_AI_PACKAGE as Y, SUPPORTED_NODE_RANGE as Z, DEFAULT_OPENAI_CODEX_SEARCH_MODEL as _, OpenAICodexCredentialStore as _t, name as a, OPENAI_CODEX_FAST_MODE_MAX_SESSION_ID_LENGTH as at, decodeOpenAICodexSettings as b, migrateOpenAICodexSearchHistory as c, normalizeTrustedOrigin as ct, OPENAI_CODEX_SEARCH_URL as d, readOpenAICodexRateLimits as dt, detectCompatibility as et, OpenAICodexSearchProvider as f, loginOpenAICodex as ft, DEFAULT_OPENAI_CODEX_SEARCH_MODE as g, OPENAI_CODEX_PROVIDER as gt, DEFAULT_OPENAI_CODEX_SEARCH_MAX_OUTPUT_TOKENS as h, OPENAI_CODEX_AUTH_FILENAME as ht, inject as i, OPENAI_CODEX_FAST_MODE_MAX_SESSIONS as it, OpenAICodexTransport as j, OPENAI_CODEX_TRANSPORT_ERROR_CODES as k, OPENAI_CODEX_BASE_URL as l, OPENAI_CODEX_USAGE_URL as lt, DEFAULT_OPENAI_CODEX_SEARCH_CONTEXT_SIZE as m, openAICodexAuthStatus as mt, OPENAI_CODEX_SETTINGS_NS as n, OPENAI_CODEX_FAST_MODE_PATH as nt, OPENAI_CODEX_HISTORY_BACKUP_SUFFIX as o, isFastModeSessionId as ot, mapOpenAICodexSearchResponse as p, logoutOpenAICodex as pt, COMPATIBILITY_SCHEMA_VERSION as q, apply as r, FastModeRegistry as rt, OPENAI_CODEX_SEARCH_MODEL_REQUEST_EVENT as s, OpenAICodexTrustedOriginsStore as st, Config as t, evaluateCompatibility as tt, OPENAI_CODEX_SEARCH_PROVIDER as u, parseOpenAICodexUsage as ut, DEFAULT_OPENAI_CODEX_SETTINGS as v, openAICodexAuthPath as vt, OPENAI_CODEX_IMAGE_MAX_ERROR_BYTES as w, resolveOpenAICodexSettings as x, OPENAI_CODEX_SETTINGS_NAMESPACE as y, CODEX_CONNECT_VERSION as z };
+export { OPENAI_CODEX_PROXY_PROBE_TIMEOUT_MS as $, openAICodexConflictMessage as A, OPENAI_CODEX_AUTH_FILENAME as At, DSH_PLUGIN_API_PACKAGES as B, OpenAICodexTransport as C, OPENAI_CODEX_USAGE_URL as Ct, IMAGE_GENERATE_TOOL_NAME as D, logoutOpenAICodex as Dt, VIEW_IMAGE_TOOL_NAME as E, loginOpenAICodex as Et, parseOpenAICodexUpdateResult as F, assessCompatibility as G, SUPPORTED_DSH_PLUGIN_API_VERSION as H, parseOpenAICodexVersion as I, readInstalledPackageVersion as J, detectCompatibility as K, COMPATIBILITY_CONTRACT as L, OPENAI_CODEX_UPDATE_PATH as M, OpenAICodexCredentialStore as Mt, checkForOpenAICodexUpdate as N, openAICodexAuthPath as Nt, assertNoOpenAICodexProviderConflict as O, openAICodexAuthStatus as Ot, compareOpenAICodexVersions as P, OPENAI_CODEX_PROXY_CANDIDATE_LIMIT as Q, COMPATIBILITY_PACKAGES as R, OPENAI_CODEX_TRANSPORT_SERVICE as S, normalizeTrustedOrigin as St, isOpenAICodexTransportError as T, readOpenAICodexRateLimits as Tt, SUPPORTED_NODE_RANGE as U, PI_AI_PACKAGE as V, SUPPORTED_PI_AI_VERSION as W, OPENAI_CODEX_PROXY_TEST_PATH as X, OPENAI_CODEX_PROXY_DETECT_PATH as Y, OPENAI_CODEX_LOCAL_PROXY_CANDIDATES as Z, OPENAI_CODEX_IMAGE_MAX_RESPONSE_BYTES as _, FastModeRegistry as _t, name as a, DEFAULT_OPENAI_CODEX_SEARCH_CONTEXT_SIZE as at, OPENAI_CODEX_TRANSPORT_API_VERSION as b, isFastModeSessionId as bt, migrateOpenAICodexSearchHistory as c, DEFAULT_OPENAI_CODEX_SEARCH_MODEL as ct, OPENAI_CODEX_SEARCH_URL as d, decodeOpenAICodexSettings as dt, OPENAI_CODEX_PROXY_PROBE_URL as et, OpenAICodexSearchProvider as f, isValidOpenAICodexProxyUrl as ft, OPENAI_CODEX_IMAGE_MAX_ERROR_BYTES as g, OPENAI_CODEX_FAST_MODE_PATH as gt, OPENAI_CODEX_IMAGE_MAX_COUNT as h, resolveOpenAICodexSettings as ht, inject as i, DEFAULT_OPENAI_CODEX_PROXY_URL as it, CODEX_CONNECT_VERSION as j, OPENAI_CODEX_PROVIDER as jt, diagnoseOpenAICodex as k, openAICodexModelCatalog as kt, OPENAI_CODEX_BASE_URL as l, DEFAULT_OPENAI_CODEX_SETTINGS as lt, OPENAI_CODEX_IMAGE_GENERATION_URL as m, resolveOpenAICodexProxyUrl as mt, OPENAI_CODEX_SETTINGS_NS as n, detectOpenAICodexProxies as nt, OPENAI_CODEX_HISTORY_BACKUP_SUFFIX as o, DEFAULT_OPENAI_CODEX_SEARCH_MAX_OUTPUT_TOKENS as ot, mapOpenAICodexSearchResponse as p, normalizeOpenAICodexProxyUrl as pt, evaluateCompatibility as q, apply as r, listOpenAICodexProxyCandidates as rt, OPENAI_CODEX_SEARCH_MODEL_REQUEST_EVENT as s, DEFAULT_OPENAI_CODEX_SEARCH_MODE as st, Config as t, OpenAICodexProxyManager as tt, OPENAI_CODEX_SEARCH_PROVIDER as u, OPENAI_CODEX_SETTINGS_NAMESPACE as ut, OPENAI_CODEX_IMAGE_PROMPT_MAX_LENGTH as v, OPENAI_CODEX_FAST_MODE_MAX_SESSIONS as vt, OpenAICodexTransportError as w, parseOpenAICodexUsage as wt, OPENAI_CODEX_TRANSPORT_ERROR_CODES as x, OpenAICodexTrustedOriginsStore as xt, OPENAI_CODEX_IMAGE_REQUEST_TIMEOUT_MS as y, OPENAI_CODEX_FAST_MODE_MAX_SESSION_ID_LENGTH as yt, COMPATIBILITY_SCHEMA_VERSION as z };