dsh-codex-connect 0.1.0-alpha.4.20 → 0.1.0-alpha.4.21

package/lib/{src-B2d5HLN5.js → src-Cxq99TvF.js}

@@ -1,4 +1,4 @@
-import { randomBytes, randomUUID } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { basename, dirname, join, parse, resolve } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import { deepEqualJson, installSettingsSection, settingsNamespace } from "@deepseek-ai/dsh-settings";
@@ -12,6 +12,7 @@ import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { Dispatcher, ProxyAgent, getGlobalDispatcher, setGlobalDispatcher } from "undici";
 import { fileURLToPath } from "node:url";
+import { SessionId } from "@deepseek-ai/dsh-session";
 import { AttachmentId } from "@deepseek-ai/dsh-attachment";
 import { TOOL_ABORTED, defineTool } from "@deepseek-ai/dsh-tools";
 import { lookup } from "node:dns/promises";
@@ -19,8 +20,8 @@ import { request } from "node:http";
 import { request as request$1 } from "node:https";
 import { BlockList, isIP } from "node:net";
 import { Service } from "@deepseek-ai/cordis";
-import { WebError } from "@deepseek-ai/dsh-web";
 import { constants } from "node:fs";
+import { WebError } from "@deepseek-ai/dsh-web";
 import { constants as constants$1, zstdCompressSync, zstdDecompressSync } from "node:zlib";
 //#region src/store.ts
 /**
@@ -53,7 +54,7 @@ async function assertOwnerOnly$1(filename) {
 	/* v8 ignore stop */
 }
 /** Validate the strict JSON document without quoting token-bearing input. */
-function parseDocument$1(text, filename) {
+function parseDocument$2(text, filename) {
 	let value;
 	try {
 		value = JSON.parse(text);
@@ -118,7 +119,7 @@ var OpenAICodexCredentialStore = class {
 			if (isENOENT$1(error)) return void 0;
 			throw error;
 		}
-		return cloneCredential(parseDocument$1(text, this.filename).credential);
+		return cloneCredential(parseDocument$2(text, this.filename).credential);
 	}
 	/** @inheritdoc */
 	async read(providerId) {
@@ -142,7 +143,7 @@ var OpenAICodexCredentialStore = class {
 			const current = await this.readCurrent();
 			const candidate = await fn(current);
 			if (candidate === void 0) return current;
-			const document = parseDocument$1(JSON.stringify({
+			const document = parseDocument$2(JSON.stringify({
 				version: AUTH_FORMAT_VERSION,
 				credential: candidate
 			}), this.filename);
@@ -521,7 +522,7 @@ async function assertOwnerOnly(filename) {
 	/* v8 ignore stop */
 }
 /** Reject malformed input without echoing its contents into an error. */
-function parseDocument(text, filename) {
+function parseDocument$1(text, filename) {
 	let value;
 	try {
 		value = JSON.parse(text);
@@ -601,7 +602,7 @@ var OpenAICodexTrustedOriginsStore = class {
 			};
 			throw error;
 		}
-		return parseDocument(text, this.filename);
+		return parseDocument$1(text, this.filename);
 	}
 	/** Read the current canonical list without acquiring the writer lock. */
 	async list() {
@@ -963,7 +964,7 @@ async function trustedRequestDecision(req, trustedOrigins = new OpenAICodexTrust
 		error: REMOTE_WEB_ORIGIN_NOT_TRUSTED
 	};
 }
-function json$3(res, status, value) {
+function json$4(res, status, value) {
 	res.writeHead(status, {
 		"content-type": "application/json; charset=utf-8",
 		"cache-control": "no-store",
@@ -1056,7 +1057,7 @@ function registerOpenAICodexAuthRoutes(ctx, store, trustedOriginsOverride, fastM
 		const authorize = async (req, res) => {
 			const decision = await trustedRequestDecision(req, trustedOrigins);
 			if (decision.trusted) return true;
-			json$3(res, 403, { error: decision.error });
+			json$4(res, 403, { error: decision.error });
 			return false;
 		};
 		const routes = [
@@ -1064,21 +1065,21 @@ function registerOpenAICodexAuthRoutes(ctx, store, trustedOriginsOverride, fastM
 				kind: "exact",
 				path: OPENAI_CODEX_AUTH_STATUS_PATH,
 				handler: async (req, res) => {
-					if (req.method !== "GET") return json$3(res, 405, { error: "method not allowed" });
+					if (req.method !== "GET") return json$4(res, 405, { error: "method not allowed" });
 					if (!await authorize(req, res)) return;
-					json$3(res, 200, await auth.status());
+					json$4(res, 200, await auth.status());
 				}
 			}),
 			ctx.webServer.register({
 				kind: "exact",
 				path: OPENAI_CODEX_AUTH_LOGIN_PATH,
 				handler: async (req, res) => {
-					if (req.method !== "POST") return json$3(res, 405, { error: "method not allowed" });
+					if (req.method !== "POST") return json$4(res, 405, { error: "method not allowed" });
 					if (!await authorize(req, res)) return;
 					try {
-						json$3(res, 200, await auth.signIn());
+						json$4(res, 200, await auth.signIn());
 					} catch (error) {
-						json$3(res, 500, { error: safeMessage(error) });
+						json$4(res, 500, { error: safeMessage(error) });
 					}
 				}
 			}),
@@ -1086,13 +1087,13 @@ function registerOpenAICodexAuthRoutes(ctx, store, trustedOriginsOverride, fastM
 				kind: "exact",
 				path: OPENAI_CODEX_AUTH_LOGOUT_PATH,
 				handler: async (req, res) => {
-					if (req.method !== "POST") return json$3(res, 405, { error: "method not allowed" });
+					if (req.method !== "POST") return json$4(res, 405, { error: "method not allowed" });
 					if (!await authorize(req, res)) return;
 					try {
 						await auth.signOut();
-						json$3(res, 200, { ok: true });
+						json$4(res, 200, { ok: true });
 					} catch (error) {
-						json$3(res, 500, { error: safeMessage(error) });
+						json$4(res, 500, { error: safeMessage(error) });
 					}
 				}
 			}),
@@ -1100,22 +1101,22 @@ function registerOpenAICodexAuthRoutes(ctx, store, trustedOriginsOverride, fastM
 				kind: "exact",
 				path: OPENAI_CODEX_FAST_MODE_PATH,
 				handler: async (req, res) => {
-					if (req.method !== "GET" && req.method !== "POST") return json$3(res, 405, { error: "method not allowed" });
+					if (req.method !== "GET" && req.method !== "POST") return json$4(res, 405, { error: "method not allowed" });
 					if (!await authorize(req, res)) return;
 					if (req.method === "GET") {
 						const sessionId = fastModeSessionIdFromQuery(req);
-						if (sessionId === void 0) return json$3(res, 400, { error: "invalid input" });
-						return json$3(res, 200, { enabled: fastMode.isEnabled(sessionId) });
+						if (sessionId === void 0) return json$4(res, 400, { error: "invalid input" });
+						return json$4(res, 200, { enabled: fastMode.isEnabled(sessionId) });
 					}
 					const type = header(req, "content-type");
-					if (type === void 0 || !/^application\/json(?:\s*;|$)/iu.test(type.trim())) return json$3(res, 415, { error: "unsupported content type" });
+					if (type === void 0 || !/^application\/json(?:\s*;|$)/iu.test(type.trim())) return json$4(res, 415, { error: "unsupported content type" });
 					try {
 						const body = fastModeBody(await readFastModeBody(req));
-						if (body === void 0) return json$3(res, 400, { error: "invalid input" });
+						if (body === void 0) return json$4(res, 400, { error: "invalid input" });
 						fastMode.set(body.sessionId, body.enabled);
-						return json$3(res, 200, { enabled: fastMode.isEnabled(body.sessionId) });
+						return json$4(res, 200, { enabled: fastMode.isEnabled(body.sessionId) });
 					} catch (error) {
-						return json$3(res, error instanceof RangeError ? 413 : 400, { error: error instanceof RangeError ? "request body too large" : "invalid input" });
+						return json$4(res, error instanceof RangeError ? 413 : 400, { error: error instanceof RangeError ? "request body too large" : "invalid input" });
 					}
 				}
 			})
@@ -1455,7 +1456,7 @@ const OPENAI_CODEX_PROXY_DETECT_PATH = "/plugins/dsh-openai-codex/proxy/detect";
 const OPENAI_CODEX_PROXY_TEST_PATH = "/plugins/dsh-openai-codex/proxy/test";
 //#endregion
 //#region src/proxy-routes.ts
-function json$2(res, status, value) {
+function json$3(res, status, value) {
 	res.writeHead(status, {
 		"content-type": "application/json; charset=utf-8",
 		"cache-control": "no-store",
@@ -1478,17 +1479,17 @@ function registerOpenAICodexProxyRoutes(ctx, trustedOrigins, manager) {
 		const authorize = async (req, res) => {
 			const decision = await trustedRequestDecision(req, trustedOrigins);
 			if (decision.trusted) return true;
-			json$2(res, 403, { error: decision.error });
+			json$3(res, 403, { error: decision.error });
 			return false;
 		};
 		const routes = [ctx.webServer.register({
 			kind: "exact",
 			path: OPENAI_CODEX_PROXY_DETECT_PATH,
 			handler: async (req, res) => {
-				if (req.method !== "POST") return json$2(res, 405, { error: "method not allowed" });
+				if (req.method !== "POST") return json$3(res, 405, { error: "method not allowed" });
 				if (!await authorize(req, res)) return;
 				const results = await detectOpenAICodexProxies(manager);
-				return json$2(res, 200, {
+				return json$3(res, 200, {
 					candidates: results.filter((result) => result.reachable),
 					results
 				});
@@ -1497,11 +1498,11 @@ function registerOpenAICodexProxyRoutes(ctx, trustedOrigins, manager) {
 			kind: "exact",
 			path: OPENAI_CODEX_PROXY_TEST_PATH,
 			handler: async (req, res) => {
-				if (req.method !== "POST") return json$2(res, 405, { error: "method not allowed" });
+				if (req.method !== "POST") return json$3(res, 405, { error: "method not allowed" });
 				if (!await authorize(req, res)) return;
 				const proxyUrl = proxyUrlFromQuery(req);
-				if (proxyUrl === void 0) return json$2(res, 400, { error: "invalid proxy URL" });
-				return json$2(res, 200, await manager.probe(proxyUrl));
+				if (proxyUrl === void 0) return json$3(res, 400, { error: "invalid proxy URL" });
+				return json$3(res, 200, await manager.probe(proxyUrl));
 			}
 		})];
 		return () => {
@@ -1616,7 +1617,12 @@ function evaluateCompatibility(input = {}) {
 }
 /** Alias for callers that prefer assessment terminology. */
 const assessCompatibility = evaluateCompatibility;
-async function readPackageVersionFromEntry(name) {
+/**
+* Resolve installed package metadata without returning a filesystem path.
+* @param name - package to resolve from this plugin installation.
+* @returns its version, or undefined when metadata cannot be read.
+*/
+async function readInstalledPackageVersion(name) {
 	let entry;
 	try {
 		const resolved = import.meta.resolve(name);
@@ -1639,7 +1645,7 @@ async function readPackageVersionFromEntry(name) {
 }
 /** Read installed package metadata and return only versions and statuses. */
 async function detectCompatibility(options = {}) {
-	const readVersion = options.readPackageVersion ?? readPackageVersionFromEntry;
+	const readVersion = options.readPackageVersion ?? readInstalledPackageVersion;
 	const packageVersions = options.packageVersions ?? options.packages ?? options.installed?.packages;
 	const resolvedPackages = packageVersions === void 0 ? Object.fromEntries(await Promise.all(COMPATIBILITY_PACKAGES.map(async (name) => [name, await readVersion(name)]))) : packageVersions;
 	return evaluateCompatibility({
@@ -2094,7 +2100,7 @@ async function detectCurrentDshVersion() {
 	const adapter = report.packages["@deepseek-ai/dsh-llm-pi-ai"].installed;
 	return llm !== null && llm === adapter ? llm : void 0;
 }
-function json$1(res, status, value) {
+function json$2(res, status, value) {
 	res.writeHead(status, {
 		"content-type": "application/json; charset=utf-8",
 		"cache-control": "no-store",
@@ -2109,14 +2115,14 @@ function registerOpenAICodexUpdateRoutes(ctx, options, trustedOrigins) {
 			kind: "exact",
 			path: OPENAI_CODEX_RUNTIME_PATH,
 			handler: async (req, res) => {
-				if (req.method !== "GET") return json$1(res, 405, { error: "method not allowed" });
+				if (req.method !== "GET") return json$2(res, 405, { error: "method not allowed" });
 				const decision = await trustedRequestDecision(req, trustedOrigins);
-				if (!decision.trusted) return json$1(res, 403, { error: decision.error });
+				if (!decision.trusted) return json$2(res, 403, { error: decision.error });
 				try {
 					const currentDshVersion = await (options.resolveCurrentDshVersion ?? detectCurrentDshVersion)();
-					return json$1(res, 200, currentDshVersion === void 0 ? {} : { currentDshVersion });
+					return json$2(res, 200, currentDshVersion === void 0 ? {} : { currentDshVersion });
 				} catch {
-					return json$1(res, 200, {});
+					return json$2(res, 200, {});
 				}
 			}
 		});
@@ -2124,9 +2130,9 @@ function registerOpenAICodexUpdateRoutes(ctx, options, trustedOrigins) {
 			kind: "exact",
 			path: OPENAI_CODEX_UPDATE_PATH,
 			handler: async (req, res) => {
-				if (req.method !== "GET") return json$1(res, 405, { error: "method not allowed" });
+				if (req.method !== "GET") return json$2(res, 405, { error: "method not allowed" });
 				const decision = await trustedRequestDecision(req, trustedOrigins);
-				if (!decision.trusted) return json$1(res, 403, { error: decision.error });
+				if (!decision.trusted) return json$2(res, 403, { error: decision.error });
 				let result;
 				let currentDshVersion;
 				try {
@@ -2149,7 +2155,7 @@ function registerOpenAICodexUpdateRoutes(ctx, options, trustedOrigins) {
 						reason: "registry-unavailable"
 					};
 				}
-				return json$1(res, 200, result);
+				return json$2(res, 200, result);
 			}
 		});
 		return () => {
@@ -2165,7 +2171,7 @@ function registerOpenAICodexUpdateRoutes(ctx, options, trustedOrigins) {
 const OPENAI_CODEX_MODEL_CATALOG_PATH = "/plugins/dsh-codex-connect/models";
 //#endregion
 //#region src/model-routes.ts
-function json(res, status, value) {
+function json$1(res, status, value) {
 	res.writeHead(status, {
 		"content-type": "application/json; charset=utf-8",
 		"cache-control": "no-store",
@@ -2178,17 +2184,162 @@ function registerOpenAICodexModelCatalogRoute(ctx, resolveCatalog, trustedOrigin
 	ctx.effect(() => ctx.webServer.register({
 		kind: "exact",
 		path: OPENAI_CODEX_MODEL_CATALOG_PATH,
+		handler: async (req, res) => {
+			if (req.method !== "GET") return json$1(res, 405, { error: "method not allowed" });
+			const decision = await trustedRequestDecision(req, trustedOrigins);
+			if (!decision.trusted) return json$1(res, 403, { error: decision.error });
+			return json$1(res, 200, resolveCatalog());
+		}
+	}), "dsh-codex-connect: model catalog route");
+}
+//#endregion
+//#region src/image-assets-contract.ts
+/** Same-origin endpoint serving one session-owned original generated image. */
+const OPENAI_CODEX_ORIGINAL_IMAGE_PATH = "/plugins/dsh-codex-connect/images/original";
+/** Opaque identifier format for one plugin-owned original image. */
+const OPENAI_CODEX_IMAGE_ASSET_ID_PATTERN = /^img_[0-9a-f]{32}$/u;
+function positiveSafeInteger$3(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+/** Decode session-log metadata without trusting an asset id, filename, or media type. */
+function decodeOpenAICodexOriginalImageRef(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const candidate = value;
+	if (typeof candidate.assetId !== "string" || !OPENAI_CODEX_IMAGE_ASSET_ID_PATTERN.test(candidate.assetId) || candidate.mediaType !== "image/png" && candidate.mediaType !== "image/jpeg" && candidate.mediaType !== "image/webp" || !positiveSafeInteger$3(candidate.width) || !positiveSafeInteger$3(candidate.height) || !positiveSafeInteger$3(candidate.bytes) || candidate.bytes > 50331648 || typeof candidate.name !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(candidate.name) || typeof candidate.sha256 !== "string" || !/^[0-9a-f]{64}$/u.test(candidate.sha256)) return void 0;
+	return {
+		assetId: candidate.assetId,
+		mediaType: candidate.mediaType,
+		width: candidate.width,
+		height: candidate.height,
+		bytes: candidate.bytes,
+		name: candidate.name,
+		sha256: candidate.sha256
+	};
+}
+//#endregion
+//#region src/image-presentation.ts
+/** Stable metadata marker for generated image result views. */
+const IMAGE_PRESENTATION_KIND = "codex-connect-images";
+function positiveSafeInteger$2(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+function mediaType$1(value) {
+	return value === "image/png" || value === "image/jpeg" || value === "image/webp";
+}
+function imageRef(value) {
+	if (typeof value !== "object" || value === null) return void 0;
+	const candidate = value;
+	if (typeof candidate.attachmentId !== "string" || candidate.attachmentId.length === 0 || !mediaType$1(candidate.mediaType) || !positiveSafeInteger$2(candidate.bytes) || !positiveSafeInteger$2(candidate.width) || !positiveSafeInteger$2(candidate.height) || candidate.name !== void 0 && (typeof candidate.name !== "string" || candidate.name.length === 0)) return void 0;
+	return {
+		attachmentId: candidate.attachmentId,
+		mediaType: candidate.mediaType,
+		bytes: candidate.bytes,
+		width: candidate.width,
+		height: candidate.height,
+		...candidate.name === void 0 ? {} : { name: candidate.name }
+	};
+}
+/** Decode durable tool-result metadata without trusting arbitrary session JSON. */
+function decodeImagePresentationMeta(value) {
+	if (typeof value !== "object" || value === null) return void 0;
+	const candidate = value;
+	if (candidate.kind !== "codex-connect-images" || typeof candidate.prompt !== "string" || candidate.prompt.length < 1 || candidate.prompt.length > 32e3 || !Array.isArray(candidate.images) || candidate.images.length < 1 || candidate.images.length > 4) return void 0;
+	if (candidate.schemaVersion === void 0) {
+		const previews = candidate.images.map(imageRef);
+		if (previews.some((image) => image === void 0)) return void 0;
+		return {
+			kind: IMAGE_PRESENTATION_KIND,
+			schemaVersion: 1,
+			prompt: candidate.prompt,
+			images: previews.map((preview) => ({ preview }))
+		};
+	}
+	if (candidate.schemaVersion !== 1) return void 0;
+	const images = [];
+	for (const value of candidate.images) {
+		if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+		const entry = value;
+		const preview = imageRef(entry.preview);
+		const original = decodeOpenAICodexOriginalImageRef(entry.original);
+		if (preview === void 0 || original === void 0) return void 0;
+		images.push({
+			preview,
+			original
+		});
+	}
+	return {
+		kind: IMAGE_PRESENTATION_KIND,
+		schemaVersion: 1,
+		prompt: candidate.prompt,
+		images
+	};
+}
+//#endregion
+//#region src/image-asset-routes.ts
+/** Fork access follows copied result events, not every asset owned by an ancestor. */
+function inheritedOriginal(session, assetId) {
+	if (session?.header.parentSession === void 0) return void 0;
+	const seedLength = session.header.seedLength ?? 0;
+	for (const event of session.events) {
+		if (event.seq >= seedLength) break;
+		if (event.type !== "tool/result") continue;
+		const original = decodeImagePresentationMeta(event.data.meta)?.images.find((image) => image.original?.assetId === assetId)?.original;
+		if (original !== void 0) return original;
+	}
+}
+function json(res, status, value) {
+	res.writeHead(status, {
+		"content-type": "application/json; charset=utf-8",
+		"cache-control": "no-store",
+		"x-content-type-options": "nosniff"
+	});
+	res.end(JSON.stringify(value));
+}
+function query(req) {
+	if (typeof req.url !== "string") return void 0;
+	try {
+		const parsed = new URL(req.url, "http://dsh.invalid");
+		const sessionIds = parsed.searchParams.getAll("sessionId");
+		const assetIds = parsed.searchParams.getAll("assetId");
+		const sessionId = sessionIds[0];
+		const assetId = assetIds[0];
+		if (sessionIds.length !== 1 || assetIds.length !== 1 || sessionId === void 0 || sessionId.length < 1 || sessionId.length > 512 || assetId === void 0 || !OPENAI_CODEX_IMAGE_ASSET_ID_PATTERN.test(assetId)) return void 0;
+		return {
+			sessionId,
+			assetId
+		};
+	} catch {
+		return;
+	}
+}
+/** Register a history-safe route even while new image generation is disabled. */
+function registerOpenAICodexOriginalImageRoute(ctx, trustedOrigins, assets) {
+	ctx.effect(() => ctx.webServer.register({
+		kind: "exact",
+		path: OPENAI_CODEX_ORIGINAL_IMAGE_PATH,
 		handler: async (req, res) => {
 			if (req.method !== "GET") return json(res, 405, { error: "method not allowed" });
 			const decision = await trustedRequestDecision(req, trustedOrigins);
 			if (!decision.trusted) return json(res, 403, { error: decision.error });
-			return json(res, 200, resolveCatalog());
+			const requested = query(req);
+			if (requested === void 0) return json(res, 400, { error: "invalid input" });
+			const session = ctx.get("sessions")?.get(SessionId(requested.sessionId));
+			const stored = await assets.read(requested.sessionId, requested.assetId, inheritedOriginal(session, requested.assetId));
+			if (stored === void 0) return json(res, 404, { error: "original image not found" });
+			res.writeHead(200, {
+				"content-type": stored.ref.mediaType,
+				"content-length": String(stored.ref.bytes),
+				"content-disposition": `attachment; filename="${stored.ref.name}"`,
+				"cache-control": "private, no-store",
+				"x-content-type-options": "nosniff"
+			});
+			res.end(Buffer.from(stored.data));
 		}
-	}), "dsh-codex-connect: model catalog route");
+	}), "dsh-codex-connect: original image download route");
 }
 //#endregion
 //#region src/version.ts
-const CODEX_CONNECT_VERSION = "0.1.0-alpha.4.20";
+const CODEX_CONNECT_VERSION = "0.1.0-alpha.4.21";
 //#endregion
 //#region src/doctor.ts
 /** Secret-free diagnostics and duplicate-provider guidance. */
@@ -2370,10 +2521,6 @@ function detectEncodedImage(data) {
 	}
 }
 //#endregion
-//#region src/image-presentation.ts
-/** Stable metadata marker for generated image result views. */
-const IMAGE_PRESENTATION_KIND = "codex-connect-images";
-//#endregion
 //#region src/image-tool.ts
 /** Stable model-callable tool name. */
 const IMAGE_GENERATE_TOOL_NAME = "codex_connect_image_generate";
@@ -2405,29 +2552,41 @@ function extension(mediaType) {
 	return mediaType === "image/jpeg" ? "jpg" : mediaType.slice(6);
 }
 function outputContent(value) {
-	const lines = value.images.map((image, index) => `${String(index + 1)}. ${image.mediaType}, ${String(image.width)}x${String(image.height)} px, ${String(image.bytes)} bytes, attachment ${image.attachmentId}`);
+	const lines = value.images.map(({ original, preview }, index) => `${String(index + 1)}. original ${original.mediaType}, ${String(original.width)}x${String(original.height)} px, ${String(original.bytes)} bytes; preview ${String(preview.width)}x${String(preview.height)} px, attachment ${preview.attachmentId}`);
 	return [{
 		type: "text",
 		text: `Generated ${String(value.images.length)} image${value.images.length === 1 ? "" : "s"}:\n${lines.join("\n")}`
-	}, ...value.images.map((image) => ({
+	}, ...value.images.map(({ preview }) => ({
 		type: "image",
 		attachment: {
-			attachmentId: AttachmentId(image.attachmentId),
-			mediaType: image.mediaType,
-			width: image.width,
-			height: image.height,
-			bytes: image.bytes,
-			name: image.name
+			attachmentId: AttachmentId(preview.attachmentId),
+			mediaType: preview.mediaType,
+			width: preview.width,
+			height: preview.height,
+			bytes: preview.bytes,
+			name: preview.name
 		}
 	}))];
 }
-function validateRef(ref, parsed, input, name) {
-	if (typeof ref.attachmentId !== "string" || ref.attachmentId.length === 0 || ref.mediaType !== parsed.mediaType || ref.bytes !== input.data.byteLength || ref.width !== parsed.width || ref.height !== parsed.height || ref.name !== name) failure("The attachment store returned inconsistent image metadata.");
+function positiveSafeInteger$1(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+function previewValue(ref, fallbackName) {
+	if (typeof ref.attachmentId !== "string" || ref.attachmentId.length === 0 || ref.mediaType !== "image/png" && ref.mediaType !== "image/jpeg" && ref.mediaType !== "image/webp" || !positiveSafeInteger$1(ref.bytes) || !positiveSafeInteger$1(ref.width) || !positiveSafeInteger$1(ref.height)) failure("The attachment store returned invalid preview metadata.");
+	const name = typeof ref.name === "string" && /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(ref.name) ? ref.name : fallbackName;
+	return {
+		attachmentId: ref.attachmentId,
+		mediaType: ref.mediaType,
+		width: ref.width,
+		height: ref.height,
+		bytes: ref.bytes,
+		name
+	};
 }
 function executionKey(exec) {
 	return `${String(exec.agent?.id ?? "<no-agent>")}\u0000${String(exec.rootCallId)}\u0000${String(exec.callId)}`;
 }
-async function generate(ctx, transport, prompt, exec) {
+async function generate(ctx, transport, assets, prompt, exec) {
 	let response;
 	try {
 		response = await transport.generateImages({ prompt }, { signal: exec.signal });
@@ -2463,28 +2622,49 @@ async function generate(ctx, transport, prompt, exec) {
 			name
 		});
 	}
+	const sessionId = exec.agent?.id;
+	if (sessionId === void 0) failure("Image generation requires a session-owned tool call.");
+	let originals;
+	try {
+		originals = await assets.saveImages(String(sessionId), inputs.map((input, index) => {
+			const parsed = parsedImages[index];
+			if (parsed === void 0 || input.name === void 0) failure("The generated image batch is incomplete.");
+			return {
+				data: input.data,
+				mediaType: parsed.mediaType,
+				width: parsed.width,
+				height: parsed.height,
+				name: input.name
+			};
+		}));
+	} catch {
+		failure("The generated original images could not be saved.");
+	}
 	let refs;
 	try {
 		refs = await ctx.attachments.saveImages(inputs);
 	} catch {
+		await assets.removeImages(originals);
 		failure("The generated images could not be saved; no attachment references were returned.");
 	}
-	if (refs.length !== inputs.length) failure("The attachment store returned an incomplete image batch.");
-	return { images: refs.map((ref, index) => {
-		const parsed = parsedImages[index];
-		const input = inputs[index];
-		const name = input?.name;
-		if (parsed === void 0 || input === void 0 || name === void 0) failure("The attachment store returned an incomplete image batch.");
-		validateRef(ref, parsed, input, name);
-		return {
-			attachmentId: ref.attachmentId,
-			mediaType: parsed.mediaType,
-			width: parsed.width,
-			height: parsed.height,
-			bytes: input.data.byteLength,
-			name
-		};
-	}) };
+	if (refs.length !== inputs.length || originals.length !== inputs.length) {
+		await assets.removeImages(originals);
+		failure("The image stores returned an incomplete image batch.");
+	}
+	try {
+		return { images: refs.map((ref, index) => {
+			const original = originals[index];
+			const name = inputs[index]?.name;
+			if (original === void 0 || name === void 0) failure("The image stores returned an incomplete image batch.");
+			return {
+				original,
+				preview: previewValue(ref, name)
+			};
+		}) };
+	} catch (error) {
+		await assets.removeImages(originals);
+		throw error;
+	}
 }
 function appendAbortNote(result) {
 	if (!result.isError || result.error.info?.code !== TOOL_ABORTED) return void 0;
@@ -2495,11 +2675,11 @@ function appendAbortNote(result) {
 	}];
 }
 /** Build one fiber-owned image tool, including in-flight call deduplication. */
-function imageGenerateTool(ctx) {
+function imageGenerateTool(ctx, assets) {
 	const inFlight = /* @__PURE__ */ new Map();
 	return defineTool({
 		name: IMAGE_GENERATE_TOOL_NAME,
-		description: "Generate an image from a text prompt and save it as a durable DSH attachment. Supports one prompt only; output size and style are service defaults.",
+		description: "Generate an image from a text prompt, preserve the exact original, and save a DSH conversation preview. Supports one prompt only; output size and style are service defaults.",
 		parameters: { prompt: {
 			type: "string",
 			required: true,
@@ -2516,34 +2696,81 @@ function imageGenerateTool(ctx) {
 						type: "object",
 						additionalProperties: false,
 						properties: {
-							attachmentId: {
-								type: "string",
-								required: true
-							},
-							mediaType: {
-								type: "string",
+							original: {
+								type: "object",
 								required: true,
-								enum: [
-									"image/png",
-									"image/jpeg",
-									"image/webp"
-								]
+								additionalProperties: false,
+								properties: {
+									assetId: {
+										type: "string",
+										required: true
+									},
+									mediaType: {
+										type: "string",
+										required: true,
+										enum: [
+											"image/png",
+											"image/jpeg",
+											"image/webp"
+										]
+									},
+									width: {
+										type: "integer",
+										required: true
+									},
+									height: {
+										type: "integer",
+										required: true
+									},
+									bytes: {
+										type: "integer",
+										required: true
+									},
+									name: {
+										type: "string",
+										required: true
+									},
+									sha256: {
+										type: "string",
+										required: true
+									}
+								}
 							},
-							width: {
-								type: "integer",
-								required: true
-							},
-							height: {
-								type: "integer",
-								required: true
-							},
-							bytes: {
-								type: "integer",
-								required: true
-							},
-							name: {
-								type: "string",
-								required: true
+							preview: {
+								type: "object",
+								required: true,
+								additionalProperties: false,
+								properties: {
+									attachmentId: {
+										type: "string",
+										required: true
+									},
+									mediaType: {
+										type: "string",
+										required: true,
+										enum: [
+											"image/png",
+											"image/jpeg",
+											"image/webp"
+										]
+									},
+									width: {
+										type: "integer",
+										required: true
+									},
+									height: {
+										type: "integer",
+										required: true
+									},
+									bytes: {
+										type: "integer",
+										required: true
+									},
+									name: {
+										type: "string",
+										required: true
+									}
+								}
 							}
 						}
 					}
@@ -2552,6 +2779,7 @@ function imageGenerateTool(ctx) {
 			render: (_args, value) => outputContent(value),
 			presentationMeta: (args, value) => ({
 				kind: IMAGE_PRESENTATION_KIND,
+				schemaVersion: 1,
 				prompt: args.prompt.trim(),
 				images: value.images
 			})
@@ -2567,7 +2795,7 @@ function imageGenerateTool(ctx) {
 			const key = executionKey(exec);
 			const current = inFlight.get(key);
 			if (current !== void 0) return current;
-			const pending = generate(ctx, transport, prompt, exec).catch((error) => {
+			const pending = generate(ctx, transport, assets, prompt, exec).catch((error) => {
 				if (error instanceof SafeToolError) throw error;
 				failure(fixedTransportMessage(error));
 			}).finally(() => {
@@ -3185,6 +3413,169 @@ var OpenAICodexTransport = class extends Service {
 	}
 };
 //#endregion
+//#region src/image-assets.ts
+/** Owner-only storage for exact GPT Image output bytes. */
+/** Versioned plugin-owned root below DSH_HOME; this is not the DSH attachment store. */
+const OPENAI_CODEX_IMAGE_ASSET_DIRECTORY = "dsh-codex-connect/images/v1";
+const METADATA_VERSION = 1;
+const ORIGINAL_FILENAME = "original";
+const METADATA_FILENAME = "metadata.json";
+const SAFE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
+function digest(data) {
+	return createHash("sha256").update(data).digest("hex");
+}
+function positiveSafeInteger(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+function mediaType(value) {
+	return value === "image/png" || value === "image/jpeg" || value === "image/webp";
+}
+function validSessionId(value) {
+	return typeof value === "string" && value.length > 0 && value.length <= 512;
+}
+function parseDocument(text) {
+	let value;
+	try {
+		value = JSON.parse(text);
+	} catch {
+		return;
+	}
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const candidate = value;
+	if (candidate.version !== METADATA_VERSION || !validSessionId(candidate.sessionId)) return void 0;
+	const image = decodeOpenAICodexOriginalImageRef(candidate.image);
+	return image === void 0 ? void 0 : {
+		version: METADATA_VERSION,
+		sessionId: candidate.sessionId,
+		image
+	};
+}
+async function assertOwnerFile(filename) {
+	const metadata = await lstat(filename);
+	if (!metadata.isFile()) throw new Error("original image object is not a regular file");
+	/* v8 ignore next -- native Windows does not expose POSIX permission semantics. */
+	if (process.platform !== "win32" && (metadata.mode & 63) !== 0) throw new Error("original image object is readable beyond its owner");
+}
+async function writeBinaryFile(filename, data) {
+	await mkdir(dirname(filename), {
+		recursive: true,
+		mode: 448
+	});
+	const handle = await open(filename, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 384);
+	try {
+		await handle.writeFile(data);
+		await handle.sync();
+	} finally {
+		await handle.close();
+	}
+}
+/** Exact-byte image store kept separate from DSH's deliberately normalized attachments. */
+var OpenAICodexImageAssetStore = class {
+	root;
+	constructor(dshHome) {
+		this.root = resolve(join(resolveDshHome(dshHome), OPENAI_CODEX_IMAGE_ASSET_DIRECTORY));
+	}
+	directory(assetId) {
+		if (!OPENAI_CODEX_IMAGE_ASSET_ID_PATTERN.test(assetId)) throw new TypeError("invalid original image asset id");
+		return join(this.root, assetId.slice(4, 6), assetId);
+	}
+	async saveOne(sessionId, input) {
+		if (!validSessionId(sessionId)) throw new TypeError("invalid original image session id");
+		if (!(input.data instanceof Uint8Array) || input.data.byteLength < 1 || input.data.byteLength > 50331648 || !mediaType(input.mediaType) || !positiveSafeInteger(input.width) || !positiveSafeInteger(input.height) || !SAFE_NAME_PATTERN.test(input.name)) throw new TypeError("invalid original image input");
+		const detected = detectEncodedImage(input.data);
+		if (detected === void 0 || detected.mediaType !== input.mediaType || detected.width !== input.width || detected.height !== input.height) throw new TypeError("original image bytes do not match their declared metadata");
+		const assetId = `img_${randomUUID().replaceAll("-", "")}`;
+		const directory = this.directory(assetId);
+		const ref = {
+			assetId,
+			mediaType: input.mediaType,
+			width: input.width,
+			height: input.height,
+			bytes: input.data.byteLength,
+			name: input.name,
+			sha256: digest(input.data)
+		};
+		try {
+			await mkdir(dirname(directory), {
+				recursive: true,
+				mode: 448
+			});
+			await mkdir(directory, {
+				recursive: false,
+				mode: 448
+			});
+			await writeBinaryFile(join(directory, ORIGINAL_FILENAME), input.data);
+			const document = {
+				version: METADATA_VERSION,
+				sessionId,
+				image: ref
+			};
+			await writeFileAtomic(join(directory, METADATA_FILENAME), `${JSON.stringify(document, null, 2)}\n`, {
+				mode: 384,
+				dirMode: 448
+			});
+			return ref;
+		} catch (error) {
+			await rm(directory, {
+				recursive: true,
+				force: true
+			}).catch(() => void 0);
+			throw error;
+		}
+	}
+	/** Save one complete response batch and remove already-written members if a later write fails. */
+	async saveImages(sessionId, inputs) {
+		if (inputs.length < 1 || inputs.length > 4) throw new TypeError("original image batch must contain 1 to 4 images");
+		const refs = [];
+		try {
+			for (const input of inputs) refs.push(await this.saveOne(sessionId, input));
+			return refs;
+		} catch (error) {
+			await this.removeImages(refs);
+			throw error;
+		}
+	}
+	/** Remove exact assets created by a failed cross-store operation. */
+	async removeImages(refs) {
+		await Promise.all(refs.map(async (ref) => {
+			try {
+				await rm(this.directory(ref.assetId), {
+					recursive: true,
+					force: true
+				});
+			} catch {}
+		}));
+	}
+	/**
+	* Read verified bytes for the owner or a server-authorized inherited reference.
+	* @param sessionId - requesting session.
+	* @param assetId - opaque original identifier.
+	* @param inherited - reference resolved from the session's immutable fork prefix, never request data.
+	* @returns the exact original, or undefined for denied access or invalid files.
+	*/
+	async read(sessionId, assetId, inherited) {
+		if (!validSessionId(sessionId) || !OPENAI_CODEX_IMAGE_ASSET_ID_PATTERN.test(assetId)) return void 0;
+		const directory = this.directory(assetId);
+		const metadataPath = join(directory, METADATA_FILENAME);
+		const originalPath = join(directory, ORIGINAL_FILENAME);
+		try {
+			await Promise.all([assertOwnerFile(metadataPath), assertOwnerFile(originalPath)]);
+			const document = parseDocument(await readFile(metadataPath, "utf8"));
+			if (document === void 0 || document.image.assetId !== assetId) return void 0;
+			if (document.sessionId !== sessionId && (inherited === void 0 || inherited.assetId !== document.image.assetId || inherited.sha256 !== document.image.sha256 || inherited.mediaType !== document.image.mediaType || inherited.width !== document.image.width || inherited.height !== document.image.height || inherited.bytes !== document.image.bytes || inherited.name !== document.image.name)) return void 0;
+			const data = new Uint8Array(await readFile(originalPath));
+			const detected = detectEncodedImage(data);
+			if (data.byteLength !== document.image.bytes || digest(data) !== document.image.sha256 || detected === void 0 || detected.mediaType !== document.image.mediaType || detected.width !== document.image.width || detected.height !== document.image.height) return void 0;
+			return {
+				ref: document.image,
+				data
+			};
+		} catch {
+			return;
+		}
+	}
+};
+//#endregion
 //#region src/search.ts
 /**
 * OpenAI Codex standalone web search over the dsh web provider seam.
@@ -3706,6 +4097,7 @@ function apply(ctx, config) {
 	const resolveProviderProxyUrl = () => resolveOpenAICodexProxyUrl(resolveOpenAICodexSettings(current()));
 	let proxyWasActive = resolveProviderProxyUrl() !== void 0;
 	const credentials = new OpenAICodexCredentialStore();
+	const imageAssets = new OpenAICodexImageAssetStore();
 	const trustedOrigins = new OpenAICodexTrustedOriginsStore(join(dirname(credentials.filename), OPENAI_CODEX_TRUSTED_ORIGINS_FILENAME));
 	const fastMode = new FastModeRegistry();
 	assertNoOpenAICodexProviderConflict(ctx.llm.listProviders().map((provider) => provider.id));
@@ -3716,6 +4108,7 @@ function apply(ctx, config) {
 		registerOpenAICodexProxyRoutes(webCtx, trustedOrigins, proxyManager);
 		registerOpenAICodexUpdateRoutes(webCtx, { currentVersion: CODEX_CONNECT_VERSION }, trustedOrigins);
 		registerOpenAICodexModelCatalogRoute(webCtx, openAICodexModelCatalog, trustedOrigins);
+		registerOpenAICodexOriginalImageRoute(webCtx, trustedOrigins, imageAssets);
 	});
 	let stopped = false;
 	let searchFiber;
@@ -3789,7 +4182,7 @@ function apply(ctx, config) {
 		imageGenerationFiber = void 0;
 		if (previous !== void 0) await previous.dispose();
 		if (stopped || !enabled) return;
-		const fiber = ctx.inject(["tools", "attachments"], (toolCtx) => toolCtx.tools.register(imageGenerateTool(toolCtx)));
+		const fiber = ctx.inject(["tools", "attachments"], (toolCtx) => toolCtx.tools.register(imageGenerateTool(toolCtx, imageAssets)));
 		imageGenerationFiber = fiber;
 		Promise.resolve(fiber).catch((error) => {
 			if (imageGenerationFiber === fiber) imageGenerationFiber = void 0;
@@ -3852,4 +4245,4 @@ function apply(ctx, config) {
 	scheduleCapabilities();
 }
 //#endregion
-export { OPENAI_CODEX_PROXY_PROBE_URL as $, openAICodexConflictMessage as A, openAICodexAuthPath as At, DSH_PLUGIN_API_PACKAGES as B, OpenAICodexTransport as C, readOpenAICodexRateLimits as Ct, IMAGE_GENERATE_TOOL_NAME as D, OPENAI_CODEX_AUTH_FILENAME as Dt, VIEW_IMAGE_TOOL_NAME as E, openAICodexAuthStatus as Et, parseOpenAICodexUpdateResult as F, assessCompatibility as G, SUPPORTED_DSH_PLUGIN_API_VERSION as H, parseOpenAICodexVersion as I, OPENAI_CODEX_PROXY_DETECT_PATH as J, detectCompatibility as K, COMPATIBILITY_CONTRACT as L, OPENAI_CODEX_UPDATE_PATH as M, checkForOpenAICodexUpdate as N, assertNoOpenAICodexProviderConflict as O, OPENAI_CODEX_PROVIDER as Ot, compareOpenAICodexVersions as P, OPENAI_CODEX_PROXY_PROBE_TIMEOUT_MS as Q, COMPATIBILITY_PACKAGES as R, OPENAI_CODEX_TRANSPORT_SERVICE as S, parseOpenAICodexUsage as St, isOpenAICodexTransportError as T, logoutOpenAICodex as Tt, SUPPORTED_NODE_RANGE as U, PI_AI_PACKAGE as V, SUPPORTED_PI_AI_VERSION as W, OPENAI_CODEX_LOCAL_PROXY_CANDIDATES as X, OPENAI_CODEX_PROXY_TEST_PATH as Y, OPENAI_CODEX_PROXY_CANDIDATE_LIMIT as Z, OPENAI_CODEX_IMAGE_MAX_RESPONSE_BYTES as _, OPENAI_CODEX_FAST_MODE_MAX_SESSION_ID_LENGTH as _t, name as a, DEFAULT_OPENAI_CODEX_SEARCH_MAX_OUTPUT_TOKENS as at, OPENAI_CODEX_TRANSPORT_API_VERSION as b, normalizeTrustedOrigin as bt, migrateOpenAICodexSearchHistory as c, DEFAULT_OPENAI_CODEX_SETTINGS as ct, OPENAI_CODEX_SEARCH_URL as d, isValidOpenAICodexProxyUrl as dt, OpenAICodexProxyManager as et, OpenAICodexSearchProvider as f, resolveOpenAICodexProxyUrl as ft, OPENAI_CODEX_IMAGE_MAX_ERROR_BYTES as g, OPENAI_CODEX_FAST_MODE_MAX_SESSIONS as gt, OPENAI_CODEX_IMAGE_MAX_COUNT as h, FastModeRegistry as ht, inject as i, DEFAULT_OPENAI_CODEX_SEARCH_CONTEXT_SIZE as it, CODEX_CONNECT_VERSION as j, diagnoseOpenAICodex as k, OpenAICodexCredentialStore as kt, OPENAI_CODEX_BASE_URL as l, OPENAI_CODEX_SETTINGS_NAMESPACE as lt, OPENAI_CODEX_IMAGE_GENERATION_URL as m, OPENAI_CODEX_FAST_MODE_PATH as mt, OPENAI_CODEX_SETTINGS_NS as n, listOpenAICodexProxyCandidates as nt, OPENAI_CODEX_HISTORY_BACKUP_SUFFIX as o, DEFAULT_OPENAI_CODEX_SEARCH_MODE as ot, mapOpenAICodexSearchResponse as p, resolveOpenAICodexSettings as pt, evaluateCompatibility as q, apply as r, DEFAULT_OPENAI_CODEX_PROXY_URL as rt, OPENAI_CODEX_SEARCH_MODEL_REQUEST_EVENT as s, DEFAULT_OPENAI_CODEX_SEARCH_MODEL as st, Config as t, detectOpenAICodexProxies as tt, OPENAI_CODEX_SEARCH_PROVIDER as u, decodeOpenAICodexSettings as ut, OPENAI_CODEX_IMAGE_PROMPT_MAX_LENGTH as v, isFastModeSessionId as vt, OpenAICodexTransportError as w, loginOpenAICodex as wt, OPENAI_CODEX_TRANSPORT_ERROR_CODES as x, OPENAI_CODEX_USAGE_URL as xt, OPENAI_CODEX_IMAGE_REQUEST_TIMEOUT_MS as y, OpenAICodexTrustedOriginsStore as yt, COMPATIBILITY_SCHEMA_VERSION as z };
+export { OPENAI_CODEX_PROXY_PROBE_TIMEOUT_MS as $, openAICodexConflictMessage as A, OPENAI_CODEX_AUTH_FILENAME as At, DSH_PLUGIN_API_PACKAGES as B, OpenAICodexTransport as C, OPENAI_CODEX_USAGE_URL as Ct, IMAGE_GENERATE_TOOL_NAME as D, logoutOpenAICodex as Dt, VIEW_IMAGE_TOOL_NAME as E, loginOpenAICodex as Et, parseOpenAICodexUpdateResult as F, assessCompatibility as G, SUPPORTED_DSH_PLUGIN_API_VERSION as H, parseOpenAICodexVersion as I, readInstalledPackageVersion as J, detectCompatibility as K, COMPATIBILITY_CONTRACT as L, OPENAI_CODEX_UPDATE_PATH as M, OpenAICodexCredentialStore as Mt, checkForOpenAICodexUpdate as N, openAICodexAuthPath as Nt, assertNoOpenAICodexProviderConflict as O, openAICodexAuthStatus as Ot, compareOpenAICodexVersions as P, OPENAI_CODEX_PROXY_CANDIDATE_LIMIT as Q, COMPATIBILITY_PACKAGES as R, OPENAI_CODEX_TRANSPORT_SERVICE as S, normalizeTrustedOrigin as St, isOpenAICodexTransportError as T, readOpenAICodexRateLimits as Tt, SUPPORTED_NODE_RANGE as U, PI_AI_PACKAGE as V, SUPPORTED_PI_AI_VERSION as W, OPENAI_CODEX_PROXY_TEST_PATH as X, OPENAI_CODEX_PROXY_DETECT_PATH as Y, OPENAI_CODEX_LOCAL_PROXY_CANDIDATES as Z, OPENAI_CODEX_IMAGE_MAX_RESPONSE_BYTES as _, FastModeRegistry as _t, name as a, DEFAULT_OPENAI_CODEX_SEARCH_CONTEXT_SIZE as at, OPENAI_CODEX_TRANSPORT_API_VERSION as b, isFastModeSessionId as bt, migrateOpenAICodexSearchHistory as c, DEFAULT_OPENAI_CODEX_SEARCH_MODEL as ct, OPENAI_CODEX_SEARCH_URL as d, decodeOpenAICodexSettings as dt, OPENAI_CODEX_PROXY_PROBE_URL as et, OpenAICodexSearchProvider as f, isValidOpenAICodexProxyUrl as ft, OPENAI_CODEX_IMAGE_MAX_ERROR_BYTES as g, OPENAI_CODEX_FAST_MODE_PATH as gt, OPENAI_CODEX_IMAGE_MAX_COUNT as h, resolveOpenAICodexSettings as ht, inject as i, DEFAULT_OPENAI_CODEX_PROXY_URL as it, CODEX_CONNECT_VERSION as j, OPENAI_CODEX_PROVIDER as jt, diagnoseOpenAICodex as k, openAICodexModelCatalog as kt, OPENAI_CODEX_BASE_URL as l, DEFAULT_OPENAI_CODEX_SETTINGS as lt, OPENAI_CODEX_IMAGE_GENERATION_URL as m, resolveOpenAICodexProxyUrl as mt, OPENAI_CODEX_SETTINGS_NS as n, detectOpenAICodexProxies as nt, OPENAI_CODEX_HISTORY_BACKUP_SUFFIX as o, DEFAULT_OPENAI_CODEX_SEARCH_MAX_OUTPUT_TOKENS as ot, mapOpenAICodexSearchResponse as p, normalizeOpenAICodexProxyUrl as pt, evaluateCompatibility as q, apply as r, listOpenAICodexProxyCandidates as rt, OPENAI_CODEX_SEARCH_MODEL_REQUEST_EVENT as s, DEFAULT_OPENAI_CODEX_SEARCH_MODE as st, Config as t, OpenAICodexProxyManager as tt, OPENAI_CODEX_SEARCH_PROVIDER as u, OPENAI_CODEX_SETTINGS_NAMESPACE as ut, OPENAI_CODEX_IMAGE_PROMPT_MAX_LENGTH as v, OPENAI_CODEX_FAST_MODE_MAX_SESSIONS as vt, OpenAICodexTransportError as w, parseOpenAICodexUsage as wt, OPENAI_CODEX_TRANSPORT_ERROR_CODES as x, OpenAICodexTrustedOriginsStore as xt, OPENAI_CODEX_IMAGE_REQUEST_TIMEOUT_MS as y, OPENAI_CODEX_FAST_MODE_MAX_SESSION_ID_LENGTH as yt, COMPATIBILITY_SCHEMA_VERSION as z };