dsh-codex-connect 0.1.0-alpha.4.27 → 0.1.0-alpha.4.29

package/INSTALL.md

@@ -1,6 +1,6 @@
 # Installation Runbook for CLI Agents
 
-Alpha 4.27 is verified with DSH `0.1.2-rc.1` and its declared pi-ai range `^0.84.2`.
+Alpha 4.29 is verified with DSH `0.1.2-rc.1` and its declared pi-ai range `^0.84.2`.
 
 Install `dsh-codex-connect` into one requested DeepSeek Harness profile without changing its current default model, search route, global configuration, or OAuth state.
 
@@ -23,14 +23,14 @@ Check `dsh --version` before changing the requested profile. Use `dsh --help` to
 | `0.1.0-rc.7` | `0.1.0-alpha.4.14` |
 | `0.1.1-rc.2` | `0.1.0-alpha.4.21` |
 | `0.1.2-alpha.2` | `0.1.0-alpha.4.23` |
-| `0.1.2-rc.1` | `0.1.0-alpha.4.27` |
+| `0.1.2-rc.1` | `0.1.0-alpha.4.29` |
 | `0.1.2-alpha.5` | `0.1.0-alpha.4.25` |
 
 If your exact DSH version is unknown or not listed, stop and verify the combination before installing. Do not blindly install `dsh-codex-connect@alpha`: `alpha` is a moving tag, not a compatibility guarantee. Do not infer support for newer DSH versions from these rows.
 
-Alpha 4.27's verified contract is DSH plugin API packages `0.1.2-rc.1`, `@earendil-works/pi-ai` `^0.84.2`, and Node.js `^22.19.0 || >=24.0.0`. Alpha 4.25 remains the verified choice for DSH `0.1.2-alpha.5`, Alpha 4.23 remains the verified choice for DSH `0.1.2-alpha.2`, Alpha 4.21 remains the verified choice for DSH `0.1.1-rc.2`, and staying on DSH `0.1.0-rc.7` means selecting Alpha 4.14. Upgrading DSH is a separate decision: upgrade the DSH API packages and pi-ai together, then rerun `dsh-codex-connect doctor --json` and `pnpm --silent run check:compatibility` for the selected combination.
+Alpha 4.29's verified contract is DSH plugin API packages `0.1.2-rc.1`, `@earendil-works/pi-ai` `^0.84.2`, and Node.js `^22.19.0 || >=24.0.0`. Alpha 4.25 remains the verified choice for DSH `0.1.2-alpha.5`, Alpha 4.23 remains the verified choice for DSH `0.1.2-alpha.2`, Alpha 4.21 remains the verified choice for DSH `0.1.1-rc.2`, and staying on DSH `0.1.0-rc.7` means selecting Alpha 4.14. Upgrading DSH is a separate decision: upgrade the DSH API packages and pi-ai together, then rerun `dsh-codex-connect doctor --json` and `pnpm --silent run check:compatibility` for the selected combination.
 
-The Alpha 4.27 row reflects a fresh isolated installation and runtime probe. Historical rows remain the repository's existing verification record. This guidance does not change upstream DSH behavior or resolve [Issue #64](https://github.com/franksong2702/dsh-codex-connect/issues/64).
+The Alpha 4.29 row reflects a fresh isolated installation and runtime probe. Historical rows remain the repository's existing verification record. This guidance does not change upstream DSH behavior or resolve [Issue #64](https://github.com/franksong2702/dsh-codex-connect/issues/64).
 
 ### Install the selected version and validate
 
@@ -53,10 +53,10 @@ The Alpha 4.27 row reflects a fresh isolated installation and runtime probe. His
    dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.23
    ```
 
-   For DSH `0.1.2-rc.1`, use Alpha 4.27:
+   For DSH `0.1.2-rc.1`, use Alpha 4.29:
 
    ```sh
-   dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.27
+   dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.29
    ```
 
    For DSH `0.1.2-alpha.5`, use Alpha 4.25:
@@ -65,7 +65,7 @@ The Alpha 4.27 row reflects a fresh isolated installation and runtime probe. His
    dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.25
    ```
 
-   If npm is unavailable after the matching GitHub prerelease is created, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.21'` only for the DSH `0.1.1-rc.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.23'` only for the DSH `0.1.2-alpha.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.25'` only for the DSH `0.1.2-alpha.5` combination, or `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.27'` only for the DSH `0.1.2-rc.1` combination.
+   If npm is unavailable after the matching GitHub prerelease is created, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.21'` only for the DSH `0.1.1-rc.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.23'` only for the DSH `0.1.2-alpha.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.25'` only for the DSH `0.1.2-alpha.5` combination, or `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.29'` only for the DSH `0.1.2-rc.1` combination.
 
 3. Run `dsh web --help` once to compose the installed profile without starting the server. DSH `0.1.2-rc.1` prepares profile plugin dependency fallback during this step.
 4. Run `dsh --profile web --dump-config` and require exactly one `llm-openai-codex` row loading `dsh-codex-connect`.

package/NOTICE

@@ -13,3 +13,8 @@ release validation.
 
 The upstream material and the Codex Connect modifications are distributed
 under the Apache License, Version 2.0 included in LICENSE.
+
+This product also includes OAuth login and refresh code from earendil-works/pi
+(@earendil-works/pi-ai 0.84.4), under the MIT license reproduced in
+docs/licenses/pi-ai-oauth.txt. JWT payload decoding, callback connection cleanup
+and structured refresh rejection handling are modified.

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   git hash-object README.md docs/README.zh.md
-README.md: c135f207b65d25355ffa0dadf44a18732cad765f
-docs/README.zh.md: c95461b5c330da72852c0161ee1b05625b7f914b
+README.md: 02e02fc550c598823a846a1938f2146dbf826418
+docs/README.zh.md: 5587a2ad4853e2479aa03a414a4199baba92b1c0

package/README.md

@@ -32,7 +32,7 @@ The command below is the verified public pairing for DSH `0.1.2-rc.1`. Check `ds
 ### 1. Install one exact version
 
 ```sh
-dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.27
+dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.29
 ```
 
 Replace `web` with your existing profile name. From a DeepSeek Harness source checkout, prefix commands with `pnpm`. Installation must leave the profile's default model and search route unchanged.
@@ -70,11 +70,18 @@ The effective configuration should contain exactly one `llm-openai-codex` row. A
 The Models card and the Plugin configuration page share the same account state. **Manage accounts** can add, select, or remove accounts. Browser responses expose only plugin-generated account keys and masked labels, never OAuth tokens or raw OpenAI account ids.
 
 - Adding an account leaves the current account usable while authorization is pending.
-- Cancelling or timing out a new authorization preserves every existing account. Pending authorization expires after 10 minutes by default; `oauthTimeoutMs` accepts 1,000–1,800,000 milliseconds and is applied when the plugin loads.
-- Switching accounts affects subsequent requests. A request captures its account before resolving authentication, so a concurrent switch cannot mix credentials.
+- Cancelling or timing out a new authorization preserves every existing account and closes accepted callback connections, including incomplete HTTP requests. After cancellation, the browser reads account labels and quota together before updating the view. Pending authorization expires after 10 minutes by default; `oauthTimeoutMs` accepts 1,000–1,800,000 milliseconds and is applied when the plugin loads.
+- Switching accounts affects subsequent requests. A request captures its account before resolving authentication, so a concurrent switch cannot mix credentials. If that account becomes unavailable during authentication, the request fails and requires an explicit retry with the selected account.
+- Quota, search, image generation and Auto-review keep that same account through token refresh. Each quota response pairs its usage and account labels from one snapshot; a concurrent switch may leave an older snapshot visible until the next refresh, but does not relabel its quota as another account's.
 - Removing the active account requires selecting a replacement when another account remains. Removing the last account signs out; **Sign out all accounts** deletes all locally stored Codex credentials.
 - Codex Connect does not rotate accounts automatically or fail over when a request is rejected.
 
+Credential changes wait up to 20 seconds for the writer lock, allowing an in-progress token refresh to finish. A lock timeout fails the operation without deleting another writer's lock or changing stored accounts. A lock left behind by a crashed process requires operator recovery after confirming that no writer is running.
+
+Request authentication failures use fixed messages without upstream response bodies or nested provider errors. A failed refresh preserves the stored credentials.
+
+An explicit OAuth `invalid_grant` rejection during refresh shows the reauthorization prompt. Network failures, timeouts and server errors keep the account selected and show a quota error so you can retry; they do not delete credentials or start a new login.
+
 For GPT Codex conversations, the Composer shows two session controls:
 
 - **Fast Mode** requests the faster `1.5×` mode for that conversation only. It is off by default and does not change the model.
@@ -98,15 +105,18 @@ Fresh installations register the model provider and leave every additional capab
     enableAutoReview: false
 ```
 
-Edit these options under **Settings → Plugins → Plugin configuration → Codex Connect** or **Settings → Models → Openai-Codex → More settings**. Changes are staged until **Save changes**. Most settings affect only this plugin; enabling Codex Search also selects it as the active profile-wide search route.
+Edit these options under **Settings → Plugins → Plugin configuration → Codex Connect** or **Settings → Models → Openai-Codex → More settings**. Changes are staged until **Save changes**. Saving commits edited fields together and preserves concurrent changes to untouched fields. A conflicting edit or failed save keeps your draft; discard it to reload the latest settings. Most settings affect only this plugin; enabling Codex Search also selects it as the active profile-wide search route.
 
 ### Proxy
 
+Disabling the proxy or unloading the plugin gives active proxy operations one second to finish, then destroys this instance's pools with a further one-second completion limit. New proxy operations are rejected during shutdown; interrupted requests are not retried directly. Arbitrary application callbacks cannot be forcibly terminated by the proxy manager. The scoped dispatcher remains until late callbacks settle, so they cannot bypass their destroyed proxy; unrelated traffic still uses the host dispatcher.
+
 Direct connection is the default. An enabled credential-free HTTP(S) proxy applies only to this plugin's model, OAuth, refresh, quota, search, image, and Auto-review traffic. Detection checks standard proxy environment variables and documented loopback candidates without making a model call, consuming quota, or saving settings. A failed proxy request never silently retries through a direct connection. Loading Codex Connect does not replace Node's environment-proxy dispatcher, so unrelated Harness requests continue using the process's existing proxy policy.
 
 ### Search and image tools
 
 - `enableSearch: true` registers Codex as an available search provider and selects it for profile-wide searches. Disabling it unregisters the provider and restores the route that was active before Codex Search was enabled.
+- Search has a 30-second total deadline covering authentication, response headers and body reading. Responses larger than 1 MiB are rejected, and unfinished response bodies are cancelled on failure. Caller cancellation can end a search sooner.
 - `enableImageTool: true` registers `view_image` on vision-capable models. Remote reads accept credential-free public HTTP(S) only and revalidate DNS and redirects.
 - `enableImageGeneration: true` registers prompt-only GPT Image generation. Use the image generation capability included with your current GPT subscription. Availability, dimensions, and quota remain account- and service-controlled.
 

package/docs/README.zh.md

@@ -32,7 +32,7 @@ Codex Connect 为 DeepSeek Harness 添加 ChatGPT OAuth 和 `openai-codex` 模
 ### 1. 安装一个精确版本
 
 ```sh
-dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.27
+dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.29
 ```
 
 将 `web` 替换为你正在使用的 profile 名。从 DeepSeek Harness 源码 checkout 执行时，请在命令前加 `pnpm`。安装后，profile 的默认模型和搜索路由必须保持不变。
@@ -70,11 +70,18 @@ dsh plugin --profile web exec dsh-codex-connect doctor --json
 “模型”卡片和“插件配置”页面共享同一份账户状态。**管理账户**可以添加、选择或移除账户。浏览器响应只会包含插件生成的账户 key 和脱敏标签，不会暴露 OAuth token 或原始 OpenAI account id。
 
 - 添加账户期间，当前账户仍可继续使用。
-- 取消新的授权或等待超时，不会删除任何已有账户。待处理授权默认 10 分钟后过期；`oauthTimeoutMs` 接受 1,000–1,800,000 毫秒，并在插件加载时应用。
-- 切换账户只影响后续请求。每个请求会在解析认证前固定当前账户，因此并发切换不会混用凭据。
+- 取消新的授权或等待超时，不会删除任何已有账户，并会关闭已接受的回调连接，包括未完成的 HTTP 请求。取消后，浏览器会一起读取账户标签与额度，再更新显示。待处理授权默认 10 分钟后过期；`oauthTimeoutMs` 接受 1,000–1,800,000 毫秒，并在插件加载时应用。
+- 切换账户只影响后续请求。每个请求会在解析认证前固定当前账户，因此并发切换不会混用凭据。如果该账户在认证过程中变得不可用，请求会失败，需要使用所选账户显式重试。
+- 额度、搜索、图片生成和自动审查会在 token 刷新期间保持同一请求账户。每次额度响应的用量与账户标签来自同一快照；并发切换时，旧快照可能显示到下次刷新，但不会把它的额度标为另一个账户的。
 - 如果还有其他账户，移除当前账户时必须选择替代账户；移除最后一个账户即退出登录；**退出所有账户**会删除本地保存的全部 Codex 凭据。
 - 请求被拒绝时，Codex Connect 不会自动轮换账户或进行故障切换。
 
+凭据修改最多等待写锁 20 秒，以便正在进行的 token 刷新完成。等待超时会使操作失败，但不会删除其他写入者的锁或更改已保存的账户。进程崩溃遗留的锁需要操作者确认没有写入者运行后再恢复。
+
+请求认证失败时使用固定提示，不包含上游响应正文或嵌套的提供方异常。刷新失败会保留已保存的凭据。
+
+刷新时收到明确的 OAuth `invalid_grant` 拒绝，会显示重新授权提示。网络故障、超时和服务端错误会保留当前账户并显示额度查询错误，供你重试；不会删除凭据或启动新的登录。
+
 GPT Codex 对话的 Composer 会显示两个会话级控件：
 
 - **Fast Mode** 只为当前对话请求更快的 `1.5×` 模式。默认关闭，也不会更换模型。
@@ -98,15 +105,18 @@ GPT Codex 对话的 Composer 会显示两个会话级控件：
     enableAutoReview: false
 ```
 
-请在 **设置 → 插件 → 插件配置 → Codex Connect** 或 **设置 → 模型 → Openai-Codex → 更多设置** 中编辑这些选项。修改会暂存到点击 **保存更改** 为止。大多数设置只影响本插件；启用 Codex 搜索还会把它选为整个 profile 当前使用的搜索路由。
+请在 **设置 → 插件 → 插件配置 → Codex Connect** 或 **设置 → 模型 → Openai-Codex → 更多设置** 中编辑这些选项。修改会暂存到点击 **保存更改** 为止。保存会一次提交所有已编辑字段，并保留其他页面对未编辑字段的修改。发生编辑冲突或保存失败时会保留草稿；放弃草稿可重新加载最新设置。大多数设置只影响本插件；启用 Codex 搜索还会把它选为整个 profile 当前使用的搜索路由。
 
 ### 代理
 
+关闭代理或卸载插件时，先给活动代理操作一秒收尾，再销毁本实例的连接池，最多再等待一秒完成。关闭期间拒绝新的代理操作；被中断的请求不会改走直连重试。代理管理器无法强制终止任意应用回调。作用域 dispatcher 会保留至迟到回调结束，防止它们绕过已销毁的代理；无关流量仍使用宿主 dispatcher。
+
 默认使用直连。启用后，不带凭据的 HTTP(S) proxy 只应用于本插件的模型、OAuth、刷新、额度、搜索、图片和自动审查流量。检测只检查标准代理环境变量和文档列出的 loopback 候选地址，不调用模型、不消耗额度，也不保存设置。代理请求失败时，绝不会静默改走直连。加载 Codex Connect 不会替换 Node 的环境代理 dispatcher，因此其他 Harness 请求会继续使用进程已有的代理策略。
 
 ### 搜索与图片工具
 
 - `enableSearch: true` 将 Codex 注册为可用搜索提供方，并用于整个 profile 的搜索。关闭时会注销该提供方，并恢复启用 Codex 搜索之前的路由。
+- 搜索从认证开始到读完响应共用 30 秒总期限。超过 1 MiB 的响应会被拒绝，失败时会取消尚未读完的响应体。调用方也可以提前取消搜索。
 - `enableImageTool: true` 为具备视觉能力的模型注册 `view_image`。远程读取只接受不带凭据的公网 HTTP(S)，并重新检查 DNS 与重定向。
 - `enableImageGeneration: true` 注册只接受提示词的 GPT Image 图片生成。使用你当前 GPT 订阅计划提供的图片生成能力。可用性、尺寸和额度仍由账户及服务端控制。
 

package/docs/agent-notes/account-recovery-state.md

@@ -0,0 +1,9 @@
+# Account recovery state
+
+Cancellation ignores the status-only mutation response and reads the same combined account/quota endpoint used by other account mutations. The browser publishes that pair together. If the read fails, it retains the prior pair and reports an operation error; normal retry scheduling remains active.
+
+The pinned OAuth implementation retains an explicit HTTP 400/401 `invalid_grant` JSON response as a typed, secret-free refresh rejection. Request authentication converts the pi-ai OAuth wrapper into `REAUTH_REQUIRED`; quota status maps it to the existing reauthorization UI. Network failures, timeouts, 5xx, rate limits, malformed responses and client-configuration failures do not establish revoked credentials. They remain safe generic failures and preserve the stored account.
+
+The vendored implementation now supplies login and refresh through pi-ai's public OAuth provider methods. pi-ai still schedules refresh and the credential store still serializes it and commits only a successful result. This preserves structured errors before upstream formatting discards their fields; it does not parse arbitrary exception messages. Vendor generation verifies both patches against pi-ai 0.84.4. Remove a patch only after the upstream behavior passes its corresponding regression.
+
+Regression tests use two independent account stores against the real account routes and temporary credential files, and real pi-ai refresh resolution with fixture HTTP responses. No real account or authorization is required. JWT payload decoding is covered by the [OAuth decoding note](oauth-jwt-decoding.md).

package/docs/agent-notes/auth-diagnostics-safety.md

@@ -0,0 +1,5 @@
+# Public authentication diagnostics
+
+Browser and CLI authentication failures expose only a closed vocabulary of messages. Unknown provider errors and nested causes are not copied into public diagnostics. Numeric usage HTTP statuses remain available without response bodies. This also intentionally removes arbitrary filesystem and provider error detail from these public outputs.
+
+The refresh regression uses the installed pi-ai OAuth implementation and a synthetic malformed response. Separate browser-route and CLI regressions exercise the public sinks. No real credentials or account access are required.

package/docs/agent-notes/dispatcher-ownership.md

@@ -0,0 +1,7 @@
+# Host dispatcher preservation
+
+Undici v1 and v2 dispatchers retain separate protocol slots. Initialization preserves an existing host v1 dispatcher without assigning it to the incompatible v2 slot. A separate runtime chunk initializes before provider evaluation. The HTTP helper uses CommonJS loading because Node 26's node:http ESM facade initializes built-in Undici during module linking, before preservation code can execute.
+
+During proxy ownership, unrelated v1 requests use their original dispatcher; scoped requests use Undici's v1 bridge. Unrelated v2 requests use their original v2 dispatcher. Reacquisition captures third-party replacements in a new immutable wrapper, so third-party wrappers retaining an older dispatcher do not form cycles. Final disposal restores only objects still owned by the plugin and preserves independent v1 and v2 replacements.
+
+Fresh-process checks cover custom legacy dispatchers and environment proxies. Node 22 and 24 native fetch consumes v1; Node 26 native fetch consumes v2, so the legacy protocol is also exercised directly. This change does not add operation deadlines or change proxy drain limits.

package/docs/agent-notes/oauth-cancel-commit.md

@@ -0,0 +1,9 @@
+# OAuth cancellation and credential commits
+
+Credential modification checks cancellation before waiting and immediately before invoking the mutation callback under the file lock. The callback is pi-ai's commit point: cancellation before invocation prevents mutation; cancellation after invocation waits for the mutation result. Cross-process serialization and atomic replacement remain unchanged.
+
+The same cancellation checks apply to captured-account stores used for request authentication. The wrapper forwards operation options and checks cancellation before calling a refresh callback, without updating its request-local credential on rejection.
+
+The regression combines the installed pi-ai login orchestration with the real credential store and file lock. OAuth returns a synthetic credential while another writer holds the lock. Cancellation returns before the lock is released; the queued mutation then rejects without adding or activating an account. A separate control verifies that cancellation after callback invocation does not report failure for a completed commit.
+
+This change does not extend lock wait limits or change callback-server socket shutdown.

package/docs/agent-notes/oauth-jwt-decoding.md

@@ -0,0 +1,7 @@
+# OAuth JWT payload decoding
+
+The pinned OAuth copy decodes the payload using the base64url alphabet and a fatal UTF-8 decoder before JSON parsing. Existing account identity validation still requires a nonempty string. Padding is accepted for compatibility with existing fixtures, while invalid alphabet characters and invalid UTF-8 fail. This is claim extraction from an OAuth response, not JWT signature verification or an entitlement check.
+
+Login and refresh use the same decoder. Failed extraction prevents a credential commit; refresh cannot change the captured account identity. The reproducible vendor script owns the patch and rejects an unexpected upstream decoder before rewriting anything.
+
+Tests exercise actual device-code login and refresh resolution against temporary credential files with fixture HTTP responses. They cover both base64url-specific characters, unpadded payloads, Unicode identities and claims, malformed JSON, invalid UTF-8, missing/invalid account identities and unchanged old credentials after failure. No real credentials or device authorization are used.

package/docs/agent-notes/request-response-lifecycle.md

@@ -0,0 +1,7 @@
+# Request response lifecycle
+
+Quota reads cancel discarded non-success response bodies before reporting the HTTP status. Cancellation failure does not replace the status or the existing HTTP 401/403 reauthorization result. Successful response parsing is unchanged.
+
+Proxy probes recognize native `TimeoutError` exceptions and explicit timeout codes through nested causes. Caller cancellation remains a connection failure rather than an operation timeout. DNS, connection-refused and TLS classifications retain their existing string-code handling.
+
+Regression tests use a local HTTP server with an unfinished error body to verify prompt socket closure, plus fixture responses for cancellation failure and reauthorization. Probe tests use the native `AbortSignal.timeout` reason and nested network errors. These checks do not establish real provider availability or real-account acceptance.

package/docs/licenses/pi-ai-oauth.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Mario Zechner
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/lib/bin.js

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
-import { Bt as OPENAI_CODEX_PROVIDER, Dt as OpenAICodexTrustedOriginsStore, Ft as openAICodexModelCatalog, H as DSH_PLUGIN_API_PACKAGES, Ht as openAICodexAuthPath, Mt as loginOpenAICodex, N as CODEX_CONNECT_VERSION, Nt as logoutOpenAICodex, Ot as normalizeTrustedOrigin, Pt as openAICodexAuthStatus, Vt as OpenAICodexCredentialStore, X as readInstalledPackageVersion, Y as evaluateCompatibility, bt as ProxyAgent, c as migrateOpenAICodexSearchHistory, d as OPENAI_CODEX_BASE_URL, gt as normalizeOpenAICodexProxyUrl, j as diagnoseOpenAICodex, l as CODEX_AUTO_REVIEW_MODEL, u as probeCodexAutoReview, xt as fetch, yt as Agent } from "./src-BcyhDCEJ.js";
+import { At as loginOpenAICodex, Bt as openAICodexAuthPath, H as DSH_PLUGIN_API_PACKAGES, Mt as openAICodexAuthStatus, N as CODEX_CONNECT_VERSION, Nt as publicAuthError, Rt as OPENAI_CODEX_PROVIDER, Tt as normalizeTrustedOrigin, X as readInstalledPackageVersion, Y as evaluateCompatibility, c as migrateOpenAICodexSearchHistory, d as OPENAI_CODEX_BASE_URL, gt as normalizeOpenAICodexProxyUrl, j as diagnoseOpenAICodex, jt as logoutOpenAICodex, kt as openAICodexModelCatalog, l as CODEX_AUTO_REVIEW_MODEL, u as probeCodexAutoReview, wt as OpenAICodexTrustedOriginsStore, zt as OpenAICodexCredentialStore } from "./src-BNfobpwF.js";
+import { i as fetch, r as ProxyAgent, t as Agent } from "./undici-runtime-H2uktiw6.js";
 import { createHash } from "node:crypto";
-import { fileURLToPath } from "node:url";
 import { realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
 import { spawn } from "node:child_process";
 import { createInterface } from "node:readline/promises";
 //#region src/capability-probe.ts
@@ -511,10 +512,6 @@ function openBrowser(rawUrl) {
 		child.unref();
 	} catch {}
 }
-/** Remove token-like strings from an external OAuth diagnostic. */
-function safeMessage(error) {
-	return (error instanceof Error ? error.message : String(error)).replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[redacted token]").replace(/(\b(?:code|token|refresh_token|access_token)=)[^&\s]+/giu, "$1[redacted]");
-}
 /** Render one provider event without exposing stored credentials. */
 function notify(event, useBrowser) {
 	switch (event.type) {
@@ -744,7 +741,7 @@ async function run(argv) {
 			}
 		}
 	} catch (error) {
-		process.stderr.write(`dsh-codex-connect: ${action} failed: ${safeMessage(error)}\n`);
+		process.stderr.write(`dsh-codex-connect: ${action} failed: ${publicAuthError(error)}\n`);
 		return 1;
 	}
 }

package/lib/client.js

@@ -299,6 +299,7 @@ window.__ModuleLoader__.load({
 			}
 			stableStatus(status, accounts) {
 				if (status.status !== "signing-in" || accounts.length === 0) return status;
+				if (accounts.find((account) => account.active)?.accountKey !== this.snapshot.accounts.find((account) => account.active)?.accountKey) return status;
 				return this.snapshot.status.status === "signed-in" || this.snapshot.status.status === "reauth-required" ? this.snapshot.status : status;
 			}
 			/** Refresh only while observed, without overlapping status reads or OAuth mutations. */
@@ -387,11 +388,12 @@ window.__ModuleLoader__.load({
 					operation: { kind: "cancelling-authorization" }
 				});
 				try {
-					const status = parseStatus(await request(OPENAI_CODEX_AUTH_CANCEL_PATH, "POST"));
+					await request(OPENAI_CODEX_AUTH_CANCEL_PATH, "POST");
+					const { status, accounts } = await this.readServerState();
 					this.publish({
 						status,
 						busy: false,
-						accounts: this.snapshot.accounts,
+						accounts,
 						operation: { kind: "idle" }
 					});
 				} catch (error) {
@@ -462,8 +464,8 @@ window.__ModuleLoader__.load({
 					}
 				});
 				try {
-					const status = parseStatus(await request(OPENAI_CODEX_AUTH_ACCOUNTS_PATH, method, void 0, body));
-					const accounts = parseAccounts(await request(OPENAI_CODEX_AUTH_ACCOUNTS_PATH));
+					await request(OPENAI_CODEX_AUTH_ACCOUNTS_PATH, method, void 0, body);
+					const { status, accounts } = await this.readServerState();
 					this.publish({
 						status,
 						accounts,
@@ -910,15 +912,13 @@ window.__ModuleLoader__.load({
 			if (left === void 0 || right === void 0) return left === right;
 			return Array.isArray(left) && Array.isArray(right) && left.length === right.length && left.every((model, index) => model === right[index]);
 		}
-		function sameConfig(left, right) {
-			return left !== void 0 && right !== void 0 && CONFIG_FIELDS.every((field) => sameField(field, left[field], right[field]));
-		}
 		/** Edit the Host-owned llm-openai-codex settings section with Save/Discard staging. */
 		function OpenAICodexConfiguration({ scope, t, activeModule, panelIdPrefix }) {
 			const subscribe = (0, react.useCallback)((listener) => scope?.subscribe(listener) ?? (() => void 0), [scope]);
 			const getSnapshot = (0, react.useCallback)(() => scope?.getSnapshot() ?? UNAVAILABLE_SNAPSHOT, [scope]);
 			const snapshot = (0, react.useSyncExternalStore)(subscribe, getSnapshot, getSnapshot);
 			const [draft, setDraft] = (0, react.useState)(snapshot.value);
+			const baseline = (0, react.useRef)(snapshot.value);
 			const [dirty, setDirty] = (0, react.useState)(false);
 			const [busy, setBusy] = (0, react.useState)(false);
 			const [feedback, setFeedback] = (0, react.useState)("idle");
@@ -960,6 +960,7 @@ window.__ModuleLoader__.load({
 			}, [scope]);
 			(0, react.useEffect)(() => {
 				if (!dirty && !busy) {
+					baseline.current = snapshot.value;
 					setDraft(snapshot.value);
 					setManualProxyUrl(snapshot.value?.proxyUrl ?? "");
 				}
@@ -1140,19 +1141,28 @@ window.__ModuleLoader__.load({
 				setBusy(true);
 				setFeedback("idle");
 				try {
-					for (const field of CONFIG_FIELDS) {
-						const accepted = scope.getSnapshot().value;
-						if (accepted !== void 0 && sameField(field, accepted[field], desired[field])) continue;
+					const current = scope.getSnapshot();
+					const original = baseline.current;
+					if (current.value === void 0 || original === void 0 || current.revision === void 0) throw new Error("Host settings are unavailable");
+					const changed = CONFIG_FIELDS.filter((field) => !sameField(field, original[field], desired[field]));
+					const ops = changed.map((field) => {
+						if (!sameField(field, original[field], current.value[field]) && !sameField(field, desired[field], current.value[field])) throw new Error(`Concurrent change to ${field}`);
 						const value = field === "contextWindowOverrides" ? {
 							...Object.fromEntries((modelCatalog ?? []).map((model) => [model.id, null])),
 							...desired.contextWindowOverrides
 						} : desired[field];
-						await scope.set(field, value);
-						const committed = scope.getSnapshot().value;
-						if (committed === void 0 || !sameField(field, committed[field], desired[field])) throw new Error(`Host refused ${field}`);
-					}
+						return value === void 0 ? {
+							op: "unset",
+							path: [field]
+						} : {
+							op: "set",
+							path: [field],
+							value
+						};
+					});
+					if (ops.length > 0) await scope.mutate(ops, current.revision);
 					const accepted = scope.getSnapshot().value;
-					if (!sameConfig(accepted, desired)) throw new Error("Host returned a different configuration");
+					if (accepted === void 0 || changed.some((field) => !sameField(field, accepted[field], desired[field]))) throw new Error("Host refused the configuration change");
 					setDraft(accepted);
 					setDirty(false);
 					setFeedback("saved");
@@ -6230,7 +6240,7 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 		//#region src/version.ts
-		const CODEX_CONNECT_VERSION = "0.1.0-alpha.4.27";
+		const CODEX_CONNECT_VERSION = "0.1.0-alpha.4.29";
 		//#endregion
 		//#region src/client/OpenAICodexModelsCard.tsx
 		/** Compact Models account entry with quota disclosure and shared configuration. */

package/lib/index.d.ts

@@ -24,6 +24,11 @@ interface OpenAICodexAccountSummary {
   profileSource: OpenAICodexAccountProfileSource;
   active: boolean;
 }
+/** One request's credentials and browser labels from the same document read. */
+interface CapturedOpenAICodexAccount extends CredentialStore {
+  accounts(): Promise<readonly OpenAICodexAccountSummary[]>;
+  captureActiveAccount(): Promise<CapturedOpenAICodexAccount>;
+}
 /**
  * Resolve the default OAuth document path.
  * @param dshHome - optional Harness-home override.
@@ -51,7 +56,7 @@ declare class OpenAICodexCredentialStore implements CredentialStore {
    * Refreshes through the returned store update only that captured account and
    * never change the user's current account selection.
    */
-  captureActiveAccount(): Promise<CredentialStore>;
+  captureActiveAccount(): Promise<CapturedOpenAICodexAccount>;
   private modifyCapturedAccount;
   /** @inheritdoc */
   list(): Promise<readonly CredentialInfo[]>;
@@ -64,9 +69,11 @@ declare class OpenAICodexCredentialStore implements CredentialStore {
   /** Remove one account; active removal requires an explicit stored replacement. */
   removeAccount(selectedAccountKey: string, replacementAccountKey?: string): Promise<void>;
   /** @inheritdoc */
-  modify(providerId: string, fn: (current: Credential | undefined) => Promise<Credential | undefined>): Promise<Credential | undefined>;
+  modify(providerId: string, fn: (current: Credential | undefined) => Promise<Credential | undefined>, options?: Parameters<CredentialStore['modify']>[2]): Promise<Credential | undefined>;
   /** @inheritdoc */
   delete(providerId: string): Promise<void>;
+  /** Allow the provider's 15-second refresh plus bounded filesystem completion. */
+  private withWriterLock;
 }
 //#endregion
 //#region src/provider-proxy.d.ts
@@ -97,12 +104,15 @@ declare function listOpenAICodexProxyCandidates(): readonly string[];
 /** One plugin instance owns its proxy agents and contributes one global wrapper owner. */
 declare class OpenAICodexProxyManager {
   private readonly agents;
+  private readonly connections;
   private activeOperations;
   private idleWaiters;
   private disposed;
   private disposePromise;
+  private closing;
   private waitForIdle;
   private closeAgents;
+  private shutdown;
   private agentFor;
   private acquire;
   /** Run a synchronous or asynchronous Codex operation in the selected proxy scope. */
@@ -113,9 +123,9 @@ declare class OpenAICodexProxyManager {
   }>(proxyUrl: string | undefined, operation: () => T): T;
   /** Probe one proxy without credentials, model calls, quota calls, or settings writes. */
   probe(proxyUrl: string): Promise<OpenAICodexProxyProbeResult>;
-  /** Close owned pools only after all scoped operations have become quiescent. */
+  /** Allow one second to drain, then destroy owned pools with a one-second completion bound. */
   dispose(): Promise<void>;
-  /** Release the process wrapper and pools after the user disables the proxy. */
+  /** Bound shutdown as on disposal; reject new proxy leases until reconfiguration finishes. */
   deactivate(): Promise<void>;
 }
 /** Probe the bounded automatic candidate set in parallel. */
@@ -198,7 +208,6 @@ declare class OpenAICodexTransport extends Service implements OpenAICodexTranspo
   private readonly proxyManager?;
   private readonly resolveProxyUrl;
   readonly apiVersion: 1;
-  private readonly models;
   constructor(ctx: Context, credentials: OpenAICodexCredentialStore, proxyManager?: OpenAICodexProxyManager | undefined, resolveProxyUrl?: () => string | undefined);
   generateImages(input: ImageGenerationRequest, context: ImageRequestContext): Promise<ImageGenerationResponse>;
   private generateImagesWithoutProxy;
@@ -381,7 +390,7 @@ declare function parseOpenAICodexUsage(value: unknown): OpenAICodexUsage;
  * @param store - plugin-owned OAuth credential store.
  * @returns current rate-limit buckets safe to expose to the local browser page.
  */
-declare function readOpenAICodexRateLimits(store: OpenAICodexCredentialStore): Promise<OpenAICodexUsage>;
+declare function readOpenAICodexRateLimits(store: Pick<OpenAICodexCredentialStore, 'captureActiveAccount'>): Promise<OpenAICodexUsage>;
 //#endregion
 //#region src/settings-contract.d.ts
 /** Node-free settings contract shared by the Host plugin and browser card. */
@@ -519,7 +528,6 @@ declare function mapOpenAICodexSearchResponse(value: unknown): WebSearchResult;
 declare class OpenAICodexSearchProvider implements WebSearchProvider {
   private readonly options;
   readonly id = "openai-codex";
-  private readonly models;
   /**
    * @param options - fixed trusted endpoint policy and deployment tunables.
    */
@@ -562,7 +570,7 @@ declare function logoutOpenAICodex(store?: OpenAICodexCredentialStore): Promise<
  * @param store - credential store, defaulting under `$DSH_HOME`.
  * @returns stored login state and expiry.
  */
-declare function openAICodexAuthStatus(store?: OpenAICodexCredentialStore): Promise<OpenAICodexAuthStatus>;
+declare function openAICodexAuthStatus(store?: CredentialStore): Promise<OpenAICodexAuthStatus>;
 //#endregion
 //#region src/fast-mode.d.ts
 /** Process-local, per-session OpenAI Codex Fast Mode state. */

package/lib/index.js

@@ -1,2 +1,2 @@
-import { $ as OPENAI_CODEX_LOCAL_PROXY_CANDIDATES, A as assertNoOpenAICodexProviderConflict, At as parseOpenAICodexUsage, B as COMPATIBILITY_PACKAGES, Bt as OPENAI_CODEX_PROVIDER, C as OPENAI_CODEX_TRANSPORT_ERROR_CODES, Ct as FastModeRegistry, D as isOpenAICodexTransportError, E as OpenAICodexTransportError, Et as isFastModeSessionId, F as checkForOpenAICodexUpdate, G as SUPPORTED_NODE_RANGE, H as DSH_PLUGIN_API_PACKAGES, Ht as openAICodexAuthPath, I as compareOpenAICodexVersions, It as OPENAI_CODEX_ACCOUNT_LIMIT, J as detectCompatibility, K as SUPPORTED_PI_AI_RANGE, L as parseOpenAICodexUpdateResult, Lt as OPENAI_CODEX_AUTH_DOCUMENT_LIMIT, M as openAICodexConflictMessage, Mt as loginOpenAICodex, Nt as logoutOpenAICodex, O as VIEW_IMAGE_TOOL_NAME, P as OPENAI_CODEX_UPDATE_PATH, Pt as openAICodexAuthStatus, Q as OPENAI_CODEX_PROXY_TEST_PATH, R as parseOpenAICodexVersion, Rt as OPENAI_CODEX_AUTH_FILENAME, S as OPENAI_CODEX_TRANSPORT_API_VERSION, St as OPENAI_CODEX_FAST_MODE_PATH, T as OpenAICodexTransport, Tt as OPENAI_CODEX_FAST_MODE_MAX_SESSION_ID_LENGTH, U as PI_AI_PACKAGE, V as COMPATIBILITY_SCHEMA_VERSION, Vt as OpenAICodexCredentialStore, W as SUPPORTED_DSH_PLUGIN_API_VERSION, Y as evaluateCompatibility, Z as OPENAI_CODEX_PROXY_DETECT_PATH, _ as OPENAI_CODEX_IMAGE_MAX_COUNT, _t as resolveOpenAICodexProxyUrl, a as name, at as listOpenAICodexProxyCandidates, b as OPENAI_CODEX_IMAGE_PROMPT_MAX_LENGTH, c as migrateOpenAICodexSearchHistory, ct as DEFAULT_OPENAI_CODEX_SEARCH_MAX_OUTPUT_TOKENS, d as OPENAI_CODEX_BASE_URL, dt as DEFAULT_OPENAI_CODEX_SETTINGS, et as OPENAI_CODEX_PROXY_CANDIDATE_LIMIT, f as OPENAI_CODEX_SEARCH_PROVIDER, ft as OPENAI_CODEX_SETTINGS_NAMESPACE, g as OPENAI_CODEX_IMAGE_GENERATION_URL, h as mapOpenAICodexSearchResponse, ht as isValidOpenAICodexProxyUrl, i as inject, it as detectOpenAICodexProxies, j as diagnoseOpenAICodex, jt as readOpenAICodexRateLimits, k as IMAGE_GENERATE_TOOL_NAME, kt as OPENAI_CODEX_USAGE_URL, lt as DEFAULT_OPENAI_CODEX_SEARCH_MODE, m as OpenAICodexSearchProvider, mt as isValidOpenAICodexContextWindowOverrides, n as OPENAI_CODEX_SETTINGS_NS, nt as OPENAI_CODEX_PROXY_PROBE_URL, o as OPENAI_CODEX_HISTORY_BACKUP_SUFFIX, ot as DEFAULT_OPENAI_CODEX_PROXY_URL, p as OPENAI_CODEX_SEARCH_URL, pt as decodeOpenAICodexSettings, q as assessCompatibility, r as apply, rt as OpenAICodexProxyManager, s as OPENAI_CODEX_SEARCH_MODEL_REQUEST_EVENT, st as DEFAULT_OPENAI_CODEX_SEARCH_CONTEXT_SIZE, t as Config, tt as OPENAI_CODEX_PROXY_PROBE_TIMEOUT_MS, ut as DEFAULT_OPENAI_CODEX_SEARCH_MODEL, v as OPENAI_CODEX_IMAGE_MAX_ERROR_BYTES, vt as resolveOpenAICodexSettings, w as OPENAI_CODEX_TRANSPORT_SERVICE, wt as OPENAI_CODEX_FAST_MODE_MAX_SESSIONS, x as OPENAI_CODEX_IMAGE_REQUEST_TIMEOUT_MS, y as OPENAI_CODEX_IMAGE_MAX_RESPONSE_BYTES, z as COMPATIBILITY_CONTRACT, zt as OPENAI_CODEX_AUTH_V1_BACKUP_SUFFIX } from "./src-BcyhDCEJ.js";
+import { $ as OPENAI_CODEX_LOCAL_PROXY_CANDIDATES, A as assertNoOpenAICodexProviderConflict, At as loginOpenAICodex, B as COMPATIBILITY_PACKAGES, Bt as openAICodexAuthPath, C as OPENAI_CODEX_TRANSPORT_ERROR_CODES, Ct as isFastModeSessionId, D as isOpenAICodexTransportError, Dt as parseOpenAICodexUsage, E as OpenAICodexTransportError, Et as OPENAI_CODEX_USAGE_URL, F as checkForOpenAICodexUpdate, Ft as OPENAI_CODEX_AUTH_DOCUMENT_LIMIT, G as SUPPORTED_NODE_RANGE, H as DSH_PLUGIN_API_PACKAGES, I as compareOpenAICodexVersions, It as OPENAI_CODEX_AUTH_FILENAME, J as detectCompatibility, K as SUPPORTED_PI_AI_RANGE, L as parseOpenAICodexUpdateResult, Lt as OPENAI_CODEX_AUTH_V1_BACKUP_SUFFIX, M as openAICodexConflictMessage, Mt as openAICodexAuthStatus, O as VIEW_IMAGE_TOOL_NAME, Ot as readOpenAICodexRateLimits, P as OPENAI_CODEX_UPDATE_PATH, Pt as OPENAI_CODEX_ACCOUNT_LIMIT, Q as OPENAI_CODEX_PROXY_TEST_PATH, R as parseOpenAICodexVersion, Rt as OPENAI_CODEX_PROVIDER, S as OPENAI_CODEX_TRANSPORT_API_VERSION, St as OPENAI_CODEX_FAST_MODE_MAX_SESSION_ID_LENGTH, T as OpenAICodexTransport, U as PI_AI_PACKAGE, V as COMPATIBILITY_SCHEMA_VERSION, W as SUPPORTED_DSH_PLUGIN_API_VERSION, Y as evaluateCompatibility, Z as OPENAI_CODEX_PROXY_DETECT_PATH, _ as OPENAI_CODEX_IMAGE_MAX_COUNT, _t as resolveOpenAICodexProxyUrl, a as name, at as listOpenAICodexProxyCandidates, b as OPENAI_CODEX_IMAGE_PROMPT_MAX_LENGTH, bt as FastModeRegistry, c as migrateOpenAICodexSearchHistory, ct as DEFAULT_OPENAI_CODEX_SEARCH_MAX_OUTPUT_TOKENS, d as OPENAI_CODEX_BASE_URL, dt as DEFAULT_OPENAI_CODEX_SETTINGS, et as OPENAI_CODEX_PROXY_CANDIDATE_LIMIT, f as OPENAI_CODEX_SEARCH_PROVIDER, ft as OPENAI_CODEX_SETTINGS_NAMESPACE, g as OPENAI_CODEX_IMAGE_GENERATION_URL, h as mapOpenAICodexSearchResponse, ht as isValidOpenAICodexProxyUrl, i as inject, it as detectOpenAICodexProxies, j as diagnoseOpenAICodex, jt as logoutOpenAICodex, k as IMAGE_GENERATE_TOOL_NAME, lt as DEFAULT_OPENAI_CODEX_SEARCH_MODE, m as OpenAICodexSearchProvider, mt as isValidOpenAICodexContextWindowOverrides, n as OPENAI_CODEX_SETTINGS_NS, nt as OPENAI_CODEX_PROXY_PROBE_URL, o as OPENAI_CODEX_HISTORY_BACKUP_SUFFIX, ot as DEFAULT_OPENAI_CODEX_PROXY_URL, p as OPENAI_CODEX_SEARCH_URL, pt as decodeOpenAICodexSettings, q as assessCompatibility, r as apply, rt as OpenAICodexProxyManager, s as OPENAI_CODEX_SEARCH_MODEL_REQUEST_EVENT, st as DEFAULT_OPENAI_CODEX_SEARCH_CONTEXT_SIZE, t as Config, tt as OPENAI_CODEX_PROXY_PROBE_TIMEOUT_MS, ut as DEFAULT_OPENAI_CODEX_SEARCH_MODEL, v as OPENAI_CODEX_IMAGE_MAX_ERROR_BYTES, vt as resolveOpenAICodexSettings, w as OPENAI_CODEX_TRANSPORT_SERVICE, x as OPENAI_CODEX_IMAGE_REQUEST_TIMEOUT_MS, xt as OPENAI_CODEX_FAST_MODE_MAX_SESSIONS, y as OPENAI_CODEX_IMAGE_MAX_RESPONSE_BYTES, yt as OPENAI_CODEX_FAST_MODE_PATH, z as COMPATIBILITY_CONTRACT, zt as OpenAICodexCredentialStore } from "./src-BNfobpwF.js";
 export { COMPATIBILITY_CONTRACT, COMPATIBILITY_PACKAGES, COMPATIBILITY_SCHEMA_VERSION, Config, DEFAULT_OPENAI_CODEX_PROXY_URL, DEFAULT_OPENAI_CODEX_SEARCH_CONTEXT_SIZE, DEFAULT_OPENAI_CODEX_SEARCH_MAX_OUTPUT_TOKENS, DEFAULT_OPENAI_CODEX_SEARCH_MODE, DEFAULT_OPENAI_CODEX_SEARCH_MODEL, DEFAULT_OPENAI_CODEX_SETTINGS, DSH_PLUGIN_API_PACKAGES, FastModeRegistry, FastModeRegistry as OpenAICodexFastModeRegistry, IMAGE_GENERATE_TOOL_NAME, OPENAI_CODEX_ACCOUNT_LIMIT, OPENAI_CODEX_AUTH_DOCUMENT_LIMIT, OPENAI_CODEX_AUTH_FILENAME, OPENAI_CODEX_AUTH_V1_BACKUP_SUFFIX, OPENAI_CODEX_BASE_URL, OPENAI_CODEX_FAST_MODE_MAX_SESSIONS, OPENAI_CODEX_FAST_MODE_MAX_SESSION_ID_LENGTH, OPENAI_CODEX_FAST_MODE_PATH, OPENAI_CODEX_HISTORY_BACKUP_SUFFIX, OPENAI_CODEX_IMAGE_GENERATION_URL, OPENAI_CODEX_IMAGE_MAX_COUNT, OPENAI_CODEX_IMAGE_MAX_ERROR_BYTES, OPENAI_CODEX_IMAGE_MAX_RESPONSE_BYTES, OPENAI_CODEX_IMAGE_PROMPT_MAX_LENGTH, OPENAI_CODEX_IMAGE_REQUEST_TIMEOUT_MS, OPENAI_CODEX_LOCAL_PROXY_CANDIDATES, OPENAI_CODEX_PROVIDER, OPENAI_CODEX_PROXY_CANDIDATE_LIMIT, OPENAI_CODEX_PROXY_DETECT_PATH, OPENAI_CODEX_PROXY_PROBE_TIMEOUT_MS, OPENAI_CODEX_PROXY_PROBE_URL, OPENAI_CODEX_PROXY_TEST_PATH, OPENAI_CODEX_SEARCH_MODEL_REQUEST_EVENT, OPENAI_CODEX_SEARCH_PROVIDER, OPENAI_CODEX_SEARCH_URL, OPENAI_CODEX_SETTINGS_NAMESPACE, OPENAI_CODEX_SETTINGS_NS, OPENAI_CODEX_TRANSPORT_API_VERSION, OPENAI_CODEX_TRANSPORT_ERROR_CODES, OPENAI_CODEX_TRANSPORT_SERVICE, OPENAI_CODEX_UPDATE_PATH, OPENAI_CODEX_USAGE_URL, OpenAICodexCredentialStore, OpenAICodexProxyManager, OpenAICodexSearchProvider, OpenAICodexTransport, OpenAICodexTransportError, PI_AI_PACKAGE, SUPPORTED_DSH_PLUGIN_API_VERSION, SUPPORTED_NODE_RANGE, SUPPORTED_PI_AI_RANGE, VIEW_IMAGE_TOOL_NAME, apply, assertNoOpenAICodexProviderConflict, assessCompatibility, checkForOpenAICodexUpdate, compareOpenAICodexVersions, decodeOpenAICodexSettings, detectCompatibility, detectOpenAICodexProxies, diagnoseOpenAICodex, evaluateCompatibility, inject, isFastModeSessionId, isOpenAICodexTransportError, isValidOpenAICodexContextWindowOverrides, isValidOpenAICodexProxyUrl, listOpenAICodexProxyCandidates, loginOpenAICodex, logoutOpenAICodex, mapOpenAICodexSearchResponse, migrateOpenAICodexSearchHistory, name, openAICodexAuthPath, openAICodexAuthStatus, openAICodexConflictMessage, parseOpenAICodexUpdateResult, parseOpenAICodexUsage, parseOpenAICodexVersion, readOpenAICodexRateLimits, resolveOpenAICodexProxyUrl, resolveOpenAICodexSettings };