dsh-codex-connect 0.1.0-alpha.4.28 → 0.1.0-alpha.4.29

package/INSTALL.md

@@ -1,6 +1,6 @@
 # Installation Runbook for CLI Agents
 
-Alpha 4.28 is verified with DSH `0.1.2-rc.1` and its declared pi-ai range `^0.84.2`.
+Alpha 4.29 is verified with DSH `0.1.2-rc.1` and its declared pi-ai range `^0.84.2`.
 
 Install `dsh-codex-connect` into one requested DeepSeek Harness profile without changing its current default model, search route, global configuration, or OAuth state.
 
@@ -23,14 +23,14 @@ Check `dsh --version` before changing the requested profile. Use `dsh --help` to
 | `0.1.0-rc.7` | `0.1.0-alpha.4.14` |
 | `0.1.1-rc.2` | `0.1.0-alpha.4.21` |
 | `0.1.2-alpha.2` | `0.1.0-alpha.4.23` |
-| `0.1.2-rc.1` | `0.1.0-alpha.4.28` |
+| `0.1.2-rc.1` | `0.1.0-alpha.4.29` |
 | `0.1.2-alpha.5` | `0.1.0-alpha.4.25` |
 
 If your exact DSH version is unknown or not listed, stop and verify the combination before installing. Do not blindly install `dsh-codex-connect@alpha`: `alpha` is a moving tag, not a compatibility guarantee. Do not infer support for newer DSH versions from these rows.
 
-Alpha 4.28's verified contract is DSH plugin API packages `0.1.2-rc.1`, `@earendil-works/pi-ai` `^0.84.2`, and Node.js `^22.19.0 || >=24.0.0`. Alpha 4.25 remains the verified choice for DSH `0.1.2-alpha.5`, Alpha 4.23 remains the verified choice for DSH `0.1.2-alpha.2`, Alpha 4.21 remains the verified choice for DSH `0.1.1-rc.2`, and staying on DSH `0.1.0-rc.7` means selecting Alpha 4.14. Upgrading DSH is a separate decision: upgrade the DSH API packages and pi-ai together, then rerun `dsh-codex-connect doctor --json` and `pnpm --silent run check:compatibility` for the selected combination.
+Alpha 4.29's verified contract is DSH plugin API packages `0.1.2-rc.1`, `@earendil-works/pi-ai` `^0.84.2`, and Node.js `^22.19.0 || >=24.0.0`. Alpha 4.25 remains the verified choice for DSH `0.1.2-alpha.5`, Alpha 4.23 remains the verified choice for DSH `0.1.2-alpha.2`, Alpha 4.21 remains the verified choice for DSH `0.1.1-rc.2`, and staying on DSH `0.1.0-rc.7` means selecting Alpha 4.14. Upgrading DSH is a separate decision: upgrade the DSH API packages and pi-ai together, then rerun `dsh-codex-connect doctor --json` and `pnpm --silent run check:compatibility` for the selected combination.
 
-The Alpha 4.28 row reflects a fresh isolated installation and runtime probe. Historical rows remain the repository's existing verification record. This guidance does not change upstream DSH behavior or resolve [Issue #64](https://github.com/franksong2702/dsh-codex-connect/issues/64).
+The Alpha 4.29 row reflects a fresh isolated installation and runtime probe. Historical rows remain the repository's existing verification record. This guidance does not change upstream DSH behavior or resolve [Issue #64](https://github.com/franksong2702/dsh-codex-connect/issues/64).
 
 ### Install the selected version and validate
 
@@ -53,10 +53,10 @@ The Alpha 4.28 row reflects a fresh isolated installation and runtime probe. His
    dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.23
    ```
 
-   For DSH `0.1.2-rc.1`, use Alpha 4.28:
+   For DSH `0.1.2-rc.1`, use Alpha 4.29:
 
    ```sh
-   dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.28
+   dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.29
    ```
 
    For DSH `0.1.2-alpha.5`, use Alpha 4.25:
@@ -65,7 +65,7 @@ The Alpha 4.28 row reflects a fresh isolated installation and runtime probe. His
    dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.25
    ```
 
-   If npm is unavailable after the matching GitHub prerelease is created, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.21'` only for the DSH `0.1.1-rc.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.23'` only for the DSH `0.1.2-alpha.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.25'` only for the DSH `0.1.2-alpha.5` combination, or `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.28'` only for the DSH `0.1.2-rc.1` combination.
+   If npm is unavailable after the matching GitHub prerelease is created, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.21'` only for the DSH `0.1.1-rc.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.23'` only for the DSH `0.1.2-alpha.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.25'` only for the DSH `0.1.2-alpha.5` combination, or `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.29'` only for the DSH `0.1.2-rc.1` combination.
 
 3. Run `dsh web --help` once to compose the installed profile without starting the server. DSH `0.1.2-rc.1` prepares profile plugin dependency fallback during this step.
 4. Run `dsh --profile web --dump-config` and require exactly one `llm-openai-codex` row loading `dsh-codex-connect`.

package/NOTICE

@@ -14,6 +14,7 @@ release validation.
 The upstream material and the Codex Connect modifications are distributed
 under the Apache License, Version 2.0 included in LICENSE.
 
-This product also includes login-only OAuth code from earendil-works/pi
+This product also includes OAuth login and refresh code from earendil-works/pi
 (@earendil-works/pi-ai 0.84.4), under the MIT license reproduced in
-docs/licenses/pi-ai-oauth.txt. Callback connection cleanup is modified.
+docs/licenses/pi-ai-oauth.txt. JWT payload decoding, callback connection cleanup
+and structured refresh rejection handling are modified.

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   git hash-object README.md docs/README.zh.md
-README.md: 42ce8089bf4f6f36296b5f6769becbca5f0cf29f
-docs/README.zh.md: 040b626e3265cd617b59bf912c987f8e8675f0f9
+README.md: 02e02fc550c598823a846a1938f2146dbf826418
+docs/README.zh.md: 5587a2ad4853e2479aa03a414a4199baba92b1c0

package/README.md

@@ -32,7 +32,7 @@ The command below is the verified public pairing for DSH `0.1.2-rc.1`. Check `ds
 ### 1. Install one exact version
 
 ```sh
-dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.28
+dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.29
 ```
 
 Replace `web` with your existing profile name. From a DeepSeek Harness source checkout, prefix commands with `pnpm`. Installation must leave the profile's default model and search route unchanged.
@@ -70,14 +70,18 @@ The effective configuration should contain exactly one `llm-openai-codex` row. A
 The Models card and the Plugin configuration page share the same account state. **Manage accounts** can add, select, or remove accounts. Browser responses expose only plugin-generated account keys and masked labels, never OAuth tokens or raw OpenAI account ids.
 
 - Adding an account leaves the current account usable while authorization is pending.
-- Cancelling or timing out a new authorization preserves every existing account and closes accepted callback connections, including incomplete HTTP requests. Pending authorization expires after 10 minutes by default; `oauthTimeoutMs` accepts 1,000–1,800,000 milliseconds and is applied when the plugin loads.
-- Switching accounts affects subsequent requests. A request captures its account before resolving authentication, so a concurrent switch cannot mix credentials.
+- Cancelling or timing out a new authorization preserves every existing account and closes accepted callback connections, including incomplete HTTP requests. After cancellation, the browser reads account labels and quota together before updating the view. Pending authorization expires after 10 minutes by default; `oauthTimeoutMs` accepts 1,000–1,800,000 milliseconds and is applied when the plugin loads.
+- Switching accounts affects subsequent requests. A request captures its account before resolving authentication, so a concurrent switch cannot mix credentials. If that account becomes unavailable during authentication, the request fails and requires an explicit retry with the selected account.
 - Quota, search, image generation and Auto-review keep that same account through token refresh. Each quota response pairs its usage and account labels from one snapshot; a concurrent switch may leave an older snapshot visible until the next refresh, but does not relabel its quota as another account's.
 - Removing the active account requires selecting a replacement when another account remains. Removing the last account signs out; **Sign out all accounts** deletes all locally stored Codex credentials.
 - Codex Connect does not rotate accounts automatically or fail over when a request is rejected.
 
 Credential changes wait up to 20 seconds for the writer lock, allowing an in-progress token refresh to finish. A lock timeout fails the operation without deleting another writer's lock or changing stored accounts. A lock left behind by a crashed process requires operator recovery after confirming that no writer is running.
 
+Request authentication failures use fixed messages without upstream response bodies or nested provider errors. A failed refresh preserves the stored credentials.
+
+An explicit OAuth `invalid_grant` rejection during refresh shows the reauthorization prompt. Network failures, timeouts and server errors keep the account selected and show a quota error so you can retry; they do not delete credentials or start a new login.
+
 For GPT Codex conversations, the Composer shows two session controls:
 
 - **Fast Mode** requests the faster `1.5×` mode for that conversation only. It is off by default and does not change the model.

package/docs/README.zh.md

@@ -32,7 +32,7 @@ Codex Connect 为 DeepSeek Harness 添加 ChatGPT OAuth 和 `openai-codex` 模
 ### 1. 安装一个精确版本
 
 ```sh
-dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.28
+dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.29
 ```
 
 将 `web` 替换为你正在使用的 profile 名。从 DeepSeek Harness 源码 checkout 执行时，请在命令前加 `pnpm`。安装后，profile 的默认模型和搜索路由必须保持不变。
@@ -70,14 +70,18 @@ dsh plugin --profile web exec dsh-codex-connect doctor --json
 “模型”卡片和“插件配置”页面共享同一份账户状态。**管理账户**可以添加、选择或移除账户。浏览器响应只会包含插件生成的账户 key 和脱敏标签，不会暴露 OAuth token 或原始 OpenAI account id。
 
 - 添加账户期间，当前账户仍可继续使用。
-- 取消新的授权或等待超时，不会删除任何已有账户，并会关闭已接受的回调连接，包括未完成的 HTTP 请求。待处理授权默认 10 分钟后过期；`oauthTimeoutMs` 接受 1,000–1,800,000 毫秒，并在插件加载时应用。
-- 切换账户只影响后续请求。每个请求会在解析认证前固定当前账户，因此并发切换不会混用凭据。
+- 取消新的授权或等待超时，不会删除任何已有账户，并会关闭已接受的回调连接，包括未完成的 HTTP 请求。取消后，浏览器会一起读取账户标签与额度，再更新显示。待处理授权默认 10 分钟后过期；`oauthTimeoutMs` 接受 1,000–1,800,000 毫秒，并在插件加载时应用。
+- 切换账户只影响后续请求。每个请求会在解析认证前固定当前账户，因此并发切换不会混用凭据。如果该账户在认证过程中变得不可用，请求会失败，需要使用所选账户显式重试。
 - 额度、搜索、图片生成和自动审查会在 token 刷新期间保持同一请求账户。每次额度响应的用量与账户标签来自同一快照；并发切换时，旧快照可能显示到下次刷新，但不会把它的额度标为另一个账户的。
 - 如果还有其他账户，移除当前账户时必须选择替代账户；移除最后一个账户即退出登录；**退出所有账户**会删除本地保存的全部 Codex 凭据。
 - 请求被拒绝时，Codex Connect 不会自动轮换账户或进行故障切换。
 
 凭据修改最多等待写锁 20 秒，以便正在进行的 token 刷新完成。等待超时会使操作失败，但不会删除其他写入者的锁或更改已保存的账户。进程崩溃遗留的锁需要操作者确认没有写入者运行后再恢复。
 
+请求认证失败时使用固定提示，不包含上游响应正文或嵌套的提供方异常。刷新失败会保留已保存的凭据。
+
+刷新时收到明确的 OAuth `invalid_grant` 拒绝，会显示重新授权提示。网络故障、超时和服务端错误会保留当前账户并显示额度查询错误，供你重试；不会删除凭据或启动新的登录。
+
 GPT Codex 对话的 Composer 会显示两个会话级控件：
 
 - **Fast Mode** 只为当前对话请求更快的 `1.5×` 模式。默认关闭，也不会更换模型。

package/docs/agent-notes/account-recovery-state.md

@@ -0,0 +1,9 @@
+# Account recovery state
+
+Cancellation ignores the status-only mutation response and reads the same combined account/quota endpoint used by other account mutations. The browser publishes that pair together. If the read fails, it retains the prior pair and reports an operation error; normal retry scheduling remains active.
+
+The pinned OAuth implementation retains an explicit HTTP 400/401 `invalid_grant` JSON response as a typed, secret-free refresh rejection. Request authentication converts the pi-ai OAuth wrapper into `REAUTH_REQUIRED`; quota status maps it to the existing reauthorization UI. Network failures, timeouts, 5xx, rate limits, malformed responses and client-configuration failures do not establish revoked credentials. They remain safe generic failures and preserve the stored account.
+
+The vendored implementation now supplies login and refresh through pi-ai's public OAuth provider methods. pi-ai still schedules refresh and the credential store still serializes it and commits only a successful result. This preserves structured errors before upstream formatting discards their fields; it does not parse arbitrary exception messages. Vendor generation verifies both patches against pi-ai 0.84.4. Remove a patch only after the upstream behavior passes its corresponding regression.
+
+Regression tests use two independent account stores against the real account routes and temporary credential files, and real pi-ai refresh resolution with fixture HTTP responses. No real account or authorization is required. JWT payload decoding is covered by the [OAuth decoding note](oauth-jwt-decoding.md).

package/docs/agent-notes/oauth-jwt-decoding.md

@@ -0,0 +1,7 @@
+# OAuth JWT payload decoding
+
+The pinned OAuth copy decodes the payload using the base64url alphabet and a fatal UTF-8 decoder before JSON parsing. Existing account identity validation still requires a nonempty string. Padding is accepted for compatibility with existing fixtures, while invalid alphabet characters and invalid UTF-8 fail. This is claim extraction from an OAuth response, not JWT signature verification or an entitlement check.
+
+Login and refresh use the same decoder. Failed extraction prevents a credential commit; refresh cannot change the captured account identity. The reproducible vendor script owns the patch and rejects an unexpected upstream decoder before rewriting anything.
+
+Tests exercise actual device-code login and refresh resolution against temporary credential files with fixture HTTP responses. They cover both base64url-specific characters, unpadded payloads, Unicode identities and claims, malformed JSON, invalid UTF-8, missing/invalid account identities and unchanged old credentials after failure. No real credentials or device authorization are used.

package/docs/agent-notes/request-response-lifecycle.md

@@ -0,0 +1,7 @@
+# Request response lifecycle
+
+Quota reads cancel discarded non-success response bodies before reporting the HTTP status. Cancellation failure does not replace the status or the existing HTTP 401/403 reauthorization result. Successful response parsing is unchanged.
+
+Proxy probes recognize native `TimeoutError` exceptions and explicit timeout codes through nested causes. Caller cancellation remains a connection failure rather than an operation timeout. DNS, connection-refused and TLS classifications retain their existing string-code handling.
+
+Regression tests use a local HTTP server with an unfinished error body to verify prompt socket closure, plus fixture responses for cancellation failure and reauthorization. Probe tests use the native `AbortSignal.timeout` reason and nested network errors. These checks do not establish real provider availability or real-account acceptance.

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { At as loginOpenAICodex, Bt as openAICodexAuthPath, Et as normalizeTrustedOrigin, H as DSH_PLUGIN_API_PACKAGES, Mt as openAICodexAuthStatus, N as CODEX_CONNECT_VERSION, Nt as openAICodexModelCatalog, Rt as OPENAI_CODEX_PROVIDER, Tt as OpenAICodexTrustedOriginsStore, X as readInstalledPackageVersion, Y as evaluateCompatibility, c as migrateOpenAICodexSearchHistory, d as OPENAI_CODEX_BASE_URL, gt as normalizeOpenAICodexProxyUrl, j as diagnoseOpenAICodex, jt as logoutOpenAICodex, l as CODEX_AUTO_REVIEW_MODEL, u as probeCodexAutoReview, yt as publicAuthError, zt as OpenAICodexCredentialStore } from "./src-DUF_v9f_.js";
+import { At as loginOpenAICodex, Bt as openAICodexAuthPath, H as DSH_PLUGIN_API_PACKAGES, Mt as openAICodexAuthStatus, N as CODEX_CONNECT_VERSION, Nt as publicAuthError, Rt as OPENAI_CODEX_PROVIDER, Tt as normalizeTrustedOrigin, X as readInstalledPackageVersion, Y as evaluateCompatibility, c as migrateOpenAICodexSearchHistory, d as OPENAI_CODEX_BASE_URL, gt as normalizeOpenAICodexProxyUrl, j as diagnoseOpenAICodex, jt as logoutOpenAICodex, kt as openAICodexModelCatalog, l as CODEX_AUTO_REVIEW_MODEL, u as probeCodexAutoReview, wt as OpenAICodexTrustedOriginsStore, zt as OpenAICodexCredentialStore } from "./src-BNfobpwF.js";
 import { i as fetch, r as ProxyAgent, t as Agent } from "./undici-runtime-H2uktiw6.js";
 import { createHash } from "node:crypto";
 import { realpathSync } from "node:fs";

package/lib/client.js

@@ -388,11 +388,12 @@ window.__ModuleLoader__.load({
 					operation: { kind: "cancelling-authorization" }
 				});
 				try {
-					const status = parseStatus(await request(OPENAI_CODEX_AUTH_CANCEL_PATH, "POST"));
+					await request(OPENAI_CODEX_AUTH_CANCEL_PATH, "POST");
+					const { status, accounts } = await this.readServerState();
 					this.publish({
 						status,
 						busy: false,
-						accounts: this.snapshot.accounts,
+						accounts,
 						operation: { kind: "idle" }
 					});
 				} catch (error) {
@@ -6239,7 +6240,7 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 		//#region src/version.ts
-		const CODEX_CONNECT_VERSION = "0.1.0-alpha.4.28";
+		const CODEX_CONNECT_VERSION = "0.1.0-alpha.4.29";
 		//#endregion
 		//#region src/client/OpenAICodexModelsCard.tsx
 		/** Compact Models account entry with quota disclosure and shared configuration. */

package/lib/index.js

@@ -1,2 +1,2 @@
-import { $ as OPENAI_CODEX_LOCAL_PROXY_CANDIDATES, A as assertNoOpenAICodexProviderConflict, At as loginOpenAICodex, B as COMPATIBILITY_PACKAGES, Bt as openAICodexAuthPath, C as OPENAI_CODEX_TRANSPORT_ERROR_CODES, Ct as OPENAI_CODEX_FAST_MODE_MAX_SESSION_ID_LENGTH, D as isOpenAICodexTransportError, Dt as OPENAI_CODEX_USAGE_URL, E as OpenAICodexTransportError, F as checkForOpenAICodexUpdate, Ft as OPENAI_CODEX_AUTH_DOCUMENT_LIMIT, G as SUPPORTED_NODE_RANGE, H as DSH_PLUGIN_API_PACKAGES, I as compareOpenAICodexVersions, It as OPENAI_CODEX_AUTH_FILENAME, J as detectCompatibility, K as SUPPORTED_PI_AI_RANGE, L as parseOpenAICodexUpdateResult, Lt as OPENAI_CODEX_AUTH_V1_BACKUP_SUFFIX, M as openAICodexConflictMessage, Mt as openAICodexAuthStatus, O as VIEW_IMAGE_TOOL_NAME, Ot as parseOpenAICodexUsage, P as OPENAI_CODEX_UPDATE_PATH, Pt as OPENAI_CODEX_ACCOUNT_LIMIT, Q as OPENAI_CODEX_PROXY_TEST_PATH, R as parseOpenAICodexVersion, Rt as OPENAI_CODEX_PROVIDER, S as OPENAI_CODEX_TRANSPORT_API_VERSION, St as OPENAI_CODEX_FAST_MODE_MAX_SESSIONS, T as OpenAICodexTransport, U as PI_AI_PACKAGE, V as COMPATIBILITY_SCHEMA_VERSION, W as SUPPORTED_DSH_PLUGIN_API_VERSION, Y as evaluateCompatibility, Z as OPENAI_CODEX_PROXY_DETECT_PATH, _ as OPENAI_CODEX_IMAGE_MAX_COUNT, _t as resolveOpenAICodexProxyUrl, a as name, at as listOpenAICodexProxyCandidates, b as OPENAI_CODEX_IMAGE_PROMPT_MAX_LENGTH, bt as OPENAI_CODEX_FAST_MODE_PATH, c as migrateOpenAICodexSearchHistory, ct as DEFAULT_OPENAI_CODEX_SEARCH_MAX_OUTPUT_TOKENS, d as OPENAI_CODEX_BASE_URL, dt as DEFAULT_OPENAI_CODEX_SETTINGS, et as OPENAI_CODEX_PROXY_CANDIDATE_LIMIT, f as OPENAI_CODEX_SEARCH_PROVIDER, ft as OPENAI_CODEX_SETTINGS_NAMESPACE, g as OPENAI_CODEX_IMAGE_GENERATION_URL, h as mapOpenAICodexSearchResponse, ht as isValidOpenAICodexProxyUrl, i as inject, it as detectOpenAICodexProxies, j as diagnoseOpenAICodex, jt as logoutOpenAICodex, k as IMAGE_GENERATE_TOOL_NAME, kt as readOpenAICodexRateLimits, lt as DEFAULT_OPENAI_CODEX_SEARCH_MODE, m as OpenAICodexSearchProvider, mt as isValidOpenAICodexContextWindowOverrides, n as OPENAI_CODEX_SETTINGS_NS, nt as OPENAI_CODEX_PROXY_PROBE_URL, o as OPENAI_CODEX_HISTORY_BACKUP_SUFFIX, ot as DEFAULT_OPENAI_CODEX_PROXY_URL, p as OPENAI_CODEX_SEARCH_URL, pt as decodeOpenAICodexSettings, q as assessCompatibility, r as apply, rt as OpenAICodexProxyManager, s as OPENAI_CODEX_SEARCH_MODEL_REQUEST_EVENT, st as DEFAULT_OPENAI_CODEX_SEARCH_CONTEXT_SIZE, t as Config, tt as OPENAI_CODEX_PROXY_PROBE_TIMEOUT_MS, ut as DEFAULT_OPENAI_CODEX_SEARCH_MODEL, v as OPENAI_CODEX_IMAGE_MAX_ERROR_BYTES, vt as resolveOpenAICodexSettings, w as OPENAI_CODEX_TRANSPORT_SERVICE, wt as isFastModeSessionId, x as OPENAI_CODEX_IMAGE_REQUEST_TIMEOUT_MS, xt as FastModeRegistry, y as OPENAI_CODEX_IMAGE_MAX_RESPONSE_BYTES, z as COMPATIBILITY_CONTRACT, zt as OpenAICodexCredentialStore } from "./src-DUF_v9f_.js";
+import { $ as OPENAI_CODEX_LOCAL_PROXY_CANDIDATES, A as assertNoOpenAICodexProviderConflict, At as loginOpenAICodex, B as COMPATIBILITY_PACKAGES, Bt as openAICodexAuthPath, C as OPENAI_CODEX_TRANSPORT_ERROR_CODES, Ct as isFastModeSessionId, D as isOpenAICodexTransportError, Dt as parseOpenAICodexUsage, E as OpenAICodexTransportError, Et as OPENAI_CODEX_USAGE_URL, F as checkForOpenAICodexUpdate, Ft as OPENAI_CODEX_AUTH_DOCUMENT_LIMIT, G as SUPPORTED_NODE_RANGE, H as DSH_PLUGIN_API_PACKAGES, I as compareOpenAICodexVersions, It as OPENAI_CODEX_AUTH_FILENAME, J as detectCompatibility, K as SUPPORTED_PI_AI_RANGE, L as parseOpenAICodexUpdateResult, Lt as OPENAI_CODEX_AUTH_V1_BACKUP_SUFFIX, M as openAICodexConflictMessage, Mt as openAICodexAuthStatus, O as VIEW_IMAGE_TOOL_NAME, Ot as readOpenAICodexRateLimits, P as OPENAI_CODEX_UPDATE_PATH, Pt as OPENAI_CODEX_ACCOUNT_LIMIT, Q as OPENAI_CODEX_PROXY_TEST_PATH, R as parseOpenAICodexVersion, Rt as OPENAI_CODEX_PROVIDER, S as OPENAI_CODEX_TRANSPORT_API_VERSION, St as OPENAI_CODEX_FAST_MODE_MAX_SESSION_ID_LENGTH, T as OpenAICodexTransport, U as PI_AI_PACKAGE, V as COMPATIBILITY_SCHEMA_VERSION, W as SUPPORTED_DSH_PLUGIN_API_VERSION, Y as evaluateCompatibility, Z as OPENAI_CODEX_PROXY_DETECT_PATH, _ as OPENAI_CODEX_IMAGE_MAX_COUNT, _t as resolveOpenAICodexProxyUrl, a as name, at as listOpenAICodexProxyCandidates, b as OPENAI_CODEX_IMAGE_PROMPT_MAX_LENGTH, bt as FastModeRegistry, c as migrateOpenAICodexSearchHistory, ct as DEFAULT_OPENAI_CODEX_SEARCH_MAX_OUTPUT_TOKENS, d as OPENAI_CODEX_BASE_URL, dt as DEFAULT_OPENAI_CODEX_SETTINGS, et as OPENAI_CODEX_PROXY_CANDIDATE_LIMIT, f as OPENAI_CODEX_SEARCH_PROVIDER, ft as OPENAI_CODEX_SETTINGS_NAMESPACE, g as OPENAI_CODEX_IMAGE_GENERATION_URL, h as mapOpenAICodexSearchResponse, ht as isValidOpenAICodexProxyUrl, i as inject, it as detectOpenAICodexProxies, j as diagnoseOpenAICodex, jt as logoutOpenAICodex, k as IMAGE_GENERATE_TOOL_NAME, lt as DEFAULT_OPENAI_CODEX_SEARCH_MODE, m as OpenAICodexSearchProvider, mt as isValidOpenAICodexContextWindowOverrides, n as OPENAI_CODEX_SETTINGS_NS, nt as OPENAI_CODEX_PROXY_PROBE_URL, o as OPENAI_CODEX_HISTORY_BACKUP_SUFFIX, ot as DEFAULT_OPENAI_CODEX_PROXY_URL, p as OPENAI_CODEX_SEARCH_URL, pt as decodeOpenAICodexSettings, q as assessCompatibility, r as apply, rt as OpenAICodexProxyManager, s as OPENAI_CODEX_SEARCH_MODEL_REQUEST_EVENT, st as DEFAULT_OPENAI_CODEX_SEARCH_CONTEXT_SIZE, t as Config, tt as OPENAI_CODEX_PROXY_PROBE_TIMEOUT_MS, ut as DEFAULT_OPENAI_CODEX_SEARCH_MODEL, v as OPENAI_CODEX_IMAGE_MAX_ERROR_BYTES, vt as resolveOpenAICodexSettings, w as OPENAI_CODEX_TRANSPORT_SERVICE, x as OPENAI_CODEX_IMAGE_REQUEST_TIMEOUT_MS, xt as OPENAI_CODEX_FAST_MODE_MAX_SESSIONS, y as OPENAI_CODEX_IMAGE_MAX_RESPONSE_BYTES, yt as OPENAI_CODEX_FAST_MODE_PATH, z as COMPATIBILITY_CONTRACT, zt as OpenAICodexCredentialStore } from "./src-BNfobpwF.js";
 export { COMPATIBILITY_CONTRACT, COMPATIBILITY_PACKAGES, COMPATIBILITY_SCHEMA_VERSION, Config, DEFAULT_OPENAI_CODEX_PROXY_URL, DEFAULT_OPENAI_CODEX_SEARCH_CONTEXT_SIZE, DEFAULT_OPENAI_CODEX_SEARCH_MAX_OUTPUT_TOKENS, DEFAULT_OPENAI_CODEX_SEARCH_MODE, DEFAULT_OPENAI_CODEX_SEARCH_MODEL, DEFAULT_OPENAI_CODEX_SETTINGS, DSH_PLUGIN_API_PACKAGES, FastModeRegistry, FastModeRegistry as OpenAICodexFastModeRegistry, IMAGE_GENERATE_TOOL_NAME, OPENAI_CODEX_ACCOUNT_LIMIT, OPENAI_CODEX_AUTH_DOCUMENT_LIMIT, OPENAI_CODEX_AUTH_FILENAME, OPENAI_CODEX_AUTH_V1_BACKUP_SUFFIX, OPENAI_CODEX_BASE_URL, OPENAI_CODEX_FAST_MODE_MAX_SESSIONS, OPENAI_CODEX_FAST_MODE_MAX_SESSION_ID_LENGTH, OPENAI_CODEX_FAST_MODE_PATH, OPENAI_CODEX_HISTORY_BACKUP_SUFFIX, OPENAI_CODEX_IMAGE_GENERATION_URL, OPENAI_CODEX_IMAGE_MAX_COUNT, OPENAI_CODEX_IMAGE_MAX_ERROR_BYTES, OPENAI_CODEX_IMAGE_MAX_RESPONSE_BYTES, OPENAI_CODEX_IMAGE_PROMPT_MAX_LENGTH, OPENAI_CODEX_IMAGE_REQUEST_TIMEOUT_MS, OPENAI_CODEX_LOCAL_PROXY_CANDIDATES, OPENAI_CODEX_PROVIDER, OPENAI_CODEX_PROXY_CANDIDATE_LIMIT, OPENAI_CODEX_PROXY_DETECT_PATH, OPENAI_CODEX_PROXY_PROBE_TIMEOUT_MS, OPENAI_CODEX_PROXY_PROBE_URL, OPENAI_CODEX_PROXY_TEST_PATH, OPENAI_CODEX_SEARCH_MODEL_REQUEST_EVENT, OPENAI_CODEX_SEARCH_PROVIDER, OPENAI_CODEX_SEARCH_URL, OPENAI_CODEX_SETTINGS_NAMESPACE, OPENAI_CODEX_SETTINGS_NS, OPENAI_CODEX_TRANSPORT_API_VERSION, OPENAI_CODEX_TRANSPORT_ERROR_CODES, OPENAI_CODEX_TRANSPORT_SERVICE, OPENAI_CODEX_UPDATE_PATH, OPENAI_CODEX_USAGE_URL, OpenAICodexCredentialStore, OpenAICodexProxyManager, OpenAICodexSearchProvider, OpenAICodexTransport, OpenAICodexTransportError, PI_AI_PACKAGE, SUPPORTED_DSH_PLUGIN_API_VERSION, SUPPORTED_NODE_RANGE, SUPPORTED_PI_AI_RANGE, VIEW_IMAGE_TOOL_NAME, apply, assertNoOpenAICodexProviderConflict, assessCompatibility, checkForOpenAICodexUpdate, compareOpenAICodexVersions, decodeOpenAICodexSettings, detectCompatibility, detectOpenAICodexProxies, diagnoseOpenAICodex, evaluateCompatibility, inject, isFastModeSessionId, isOpenAICodexTransportError, isValidOpenAICodexContextWindowOverrides, isValidOpenAICodexProxyUrl, listOpenAICodexProxyCandidates, loginOpenAICodex, logoutOpenAICodex, mapOpenAICodexSearchResponse, migrateOpenAICodexSearchHistory, name, openAICodexAuthPath, openAICodexAuthStatus, openAICodexConflictMessage, parseOpenAICodexUpdateResult, parseOpenAICodexUsage, parseOpenAICodexVersion, readOpenAICodexRateLimits, resolveOpenAICodexProxyUrl, resolveOpenAICodexSettings };