dsh-codex-oauth 0.1.1 → 0.2.1

package/README.md

@@ -2,47 +2,72 @@
 
 [English](README.md) | [中文](README.zh.md)
 
-DSH adapter that uses the same OpenAI Codex OAuth credential as Pi:
-`~/.pi/agent/auth.json` → `openai-codex`.
+A standalone [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) plugin for using ChatGPT Plus/Pro Codex models through OpenAI's Codex OAuth flow. Pi is **not** required.
 
-It uses Pi's installed `@earendil-works/pi-ai` Codex provider and DSH's public
-`dsh-llm-pi-ai` adapter, including the official Codex Responses transport, images,
-tool calls, reasoning replay, compaction, and OAuth refresh. It does not copy the
-token into an API-key environment variable.
+It uses the official `openaiCodexProvider` from `@earendil-works/pi-ai` and DSH's public `dsh-llm-pi-ai` adapter. It supports streaming, tool calls, reasoning, images, replay, compaction, automatic token refresh, and the Codex model catalog.
+
+This is the ChatGPT Codex backend, not a general OpenAI Platform API-key adapter.
 
 ## Install
 
 ```bash
 dsh plugin --profile web add dsh-codex-oauth
+dsh web
 ```
 
-For a manual profile install, add the package to the profile and include this
-entry in its `cordis.patch.yml`:
+For an `npx` installation:
 
-```yaml
-- insert:
-    - id: llm-codex-oauth
-      name: dsh-codex-oauth
+```bash
+npx @deepseek-ai/dsh plugin --profile web add dsh-codex-oauth
+npx @deepseek-ai/dsh web
 ```
 
-The profile must also include the normal `llm` service. Restart:
+## Sign in
+
+The plugin owns its own credential file and login flow. No Pi installation or token copying is needed.
+
+### Web UI
+
+Open **Settings → OpenAI Codex** and click **Sign in with ChatGPT**. A browser window opens for the OAuth approval; after it completes, return to DSH and select `openai-codex` in the model picker.
+
+### CLI
 
 ```bash
-npx @deepseek-ai/dsh web
+dsh plugin --profile web exec dsh-openai-codex login
+# headless machines:
+dsh plugin --profile web exec dsh-openai-codex login --device-code
+
+dsh plugin --profile web exec dsh-openai-codex status
+dsh plugin --profile web exec dsh-openai-codex logout
 ```
 
-Then select provider `openai-codex` in the model picker.
+The browser login opens OpenAI's authorization page and completes through a localhost callback. `--device-code` is the fallback for machines without a usable browser.
+
+After signing in, choose `openai-codex` in the DSH model picker.
+
+### Credentials
+
+Credentials are stored at:
+
+```text
+$DSH_HOME/.openai-codex-auth.json
+```
+
+The default is `~/.dsh/.openai-codex-auth.json`. The file is written atomically with owner-only permissions, and refresh/login/logout operations use a cross-process file lock. The plugin never reads or modifies `~/.pi/agent/auth.json` or `~/.codex/auth.json`.
+
+## Development
+
+```bash
+npm test
+```
 
-## Scope
+The test requires the DSH and `pi-ai` peer dependencies supplied by a DSH profile.
 
-The plugin delegates message conversion, streaming, image attachments, tool calls,
-reasoning replay, and compaction to DSH's public `dsh-llm-pi-ai` adapter. It only
-bridges the credential store to Pi's existing OAuth document.
+## Limitations
 
-The plugin reads/writes `~/.pi/agent/auth.json` and never prints token values.
-Because Pi and DSH do not share a cross-application lock, avoid starting both at the
-same time while an OAuth refresh may occur; a future version may use a separate DSH
-credential file and its own login flow to remove that race.
+- ChatGPT plan eligibility, model access, quotas, and backend behavior are controlled by OpenAI and may change.
+- Codex endpoints are not public OpenAI Platform API endpoints.
+- Filesystem, shell, MCP, permissions, attachments, and other DSH capabilities come from the active profile.
 
 ## License
 

package/README.zh.md

@@ -2,71 +2,71 @@
 
 [English](README.md) | 中文
 
-让 [DeepSeek Harness（dsh）](https://github.com/deepseek-ai/deepseek-harness)
-复用 Pi 已登录的 ChatGPT Plus/Pro Codex OAuth，在不使用 OpenAI Platform API Key 的情况下调用 `openai-codex` 模型。
+一个独立的 [DeepSeek Harness（dsh）](https://github.com/deepseek-ai/deepseek-harness) 插件，通过 OpenAI Codex OAuth 使用 ChatGPT Plus/Pro 订阅模型。
 
-本插件不是普通的 OpenAI API 适配器，也不会把 ChatGPT 订阅变成通用 API 凭据。它使用 Pi 的 Codex provider、官方 Codex Responses 传输和 DSH 公共的 `dsh-llm-pi-ai` 适配器。
+**不需要安装 Pi。** 插件使用 `@earendil-works/pi-ai` 提供的 Codex provider，以及 DSH 公共的 `dsh-llm-pi-ai` 适配器，支持流式输出、工具调用、推理、图片、replay、上下文压缩、OAuth 自动刷新和 Codex 模型目录。
 
-## 功能
-
-- 复用 `~/.pi/agent/auth.json` 中的 `openai-codex` OAuth 凭据；
-- access token 过期时自动使用 refresh token 更新；
-- 使用 Pi 同款 Codex 模型目录；
-- 支持流式输出、工具调用、推理、图片输入、replay 和上下文压缩；
-- 不读取或打印 API Key，也不会把 token 放进环境变量。
+这是 ChatGPT Codex 后端接入，不是普通的 OpenAI Platform API Key 适配器。
 
 ## 安装
 
-将插件安装到 dsh 的 `web` profile：
-
 ```bash
 dsh plugin --profile web add dsh-codex-oauth
 dsh web
 ```
 
-如果使用的是 `npx` 版本：
+如果使用 `npx`：
 
 ```bash
 npx @deepseek-ai/dsh plugin --profile web add dsh-codex-oauth
 npx @deepseek-ai/dsh web
 ```
 
-启动后，在模型选择器中选择：
+## 登录
 
-```text
-Provider: openai-codex
-```
+插件拥有独立的 OAuth 登录流程和凭据文件。新用户不需要安装 Pi，也不需要复制任何 token。
+
+### Web UI
+
+打开 **设置 → OpenAI Codex**，点击 **使用 ChatGPT 登录**。插件会打开浏览器完成 OAuth 授权；返回 DSH 后，在模型选择器中选择 `openai-codex`。
 
-也可以手动把下面的条目加入 profile 的 `cordis.patch.yml`：
+### 命令行登录
 
-```yaml
-- insert:
-    - id: llm-codex-oauth
-      name: dsh-codex-oauth
+```bash
+dsh plugin --profile web exec dsh-openai-codex login
 ```
 
-## 前置条件
+无图形浏览器的机器：
+
+```bash
+dsh plugin --profile web exec dsh-openai-codex login --device-code
+```
 
-Pi 必须已经完成 OpenAI Codex 登录，并且存在：
+查看状态和退出登录：
 
-```text
-~/.pi/agent/auth.json
+```bash
+dsh plugin --profile web exec dsh-openai-codex status
+dsh plugin --profile web exec dsh-openai-codex logout
 ```
 
-文件中应有 `openai-codex` OAuth 条目。插件不会替用户登录，也不会要求复制 token。
+浏览器登录会打开 OpenAI 授权页面，并通过 localhost 回调完成。登录后，在 DSH 模型选择器中选择 `openai-codex`。
 
-## 凭据与并发注意事项
+### 凭据存储
 
-插件只使用 Pi 的现有凭据文件，并会在 OAuth 刷新后写回该文件。Pi 与 DSH 并不共享同一个跨应用锁，因此在 token 可能刷新时，不建议同时运行 Pi 和 DSH。
+凭据默认存储在：
 
-卸载插件不会删除 Pi 的登录凭据。若要退出登录，请通过 Pi 自己的 `/logout` 完成。
+```text
+~/.dsh/.openai-codex-auth.json
+```
 
-## 限制
+也可以通过 `DSH_HOME` 改变目录。文件采用原子写入、仅所有者可读写（`0600`），登录、刷新和退出登录使用跨进程文件锁。
 
-- ChatGPT 订阅权限、模型目录、配额和 Codex 后端行为由 OpenAI 控制，可能变化；
-- 插件依赖 DSH 的公共 `dsh-llm-pi-ai` 适配器，需与当前 DSH 版本兼容；
-- 这是 Codex 后端接入，不是公开的 OpenAI Platform API；
-- DSH 的其他能力（文件系统、Shell、MCP、权限、附件等）仍由当前 profile 提供。
+插件**不会**读取或修改：
+
+```text
+~/.pi/agent/auth.json
+~/.codex/auth.json
+```
 
 ## 开发与测试
 
@@ -74,7 +74,13 @@ Pi 必须已经完成 OpenAI Codex 登录，并且存在：
 npm test
 ```
 
-测试需要 DSH 和 Pi 的依赖已经安装或由 DSH profile 提供。
+测试需要当前 DSH profile 提供 DSH 和 `pi-ai` peer dependencies。
+
+## 限制
+
+- ChatGPT 套餐资格、模型权限、配额和后端行为由 OpenAI 控制，可能变化；
+- Codex 端点不是公开的 OpenAI Platform API 端点；
+- 文件系统、Shell、MCP、权限、附件等能力仍由当前 DSH profile 提供。
 
 ## 许可证
 

package/SPEC.md

@@ -0,0 +1,73 @@
+# dsh-codex-oauth 独立登录规格
+
+## 目标
+
+让新用户只安装 DSH 插件即可登录并使用 ChatGPT Codex 订阅，不要求安装 Pi，也不读取或修改 `~/.pi/agent/auth.json`。
+
+## 用户流程
+
+### CLI（第一版）
+
+1. 安装插件并重启 DSH；
+2. 执行 `dsh-openai-codex login`；
+3. 插件打开 OpenAI OAuth 授权页；
+4. 用户在浏览器中批准；
+5. localhost 回调完成登录；
+6. DSH 使用 `openai-codex` 模型。
+
+无图形浏览器时使用 `login --device-code`。
+
+### Web
+
+在 DSH 设置页提供登录状态、浏览器 OAuth 登录和退出登录按钮。
+
+### 命令
+
+提供：
+
+```bash
+dsh plugin --profile web exec dsh-openai-codex login
+dsh plugin --profile web exec dsh-openai-codex status
+dsh plugin --profile web exec dsh-openai-codex logout
+```
+
+无图形浏览器时提供 `login --device-code`。
+
+## 凭据
+
+- 存储位置：`$DSH_HOME/.openai-codex-auth.json`，默认 `~/.dsh/.openai-codex-auth.json`；
+- 格式：版本化 JSON，字段为 `version` 和 `credential`；
+- `credential` 保留 `type`, `access`, `refresh`, `expires`, `accountId`；
+- 原子写入，文件权限 `0600`，目录权限 `0700`；
+- 刷新、登录、登出使用跨进程文件锁；
+- 不读取、复制、修改 `~/.pi/agent/auth.json` 或 `~/.codex/auth.json`。
+
+## API 与模型
+
+- 使用 `@earendil-works/pi-ai` 的 `openaiCodexProvider`；
+- 使用 DSH 公共 `PiAiAdapter`；
+- 使用 Codex Responses endpoint，不伪装成普通 OpenAI Platform API；
+- 保留流式输出、工具调用、推理、图片、replay 和 compaction；
+- 新建 agent 默认模型沿用 Codex catalog 中的可用模型，不硬编码不存在的模型。
+
+## 安全边界
+
+- OAuth 密码、授权码、access token、refresh token 不进入日志、session、Git 或错误信息；
+- Web 登录回调只接受 localhost 同源请求，并返回 `no-store`；
+- 插件移除不自动删除凭据；登出必须由用户明确执行；
+- 不实现普通 OpenAI API Key 兼容层。
+
+## 明确不做
+
+- 不依赖 Pi；
+- 不导入 Pi 的 auth 文件；
+- 不修改 DSH 源码；
+- 第一版不加入独立搜索、图片生成和额度面板；这些属于后续功能。
+
+## 验收标准
+
+- 干净环境安装插件后，`status` 返回 signed out；
+- CLI OAuth 登录后，`status` 返回 signed in，且不打印 token；
+- access token 过期后请求会自动刷新并持久化；
+- 删除 Pi auth 文件不影响 DSH 插件；
+- Web profile 能加载 `openai-codex`，且公共 DSH adapter 的图片、工具和 replay 测试继续通过。

package/bin/dsh-openai-codex.js

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+import { spawn } from "node:child_process";
+import { createInterface } from "node:readline/promises";
+import { authPath, login, logout, status } from "../lib/auth.js";
+
+function openBrowser(raw) {
+  const url = new URL(raw);
+  if (url.protocol !== "https:") throw new Error("Refusing to open a non-HTTPS OAuth URL");
+  const command = process.platform === "darwin" ? ["open", url.href] : process.platform === "win32" ? ["rundll32.exe", "url.dll,FileProtocolHandler", url.href] : ["xdg-open", url.href];
+  const child = spawn(command[0], command.slice(1), { detached: true, stdio: "ignore", windowsHide: true });
+  child.on("error", () => {}); child.unref();
+}
+function safeMessage(error) {
+  return String(error?.message ?? error)
+    .replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[redacted token]")
+    .replace(/(\b(?:code|token|refresh_token|access_token)=)[^&\s]+/giu, "$1[redacted]");
+}
+function help() {
+  console.log("Usage: dsh-openai-codex <login|logout|status> [--device-code]");
+}
+
+const [action, ...flags] = process.argv.slice(2);
+if (!action || action === "--help" || action === "-h") { help(); process.exit(0); }
+if (!["login", "logout", "status"].includes(action) || flags.some((flag) => flag !== "--device-code") || (action !== "login" && flags.length)) { help(); process.exit(1); }
+try {
+  if (action === "status") {
+    const value = await status();
+    if (!value.authenticated) { console.log("OpenAI Codex for dsh: signed out"); process.exitCode = 1; }
+    else console.log(`OpenAI Codex for dsh: signed in; refresh is automatic`);
+  } else if (action === "logout") {
+    await logout(); console.log(`OpenAI Codex for dsh: signed out; removed ${authPath()}`);
+  } else {
+    const readline = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+      await login(undefined, {
+        prompt: async (prompt) => {
+          if (prompt.type === "select") return flags.includes("--device-code") ? "device_code" : "browser";
+          return readline.question(`${prompt.message}: `, { signal: prompt.signal });
+        },
+        notify: (event) => {
+          if (event.type === "auth_url") { console.log(`Open this URL to sign in:\n${event.url}`); openBrowser(event.url); }
+          else if (event.type === "device_code") { console.log(`Open ${event.verificationUri} and enter ${event.userCode}`); openBrowser(event.verificationUri); }
+          else if (event.message) console.log(event.message);
+        },
+      });
+    } finally { readline.close(); }
+    console.log(`OpenAI Codex for dsh: signed in; credentials saved to ${authPath()}`);
+  }
+} catch (error) {
+  console.error(`dsh-openai-codex: ${safeMessage(error)}`);
+  process.exitCode = 1;
+}

package/client/index.jsx

@@ -0,0 +1,49 @@
+import React, { useCallback, useEffect, useState } from "react";
+
+const STATUS = "/plugins/dsh-codex-oauth/auth/status";
+const LOGIN = "/plugins/dsh-codex-oauth/auth/login";
+const LOGOUT = "/plugins/dsh-codex-oauth/auth/logout";
+const h = React.createElement;
+
+async function request(path, method = "GET") {
+  const response = await fetch(path, { method, credentials: "same-origin", headers: { accept: "application/json" } });
+  const value = await response.json().catch(() => ({}));
+  if (!response.ok) throw new Error(value.error || `HTTP ${response.status}`);
+  return value;
+}
+
+function CodexSettings() {
+  const [state, setState] = useState({ status: "loading" });
+  const [busy, setBusy] = useState(false);
+  const refresh = useCallback(() => request(STATUS).then(setState).catch((error) => setState({ status: "error", message: error.message })), []);
+  useEffect(() => { refresh(); }, [refresh]);
+  useEffect(() => {
+    if (state.status !== "signing-in") return undefined;
+    const timer = setInterval(refresh, 1000);
+    return () => clearInterval(timer);
+  }, [refresh, state.status]);
+  const signIn = async () => {
+    setBusy(true); setState({ status: "signing-in" });
+    const popup = window.open("about:blank", "_blank", "noopener,noreferrer");
+    try { const challenge = await request(LOGIN, "POST"); if (!popup) throw new Error("Please allow popups to sign in"); popup.location.replace(challenge.url); }
+    catch (error) { popup?.close(); setState({ status: "error", message: error.message }); }
+    finally { setBusy(false); }
+  };
+  const signOut = async () => { setBusy(true); try { await request(LOGOUT, "POST"); setState({ status: "signed-out" }); } catch (error) { setState({ status: "error", message: error.message }); } finally { setBusy(false); } };
+  const signedIn = state.status === "signed-in";
+  const label = state.status === "signed-in" ? "已登录" : state.status === "signing-in" ? "等待浏览器完成登录…" : state.status === "loading" ? "检查登录状态…" : state.status === "error" ? "登录失败" : "未登录";
+  return h("section", { style: { display: "flex", flexDirection: "column", gap: 12, maxWidth: 640 } },
+    h("h2", { style: { margin: 0 } }, "OpenAI Codex"),
+    h("p", { style: { margin: 0, color: "var(--dsw-alias-label-secondary)" } }, "使用 ChatGPT Plus/Pro 的 Codex 订阅，无需 OpenAI API Key。"),
+    h("div", { style: { display: "flex", alignItems: "center", justifyContent: "space-between", padding: 16, border: "1px solid var(--dsw-alias-border-l2)", borderRadius: 10 } },
+      h("span", null, label),
+      state.status === "loading" ? null : h("button", { type: "button", disabled: busy || state.status === "signing-in", onClick: signedIn ? signOut : signIn }, signedIn ? "退出登录" : "使用 ChatGPT 登录")),
+    state.status === "error" ? h("p", { style: { color: "var(--dsw-alias-state-error-primary)" } }, state.message) : null,
+    h("p", { style: { margin: 0, color: "var(--dsw-alias-label-secondary)", fontSize: 13 } }, "凭据保存在 DSH_HOME/.openai-codex-auth.json，不会读取 Pi 或 Codex CLI 的登录文件。"));
+}
+
+export const name = "dsh-codex-oauth-client";
+export const inject = ["slots"];
+export function apply(ctx) {
+  ctx.slots.inject("settings.section", () => ctx.slots.register({ name: "settings.section", id: "dsh-codex-oauth", order: 15, label: () => "OpenAI Codex" }, CodexSettings));
+}

package/lib/auth.js

@@ -0,0 +1,21 @@
+import { createModels } from "@earendil-works/pi-ai";
+import { openaiCodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
+import { CodexCredentialStore, OPENAI_CODEX_PROVIDER, authPath } from "./store.js";
+
+function models(store) {
+  const value = createModels({ credentials: store });
+  value.setProvider(openaiCodexProvider());
+  return value;
+}
+
+export async function login(store = new CodexCredentialStore(), interaction) {
+  await models(store).login(OPENAI_CODEX_PROVIDER, "oauth", interaction);
+}
+export async function logout(store = new CodexCredentialStore()) {
+  await store.delete(OPENAI_CODEX_PROVIDER);
+}
+export async function status(store = new CodexCredentialStore()) {
+  const credential = await store.read(OPENAI_CODEX_PROVIDER);
+  return credential?.type === "oauth" ? { authenticated: true, expiresAt: new Date(credential.expires) } : { authenticated: false };
+}
+export { authPath };

package/lib/client.js

@@ -0,0 +1,14 @@
+var G=Object.create;var k=Object.defineProperty;var H=Object.getOwnPropertyDescriptor;var M=Object.getOwnPropertyNames;var z=Object.getPrototypeOf,B=Object.prototype.hasOwnProperty;var O=(e,t)=>()=>{try{return t||e((t={exports:{}}).exports,t),t.exports}catch(r){throw t=0,r}};var W=(e,t,r,u)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of M(t))!B.call(e,n)&&n!==r&&k(e,n,{get:()=>t[n],enumerable:!(u=H(t,n))||u.enumerable});return e};var K=(e,t,r)=>(r=e!=null?G(z(e)):{},W(t||!e||!e.__esModule?k(r,"default",{value:e,enumerable:!0}):r,e));var V=O(o=>{"use strict";var h=Symbol.for("react.element"),J=Symbol.for("react.portal"),Q=Symbol.for("react.fragment"),X=Symbol.for("react.strict_mode"),Y=Symbol.for("react.profiler"),Z=Symbol.for("react.provider"),ee=Symbol.for("react.context"),te=Symbol.for("react.forward_ref"),re=Symbol.for("react.suspense"),ne=Symbol.for("react.memo"),oe=Symbol.for("react.lazy"),R=Symbol.iterator;function ue(e){return e===null||typeof e!="object"?null:(e=R&&e[R]||e["@@iterator"],typeof e=="function"?e:null)}var P={isMounted:function(){return!1},enqueueForceUpdate:function(){},enqueueReplaceState:function(){},enqueueSetState:function(){}},I=Object.assign,T={};function y(e,t,r){this.props=e,this.context=t,this.refs=T,this.updater=r||P}y.prototype.isReactComponent={};y.prototype.setState=function(e,t){if(typeof e!="object"&&typeof e!="function"&&e!=null)throw Error("setState(...): takes an object of state variables to update or a function which returns an object of state variables.");this.updater.enqueueSetState(this,e,t,"setState")};y.prototype.forceUpdate=function(e){this.updater.enqueueForceUpdate(this,e,"forceUpdate")};function A(){}A.prototype=y.prototype;function w(e,t,r){this.props=e,this.context=t,this.refs=T,this.updater=r||P}var b=w.prototype=new A;b.constructor=w;I(b,y.prototype);b.isPureReactComponent=!0;var j=Array.isArray,D=Object.prototype.hasOwnProperty,E={current:null},q={key:!0,ref:!0,__self:!0,__source:!0};function L(e,t,r){var u,n={},c=null,a=null;if(t!=null)for(u in t.ref!==void 0&&(a=t.ref),t.key!==void 0&&(c=""+t.key),t)D.call(t,u)&&!q.hasOwnProperty(u)&&(n[u]=t[u]);var s=arguments.length-2;if(s===1)n.children=r;else if(1<s){for(var i=Array(s),l=0;l<s;l++)i[l]=arguments[l+2];n.children=i}if(e&&e.defaultProps)for(u in s=e.defaultProps,s)n[u]===void 0&&(n[u]=s[u]);return{$$typeof:h,type:e,key:c,ref:a,props:n,_owner:E.current}}function se(e,t){return{$$typeof:h,type:e.type,key:t,ref:e.ref,props:e.props,_owner:e._owner}}function x(e){return typeof e=="object"&&e!==null&&e.$$typeof===h}function ie(e){var t={"=":"=0",":":"=2"};return"$"+e.replace(/[=:]/g,function(r){return t[r]})}var $=/\/+/g;function S(e,t){return typeof e=="object"&&e!==null&&e.key!=null?ie(""+e.key):t.toString(36)}function g(e,t,r,u,n){var c=typeof e;(c==="undefined"||c==="boolean")&&(e=null);var a=!1;if(e===null)a=!0;else switch(c){case"string":case"number":a=!0;break;case"object":switch(e.$$typeof){case h:case J:a=!0}}if(a)return a=e,n=n(a),e=u===""?"."+S(a,0):u,j(n)?(r="",e!=null&&(r=e.replace($,"$&/")+"/"),g(n,t,r,"",function(l){return l})):n!=null&&(x(n)&&(n=se(n,r+(!n.key||a&&a.key===n.key?"":(""+n.key).replace($,"$&/")+"/")+e)),t.push(n)),1;if(a=0,u=u===""?".":u+":",j(e))for(var s=0;s<e.length;s++){c=e[s];var i=u+S(c,s);a+=g(c,t,r,i,n)}else if(i=ue(e),typeof i=="function")for(e=i.call(e),s=0;!(c=e.next()).done;)c=c.value,i=u+S(c,s++),a+=g(c,t,r,i,n);else if(c==="object")throw t=String(e),Error("Objects are not valid as a React child (found: "+(t==="[object Object]"?"object with keys {"+Object.keys(e).join(", ")+"}":t)+"). If you meant to render a collection of children, use an array instead.");return a}function m(e,t,r){if(e==null)return e;var u=[],n=0;return g(e,u,"","",function(c){return t.call(r,c,n++)}),u}function ce(e){if(e._status===-1){var t=e._result;t=t(),t.then(function(r){(e._status===0||e._status===-1)&&(e._status=1,e._result=r)},function(r){(e._status===0||e._status===-1)&&(e._status=2,e._result=r)}),e._status===-1&&(e._status=0,e._result=t)}if(e._status===1)return e._result.default;throw e._result}var f={current:null},v={transition:null},ae={ReactCurrentDispatcher:f,ReactCurrentBatchConfig:v,ReactCurrentOwner:E};function U(){throw Error("act(...) is not supported in production builds of React.")}o.Children={map:m,forEach:function(e,t,r){m(e,function(){t.apply(this,arguments)},r)},count:function(e){var t=0;return m(e,function(){t++}),t},toArray:function(e){return m(e,function(t){return t})||[]},only:function(e){if(!x(e))throw Error("React.Children.only expected to receive a single React element child.");return e}};o.Component=y;o.Fragment=Q;o.Profiler=Y;o.PureComponent=w;o.StrictMode=X;o.Suspense=re;o.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED=ae;o.act=U;o.cloneElement=function(e,t,r){if(e==null)throw Error("React.cloneElement(...): The argument must be a React element, but you passed "+e+".");var u=I({},e.props),n=e.key,c=e.ref,a=e._owner;if(t!=null){if(t.ref!==void 0&&(c=t.ref,a=E.current),t.key!==void 0&&(n=""+t.key),e.type&&e.type.defaultProps)var s=e.type.defaultProps;for(i in t)D.call(t,i)&&!q.hasOwnProperty(i)&&(u[i]=t[i]===void 0&&s!==void 0?s[i]:t[i])}var i=arguments.length-2;if(i===1)u.children=r;else if(1<i){s=Array(i);for(var l=0;l<i;l++)s[l]=arguments[l+2];u.children=s}return{$$typeof:h,type:e.type,key:n,ref:c,props:u,_owner:a}};o.createContext=function(e){return e={$$typeof:ee,_currentValue:e,_currentValue2:e,_threadCount:0,Provider:null,Consumer:null,_defaultValue:null,_globalName:null},e.Provider={$$typeof:Z,_context:e},e.Consumer=e};o.createElement=L;o.createFactory=function(e){var t=L.bind(null,e);return t.type=e,t};o.createRef=function(){return{current:null}};o.forwardRef=function(e){return{$$typeof:te,render:e}};o.isValidElement=x;o.lazy=function(e){return{$$typeof:oe,_payload:{_status:-1,_result:e},_init:ce}};o.memo=function(e,t){return{$$typeof:ne,type:e,compare:t===void 0?null:t}};o.startTransition=function(e){var t=v.transition;v.transition={};try{e()}finally{v.transition=t}};o.unstable_act=U;o.useCallback=function(e,t){return f.current.useCallback(e,t)};o.useContext=function(e){return f.current.useContext(e)};o.useDebugValue=function(){};o.useDeferredValue=function(e){return f.current.useDeferredValue(e)};o.useEffect=function(e,t){return f.current.useEffect(e,t)};o.useId=function(){return f.current.useId()};o.useImperativeHandle=function(e,t,r){return f.current.useImperativeHandle(e,t,r)};o.useInsertionEffect=function(e,t){return f.current.useInsertionEffect(e,t)};o.useLayoutEffect=function(e,t){return f.current.useLayoutEffect(e,t)};o.useMemo=function(e,t){return f.current.useMemo(e,t)};o.useReducer=function(e,t,r){return f.current.useReducer(e,t,r)};o.useRef=function(e){return f.current.useRef(e)};o.useState=function(e){return f.current.useState(e)};o.useSyncExternalStore=function(e,t,r){return f.current.useSyncExternalStore(e,t,r)};o.useTransition=function(){return f.current.useTransition()};o.version="18.3.1"});var F=O((me,N)=>{"use strict";N.exports=V()});var p=K(F(),1),le="/plugins/dsh-codex-oauth/auth/status",fe="/plugins/dsh-codex-oauth/auth/login",pe="/plugins/dsh-codex-oauth/auth/logout",d=p.default.createElement;async function C(e,t="GET"){let r=await fetch(e,{method:t,credentials:"same-origin",headers:{accept:"application/json"}}),u=await r.json().catch(()=>({}));if(!r.ok)throw new Error(u.error||`HTTP ${r.status}`);return u}function de(){let[e,t]=(0,p.useState)({status:"loading"}),[r,u]=(0,p.useState)(!1),n=(0,p.useCallback)(()=>C(le).then(t).catch(l=>t({status:"error",message:l.message})),[]);(0,p.useEffect)(()=>{n()},[n]),(0,p.useEffect)(()=>{if(e.status!=="signing-in")return;let l=setInterval(n,1e3);return()=>clearInterval(l)},[n,e.status]);let c=async()=>{u(!0),t({status:"signing-in"});let l=window.open("about:blank","_blank","noopener,noreferrer");try{let _=await C(fe,"POST");if(!l)throw new Error("Please allow popups to sign in");l.location.replace(_.url)}catch(_){l?.close(),t({status:"error",message:_.message})}finally{u(!1)}},a=async()=>{u(!0);try{await C(pe,"POST"),t({status:"signed-out"})}catch(l){t({status:"error",message:l.message})}finally{u(!1)}},s=e.status==="signed-in",i=e.status==="signed-in"?"\u5DF2\u767B\u5F55":e.status==="signing-in"?"\u7B49\u5F85\u6D4F\u89C8\u5668\u5B8C\u6210\u767B\u5F55\u2026":e.status==="loading"?"\u68C0\u67E5\u767B\u5F55\u72B6\u6001\u2026":e.status==="error"?"\u767B\u5F55\u5931\u8D25":"\u672A\u767B\u5F55";return d("section",{style:{display:"flex",flexDirection:"column",gap:12,maxWidth:640}},d("h2",{style:{margin:0}},"OpenAI Codex"),d("p",{style:{margin:0,color:"var(--dsw-alias-label-secondary)"}},"\u4F7F\u7528 ChatGPT Plus/Pro \u7684 Codex \u8BA2\u9605\uFF0C\u65E0\u9700 OpenAI API Key\u3002"),d("div",{style:{display:"flex",alignItems:"center",justifyContent:"space-between",padding:16,border:"1px solid var(--dsw-alias-border-l2)",borderRadius:10}},d("span",null,i),e.status==="loading"?null:d("button",{type:"button",disabled:r||e.status==="signing-in",onClick:s?a:c},s?"\u9000\u51FA\u767B\u5F55":"\u4F7F\u7528 ChatGPT \u767B\u5F55")),e.status==="error"?d("p",{style:{color:"var(--dsw-alias-state-error-primary)"}},e.message):null,d("p",{style:{margin:0,color:"var(--dsw-alias-label-secondary)",fontSize:13}},"\u51ED\u636E\u4FDD\u5B58\u5728 DSH_HOME/.openai-codex-auth.json\uFF0C\u4E0D\u4F1A\u8BFB\u53D6 Pi \u6216 Codex CLI \u7684\u767B\u5F55\u6587\u4EF6\u3002"))}var ge="dsh-codex-oauth-client",ve=["slots"];function _e(e){e.slots.inject("settings.section",()=>e.slots.register({name:"settings.section",id:"dsh-codex-oauth",order:15,label:()=>"OpenAI Codex"},de))}export{_e as apply,ve as inject,ge as name};
+/*! Bundled license information:
+
+react/cjs/react.production.min.js:
+  (**
+   * @license React
+   * react.production.min.js
+   *
+   * Copyright (c) Facebook, Inc. and its affiliates.
+   *
+   * This source code is licensed under the MIT license found in the
+   * LICENSE file in the root directory of this source tree.
+   *)
+*/

package/lib/index.js

@@ -1,15 +1,18 @@
 import { createCodexAdapter } from "./adapter.js";
-import { PiCodexCredentialStore, OPENAI_CODEX_PROVIDER, PI_AUTH_FILE } from "./store.js";
+import { CodexCredentialStore, OPENAI_CODEX_PROVIDER, authPath } from "./store.js";
+import { registerWebAuth } from "./web-auth.js";
+export { login, logout, status } from "./auth.js";
 
 export const name = "llm-codex-oauth";
 export const inject = ["llm"];
 
-export { OPENAI_CODEX_PROVIDER, PI_AUTH_FILE, PiCodexCredentialStore, createCodexAdapter };
+export { OPENAI_CODEX_PROVIDER, CodexCredentialStore, authPath, createCodexAdapter };
 
 export function apply(ctx) {
-  const credentials = new PiCodexCredentialStore();
+  const credentials = new CodexCredentialStore();
   ctx.llm.registerAdapter(
     [OPENAI_CODEX_PROVIDER],
     createCodexAdapter(credentials, () => ctx.get?.("attachments")),
   );
+  registerWebAuth(ctx, credentials);
 }

package/lib/store.js

@@ -1,65 +1,60 @@
 import { mkdir, readFile, stat } from "node:fs/promises";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
 
 export const OPENAI_CODEX_PROVIDER = "openai-codex";
-export const PI_AUTH_FILE = join(homedir(), ".pi", "agent", "auth.json");
-
-function clone(value) {
-  return value === undefined ? undefined : structuredClone(value);
+export const OPENAI_CODEX_AUTH_FILE = ".openai-codex-auth.json";
+export function authPath(home = process.env.DSH_HOME || join(homedir(), ".dsh")) {
+  return resolve(join(home, OPENAI_CODEX_AUTH_FILE));
 }
 
+function clone(value) { return value === undefined ? undefined : structuredClone(value); }
 async function ownerOnly(filename) {
   if (process.platform === "win32") return;
   try {
     if ((await stat(filename)).mode & 0o077) throw new Error(`${filename} must be owner-only (chmod 600)`);
-  } catch (error) {
-    if (error?.code !== "ENOENT") throw error;
-  }
+  } catch (error) { if (error?.code !== "ENOENT") throw error; }
+}
+function parse(text, filename) {
+  let value;
+  try { value = JSON.parse(text); } catch { throw new Error(`${filename} is not valid JSON`); }
+  const credential = value?.credential;
+  if (value?.version !== 1 || !credential || credential.type !== "oauth") throw new Error(`${filename} has an invalid auth format`);
+  for (const key of ["access", "refresh", "accountId"])
+    if (typeof credential[key] !== "string" || credential[key].length === 0) throw new Error(`${filename} credential is invalid`);
+  if (!Number.isFinite(credential.expires) || credential.expires <= 0) throw new Error(`${filename} expiry is invalid`);
+  return clone(credential);
 }
 
-export class PiCodexCredentialStore {
-  constructor(filename = PI_AUTH_FILE) { this.filename = filename; }
-
-  async readAll() {
+export class CodexCredentialStore {
+  constructor(filename = authPath()) { this.filename = filename; }
+  async readCurrent() {
     await ownerOnly(this.filename);
-    try { return JSON.parse(await readFile(this.filename, "utf8")); }
-    catch (error) { if (error?.code === "ENOENT") return {}; throw error; }
-  }
-
-  async read(providerId) {
-    if (providerId !== OPENAI_CODEX_PROVIDER) return undefined;
-    const value = (await this.readAll())[providerId];
-    return value?.type === "oauth" ? clone(value) : undefined;
-  }
-
-  async list() {
-    return (await this.read(OPENAI_CODEX_PROVIDER) === undefined)
-      ? [] : [{ providerId: OPENAI_CODEX_PROVIDER, type: "oauth" }];
+    try { return parse(await readFile(this.filename, "utf8"), this.filename); }
+    catch (error) { if (error?.code === "ENOENT") return undefined; throw error; }
   }
-
+  async read(providerId) { return providerId === OPENAI_CODEX_PROVIDER ? this.readCurrent() : undefined; }
+  async list() { return (await this.readCurrent()) ? [{ providerId: OPENAI_CODEX_PROVIDER, type: "oauth" }] : []; }
   async modify(providerId, fn) {
     if (providerId !== OPENAI_CODEX_PROVIDER) throw new Error(`credential store does not own ${providerId}`);
     await mkdir(dirname(this.filename), { recursive: true, mode: 0o700 });
     return withFileLock(this.filename, async () => {
-      const auth = await this.readAll();
-      const current = auth[providerId];
+      const current = await this.readCurrent();
       const next = await fn(clone(current));
-      if (next === undefined) return clone(current);
-      auth[providerId] = next;
-      await writeFileAtomic(this.filename, `${JSON.stringify(auth, null, 2)}\n`, { mode: 0o600, dirMode: 0o700 });
+      if (next === undefined) return current;
+      const document = { version: 1, credential: next };
+      parse(JSON.stringify(document), this.filename);
+      await writeFileAtomic(this.filename, `${JSON.stringify(document, null, 2)}\n`, { mode: 0o600, dirMode: 0o700 });
       return clone(next);
     });
   }
-
   async delete(providerId) {
     if (providerId !== OPENAI_CODEX_PROVIDER) return;
     await mkdir(dirname(this.filename), { recursive: true, mode: 0o700 });
     await withFileLock(this.filename, async () => {
-      const auth = await this.readAll();
-      delete auth[providerId];
-      await writeFileAtomic(this.filename, `${JSON.stringify(auth, null, 2)}\n`, { mode: 0o600, dirMode: 0o700 });
+      const { rm } = await import("node:fs/promises");
+      await rm(this.filename, { force: true });
     });
   }
 }

package/lib/web-auth.js

@@ -0,0 +1,62 @@
+import { login, logout, status } from "./auth.js";
+
+export const AUTH_STATUS_PATH = "/plugins/dsh-codex-oauth/auth/status";
+export const AUTH_LOGIN_PATH = "/plugins/dsh-codex-oauth/auth/login";
+export const AUTH_LOGOUT_PATH = "/plugins/dsh-codex-oauth/auth/logout";
+
+function safeMessage(error) {
+  return String(error?.message ?? error)
+    .replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[redacted token]")
+    .replace(/(\b(?:code|token|refresh_token|access_token)=)[^&\s]+/giu, "$1[redacted]")
+    .slice(0, 500);
+}
+function trusted(req) {
+  const remote = req.socket.remoteAddress;
+  if (!["127.0.0.1", "::1", "::ffff:127.0.0.1"].includes(remote)) return false;
+  if (req.headers["sec-fetch-site"] === "cross-site") return false;
+  if (!req.headers.host) return false;
+  if (!req.headers.origin) return true;
+  try { return new URL(req.headers.origin).host === new URL(`http://${req.headers.host}`).host; }
+  catch { return false; }
+}
+function json(res, statusCode, value) {
+  res.writeHead(statusCode, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store", "x-content-type-options": "nosniff" });
+  res.end(JSON.stringify(value));
+}
+
+export function registerWebAuth(ctx, store) {
+  let operation;
+  let challenge;
+  let state = { status: "signed-out" };
+  const cancellation = new AbortController();
+  const update = () => status(store).then((value) => { state = value.authenticated ? { status: "signed-in" } : { status: "signed-out" }; return state; });
+  const start = () => {
+    if (operation) return;
+    state = { status: "signing-in" };
+    challenge = undefined;
+    operation = login(store, {
+      signal: cancellation.signal,
+      prompt: async (prompt) => prompt.type === "select" ? "browser" : new Promise((_resolve, reject) => cancellation.signal.addEventListener("abort", () => reject(cancellation.signal.reason), { once: true })),
+      notify: (event) => { if (event.type === "auth_url") challenge = { url: event.url }; },
+    }).then(update, (error) => { state = { status: "error", message: safeMessage(error) }; }).finally(() => { operation = undefined; });
+  };
+  ctx.inject(["webServer"], (web) => ctx.effect(() => {
+    const routes = [
+      web.webServer.register({ kind: "exact", path: AUTH_STATUS_PATH, handler: async (req, res) => {
+        if (req.method !== "GET" || !trusted(req)) return json(res, req.method === "GET" ? 403 : 405, { error: "forbidden" });
+        if (!operation) await update();
+        json(res, 200, state);
+      }}),
+      web.webServer.register({ kind: "exact", path: AUTH_LOGIN_PATH, handler: async (req, res) => {
+        if (req.method !== "POST" || !trusted(req)) return json(res, req.method === "POST" ? 403 : 405, { error: "forbidden" });
+        try { start(); for (let i = 0; i < 50 && !challenge && operation; i++) await new Promise((resolve) => setTimeout(resolve, 100)); if (!challenge) throw new Error("OAuth URL was not created"); json(res, 200, challenge); }
+        catch (error) { json(res, 500, { error: safeMessage(error) }); }
+      }}),
+      web.webServer.register({ kind: "exact", path: AUTH_LOGOUT_PATH, handler: async (req, res) => {
+        if (req.method !== "POST" || !trusted(req)) return json(res, req.method === "POST" ? 403 : 405, { error: "forbidden" });
+        cancellation.abort(new Error("sign-in cancelled")); await operation?.catch(() => {}); await logout(store); state = { status: "signed-out" }; json(res, 200, { ok: true });
+      }}),
+    ];
+    return async () => { cancellation.abort(new Error("plugin disposed")); await operation?.catch(() => {}); for (const dispose of routes) dispose(); };
+  }, "dsh-codex-oauth: Web OAuth routes"));
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-codex-oauth",
-  "version": "0.1.1",
-  "description": "Use Pi's OpenAI Codex OAuth subscription in DeepSeek Harness",
+  "version": "0.2.1",
+  "description": "Use a ChatGPT Codex subscription in DeepSeek Harness through standalone OAuth",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/eons2long/dsh-codex-oauth.git"
@@ -15,9 +15,16 @@
   "scripts": { "test": "node test/smoke.mjs" },
   "type": "module",
   "main": "lib/index.js",
-  "exports": { ".": "./lib/index.js" },
-  "files": ["lib", "cordis.patch.yml", "README.md", "README.zh.md", "LICENSE"],
-  "dsh": { "bundle": { "patch": "./cordis.patch.yml" } },
+  "bin": { "dsh-openai-codex": "bin/dsh-openai-codex.js" },
+  "exports": { ".": "./lib/index.js", "./client": "./lib/client.js", "./cordis.patch.yml": "./cordis.patch.yml" },
+  "files": ["lib", "bin", "client", "cordis.patch.yml", "README.md", "README.zh.md", "SPEC.md", "LICENSE"],
+  "dsh": {
+    "bundle": { "patch": "./cordis.patch.yml" },
+    "client": {
+      "inject": ["@deepseek-ai/dsh-client-runtime", "@deepseek-ai/dsh-client-ui-settings", "@deepseek-ai/dsh-client-locale"],
+      "platform": "web"
+    }
+  },
   "peerDependencies": {
     "@earendil-works/pi-ai": "^0.84.1",
     "@deepseek-ai/cordis": "^4.0.1",