dsh-codex-oauth 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 eons2long
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,49 @@
+# dsh-codex-oauth
+
+[English](README.md) | [中文](README.zh.md)
+
+DSH adapter that uses the same OpenAI Codex OAuth credential as Pi:
+`~/.pi/agent/auth.json` → `openai-codex`.
+
+It uses Pi's installed `@earendil-works/pi-ai` Codex provider and DSH's public
+`dsh-llm-pi-ai` adapter, including the official Codex Responses transport, images,
+tool calls, reasoning replay, compaction, and OAuth refresh. It does not copy the
+token into an API-key environment variable.
+
+## Install
+
+```bash
+dsh plugin --profile web add dsh-codex-oauth
+```
+
+For a manual profile install, add the package to the profile and include this
+entry in its `cordis.patch.yml`:
+
+```yaml
+- insert:
+    - id: llm-codex-oauth
+      name: dsh-codex-oauth
+```
+
+The profile must also include the normal `llm` service. Restart:
+
+```bash
+npx @deepseek-ai/dsh web
+```
+
+Then select provider `openai-codex` in the model picker.
+
+## Scope
+
+The plugin delegates message conversion, streaming, image attachments, tool calls,
+reasoning replay, and compaction to DSH's public `dsh-llm-pi-ai` adapter. It only
+bridges the credential store to Pi's existing OAuth document.
+
+The plugin reads/writes `~/.pi/agent/auth.json` and never prints token values.
+Because Pi and DSH do not share a cross-application lock, avoid starting both at the
+same time while an OAuth refresh may occur; a future version may use a separate DSH
+credential file and its own login flow to remove that race.
+
+## License
+
+MIT

package/README.zh.md

@@ -0,0 +1,81 @@
+# dsh-codex-oauth
+
+[English](README.md) | 中文
+
+让 [DeepSeek Harness（dsh）](https://github.com/deepseek-ai/deepseek-harness)
+复用 Pi 已登录的 ChatGPT Plus/Pro Codex OAuth，在不使用 OpenAI Platform API Key 的情况下调用 `openai-codex` 模型。
+
+本插件不是普通的 OpenAI API 适配器，也不会把 ChatGPT 订阅变成通用 API 凭据。它使用 Pi 的 Codex provider、官方 Codex Responses 传输和 DSH 公共的 `dsh-llm-pi-ai` 适配器。
+
+## 功能
+
+- 复用 `~/.pi/agent/auth.json` 中的 `openai-codex` OAuth 凭据；
+- access token 过期时自动使用 refresh token 更新；
+- 使用 Pi 同款 Codex 模型目录；
+- 支持流式输出、工具调用、推理、图片输入、replay 和上下文压缩；
+- 不读取或打印 API Key，也不会把 token 放进环境变量。
+
+## 安装
+
+将插件安装到 dsh 的 `web` profile：
+
+```bash
+dsh plugin --profile web add dsh-codex-oauth
+dsh web
+```
+
+如果使用的是 `npx` 版本：
+
+```bash
+npx @deepseek-ai/dsh plugin --profile web add dsh-codex-oauth
+npx @deepseek-ai/dsh web
+```
+
+启动后，在模型选择器中选择：
+
+```text
+Provider: openai-codex
+```
+
+也可以手动把下面的条目加入 profile 的 `cordis.patch.yml`：
+
+```yaml
+- insert:
+    - id: llm-codex-oauth
+      name: dsh-codex-oauth
+```
+
+## 前置条件
+
+Pi 必须已经完成 OpenAI Codex 登录，并且存在：
+
+```text
+~/.pi/agent/auth.json
+```
+
+文件中应有 `openai-codex` OAuth 条目。插件不会替用户登录，也不会要求复制 token。
+
+## 凭据与并发注意事项
+
+插件只使用 Pi 的现有凭据文件，并会在 OAuth 刷新后写回该文件。Pi 与 DSH 并不共享同一个跨应用锁，因此在 token 可能刷新时，不建议同时运行 Pi 和 DSH。
+
+卸载插件不会删除 Pi 的登录凭据。若要退出登录，请通过 Pi 自己的 `/logout` 完成。
+
+## 限制
+
+- ChatGPT 订阅权限、模型目录、配额和 Codex 后端行为由 OpenAI 控制，可能变化；
+- 插件依赖 DSH 的公共 `dsh-llm-pi-ai` 适配器，需与当前 DSH 版本兼容；
+- 这是 Codex 后端接入，不是公开的 OpenAI Platform API；
+- DSH 的其他能力（文件系统、Shell、MCP、权限、附件等）仍由当前 profile 提供。
+
+## 开发与测试
+
+```bash
+npm test
+```
+
+测试需要 DSH 和 Pi 的依赖已经安装或由 DSH profile 提供。
+
+## 许可证
+
+MIT

package/cordis.patch.yml

@@ -0,0 +1,3 @@
+- insert:
+    - id: llm-codex-oauth
+      name: dsh-codex-oauth

package/lib/adapter.js

@@ -0,0 +1,43 @@
+import { createModels } from "@earendil-works/pi-ai";
+import { openaiCodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
+import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
+import { resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
+import { OPENAI_CODEX_PROVIDER } from "./store.js";
+
+const STREAM_IDLE_TIMEOUT_MS = 300_000;
+
+function tokenProvider(provider) {
+  return {
+    ...provider,
+    auth: {
+      ...provider.auth,
+      apiKey: {
+        name: "OpenAI Codex OAuth bearer token",
+        async resolve({ credential }) {
+          return credential?.access
+            ? { auth: { apiKey: credential.access }, source: "Pi OAuth" }
+            : undefined;
+        },
+      },
+    },
+  };
+}
+
+export function createCodexAdapter(credentials, resolveAttachments) {
+  const provider = openaiCodexProvider();
+  const profiles = new Map([[OPENAI_CODEX_PROVIDER, {
+    provider: OPENAI_CODEX_PROVIDER,
+    displayName: "OpenAI Codex",
+    streamIdleTimeoutMs: STREAM_IDLE_TIMEOUT_MS,
+    retryPolicy: resolveRetryPolicy(undefined, "dsh-codex-oauth retryPolicy"),
+    configuredMaxTokens: new Map(),
+    piProvider: tokenProvider(provider),
+  }]]);
+  const models = createModels({ credentials });
+  models.setProvider(provider);
+  return new PiAiAdapter({
+    profiles: () => profiles,
+    resolveApiKey: async () => (await models.getAuth(OPENAI_CODEX_PROVIDER))?.auth.apiKey,
+    resolveAttachments,
+  });
+}

package/lib/index.js

@@ -0,0 +1,15 @@
+import { createCodexAdapter } from "./adapter.js";
+import { PiCodexCredentialStore, OPENAI_CODEX_PROVIDER, PI_AUTH_FILE } from "./store.js";
+
+export const name = "llm-codex-oauth";
+export const inject = ["llm"];
+
+export { OPENAI_CODEX_PROVIDER, PI_AUTH_FILE, PiCodexCredentialStore, createCodexAdapter };
+
+export function apply(ctx) {
+  const credentials = new PiCodexCredentialStore();
+  ctx.llm.registerAdapter(
+    [OPENAI_CODEX_PROVIDER],
+    createCodexAdapter(credentials, () => ctx.get?.("attachments")),
+  );
+}

package/lib/store.js

@@ -0,0 +1,65 @@
+import { mkdir, readFile, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
+
+export const OPENAI_CODEX_PROVIDER = "openai-codex";
+export const PI_AUTH_FILE = join(homedir(), ".pi", "agent", "auth.json");
+
+function clone(value) {
+  return value === undefined ? undefined : structuredClone(value);
+}
+
+async function ownerOnly(filename) {
+  if (process.platform === "win32") return;
+  try {
+    if ((await stat(filename)).mode & 0o077) throw new Error(`${filename} must be owner-only (chmod 600)`);
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw error;
+  }
+}
+
+export class PiCodexCredentialStore {
+  constructor(filename = PI_AUTH_FILE) { this.filename = filename; }
+
+  async readAll() {
+    await ownerOnly(this.filename);
+    try { return JSON.parse(await readFile(this.filename, "utf8")); }
+    catch (error) { if (error?.code === "ENOENT") return {}; throw error; }
+  }
+
+  async read(providerId) {
+    if (providerId !== OPENAI_CODEX_PROVIDER) return undefined;
+    const value = (await this.readAll())[providerId];
+    return value?.type === "oauth" ? clone(value) : undefined;
+  }
+
+  async list() {
+    return (await this.read(OPENAI_CODEX_PROVIDER) === undefined)
+      ? [] : [{ providerId: OPENAI_CODEX_PROVIDER, type: "oauth" }];
+  }
+
+  async modify(providerId, fn) {
+    if (providerId !== OPENAI_CODEX_PROVIDER) throw new Error(`credential store does not own ${providerId}`);
+    await mkdir(dirname(this.filename), { recursive: true, mode: 0o700 });
+    return withFileLock(this.filename, async () => {
+      const auth = await this.readAll();
+      const current = auth[providerId];
+      const next = await fn(clone(current));
+      if (next === undefined) return clone(current);
+      auth[providerId] = next;
+      await writeFileAtomic(this.filename, `${JSON.stringify(auth, null, 2)}\n`, { mode: 0o600, dirMode: 0o700 });
+      return clone(next);
+    });
+  }
+
+  async delete(providerId) {
+    if (providerId !== OPENAI_CODEX_PROVIDER) return;
+    await mkdir(dirname(this.filename), { recursive: true, mode: 0o700 });
+    await withFileLock(this.filename, async () => {
+      const auth = await this.readAll();
+      delete auth[providerId];
+      await writeFileAtomic(this.filename, `${JSON.stringify(auth, null, 2)}\n`, { mode: 0o600, dirMode: 0o700 });
+    });
+  }
+}

package/package.json

@@ -0,0 +1,28 @@
+{
+  "name": "dsh-codex-oauth",
+  "version": "0.1.1",
+  "description": "Use Pi's OpenAI Codex OAuth subscription in DeepSeek Harness",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/eons2long/dsh-codex-oauth.git"
+  },
+  "homepage": "https://github.com/eons2long/dsh-codex-oauth#readme",
+  "bugs": {
+    "url": "https://github.com/eons2long/dsh-codex-oauth/issues"
+  },
+  "keywords": ["dsh-plugin", "deepseek-harness", "openai-codex", "oauth"],
+  "license": "MIT",
+  "scripts": { "test": "node test/smoke.mjs" },
+  "type": "module",
+  "main": "lib/index.js",
+  "exports": { ".": "./lib/index.js" },
+  "files": ["lib", "cordis.patch.yml", "README.md", "README.zh.md", "LICENSE"],
+  "dsh": { "bundle": { "patch": "./cordis.patch.yml" } },
+  "peerDependencies": {
+    "@earendil-works/pi-ai": "^0.84.1",
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-atomic-write": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-llm": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-llm-pi-ai": "^0.1.0-rc.6"
+  }
+}