dsh-codex-share 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DeepSeek
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,39 @@
+# dsh-codex-share
+
+A DeepSeek Harness LLM adapter that uses the same ChatGPT subscription login as the local Codex CLI. It reads Codex's current `auth.json` for each model call. Codex CLI owns sign-in and token refresh; this package has no OAuth flow and stores no credential. Calls go to the Codex subscription backend through pi-ai's Codex Responses implementation, not the OpenAI Platform API endpoint.
+
+## Requirements
+
+- DeepSeek Harness `0.1.5-rc.3` or a compatible later release, with Node.js `^22.19.0 || >=24`.
+- Codex CLI signed in with a ChatGPT account and configured for **file credential storage**. Run `codex login` and check `codex login status`. Codex must be able to read and update `$CODEX_HOME/auth.json` (default `~/.codex/auth.json`).
+- The harness process must run as the same OS user, or have read access to that same credential file. A keyring-only Codex login is not supported.
+
+## Install
+
+Once published, install the bundle into a harness profile:
+
+```sh
+dsh plugin --profile web add dsh-codex-share
+```
+
+For this checkout before publication, from its directory:
+
+```sh
+dsh plugin --profile web add .
+```
+
+Restart the profile after installation. The bundle mounts one provider route, `openai-codex`, with the model catalog supplied by pi-ai. Select that provider and a listed model in the harness model settings or agent preset. For a local Codex home outside the default location, set the absolute `CODEX_HOME` path in the environment that launches the harness. Direct Cordis composition can configure `codexHome` on the `dsh-codex-share` plugin instead.
+
+The plugin intentionally does not refresh a stale token. When Codex writes a replacement, the next harness request reads it. When Codex's current access token has expired, harness calls fail until Codex refreshes its own login. An API-key-only Codex login is rejected; this route never falls back to `OPENAI_API_KEY`.
+
+## Development
+
+```sh
+pnpm install --ignore-scripts
+pnpm typecheck
+pnpm test
+pnpm build
+pnpm pack
+```
+
+The development links in `package.json` point to the adjacent `../deepseek-harness` checkout. Replace those dev links when developing elsewhere; they are not installed by consumers of the published package.

package/cordis.patch.yml

@@ -0,0 +1,2 @@
+- id: llm-codex-share
+  name: dsh-codex-share

package/dist/index.d.mts

@@ -0,0 +1,24 @@
+import { Context } from "@deepseek-ai/cordis";
+//#region src/auth.d.ts
+/** Resolve Codex's current auth.json path without retaining a token. */
+declare function codexAuthPath(codexHome?: string): string;
+/**
+ * Read a ChatGPT bearer token for one request. Codex owns login and refresh;
+ * this plugin never persists or refreshes credentials. A later request sees
+ * any replacement written by Codex CLI.
+ */
+declare function readCodexAccessToken(codexHome?: string): Promise<string>;
+//#endregion
+//#region src/index.d.ts
+/** Harness route for subscription-backed Codex models. */
+declare const PROVIDER = "openai-codex";
+declare const name = "llm-codex-share";
+declare const inject: string[];
+/** Plugin configuration. Omit codexHome to follow CODEX_HOME or ~/.codex. */
+interface Config {
+  codexHome?: string;
+}
+/** Register the Codex subscription model catalog and stream adapter. */
+declare function apply(ctx: Context, config?: Config): void;
+//#endregion
+export { Config, PROVIDER, apply, codexAuthPath, inject, name, readCodexAccessToken };

package/dist/index.mjs

@@ -0,0 +1,95 @@
+import { LlmError, resolveImageAttachmentAccess } from "@deepseek-ai/dsh-llm";
+import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
+import { envApiKeyAuth } from "@earendil-works/pi-ai";
+import { openaiCodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { isAbsolute, join } from "node:path";
+//#region src/auth.ts
+/** Read the exact ChatGPT access token currently stored by Codex CLI. */
+/** Resolve Codex's current auth.json path without retaining a token. */
+function codexAuthPath(codexHome) {
+	const home = codexHome ?? process.env.CODEX_HOME ?? join(homedir(), ".codex");
+	if (!isAbsolute(home)) throw new LlmError("codexHome/CODEX_HOME must be an absolute path", "INVALID_CONFIG");
+	return join(home, "auth.json");
+}
+/**
+* Read a ChatGPT bearer token for one request. Codex owns login and refresh;
+* this plugin never persists or refreshes credentials. A later request sees
+* any replacement written by Codex CLI.
+*/
+async function readCodexAccessToken(codexHome) {
+	const path = codexAuthPath(codexHome);
+	let raw;
+	try {
+		raw = await readFile(path, "utf8");
+	} catch {
+		throw new LlmError(`No readable Codex login at ${path}; run codex login and use file credential storage`, "MISSING_CREDENTIAL");
+	}
+	let auth;
+	try {
+		auth = JSON.parse(raw);
+	} catch {
+		throw new LlmError(`Codex login at ${path} is not valid JSON`, "INVALID_CREDENTIAL");
+	}
+	if (auth === null || auth.auth_mode !== void 0 && auth.auth_mode !== "chatgpt" || typeof auth.OPENAI_API_KEY === "string" && auth.OPENAI_API_KEY.length > 0 || typeof auth.tokens?.access_token !== "string" || auth.tokens.access_token.length === 0) throw new LlmError(`Codex login at ${path} has no ChatGPT access token; run codex login with ChatGPT`, "MISSING_CREDENTIAL");
+	return auth.tokens.access_token;
+}
+//#endregion
+//#region src/index.ts
+/** Harness route for subscription-backed Codex models. */
+const PROVIDER = "openai-codex";
+const name = "llm-codex-share";
+const inject = ["llm"];
+/** Register the Codex subscription model catalog and stream adapter. */
+function apply(ctx, config = {}) {
+	const provider = {
+		...openaiCodexProvider(),
+		auth: { apiKey: envApiKeyAuth("Codex CLI login", []) }
+	};
+	const profiles = /* @__PURE__ */ new Map([[PROVIDER, {
+		provider: PROVIDER,
+		displayName: "OpenAI Codex (local login)",
+		piProvider: provider,
+		modelErrors: /* @__PURE__ */ new Map(),
+		configuredMaxTokens: /* @__PURE__ */ new Map(),
+		streamIdleTimeoutMs: 12e4,
+		maxRequestImageBytes: 20971520,
+		requestImagePixelBudget: 4194304,
+		requestImageMaxBytes: 1048576,
+		transport: "sse",
+		retryPolicy: {
+			mode: "normal",
+			maxRetries: 0,
+			retryableCodes: [],
+			initialDelayMs: 0,
+			maxDelayMs: 0,
+			jitterRatio: 0
+		}
+	}]]);
+	const adapter = new PiAiAdapter({
+		profiles: () => profiles,
+		resolveApiKey: async () => readCodexAccessToken(config.codexHome),
+		resolveAttachments: () => ctx.get("attachments"),
+		resolveImageAccess: (attachments, ref) => resolveImageAttachmentAccess(attachments, (hostPath) => ctx.get("fs")?.processPathFromHostPath(hostPath), ref),
+		auth: {
+			credentials: {
+				read: async () => void 0,
+				list: async () => [],
+				modify: async () => {
+					throw new LlmError("Codex credentials are owned by Codex CLI", "UNSUPPORTED_OPERATION");
+				},
+				delete: async () => {
+					throw new LlmError("Codex credentials are owned by Codex CLI", "UNSUPPORTED_OPERATION");
+				}
+			},
+			authContext: {
+				env: async () => void 0,
+				fileExists: async () => false
+			}
+		}
+	});
+	ctx.llm.registerAdapter([PROVIDER], adapter);
+}
+//#endregion
+export { PROVIDER, apply, codexAuthPath, inject, name, readCodexAccessToken };

package/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "dsh-codex-share",
+  "version": "0.1.0",
+  "description": "Use the local Codex CLI ChatGPT subscription login as a DeepSeek Harness LLM provider",
+  "type": "module",
+  "license": "MIT",
+  "main": "./dist/index.mjs",
+  "types": "./dist/index.d.mts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.mts",
+      "default": "./dist/index.mjs"
+    },
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "cordis.patch.yml",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
+  "packageManager": "pnpm@11.7.0",
+  "scripts": {
+    "build": "tsdown src/index.ts --dts --platform node --format esm",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "prepack": "pnpm build"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-llm": "^0.1.5-rc.3",
+    "@deepseek-ai/dsh-attachment": "^0.1.5-rc.3",
+    "@deepseek-ai/dsh-fs": "^0.1.5-rc.3",
+    "@deepseek-ai/dsh-llm-pi-ai": "^0.1.5-rc.3"
+  },
+  "dependencies": {
+    "@earendil-works/pi-ai": "^0.85.1"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "link:../deepseek-harness/vendor/cordis",
+    "@deepseek-ai/dsh-llm": "link:../deepseek-harness/packages/llm/llm",
+    "@deepseek-ai/dsh-attachment": "link:../deepseek-harness/packages/attachment/attachment",
+    "@deepseek-ai/dsh-fs": "link:../deepseek-harness/packages/fs/fs",
+    "@deepseek-ai/dsh-llm-pi-ai": "link:../deepseek-harness/packages/llm/llm-pi-ai",
+    "@types/node": "^22.20.0",
+    "tsdown": "^0.22.2",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.8"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  }
+}