dsh-codex-subscription 1.10.0 → 1.11.0

package/lib/index.js

@@ -11,9 +11,13 @@ import { promisify } from "node:util";
 import { HttpsProxyAgent } from "https-proxy-agent";
 import { openaiCodexProvider as createOpenAICodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
 import { createModels } from "@earendil-works/pi-ai";
-import { randomUUID } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { WebError } from "@deepseek-ai/dsh-web";
 import { defineTool } from "@deepseek-ai/dsh-tools";
+import { constants } from "node:fs";
+import { lstat, mkdir, open, readFile, rename, rm } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
 //#region src/credential-store.js
 const PROVIDER$1 = "openai-codex";
 const abortIfNeeded = (options) => options?.signal?.throwIfAborted();
@@ -725,6 +729,7 @@ const SETTINGS_NAMESPACE = "codex-subscription";
 const QUICK_QUOTA_MODE_FIELD = "quickQuotaMode";
 const LEGACY_QUICK_QUOTA_FIELD = "quickQuotaVisible";
 const QUICK_QUOTA_MODE_PERCENT = "percent";
+const QUICK_QUOTA_MODE_FORECAST = "forecast";
 const SEARCH_PROVIDER_FIELD = "searchProvider";
 const SEARCH_PROVIDER_AUTO = "auto";
 const SEARCH_PROVIDER_CODEX = "codex";
@@ -816,7 +821,8 @@ function contextModelGroups(models) {
 const normalizeQuickQuotaMode = (value, legacyVisible = false) => [
 	"off",
 	"percent",
-	"bar"
+	"bar",
+	"forecast"
 ].includes(value) ? value : legacyVisible === true ? QUICK_QUOTA_MODE_PERCENT : "off";
 const supportsCodexFastMode = (modelId) => typeof modelId === "string" && (/^gpt-5\.(?:5|6)(?:$|-)/u.test(modelId) || modelId === "gpt-5.4");
 //#endregion
@@ -930,7 +936,7 @@ function openaiCodexSubscriptionProvider({ resolveSpeedMode = () => void 0, reso
 }
 //#endregion
 //#region src/version.js
-const PACKAGE_VERSION = "1.10.0";
+const PACKAGE_VERSION = "1.11.0";
 const USER_AGENT = `dsh-codex-subscription/${PACKAGE_VERSION}`;
 //#endregion
 //#region src/model-catalog.js
@@ -946,7 +952,7 @@ const LEVELS = [
 ];
 const record$4 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 const nonEmpty$2 = (value) => typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
-const positiveInteger = (value) => Number.isSafeInteger(value) && value > 0 ? value : void 0;
+const positiveInteger$1 = (value) => Number.isSafeInteger(value) && value > 0 ? value : void 0;
 function reasoningMap(levels) {
 	const supported = new Set((Array.isArray(levels) ? levels : []).map((level) => nonEmpty$2(record$4(level) ? level.effort : void 0)).filter(Boolean));
 	const map = Object.fromEntries(LEVELS.map((level) => [level, null]));
@@ -966,7 +972,7 @@ function visibleModel(value) {
 		description: nonEmpty$2(value.description),
 		priority: Number.isFinite(value.priority) ? value.priority : 0,
 		input: input.length > 0 ? input : ["text"],
-		contextWindow: positiveInteger(value.context_window) ?? positiveInteger(value.max_context_window),
+		contextWindow: positiveInteger$1(value.context_window) ?? positiveInteger$1(value.max_context_window),
 		reasoning: supported.length > 0,
 		thinkingLevelMap: reasoningMap(supported),
 		supportVerbosity: value.support_verbosity === true,
@@ -1192,6 +1198,42 @@ function createCodexAutoSearchProvider(options) {
 		}
 	});
 }
+const ORIGINAL_IMAGE_CHUNK_BYTES = 4 * 1024 * 1024;
+const ORIGINAL_IMAGE_ID_PATTERN = /^img_[0-9a-f]{32}$/u;
+const positiveInteger = (value) => Number.isSafeInteger(value) && value > 0;
+function decodeOriginalImageRef(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value) || typeof value.assetId !== "string" || !ORIGINAL_IMAGE_ID_PATTERN.test(value.assetId) || value.mediaType !== "image/png" || !positiveInteger(value.bytes) || value.bytes > 48 * 1024 * 1024 || !positiveInteger(value.width) || !positiveInteger(value.height) || typeof value.name !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(value.name) || typeof value.sha256 !== "string" || !/^[0-9a-f]{64}$/u.test(value.sha256)) return void 0;
+	return {
+		assetId: value.assetId,
+		mediaType: value.mediaType,
+		bytes: value.bytes,
+		width: value.width,
+		height: value.height,
+		name: value.name,
+		sha256: value.sha256
+	};
+}
+function decodeImagePresentation(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value) || value.kind !== "codex-subscription-image" || value.schemaVersion !== 1) return void 0;
+	const original = decodeOriginalImageRef(value.original);
+	return original === void 0 ? void 0 : { original };
+}
+function originalImageRefsEqual(left, right) {
+	const a = decodeOriginalImageRef(left);
+	const b = decodeOriginalImageRef(right);
+	return a !== void 0 && b !== void 0 && a.assetId === b.assetId && a.mediaType === b.mediaType && a.bytes === b.bytes && a.width === b.width && a.height === b.height && a.name === b.name && a.sha256 === b.sha256;
+}
+/** Resolve only an exact original reference copied into a DSH fork prefix. */
+function inheritedOriginalImageRef(session, assetId) {
+	const parentSession = session?.header?.parentSession;
+	const seedLength = session?.header?.seedLength;
+	if (typeof parentSession !== "string" || parentSession.length === 0 || !Number.isSafeInteger(seedLength) || seedLength < 0 || !Array.isArray(session?.events) || !ORIGINAL_IMAGE_ID_PATTERN.test(assetId)) return void 0;
+	for (const event of session.events) {
+		if (!Number.isSafeInteger(event?.seq) || event.seq < 0 || event.seq >= seedLength || event.type !== "tool/result") continue;
+		const original = decodeImagePresentation(event.data?.meta)?.original;
+		if (original?.assetId === assetId) return original;
+	}
+}
 //#endregion
 //#region src/codex-images.js
 const CODEX_IMAGE_TOOL_NAME = "codex_image_generate";
@@ -1360,6 +1402,42 @@ function imageOutputSchema() {
 					name: { type: "string" }
 				}
 			},
+			original: {
+				type: "object",
+				required: true,
+				additionalProperties: false,
+				properties: {
+					assetId: {
+						type: "string",
+						required: true
+					},
+					mediaType: {
+						type: "string",
+						enum: ["image/png"],
+						required: true
+					},
+					bytes: {
+						type: "integer",
+						required: true
+					},
+					width: {
+						type: "integer",
+						required: true
+					},
+					height: {
+						type: "integer",
+						required: true
+					},
+					name: {
+						type: "string",
+						required: true
+					},
+					sha256: {
+						type: "string",
+						required: true
+					}
+				}
+			},
 			background: { type: "string" },
 			quality: { type: "string" },
 			size: { type: "string" }
@@ -1447,7 +1525,12 @@ function createCodexImageTool(options) {
 		},
 		output: {
 			schema: imageOutputSchema(),
-			render: (_args, value) => imageContent(value)
+			render: (_args, value) => imageContent(value),
+			presentationMeta: (_args, value) => ({
+				kind: "codex-subscription-image",
+				schemaVersion: 1,
+				original: value.original
+			})
 		},
 		timeoutMs: 300 * 1e3,
 		isConcurrencySafe: () => false,
@@ -1499,12 +1582,23 @@ function createCodexImageTool(options) {
 			}
 			const metadata = responseMetadata(await readJsonWithin(response, encodedLimit(maximumBytes) + RESPONSE_ENVELOPE_BYTES));
 			const data = decodeCodexPng(metadata.encoded, maximumBytes);
-			const result = {
-				image: imageReference(await attachments.saveImage({
+			const sessionId = exec.agent?.id;
+			if (sessionId === void 0) throw new Error("Codex image generation requires a session-owned tool call");
+			const original = await options.originalImages.save(String(sessionId), data);
+			let ref;
+			try {
+				ref = await attachments.saveImage({
 					data,
 					mediaType: "image/png",
 					name: "codex-generated.png"
-				})),
+				});
+			} catch (error) {
+				await options.originalImages.remove(original);
+				throw error;
+			}
+			const result = {
+				image: imageReference(ref),
+				original,
 				...metadata.background === void 0 ? {} : { background: metadata.background },
 				...metadata.quality === void 0 ? {} : { quality: metadata.quality },
 				...metadata.size === void 0 ? {} : { size: metadata.size }
@@ -1521,6 +1615,142 @@ function createCodexImageTool(options) {
 	});
 }
 //#endregion
+//#region src/image-original-store.js
+const ORIGINAL_IMAGE_DIRECTORY = "dsh-codex-subscription/images/v1";
+const METADATA_VERSION = 1;
+const digest = (data) => createHash("sha256").update(data).digest("hex");
+const validSessionId = (value) => typeof value === "string" && value.length > 0 && value.length <= 512;
+function pngDimensions(data) {
+	if (!(data instanceof Uint8Array) || data.byteLength < 24 || Buffer.from(data.subarray(0, 8)).toString("hex") !== "89504e470d0a1a0a" || Buffer.from(data.subarray(12, 16)).toString("ascii") !== "IHDR") throw new TypeError("invalid PNG dimensions");
+	const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+	const width = view.getUint32(16, false);
+	const height = view.getUint32(20, false);
+	if (width === 0 || height === 0) throw new TypeError("invalid PNG dimensions");
+	return {
+		width,
+		height
+	};
+}
+async function writeExclusive(filename, data) {
+	await mkdir(dirname(filename), {
+		recursive: true,
+		mode: 448
+	});
+	const handle = await open(filename, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 384);
+	try {
+		await handle.writeFile(data);
+		await handle.sync();
+	} finally {
+		await handle.close();
+	}
+}
+async function assertPrivateFile(filename) {
+	const stat = await lstat(filename);
+	if (!stat.isFile()) throw new Error("not a regular file");
+	if (process.platform !== "win32" && (stat.mode & 63) !== 0) throw new Error("file is not owner-only");
+}
+function parseMetadata(text) {
+	let value;
+	try {
+		value = JSON.parse(text);
+	} catch {
+		return;
+	}
+	if (value?.version !== METADATA_VERSION || !validSessionId(value.sessionId)) return void 0;
+	const image = decodeOriginalImageRef(value.image);
+	return image === void 0 ? void 0 : {
+		sessionId: value.sessionId,
+		image
+	};
+}
+var OriginalImageStore = class {
+	constructor(dshHome) {
+		this.root = resolve(join(resolveDshHome(dshHome), ORIGINAL_IMAGE_DIRECTORY));
+	}
+	directory(assetId) {
+		if (!ORIGINAL_IMAGE_ID_PATTERN.test(assetId)) throw new TypeError("invalid original image asset id");
+		return join(this.root, assetId.slice(4, 6), assetId);
+	}
+	async save(sessionId, data, name = "codex-generated-original.png") {
+		if (!validSessionId(sessionId) || !(data instanceof Uint8Array) || data.byteLength === 0 || data.byteLength > 48 * 1024 * 1024) throw new TypeError("invalid original image input");
+		const { width, height } = pngDimensions(data);
+		const assetId = `img_${randomBytes(16).toString("hex")}`;
+		const directory = this.directory(assetId);
+		const ref = {
+			assetId,
+			mediaType: "image/png",
+			bytes: data.byteLength,
+			width,
+			height,
+			name,
+			sha256: digest(data)
+		};
+		try {
+			await mkdir(dirname(directory), {
+				recursive: true,
+				mode: 448
+			});
+			await mkdir(directory, {
+				recursive: false,
+				mode: 448
+			});
+			await writeExclusive(join(directory, "original"), data);
+			const temporary = join(directory, `metadata.${randomBytes(8).toString("hex")}.tmp`);
+			await writeExclusive(temporary, Buffer.from(`${JSON.stringify({
+				version: METADATA_VERSION,
+				sessionId,
+				image: ref
+			}, null, 2)}\n`));
+			await rename(temporary, join(directory, "metadata.json"));
+			return ref;
+		} catch (error) {
+			await rm(directory, {
+				recursive: true,
+				force: true
+			}).catch(() => void 0);
+			throw error;
+		}
+	}
+	async remove(ref) {
+		if (ref !== void 0 && ORIGINAL_IMAGE_ID_PATTERN.test(ref.assetId)) await rm(this.directory(ref.assetId), {
+			recursive: true,
+			force: true
+		}).catch(() => void 0);
+	}
+	async read(sessionId, assetId, inherited) {
+		if (!validSessionId(sessionId) || !ORIGINAL_IMAGE_ID_PATTERN.test(assetId)) return void 0;
+		try {
+			const directory = this.directory(assetId);
+			const metadataFile = join(directory, "metadata.json");
+			const originalFile = join(directory, "original");
+			await Promise.all([assertPrivateFile(metadataFile), assertPrivateFile(originalFile)]);
+			const metadata = parseMetadata(await readFile(metadataFile, "utf8"));
+			if (metadata === void 0 || metadata.image.assetId !== assetId || metadata.sessionId !== sessionId && !originalImageRefsEqual(metadata.image, inherited)) return void 0;
+			const data = new Uint8Array(await readFile(originalFile));
+			const dimensions = pngDimensions(data);
+			if (data.byteLength !== metadata.image.bytes || digest(data) !== metadata.image.sha256 || dimensions.width !== metadata.image.width || dimensions.height !== metadata.image.height) return void 0;
+			return {
+				ref: metadata.image,
+				data
+			};
+		} catch {
+			return;
+		}
+	}
+	async chunk(sessionId, assetId, offset, inherited) {
+		if (!Number.isSafeInteger(offset) || offset < 0) return void 0;
+		const stored = await this.read(sessionId, assetId, inherited);
+		if (stored === void 0 || offset >= stored.data.byteLength || offset % 4194304 !== 0) return void 0;
+		const end = Math.min(stored.data.byteLength, offset + ORIGINAL_IMAGE_CHUNK_BYTES);
+		return {
+			ref: stored.ref,
+			offset,
+			encoded: Buffer.from(stored.data.subarray(offset, end)).toString("base64"),
+			done: end === stored.data.byteLength
+		};
+	}
+};
+//#endregion
 //#region src/diagnostics.js
 const requestAreas = /* @__PURE__ */ new Set([
 	"login",
@@ -1789,6 +2019,136 @@ function createCodexUsageReader(options) {
 	});
 }
 //#endregion
+//#region src/quota-forecast.js
+const HOUR_MS = 3600 * 1e3;
+const HISTORY_MS = 24 * HOUR_MS;
+const MIN_SPAN_MS = 1800 * 1e3;
+const MIN_CONSUMED_PERCENT = 1;
+const PLATEAU_SAMPLE_MS = 900 * 1e3;
+const finite = (value) => Number.isFinite(Number(value));
+const clampPercent = (value) => Math.max(0, Math.min(100, Number(value)));
+const keyFor = (window) => `codex:${Number(window.windowSeconds) || "limit"}`;
+function observeQuotaForecast(state, windows, now = Date.now()) {
+	const next = { windows: { ...state?.windows ?? {} } };
+	let changed = false;
+	for (const window of windows ?? []) {
+		if (!finite(window?.remainingPercent)) continue;
+		const key = keyFor(window);
+		const resetsAt = finite(window.resetsAt) ? Number(window.resetsAt) : null;
+		const remainingPercent = Math.round(clampPercent(window.remainingPercent) * 1e4) / 1e4;
+		const previous = next.windows[key];
+		const resetChanged = previous !== void 0 && (previous.resetsAt === null !== (resetsAt === null) || previous.resetsAt !== null && Math.abs(previous.resetsAt - resetsAt) > 300);
+		const last = previous?.samples?.at(-1);
+		const quotaIncreased = last !== void 0 && remainingPercent > last.remainingPercent + .5;
+		const record = resetChanged || quotaIncreased ? {
+			resetsAt,
+			samples: []
+		} : {
+			resetsAt,
+			samples: [...previous?.samples ?? []]
+		};
+		const latest = record.samples.at(-1);
+		if (latest === void 0 || now > latest.at && (Math.abs(remainingPercent - latest.remainingPercent) >= .001 || now - latest.at >= PLATEAU_SAMPLE_MS)) {
+			record.samples.push({
+				at: now,
+				remainingPercent
+			});
+			record.samples = record.samples.filter((sample) => sample.at >= now - HISTORY_MS).slice(-192);
+			changed = true;
+		}
+		next.windows[key] = record;
+	}
+	return {
+		state: next,
+		changed
+	};
+}
+function estimateQuotaForecast(state, window, now = Date.now()) {
+	if (!finite(window?.remainingPercent)) return { status: "calibrating" };
+	const record = state?.windows?.[keyFor(window)];
+	if (record === void 0) return { status: "calibrating" };
+	const resetsAt = finite(window.resetsAt) ? Number(window.resetsAt) : null;
+	if (record.resetsAt === null !== (resetsAt === null) || resetsAt !== null && Math.abs(record.resetsAt - resetsAt) > 300) return { status: "calibrating" };
+	const samples = record.samples.filter((sample) => sample.at >= now - HISTORY_MS && sample.at <= now + 6e4);
+	if (samples.length < 3) return {
+		status: "calibrating",
+		sampleCount: samples.length
+	};
+	const first = samples[0];
+	const last = samples.at(-1);
+	const spanMs = last.at - first.at;
+	const consumedPercent = Math.max(0, first.remainingPercent - last.remainingPercent);
+	if (spanMs < MIN_SPAN_MS || consumedPercent < MIN_CONSUMED_PERCENT) return {
+		status: "calibrating",
+		sampleCount: samples.length,
+		observedSpanMs: spanMs,
+		consumedPercent
+	};
+	const firstAt = first.at;
+	const weighted = samples.map((sample) => ({
+		x: (sample.at - firstAt) / HOUR_MS,
+		y: first.remainingPercent - sample.remainingPercent,
+		weight: Math.exp((sample.at - last.at) / (6 * HOUR_MS))
+	}));
+	const totalWeight = weighted.reduce((sum, point) => sum + point.weight, 0);
+	const meanX = weighted.reduce((sum, point) => sum + point.x * point.weight, 0) / totalWeight;
+	const meanY = weighted.reduce((sum, point) => sum + point.y * point.weight, 0) / totalWeight;
+	const numerator = weighted.reduce((sum, point) => sum + point.weight * (point.x - meanX) * (point.y - meanY), 0);
+	const denominator = weighted.reduce((sum, point) => sum + point.weight * (point.x - meanX) ** 2, 0);
+	const pacePerHour = denominator > 0 ? numerator / denominator : 0;
+	if (!Number.isFinite(pacePerHour) || pacePerHour < .02) return {
+		status: "idle",
+		pacePerHour: 0
+	};
+	const runwaySeconds = clampPercent(window.remainingPercent) / pacePerHour * 3600;
+	const resetSeconds = resetsAt === null ? null : Math.max(0, resetsAt - now / 1e3);
+	return {
+		status: "ready",
+		pacePerHour,
+		runwaySeconds,
+		survivesReset: resetSeconds !== null && runwaySeconds >= resetSeconds,
+		sampleCount: samples.length,
+		observedSpanMs: spanMs,
+		consumedPercent
+	};
+}
+function forecastUsage(usage, state = { windows: {} }, now = Date.now()) {
+	const observed = observeQuotaForecast(state, usage?.rateLimits?.find((limit) => limit.id === "codex")?.windows ?? [], now);
+	return {
+		state: observed.state,
+		changed: observed.changed,
+		usage: {
+			...usage,
+			rateLimits: (usage?.rateLimits ?? []).map((limit) => limit.id !== "codex" ? limit : {
+				...limit,
+				windows: limit.windows.map((window) => ({
+					...window,
+					forecast: estimateQuotaForecast(observed.state, window, now)
+				}))
+			})
+		}
+	};
+}
+function createQuotaForecastReader({ reader, enabled, now = Date.now }) {
+	let state = { windows: {} };
+	return Object.freeze({
+		async read(options) {
+			const usage = await reader.read(options);
+			if (!enabled()) {
+				state = { windows: {} };
+				return usage;
+			}
+			const forecast = forecastUsage(usage, state, now());
+			state = forecast.state;
+			return forecast.usage;
+		},
+		clear() {
+			state = { windows: {} };
+			reader.clear();
+		}
+	});
+}
+//#endregion
 //#region src/reset-credits.js
 const CODEX_RESET_CREDITS_URL = "https://chatgpt.com/backend-api/wham/rate-limit-reset-credits";
 const CODEX_RESET_CONSUME_URL = `${CODEX_RESET_CREDITS_URL}/consume`;
@@ -2011,8 +2371,22 @@ const publicError = (code, message) => ({
 		details: { issues: [] }
 	}
 });
-function createSubscriptionRpcHandler({ authHandler, usageReader, resetCreditService, preferences, diagnosticsReader, modelCatalog }) {
+function createSubscriptionRpcHandler({ authHandler, usageReader, resetCreditService, preferences, diagnosticsReader, modelCatalog, originalImages, resolveInheritedOriginal }) {
 	return async (endpoint, payload, signal) => {
+		if (endpoint === "image/original/chunk") try {
+			signal.throwIfAborted();
+			if (typeof payload?.sessionId !== "string" || payload.sessionId.length === 0 || payload.sessionId.length > 512 || typeof payload?.assetId !== "string" || !ORIGINAL_IMAGE_ID_PATTERN.test(payload.assetId) || !Number.isSafeInteger(payload?.offset) || payload.offset < 0 || payload.offset % 4194304 !== 0) return publicError("invalid-input", "Invalid original image request");
+			const inherited = resolveInheritedOriginal?.(payload.sessionId, payload.assetId);
+			const chunk = await originalImages?.chunk(payload.sessionId, payload.assetId, payload.offset, inherited);
+			if (chunk === void 0) return publicError("not-found", "Original image is unavailable");
+			return {
+				ok: true,
+				value: chunk
+			};
+		} catch (error) {
+			if (signal.aborted) throw error;
+			return publicError("internal", "Could not read the original image");
+		}
 		if (endpoint === "diagnostics") try {
 			signal.throwIfAborted();
 			return {
@@ -2031,7 +2405,8 @@ function createSubscriptionRpcHandler({ authHandler, usageReader, resetCreditSer
 					if (![
 						"off",
 						"percent",
-						"bar"
+						"bar",
+						"forecast"
 					].includes(payload["quickQuotaMode"])) return publicError("internal", "Invalid quick quota preference");
 					patch[QUICK_QUOTA_MODE_FIELD] = payload[QUICK_QUOTA_MODE_FIELD];
 				}
@@ -2165,7 +2540,8 @@ function apply(ctx) {
 		[QUICK_QUOTA_MODE_FIELD]: z.union([
 			"off",
 			QUICK_QUOTA_MODE_PERCENT,
-			"bar"
+			"bar",
+			QUICK_QUOTA_MODE_FORECAST
 		]),
 		[LEGACY_QUICK_QUOTA_FIELD]: z.boolean(),
 		[SEARCH_PROVIDER_FIELD]: z.union([
@@ -2190,6 +2566,7 @@ function apply(ctx) {
 	}));
 	const searchProvider = createSearchProviderSwitcher(ctx.loader);
 	const network = createCodexNetworkTransport();
+	const originalImages = new OriginalImageStore();
 	const store = new DshOAuthCredentialStore(ctx.credentials, CREDENTIAL_REF, [LEGACY_CREDENTIAL_REF]);
 	const baseProvider = createOpenAICodexProvider();
 	let resolveAuth = async () => void 0;
@@ -2265,6 +2642,7 @@ function apply(ctx) {
 		getAuth: resolveAuth,
 		readCredential: (options) => store.read(PROVIDER, options),
 		attachments: ctx.attachments,
+		originalImages,
 		fetch: (input, init) => network.fetch("image", input, init)
 	}));
 	const adapter = new PiAiAdapter({
@@ -2313,10 +2691,13 @@ function apply(ctx) {
 	}, "codex-subscription: search provider selection");
 	const auth = createCodexAuthService(authModels, store, { runLogin: (operation) => network.run("login", operation) });
 	const coordinator = new CodexLoginCoordinator(auth);
-	const usageReader = createCodexUsageReader({
-		getAuth: resolveAuth,
-		readCredential: (options) => store.read(PROVIDER, options),
-		fetch: (input, init) => network.fetch("quota", input, init)
+	const usageReader = createQuotaForecastReader({
+		reader: createCodexUsageReader({
+			getAuth: resolveAuth,
+			readCredential: (options) => store.read(PROVIDER, options),
+			fetch: (input, init) => network.fetch("quota", input, init)
+		}),
+		enabled: () => normalizeQuickQuotaMode(settings.get()[QUICK_QUOTA_MODE_FIELD], settings.get()[LEGACY_QUICK_QUOTA_FIELD]) === QUICK_QUOTA_MODE_FORECAST
 	});
 	const resetCreditService = createCodexResetCreditService({
 		getAuth: resolveAuth,
@@ -2335,12 +2716,14 @@ function apply(ctx) {
 			login: coordinator.supportState(),
 			network
 		}),
-		modelCatalog
+		modelCatalog,
+		originalImages,
+		resolveInheritedOriginal: (sessionId, assetId) => inheritedOriginalImageRef(ctx.get?.("sessions")?.get?.(sessionId), assetId)
 	});
 	ctx.effect(() => {
 		modelCatalog.refresh().catch((error) => ctx.logger?.debug?.("could not refresh Codex model catalog: %s", error.message));
 	}, "codex-subscription: official model catalog");
-	ctx.effect(() => ctx.connection.rpc.handle(CHANNEL, handler, { authority: "loopback" }), "codex-subscription: loopback account RPC");
+	ctx.effect(() => ctx.connection.rpc.handle(CHANNEL, handler, { authority: "trusted-host" }), "codex-subscription: DSH-trusted account RPC");
 }
 //#endregion
 export { CODEX_IMAGE_GENERATION_URL, CODEX_IMAGE_TOOL_NAME, CODEX_RESET_CONSUME_URL, CODEX_RESET_CREDITS_URL, CODEX_USAGE_URL, CodexLoginCoordinator, DshOAuthCredentialStore, apply, assertCodexAuthUrl, commandForCodexAuthUrl, createCodexAuthService, createCodexImageTool, createCodexResetCreditService, createCodexRpcHandler, createCodexUsageReader, createSearchProviderSwitcher, createSubscriptionDiagnostics, createSubscriptionRpcHandler, decodeCodexPng, inject, name, normalizeContextMode, normalizeCustomContextWindow, openCodexAuthUrl, parseCodexUsage };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-codex-subscription",
-  "version": "1.10.0",
+  "version": "1.11.0",
   "description": "Use ChatGPT and Codex subscriptions in DeepSeek Harness with OAuth, quota, safe resets, web search, images, and Fast mode",
   "type": "module",
   "main": "./lib/index.js",
@@ -113,6 +113,7 @@
     "@deepseek-ai/dsh-llm": "0.1.1-rc.2",
     "@deepseek-ai/dsh-llm-pi-ai": "0.1.1-rc.2",
     "@deepseek-ai/dsh-settings": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-session": "0.1.1-rc.2",
     "@deepseek-ai/dsh-tools": "0.1.1-rc.2",
     "@deepseek-ai/dsh-web": "0.1.1-rc.2",
     "@deepseek-ai/schemastery": "3.18.1",
@@ -123,10 +124,13 @@
     "tsdown": "0.22.2"
   },
   "dependencies": {
+    "@deepseek-ai/dsh-home-paths": "0.1.1-rc.2",
     "https-proxy-agent": "7.0.6"
   },
   "scripts": {
     "build": "tsdown --config tsdown.config.mjs",
+    "test:behavior": "node --test tests/auth-security.test.mjs tests/cache-contract.test.mjs tests/codex-images.test.mjs tests/codex-search.test.mjs tests/image-edit.test.mjs tests/model-catalog.test.mjs tests/oauth-network.test.mjs tests/pi-ai-runtime.test.mjs tests/plugin-integration.test.mjs tests/reset-credits.test.mjs tests/sidebar-quota.test.mjs tests/transport-contract.test.mjs tests/usage.test.mjs",
+    "test:delivery": "node --test tests/ci-change-plan.test.mjs tests/client-contract.test.mjs tests/prepare-compat-release.test.mjs tests/publish-idempotency.test.mjs tests/release-contract.test.mjs tests/release-notes.test.mjs tests/support-intake.test.mjs",
     "test": "node --test tests/*.test.mjs",
     "check": "pnpm run test && pnpm run build && pnpm pack --pack-destination .artifacts"
   }