dsh-codex-subscription 1.7.2 → 1.7.4

package/AGENTS.md

@@ -6,7 +6,7 @@ Use this guide when a user asks an Agent to install, update, verify, or remove
 ## Safety
 
 - Confirm the target DSH installation and profile. Use `web` only when it is the user's target.
-- Use the exact `1.7.2` package below; do not install a moving branch.
+- Use the exact `1.7.4` package below; do not install a moving branch.
 - Never print OAuth credentials, account IDs, authorization callbacks, or credential-store contents.
 - Preserve the DSH profile, unrelated plugins, sessions, and saved sign-in.
 - Do not start, stop, or restart DSH without explicit permission.
@@ -34,13 +34,13 @@ For an official DSH installation run through npm, keep the complete `npx` prefix
 run command does not create a global `dsh` command:
 
 ```sh
-npx -y @deepseek-ai/dsh@0.1.1-rc.2 plugin --profile web add dsh-codex-subscription@1.7.2
+npx -y @deepseek-ai/dsh@0.1.1-rc.2 plugin --profile web add dsh-codex-subscription@1.7.4
 ```
 
 With an existing global `dsh` command:
 
 ```sh
-dsh plugin --profile web add dsh-codex-subscription@1.7.2
+dsh plugin --profile web add dsh-codex-subscription@1.7.4
 ```
 
 Use the same `add` command to update or repair. This is the complete package-changing operation.
@@ -58,7 +58,7 @@ dsh --profile web --dump-config
 
 For the official npm route, run the same checks with `npx -y @deepseek-ai/dsh@0.1.1-rc.2` in place of `dsh`.
 
-1. `dsh-codex-subscription` version `1.7.2` appears exactly once.
+1. `dsh-codex-subscription` version `1.7.4` appears exactly once.
 2. `codex-subscription` appears exactly once in the composed config.
 3. No unrelated plugin or profile was changed and DSH was not restarted.
 

package/THIRD_PARTY_NOTICES.md

@@ -8,6 +8,7 @@ This project depends on software distributed under its own terms. The dependency
 | `@earendil-works/pi-ai` 0.82.1 | OpenAI Codex OAuth, model catalog, Responses transport, and WebSocket continuation | MIT | https://github.com/earendil-works/pi |
 | React | DSH settings component runtime | MIT | https://github.com/facebook/react |
 | Heroicons | Composer speed icon | MIT | https://github.com/tailwindlabs/heroicons |
+| `https-proxy-agent` 7.0.6 | HTTPS proxy transport for Codex OAuth token requests | MIT | https://github.com/TooTallNate/proxy-agents |
 | tsdown | Development-time bundler | MIT | https://github.com/rolldown/tsdown |
 
 No third-party project endorses this community plugin. See each installed package for its complete license text and transitive dependency notices.

package/lib/client.js

@@ -436,6 +436,7 @@ window.__ModuleLoader__.load({
 .codexSubscriptionCreditSection{display:flex;flex-direction:column;gap:7px}.codexSubscriptionCreditNote{font-size:11px;line-height:17px;color:var(--dsw-alias-label-tertiary)}.codexSubscriptionCreditRows{display:grid;grid-template-columns:repeat(auto-fit,minmax(180px,1fr));gap:8px}.codexSubscriptionCreditBalance,.codexSubscriptionSpendLimit{min-width:0;border-radius:10px;padding:12px 14px;background:var(--dsw-alias-bg-module-platform)}
 .codexSubscriptionCreditBalance{display:flex;flex-direction:column;gap:6px}.codexSubscriptionCreditBalance span,.codexSubscriptionCreditLabel{font-size:12px;line-height:18px;color:var(--dsw-alias-label-secondary)}.codexSubscriptionCreditBalance strong{font:600 18px/24px ui-monospace,SFMono-Regular,Consolas,monospace;font-variant-numeric:tabular-nums;overflow-wrap:anywhere}
 .codexSubscriptionResetSummary{display:flex;align-items:center;justify-content:space-between;gap:10px}.codexSubscriptionResetMeta{display:flex;min-width:0;flex-direction:column;gap:1px}.codexSubscriptionResetBalance{display:flex;flex-direction:column;gap:8px}.codexSubscriptionResetBalance .codexSubscriptionActions{justify-content:flex-start}.codexSubscriptionResetFlow{display:flex;flex-direction:column;gap:10px;border-top:1px solid var(--dsw-alias-border-l2);padding-top:10px}.codexSubscriptionResetFlow h4{margin:0;font-size:13px;line-height:20px;font-weight:500}.codexSubscriptionResetWarning{font-size:12px;line-height:18px;color:var(--dsw-alias-label-secondary)}.codexSubscriptionResetExpiry{font-size:11px;line-height:17px;color:var(--dsw-alias-label-tertiary)}.codexSubscriptionResetCheck{display:flex;align-items:flex-start;gap:8px;padding:9px 10px;border-radius:8px;background:var(--dsw-alias-bg-module-platform);font-size:12px;line-height:18px;color:var(--dsw-alias-label-primary);cursor:pointer}.codexSubscriptionResetCheck input{margin:3px 0 0;accent-color:var(--dsw-alias-label-primary)}.codexSubscriptionResetFinal{border-color:var(--dsw-alias-state-error-primary)!important;color:var(--dsw-alias-state-error-primary)!important}.codexSubscriptionResetResult{font-size:12px;line-height:18px;color:var(--dsw-alias-state-success-primary)}
+.codexSubscriptionResetUse:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover)}.codexSubscriptionResetUse:focus-visible{outline:2px solid var(--dsw-alias-border-l3);outline-offset:1px}
 .codexSubscriptionSpendLimit{display:flex;flex-direction:column;gap:8px}.codexSubscriptionSpendTop{display:flex;align-items:baseline;justify-content:space-between;gap:12px}.codexSubscriptionSpendTop strong{font:600 16px/22px ui-monospace,SFMono-Regular,Consolas,monospace;font-variant-numeric:tabular-nums}.codexSubscriptionSpendLimit progress{width:100%;height:6px;border:0;border-radius:999px;overflow:hidden;background:var(--dsw-alias-border-l3);accent-color:var(--dsw-alias-brand-primary,#3964fe);-webkit-appearance:none;appearance:none}.codexSubscriptionSpendLimit progress::-webkit-progress-bar{background:var(--dsw-alias-border-l3);border-radius:999px}.codexSubscriptionSpendLimit progress::-webkit-progress-value{background:var(--dsw-alias-brand-primary,#3964fe);border-radius:999px}.codexSubscriptionSpendLimit progress::-moz-progress-bar{background:var(--dsw-alias-brand-primary,#3964fe);border-radius:999px}
 .codexComposerQuota{display:inline-flex;align-items:center;flex:0 0 auto;height:28px;box-sizing:border-box;padding:0;color:var(--dsw-alias-label-secondary);font-family:inherit;font-size:12px;line-height:20px;font-weight:500;font-variant-numeric:tabular-nums;white-space:nowrap;user-select:none}.codexComposerQuotaBar{display:block;width:40px;height:4px;border:0;border-radius:999px;overflow:hidden;background:var(--dsw-alias-border-l3);accent-color:var(--dsw-alias-label-secondary);-webkit-appearance:none;appearance:none}.codexComposerQuotaBar::-webkit-progress-bar{background:var(--dsw-alias-border-l3);border-radius:999px}.codexComposerQuotaBar::-webkit-progress-value{background:var(--dsw-alias-label-secondary);border-radius:999px}.codexComposerQuotaBar::-moz-progress-bar{background:var(--dsw-alias-label-secondary);border-radius:999px}
 .codexModelSelect{position:relative;min-width:0}.codexModelSelectTrigger{display:flex;align-items:center;gap:4px;min-width:0;max-width:min(360px,45cqw);height:28px;padding:0 4px 0 8px;border:0;border-radius:24px;outline:0;background:transparent;color:var(--dsw-alias-label-secondary);font-size:13px;font-weight:500;line-height:20px;cursor:pointer}.codexModelSelectTrigger:hover:not(:disabled),.codexModelSelectTrigger[aria-expanded=true]{background:var(--dsw-alias-interactive-bg-hover)}.codexModelSelectTrigger:focus-visible{box-shadow:0 0 0 2px var(--dsw-alias-border-l3)}.codexModelSelectTrigger:disabled{color:var(--dsw-alias-label-dimmed);cursor:default}.codexModelSelectBolt{display:block;flex:none;width:14px;height:14px;color:var(--dsw-alias-label-primary)}.codexModelSelectLabel{min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.codexModelSelectEffort{flex:none;color:var(--dsw-alias-label-caption)}.codexModelSelectChevron{flex:none;color:var(--dsw-alias-label-caption);transition:transform 120ms}.codexModelSelectTrigger[aria-expanded=true] .codexModelSelectChevron{transform:rotate(180deg)}
@@ -1385,6 +1386,7 @@ window.__ModuleLoader__.load({
 				return () => window.clearInterval(timer);
 			}, [flow?.id, flow?.phase]);
 			const begin = (method) => {
+				setFlow(void 0);
 				setBusy(true);
 				setError(void 0);
 				call("login/start", {
@@ -1744,6 +1746,7 @@ window.__ModuleLoader__.load({
 						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 							className: "codexSubscriptionActions",
 							children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+								className: "codexSubscriptionResetUse",
 								type: "button",
 								variant: "outline",
 								disabled: resetBusy,

package/lib/index.js

@@ -3,7 +3,10 @@ import { LlmError, createUserMessage } from "@deepseek-ai/dsh-llm";
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import { settingsNamespace } from "@deepseek-ai/dsh-settings";
 import z from "@deepseek-ai/schemastery";
-import { spawn } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
+import { request } from "node:https";
+import { promisify } from "node:util";
+import { HttpsProxyAgent } from "https-proxy-agent";
 import { openaiCodexProvider as createOpenAICodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
 import { createModels } from "@earendil-works/pi-ai";
 import { randomUUID } from "node:crypto";
@@ -104,7 +107,8 @@ var DshOAuthCredentialStore = class {
 	}
 };
 /** Return only account state that is safe to expose to the browser client. */
-function createCodexAuthService(models, store) {
+function createCodexAuthService(models, store, options = {}) {
+	const runLogin = options.runLogin ?? ((run) => run());
 	return Object.freeze({
 		async status(options) {
 			const current = await store.read(PROVIDER$1, options);
@@ -120,7 +124,7 @@ function createCodexAuthService(models, store) {
 			};
 		},
 		login(interaction) {
-			return models.login(PROVIDER$1, "oauth", interaction);
+			return runLogin(() => models.login(PROVIDER$1, "oauth", interaction));
 		},
 		logout(options) {
 			return models.logout(PROVIDER$1, options);
@@ -218,6 +222,15 @@ const publicPrompt = (prompt) => ({
 	message: String(prompt.message ?? ""),
 	...typeof prompt.placeholder === "string" ? { placeholder: prompt.placeholder } : {}
 });
+function classifyLoginFailure(error) {
+	const message = error instanceof Error ? error.message : "";
+	if (/token exchange failed/iu.test(message)) return "token-exchange";
+	if (/fetch failed|\b(?:ECONN|ENOTFOUND|ETIMEDOUT|CERT_|socket|network)\b/iu.test(message)) return "network";
+	if (/extract accountId|account[_ -]?id/iu.test(message)) return "account-claim";
+	if (/credential|credentials-local|OAuth JSON/iu.test(message)) return "credential-store";
+	if (/Missing authorization code|State mismatch|callback/iu.test(message)) return "callback";
+	return "provider";
+}
 /** Own one host-side login without exposing tokens to the browser client. */
 var CodexLoginCoordinator = class {
 	#sessions = /* @__PURE__ */ new Map();
@@ -234,13 +247,23 @@ var CodexLoginCoordinator = class {
 		if (active === void 0) return { phase: "idle" };
 		return {
 			method: active.view.method,
-			phase: active.view.phase
+			phase: active.view.phase,
+			...active.view.phase === "failed" ? { failure: classifyLoginFailure(active.hostError) } : {}
 		};
 	}
 	async start({ method }) {
 		if (!LOGIN_METHODS.has(method)) throw new Error(`unsupported Codex login method: ${String(method)}`);
 		const active = this.#activeId === void 0 ? void 0 : this.#sessions.get(this.#activeId);
-		if (active !== void 0 && !TERMINAL_PHASES.has(active.view.phase)) throw new Error("a Codex login is already active");
+		if (active !== void 0 && !TERMINAL_PHASES.has(active.view.phase)) {
+			active.view = {
+				id: active.view.id,
+				provider: "openai-codex",
+				method: active.view.method,
+				phase: "cancelled",
+				authenticated: false
+			};
+			active.controller.abort(/* @__PURE__ */ new Error("Codex login replaced by a new attempt"));
+		}
 		if (active !== void 0) this.#sessions.delete(active.view.id);
 		const id = this.createId();
 		const ready = deferred();
@@ -259,7 +282,7 @@ var CodexLoginCoordinator = class {
 		};
 		this.#sessions.set(id, session);
 		this.#activeId = id;
-		const publishReady = () => ready.resolve(this.read(id));
+		const publishReady = () => ready.resolve(publicClone(session.view));
 		const interaction = {
 			signal: controller.signal,
 			prompt: async (prompt) => {
@@ -451,6 +474,158 @@ function createCodexRpcHandler(coordinator, options = {}) {
 	};
 }
 //#endregion
+//#region src/oauth-network.js
+const execFileAsync = promisify(execFile);
+const CODEX_AUTH_HOST = "auth.openai.com";
+const MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+let patchQueue = Promise.resolve();
+function normalizeProxy(raw) {
+	if (typeof raw !== "string" || raw.trim() === "") return void 0;
+	const value = raw.trim().includes("://") ? raw.trim() : `http://${raw.trim()}`;
+	try {
+		const url = new URL(value);
+		if (!["http:", "https:"].includes(url.protocol) || url.hostname === "") return void 0;
+		return url.toString();
+	} catch {
+		return;
+	}
+}
+function bypassesProxy(hostname, port, rawNoProxy) {
+	if (typeof rawNoProxy !== "string" || rawNoProxy.trim() === "") return false;
+	return rawNoProxy.split(/[\s,]+/u).some((raw) => {
+		const entry = raw.trim().toLowerCase();
+		if (entry === "*") return true;
+		if (entry === "") return false;
+		const match = /^(.*?)(?::(\d+))?$/u.exec(entry);
+		const host = match?.[1]?.replace(/^\./u, "");
+		const entryPort = match?.[2];
+		if (!host || entryPort && entryPort !== port) return false;
+		return hostname === host || hostname.endsWith(`.${host}`);
+	});
+}
+function proxyFromEnvironment(env = process.env, target = new URL(`https://${CODEX_AUTH_HOST}/`)) {
+	if (bypassesProxy(target.hostname.toLowerCase(), target.port || "443", env.NO_PROXY ?? env.no_proxy)) return void 0;
+	return normalizeProxy(env.HTTPS_PROXY ?? env.https_proxy ?? env.ALL_PROXY ?? env.all_proxy);
+}
+function selectWindowsProxy(value) {
+	if (typeof value !== "string") return void 0;
+	const entries = value.split(";").map((item) => item.trim()).filter(Boolean);
+	const https = entries.find((item) => /^https=/iu.test(item));
+	const http = entries.find((item) => /^http=/iu.test(item));
+	const selected = (https ?? http ?? entries.find((item) => !item.includes("=")))?.replace(/^[^=]+=/u, "");
+	return normalizeProxy(selected);
+}
+async function windowsSystemProxy(options = {}) {
+	const run = options.execFile ?? execFileAsync;
+	const reg = `${process.env.SystemRoot ?? "C:\\Windows"}\\System32\\reg.exe`;
+	const key = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings";
+	try {
+		const enabled = await run(reg, [
+			"query",
+			key,
+			"/v",
+			"ProxyEnable"
+		], {
+			windowsHide: true,
+			encoding: "utf8"
+		});
+		if (!/REG_DWORD\s+0x1\b/iu.test(enabled.stdout)) return void 0;
+		const configured = await run(reg, [
+			"query",
+			key,
+			"/v",
+			"ProxyServer"
+		], {
+			windowsHide: true,
+			encoding: "utf8"
+		});
+		return selectWindowsProxy(/^\s*ProxyServer\s+REG_\w+\s+(.+)$/imu.exec(configured.stdout)?.[1]);
+	} catch {
+		return;
+	}
+}
+async function macSystemProxy(options = {}) {
+	const run = options.execFile ?? execFileAsync;
+	try {
+		const result = await run("/usr/sbin/scutil", ["--proxy"], { encoding: "utf8" });
+		if (!/^\s*HTTPSEnable\s*:\s*1\s*$/imu.test(result.stdout)) return void 0;
+		const host = /^\s*HTTPSProxy\s*:\s*(\S+)\s*$/imu.exec(result.stdout)?.[1];
+		const port = /^\s*HTTPSPort\s*:\s*(\d+)\s*$/imu.exec(result.stdout)?.[1];
+		return normalizeProxy(host && port ? `${host}:${port}` : void 0);
+	} catch {
+		return;
+	}
+}
+async function resolveCodexOAuthProxy(options = {}) {
+	const envProxy = proxyFromEnvironment(options.env);
+	if (envProxy) return envProxy;
+	const platform = options.platform ?? process.platform;
+	if (platform === "win32") return windowsSystemProxy(options);
+	if (platform === "darwin") return macSystemProxy(options);
+}
+function bodyBytes(body) {
+	if (body === void 0 || body === null) return void 0;
+	if (typeof body === "string") return Buffer.from(body);
+	if (body instanceof URLSearchParams) return Buffer.from(body.toString());
+	if (body instanceof Uint8Array) return Buffer.from(body);
+	throw new TypeError("Unsupported Codex OAuth request body");
+}
+function fetchThroughProxy(input, init, proxyUrl) {
+	const target = new URL(typeof input === "string" || input instanceof URL ? input : input.url);
+	const body = bodyBytes(init?.body);
+	const headers = new Headers(init?.headers);
+	if (body && !headers.has("content-length")) headers.set("content-length", String(body.byteLength));
+	return new Promise((resolve, reject) => {
+		const request$1 = request(target, {
+			method: init?.method ?? "GET",
+			headers: Object.fromEntries(headers.entries()),
+			agent: new HttpsProxyAgent(proxyUrl),
+			signal: init?.signal
+		}, (response) => {
+			const chunks = [];
+			let total = 0;
+			response.on("data", (chunk) => {
+				total += chunk.length;
+				if (total > MAX_RESPONSE_BYTES) {
+					request$1.destroy(/* @__PURE__ */ new Error("Codex OAuth response exceeded the safety limit"));
+					return;
+				}
+				chunks.push(chunk);
+			});
+			response.on("end", () => resolve(new Response(Buffer.concat(chunks), {
+				status: response.statusCode ?? 500,
+				statusText: response.statusMessage,
+				headers: response.headers
+			})));
+		});
+		request$1.on("error", reject);
+		if (body) request$1.write(body);
+		request$1.end();
+	});
+}
+async function withCodexOAuthNetwork(run, options = {}) {
+	const previous = patchQueue;
+	let release;
+	patchQueue = new Promise((resolve) => {
+		release = resolve;
+	});
+	await previous;
+	const proxyUrl = await resolveCodexOAuthProxy(options);
+	const original = globalThis.fetch;
+	const proxyFetch = options.fetchThroughProxy ?? fetchThroughProxy;
+	const wrapper = proxyUrl ? (input, init) => {
+		const target = new URL(typeof input === "string" || input instanceof URL ? input : input.url);
+		return target.protocol === "https:" && target.hostname === CODEX_AUTH_HOST ? proxyFetch(input, init, proxyUrl) : original(input, init);
+	} : original;
+	globalThis.fetch = wrapper;
+	try {
+		return await run();
+	} finally {
+		if (globalThis.fetch === wrapper) globalThis.fetch = original;
+		release();
+	}
+}
+//#endregion
 //#region src/settings-contract.js
 const SETTINGS_NAMESPACE = "codex-subscription";
 const QUICK_QUOTA_MODE_FIELD = "quickQuotaMode";
@@ -526,7 +701,7 @@ function openaiCodexSubscriptionProvider({ resolveSpeedMode = () => void 0 } = {
 }
 //#endregion
 //#region src/version.js
-const PACKAGE_VERSION = "1.7.2";
+const PACKAGE_VERSION = "1.7.4";
 const USER_AGENT = `dsh-codex-subscription/${PACKAGE_VERSION}`;
 //#endregion
 //#region src/codex-search.js
@@ -1567,7 +1742,7 @@ function apply(ctx) {
 		select(settings.get());
 		return settings.watch(select);
 	}, "codex-subscription: search provider selection");
-	const auth = createCodexAuthService(authModels, store);
+	const auth = createCodexAuthService(authModels, store, { runLogin: withCodexOAuthNetwork });
 	const coordinator = new CodexLoginCoordinator(auth);
 	const usageReader = createCodexUsageReader({
 		getAuth: resolveAuth,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-codex-subscription",
-  "version": "1.7.2",
+  "version": "1.7.4",
   "description": "Use ChatGPT and Codex subscriptions in DeepSeek Harness with OAuth, quota, safe resets, web search, images, and Fast mode",
   "type": "module",
   "main": "./lib/index.js",
@@ -122,6 +122,9 @@
     "react-dom": "18.3.1",
     "tsdown": "0.22.2"
   },
+  "dependencies": {
+    "https-proxy-agent": "7.0.6"
+  },
   "scripts": {
     "build": "tsdown --config tsdown.config.mjs",
     "test": "node --test tests/*.test.mjs",