dsh-codex-subscription 1.7.3 → 1.7.4

package/AGENTS.md

@@ -6,7 +6,7 @@ Use this guide when a user asks an Agent to install, update, verify, or remove
 ## Safety
 
 - Confirm the target DSH installation and profile. Use `web` only when it is the user's target.
-- Use the exact `1.7.3` package below; do not install a moving branch.
+- Use the exact `1.7.4` package below; do not install a moving branch.
 - Never print OAuth credentials, account IDs, authorization callbacks, or credential-store contents.
 - Preserve the DSH profile, unrelated plugins, sessions, and saved sign-in.
 - Do not start, stop, or restart DSH without explicit permission.
@@ -34,13 +34,13 @@ For an official DSH installation run through npm, keep the complete `npx` prefix
 run command does not create a global `dsh` command:
 
 ```sh
-npx -y @deepseek-ai/dsh@0.1.1-rc.2 plugin --profile web add dsh-codex-subscription@1.7.3
+npx -y @deepseek-ai/dsh@0.1.1-rc.2 plugin --profile web add dsh-codex-subscription@1.7.4
 ```
 
 With an existing global `dsh` command:
 
 ```sh
-dsh plugin --profile web add dsh-codex-subscription@1.7.3
+dsh plugin --profile web add dsh-codex-subscription@1.7.4
 ```
 
 Use the same `add` command to update or repair. This is the complete package-changing operation.
@@ -58,7 +58,7 @@ dsh --profile web --dump-config
 
 For the official npm route, run the same checks with `npx -y @deepseek-ai/dsh@0.1.1-rc.2` in place of `dsh`.
 
-1. `dsh-codex-subscription` version `1.7.3` appears exactly once.
+1. `dsh-codex-subscription` version `1.7.4` appears exactly once.
 2. `codex-subscription` appears exactly once in the composed config.
 3. No unrelated plugin or profile was changed and DSH was not restarted.
 

package/THIRD_PARTY_NOTICES.md

@@ -8,6 +8,7 @@ This project depends on software distributed under its own terms. The dependency
 | `@earendil-works/pi-ai` 0.82.1 | OpenAI Codex OAuth, model catalog, Responses transport, and WebSocket continuation | MIT | https://github.com/earendil-works/pi |
 | React | DSH settings component runtime | MIT | https://github.com/facebook/react |
 | Heroicons | Composer speed icon | MIT | https://github.com/tailwindlabs/heroicons |
+| `https-proxy-agent` 7.0.6 | HTTPS proxy transport for Codex OAuth token requests | MIT | https://github.com/TooTallNate/proxy-agents |
 | tsdown | Development-time bundler | MIT | https://github.com/rolldown/tsdown |
 
 No third-party project endorses this community plugin. See each installed package for its complete license text and transitive dependency notices.

package/lib/index.js

@@ -3,7 +3,10 @@ import { LlmError, createUserMessage } from "@deepseek-ai/dsh-llm";
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import { settingsNamespace } from "@deepseek-ai/dsh-settings";
 import z from "@deepseek-ai/schemastery";
-import { spawn } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
+import { request } from "node:https";
+import { promisify } from "node:util";
+import { HttpsProxyAgent } from "https-proxy-agent";
 import { openaiCodexProvider as createOpenAICodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
 import { createModels } from "@earendil-works/pi-ai";
 import { randomUUID } from "node:crypto";
@@ -104,7 +107,8 @@ var DshOAuthCredentialStore = class {
 	}
 };
 /** Return only account state that is safe to expose to the browser client. */
-function createCodexAuthService(models, store) {
+function createCodexAuthService(models, store, options = {}) {
+	const runLogin = options.runLogin ?? ((run) => run());
 	return Object.freeze({
 		async status(options) {
 			const current = await store.read(PROVIDER$1, options);
@@ -120,7 +124,7 @@ function createCodexAuthService(models, store) {
 			};
 		},
 		login(interaction) {
-			return models.login(PROVIDER$1, "oauth", interaction);
+			return runLogin(() => models.login(PROVIDER$1, "oauth", interaction));
 		},
 		logout(options) {
 			return models.logout(PROVIDER$1, options);
@@ -221,6 +225,7 @@ const publicPrompt = (prompt) => ({
 function classifyLoginFailure(error) {
 	const message = error instanceof Error ? error.message : "";
 	if (/token exchange failed/iu.test(message)) return "token-exchange";
+	if (/fetch failed|\b(?:ECONN|ENOTFOUND|ETIMEDOUT|CERT_|socket|network)\b/iu.test(message)) return "network";
 	if (/extract accountId|account[_ -]?id/iu.test(message)) return "account-claim";
 	if (/credential|credentials-local|OAuth JSON/iu.test(message)) return "credential-store";
 	if (/Missing authorization code|State mismatch|callback/iu.test(message)) return "callback";
@@ -469,6 +474,158 @@ function createCodexRpcHandler(coordinator, options = {}) {
 	};
 }
 //#endregion
+//#region src/oauth-network.js
+const execFileAsync = promisify(execFile);
+const CODEX_AUTH_HOST = "auth.openai.com";
+const MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+let patchQueue = Promise.resolve();
+function normalizeProxy(raw) {
+	if (typeof raw !== "string" || raw.trim() === "") return void 0;
+	const value = raw.trim().includes("://") ? raw.trim() : `http://${raw.trim()}`;
+	try {
+		const url = new URL(value);
+		if (!["http:", "https:"].includes(url.protocol) || url.hostname === "") return void 0;
+		return url.toString();
+	} catch {
+		return;
+	}
+}
+function bypassesProxy(hostname, port, rawNoProxy) {
+	if (typeof rawNoProxy !== "string" || rawNoProxy.trim() === "") return false;
+	return rawNoProxy.split(/[\s,]+/u).some((raw) => {
+		const entry = raw.trim().toLowerCase();
+		if (entry === "*") return true;
+		if (entry === "") return false;
+		const match = /^(.*?)(?::(\d+))?$/u.exec(entry);
+		const host = match?.[1]?.replace(/^\./u, "");
+		const entryPort = match?.[2];
+		if (!host || entryPort && entryPort !== port) return false;
+		return hostname === host || hostname.endsWith(`.${host}`);
+	});
+}
+function proxyFromEnvironment(env = process.env, target = new URL(`https://${CODEX_AUTH_HOST}/`)) {
+	if (bypassesProxy(target.hostname.toLowerCase(), target.port || "443", env.NO_PROXY ?? env.no_proxy)) return void 0;
+	return normalizeProxy(env.HTTPS_PROXY ?? env.https_proxy ?? env.ALL_PROXY ?? env.all_proxy);
+}
+function selectWindowsProxy(value) {
+	if (typeof value !== "string") return void 0;
+	const entries = value.split(";").map((item) => item.trim()).filter(Boolean);
+	const https = entries.find((item) => /^https=/iu.test(item));
+	const http = entries.find((item) => /^http=/iu.test(item));
+	const selected = (https ?? http ?? entries.find((item) => !item.includes("=")))?.replace(/^[^=]+=/u, "");
+	return normalizeProxy(selected);
+}
+async function windowsSystemProxy(options = {}) {
+	const run = options.execFile ?? execFileAsync;
+	const reg = `${process.env.SystemRoot ?? "C:\\Windows"}\\System32\\reg.exe`;
+	const key = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings";
+	try {
+		const enabled = await run(reg, [
+			"query",
+			key,
+			"/v",
+			"ProxyEnable"
+		], {
+			windowsHide: true,
+			encoding: "utf8"
+		});
+		if (!/REG_DWORD\s+0x1\b/iu.test(enabled.stdout)) return void 0;
+		const configured = await run(reg, [
+			"query",
+			key,
+			"/v",
+			"ProxyServer"
+		], {
+			windowsHide: true,
+			encoding: "utf8"
+		});
+		return selectWindowsProxy(/^\s*ProxyServer\s+REG_\w+\s+(.+)$/imu.exec(configured.stdout)?.[1]);
+	} catch {
+		return;
+	}
+}
+async function macSystemProxy(options = {}) {
+	const run = options.execFile ?? execFileAsync;
+	try {
+		const result = await run("/usr/sbin/scutil", ["--proxy"], { encoding: "utf8" });
+		if (!/^\s*HTTPSEnable\s*:\s*1\s*$/imu.test(result.stdout)) return void 0;
+		const host = /^\s*HTTPSProxy\s*:\s*(\S+)\s*$/imu.exec(result.stdout)?.[1];
+		const port = /^\s*HTTPSPort\s*:\s*(\d+)\s*$/imu.exec(result.stdout)?.[1];
+		return normalizeProxy(host && port ? `${host}:${port}` : void 0);
+	} catch {
+		return;
+	}
+}
+async function resolveCodexOAuthProxy(options = {}) {
+	const envProxy = proxyFromEnvironment(options.env);
+	if (envProxy) return envProxy;
+	const platform = options.platform ?? process.platform;
+	if (platform === "win32") return windowsSystemProxy(options);
+	if (platform === "darwin") return macSystemProxy(options);
+}
+function bodyBytes(body) {
+	if (body === void 0 || body === null) return void 0;
+	if (typeof body === "string") return Buffer.from(body);
+	if (body instanceof URLSearchParams) return Buffer.from(body.toString());
+	if (body instanceof Uint8Array) return Buffer.from(body);
+	throw new TypeError("Unsupported Codex OAuth request body");
+}
+function fetchThroughProxy(input, init, proxyUrl) {
+	const target = new URL(typeof input === "string" || input instanceof URL ? input : input.url);
+	const body = bodyBytes(init?.body);
+	const headers = new Headers(init?.headers);
+	if (body && !headers.has("content-length")) headers.set("content-length", String(body.byteLength));
+	return new Promise((resolve, reject) => {
+		const request$1 = request(target, {
+			method: init?.method ?? "GET",
+			headers: Object.fromEntries(headers.entries()),
+			agent: new HttpsProxyAgent(proxyUrl),
+			signal: init?.signal
+		}, (response) => {
+			const chunks = [];
+			let total = 0;
+			response.on("data", (chunk) => {
+				total += chunk.length;
+				if (total > MAX_RESPONSE_BYTES) {
+					request$1.destroy(/* @__PURE__ */ new Error("Codex OAuth response exceeded the safety limit"));
+					return;
+				}
+				chunks.push(chunk);
+			});
+			response.on("end", () => resolve(new Response(Buffer.concat(chunks), {
+				status: response.statusCode ?? 500,
+				statusText: response.statusMessage,
+				headers: response.headers
+			})));
+		});
+		request$1.on("error", reject);
+		if (body) request$1.write(body);
+		request$1.end();
+	});
+}
+async function withCodexOAuthNetwork(run, options = {}) {
+	const previous = patchQueue;
+	let release;
+	patchQueue = new Promise((resolve) => {
+		release = resolve;
+	});
+	await previous;
+	const proxyUrl = await resolveCodexOAuthProxy(options);
+	const original = globalThis.fetch;
+	const proxyFetch = options.fetchThroughProxy ?? fetchThroughProxy;
+	const wrapper = proxyUrl ? (input, init) => {
+		const target = new URL(typeof input === "string" || input instanceof URL ? input : input.url);
+		return target.protocol === "https:" && target.hostname === CODEX_AUTH_HOST ? proxyFetch(input, init, proxyUrl) : original(input, init);
+	} : original;
+	globalThis.fetch = wrapper;
+	try {
+		return await run();
+	} finally {
+		if (globalThis.fetch === wrapper) globalThis.fetch = original;
+		release();
+	}
+}
+//#endregion
 //#region src/settings-contract.js
 const SETTINGS_NAMESPACE = "codex-subscription";
 const QUICK_QUOTA_MODE_FIELD = "quickQuotaMode";
@@ -544,7 +701,7 @@ function openaiCodexSubscriptionProvider({ resolveSpeedMode = () => void 0 } = {
 }
 //#endregion
 //#region src/version.js
-const PACKAGE_VERSION = "1.7.3";
+const PACKAGE_VERSION = "1.7.4";
 const USER_AGENT = `dsh-codex-subscription/${PACKAGE_VERSION}`;
 //#endregion
 //#region src/codex-search.js
@@ -1585,7 +1742,7 @@ function apply(ctx) {
 		select(settings.get());
 		return settings.watch(select);
 	}, "codex-subscription: search provider selection");
-	const auth = createCodexAuthService(authModels, store);
+	const auth = createCodexAuthService(authModels, store, { runLogin: withCodexOAuthNetwork });
 	const coordinator = new CodexLoginCoordinator(auth);
 	const usageReader = createCodexUsageReader({
 		getAuth: resolveAuth,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-codex-subscription",
-  "version": "1.7.3",
+  "version": "1.7.4",
   "description": "Use ChatGPT and Codex subscriptions in DeepSeek Harness with OAuth, quota, safe resets, web search, images, and Fast mode",
   "type": "module",
   "main": "./lib/index.js",
@@ -122,6 +122,9 @@
     "react-dom": "18.3.1",
     "tsdown": "0.22.2"
   },
+  "dependencies": {
+    "https-proxy-agent": "7.0.6"
+  },
   "scripts": {
     "build": "tsdown --config tsdown.config.mjs",
     "test": "node --test tests/*.test.mjs",