dsh-coding-subscription-oauth 0.6.2 → 0.6.4

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-coding-subscription-oauth",
   "description": "DeepSeek Harness coding-subscription OAuth: SuperGrok/Grok Build, ChatGPT Plus Codex, Kimi Code, Claude Code. Fixes AUTH API key is invalid, INVALID_REPLAY_STATE, grok-4.6 xhigh, Kimi Bearer vs x-api-key.",
-	"version": "0.6.2",
+  "version": "0.6.4",
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/"
@@ -39,18 +39,18 @@
     "dsh-coding-oauth": "lib/bin.js",
     "dsh-grok-build": "lib/bin.js"
   },
-  "scripts": {
-    "check:bom": "node build/verify-dsh-bom.mjs",
+  "scripts": {
+    "check:bom": "node build/verify-dsh-bom.mjs",
     "clean": "node build/clean.mjs",
     "typecheck": "tsc -b tsconfig.host.json tsconfig.client.json",
     "build:server": "tsc -p tsconfig.build.json && tsc -p tsconfig.dts-bin.json && node build/build-server.mjs",
     "build:client": "node build/build-client.mjs",
-    "build:artifacts": "pnpm run check:bom && pnpm run clean && pnpm run typecheck && pnpm run build:server && pnpm run build:client",
+    "build:artifacts": "pnpm run check:bom && pnpm run clean && pnpm run typecheck && pnpm run build:server && pnpm run build:client",
     "build": "pnpm run release:build",
     "test": "vitest run",
     "test:watch": "vitest",
     "lint": "biome check",
-    "check:next": "pnpm run check:bom && pnpm run lint && pnpm run typecheck && pnpm run test",
+    "check:next": "pnpm run check:bom && pnpm run lint && pnpm run typecheck && pnpm run test",
     "check": "pnpm run lint && pnpm run release:build && pnpm run test",
     "release:promote": "node build/promote-release.mjs",
     "release:verify": "node build/verify-release.mjs",
@@ -83,9 +83,9 @@
     "CHANGELOG.md",
     "CONTRIBUTING.md",
     "docs/00-project-rules.md",
-    "docs/02-architecture.md",
-    "docs/02-architecture.zh-CN.md",
-    "compatibility/dsh-bom.json",
+    "docs/02-architecture.md",
+    "docs/02-architecture.zh-CN.md",
+    "compatibility/dsh-bom.json",
     "README.zh-CN.md",
     "README.ja.md",
     "README.ko.md",
@@ -102,34 +102,34 @@
     "NOTICE"
   ],
   "license": "Apache-2.0",
-  "dsh": {
-    "compatibility": {
-      "coreAbi": "dsh-coding-oauth-core/v1",
-      "verifiedBom": "./compatibility/dsh-bom.json",
-      "participant": "coding-subscription-oauth",
-      "diagnostics": "standalone",
-      "bom": {
-        "@deepseek-ai/cordis": "4.0.1",
-        "@deepseek-ai/dsh-atomic-write": "0.1.1-rc.2",
-        "@deepseek-ai/dsh-attachment": "0.1.1-rc.2",
-        "@deepseek-ai/dsh-client-locale": "0.1.1-rc.2",
-        "@deepseek-ai/dsh-client-runtime": "0.1.1-rc.2",
-        "@deepseek-ai/dsh-client-ui-settings": "0.1.1-rc.2",
-        "@deepseek-ai/dsh-client-ui-slots": "0.1.1-rc.2",
-        "@deepseek-ai/dsh-client-web": "0.1.1-rc.2",
-        "@deepseek-ai/dsh-credentials": "0.1.1-rc.2",
-        "@deepseek-ai/dsh-home-paths": "0.1.1-rc.2",
-        "@deepseek-ai/dsh-host-webserver": "0.1.1-rc.2",
-        "@deepseek-ai/dsh-invariants": "0.1.1-rc.2",
-        "@deepseek-ai/dsh-llm": "0.1.1-rc.2",
-        "@deepseek-ai/dsh-llm-pi-ai": "0.1.1-rc.2",
-        "@deepseek-ai/dsh-tools": "0.1.1-rc.2",
-        "@deepseek-ai/schemastery": "3.18.1",
-        "@earendil-works/pi-ai": "0.84.2",
-        "react": "18.3.1",
-        "react-dom": "18.3.1"
-      }
-    },
+  "dsh": {
+    "compatibility": {
+      "coreAbi": "dsh-coding-oauth-core/v1",
+      "verifiedBom": "./compatibility/dsh-bom.json",
+      "participant": "coding-subscription-oauth",
+      "diagnostics": "standalone",
+      "bom": {
+        "@deepseek-ai/cordis": "4.0.1",
+        "@deepseek-ai/dsh-atomic-write": "0.1.1-rc.2",
+        "@deepseek-ai/dsh-attachment": "0.1.1-rc.2",
+        "@deepseek-ai/dsh-client-locale": "0.1.1-rc.2",
+        "@deepseek-ai/dsh-client-runtime": "0.1.1-rc.2",
+        "@deepseek-ai/dsh-client-ui-settings": "0.1.1-rc.2",
+        "@deepseek-ai/dsh-client-ui-slots": "0.1.1-rc.2",
+        "@deepseek-ai/dsh-client-web": "0.1.1-rc.2",
+        "@deepseek-ai/dsh-credentials": "0.1.1-rc.2",
+        "@deepseek-ai/dsh-home-paths": "0.1.1-rc.2",
+        "@deepseek-ai/dsh-host-webserver": "0.1.1-rc.2",
+        "@deepseek-ai/dsh-invariants": "0.1.1-rc.2",
+        "@deepseek-ai/dsh-llm": "0.1.1-rc.2",
+        "@deepseek-ai/dsh-llm-pi-ai": "0.1.1-rc.2",
+        "@deepseek-ai/dsh-tools": "0.1.1-rc.2",
+        "@deepseek-ai/schemastery": "3.18.1",
+        "@earendil-works/pi-ai": "0.84.2",
+        "react": "18.3.1",
+        "react-dom": "18.3.1"
+      }
+    },
     "bundle": {
       "patch": "./cordis.patch.yml"
     },
@@ -142,25 +142,25 @@
       "platform": "web"
     }
   },
-  "dependencies": {
-	"dsh-coding-oauth-core": "0.1.0",
-    "undici": "^7.24.8"
-  },
+  "dependencies": {
+    "dsh-coding-oauth-core": "0.1.1",
+    "undici": "7.29.0"
+  },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "4.0.1",
-    "@deepseek-ai/dsh-atomic-write": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-attachment": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-credentials": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-home-paths": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-host-webserver": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-invariants": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-llm": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-llm-pi-ai": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-tools": "0.1.1-rc.2",
+    "@deepseek-ai/cordis": "4.0.1",
+    "@deepseek-ai/dsh-atomic-write": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-attachment": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-credentials": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-home-paths": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-invariants": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-llm": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-tools": "0.1.1-rc.2",
     "@deepseek-ai/schemastery": "3.18.1",
     "@earendil-works/pi-ai": "0.84.2",
-    "react": "18.3.1",
-    "react-dom": "18.3.1"
+    "react": "18.3.1",
+    "react-dom": "18.3.1"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/cordis": {
@@ -181,40 +181,40 @@
     "@deepseek-ai/dsh-tools": {
       "optional": true
     },
-    "react": {
-      "optional": true
-    },
-    "react-dom": {
-      "optional": true
+    "react": {
+      "optional": true
+    },
+    "react-dom": {
+      "optional": true
     }
   },
   "devDependencies": {
     "@biomejs/biome": "^2.5.8",
-    "@deepseek-ai/cordis": "4.0.1",
-    "@deepseek-ai/dsh-atomic-write": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-attachment": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-locale": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-runtime": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-slots": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-web": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-credentials": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-home-paths": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-host-webserver": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-invariants": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-llm": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-llm-pi-ai": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-tools": "0.1.1-rc.2",
+    "@deepseek-ai/cordis": "4.0.1",
+    "@deepseek-ai/dsh-atomic-write": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-attachment": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-locale": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-runtime": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-web": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-credentials": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-home-paths": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-invariants": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-llm": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-tools": "0.1.1-rc.2",
     "@deepseek-ai/schemastery": "3.18.1",
     "@earendil-works/pi-ai": "0.84.2",
     "@types/node": "^22.20.0",
-    "@types/react": "~18.3.1",
-    "@types/react-dom": "18.3.7",
+    "@types/react": "~18.3.1",
+    "@types/react-dom": "18.3.7",
     "esbuild": "^0.28.2",
-    "react": "18.3.1",
-    "react-dom": "18.3.1",
+    "react": "18.3.1",
+    "react-dom": "18.3.1",
     "typescript": "^6.0.3",
-    "undici": "^7.24.8",
+    "undici": "7.29.0",
     "vitest": "^4.1.8"
   },
   "overrides": {

package/src/adapter.ts

@@ -3,7 +3,7 @@
 import type { AttachmentStore } from "@deepseek-ai/dsh-attachment";
 import type { RetryPolicyConfig } from "@deepseek-ai/dsh-llm";
 import { type LlmAdapter, LlmError, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
-import type { PiAiAdapterOptions, ResolvedPiAiProviderProfile } from "@deepseek-ai/dsh-llm-pi-ai";
+import type { PiAiAdapterOptions, ResolvedPiAiProviderProfile } from "@deepseek-ai/dsh-llm-pi-ai";
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import type { AliasLlmRoutePolicy } from "./alias-adapter.ts";
 import { AliasLlmAdapter } from "./alias-adapter.ts";
@@ -25,60 +25,60 @@ import {
 import type { OAuthProviderSession } from "./oauth-session.ts";
 import { grokBuildBaselineModels, grokBuildFingerprintHeaders } from "./provider.ts";
 import { safeMessage } from "./redact.ts";
-import type { GrokBuildSession } from "./session.ts";
-
-type PiAiAuthInjection = PiAiAdapterOptions["auth"];
-type PiAiCredentialStore = PiAiAuthInjection["credentials"];
-
-const REQUEST_IMAGE_POLICY = {
-	maxRequestImageBytes: 20 * 1024 * 1024,
-	requestImagePixelBudget: 2048 * 2048,
-	requestImageMaxBytes: 1024 * 1024,
-} as const;
-
-/**
- * Route pi-ai credential operations to the already owner-locked OAuth files.
- * The adapter may ask its collection about every profile, so an unknown id is
- * never allowed to reach a writable store. Reads are empty and writes fail
- * closed, preserving the existing per-provider refresh lock and file policy.
- */
-function oauthAuthInjection(grok: GrokBuildSession, subscriptions: readonly OAuthProviderSession[]): PiAiAuthInjection {
-	const stores = new Map<string, PiAiCredentialStore>([
-		[XAI_PI_PROVIDER, grok.store],
-		...subscriptions.map((session) => [session.definition.nativeProviderId, session.store] as const),
-	]);
-	const storeFor = (providerId: string): PiAiCredentialStore | undefined => stores.get(providerId);
-	return {
-		credentials: {
-			async read(providerId, options) {
-				return storeFor(providerId)?.read(providerId, options);
-			},
-			async list(options) {
-				const entries = await Promise.all([...stores.values()].map((store) => store.list(options)));
-				return entries.flat();
-			},
-			async modify(providerId, fn, options) {
-				const store = storeFor(providerId);
-				if (store === undefined)
-					throw new Error(`refusing credential write for unknown OAuth provider "${providerId}"`);
-				return store.modify(providerId, fn, options);
-			},
-			async delete(providerId, options) {
-				const store = storeFor(providerId);
-				if (store === undefined)
-					throw new Error(`refusing credential deletion for unknown OAuth provider "${providerId}"`);
-				await store.delete(providerId, options);
-			},
-		},
-		authContext: {
-			// Subscription adapters obtain request credentials only from their
-			// owner-scoped stores. Do not let a foreign environment/file credential
-			// silently change a selected OAuth route.
-			env: async () => undefined,
-			fileExists: async () => false,
-		},
-	};
-}
+import type { GrokBuildSession } from "./session.ts";
+
+type PiAiAuthInjection = PiAiAdapterOptions["auth"];
+type PiAiCredentialStore = PiAiAuthInjection["credentials"];
+
+const REQUEST_IMAGE_POLICY = {
+	maxRequestImageBytes: 20 * 1024 * 1024,
+	requestImagePixelBudget: 2048 * 2048,
+	requestImageMaxBytes: 1024 * 1024,
+} as const;
+
+/**
+ * Route pi-ai credential operations to the already owner-locked OAuth files.
+ * The adapter may ask its collection about every profile, so an unknown id is
+ * never allowed to reach a writable store. Reads are empty and writes fail
+ * closed, preserving the existing per-provider refresh lock and file policy.
+ */
+function oauthAuthInjection(grok: GrokBuildSession, subscriptions: readonly OAuthProviderSession[]): PiAiAuthInjection {
+	const stores = new Map<string, PiAiCredentialStore>([
+		[XAI_PI_PROVIDER, grok.store],
+		...subscriptions.map((session) => [session.definition.nativeProviderId, session.store] as const),
+	]);
+	const storeFor = (providerId: string): PiAiCredentialStore | undefined => stores.get(providerId);
+	return {
+		credentials: {
+			async read(providerId, options) {
+				return storeFor(providerId)?.read(providerId, options);
+			},
+			async list(options) {
+				const entries = await Promise.all([...stores.values()].map((store) => store.list(options)));
+				return entries.flat();
+			},
+			async modify(providerId, fn, options) {
+				const store = storeFor(providerId);
+				if (store === undefined)
+					throw new Error(`refusing credential write for unknown OAuth provider "${providerId}"`);
+				return store.modify(providerId, fn, options);
+			},
+			async delete(providerId, options) {
+				const store = storeFor(providerId);
+				if (store === undefined)
+					throw new Error(`refusing credential deletion for unknown OAuth provider "${providerId}"`);
+				await store.delete(providerId, options);
+			},
+		},
+		authContext: {
+			// Subscription adapters obtain request credentials only from their
+			// owner-scoped stores. Do not let a foreign environment/file credential
+			// silently change a selected OAuth route.
+			env: async () => undefined,
+			fileExists: async () => false,
+		},
+	};
+}
 
 /** Prefer grok-4.6 when the current (live or baseline) list has it. */
 export function preferredGrokBuildModel(models: readonly { id: string }[] = grokBuildBaselineModels()): string {
@@ -139,8 +139,8 @@ function profile(
 			retryPolicy ?? CODING_OAUTH_RETRY_POLICY,
 			"dsh-coding-subscription-oauth retryPolicy",
 		),
-		configuredMaxTokens: new Map(),
-		...REQUEST_IMAGE_POLICY,
+		configuredMaxTokens: new Map(),
+		...REQUEST_IMAGE_POLICY,
 		...(headers === undefined ? {} : { headers }),
 		piProvider,
 	};
@@ -151,7 +151,7 @@ export function createGrokBuildAdapter(
 	session: GrokBuildSession,
 	resolveAttachments: () => AttachmentStore | undefined,
 ): PiAiAdapter {
-	return new PiAiAdapter({
+	return new PiAiAdapter({
 		profiles: () =>
 			new Map<string, ResolvedPiAiProviderProfile>([
 				[
@@ -159,13 +159,13 @@ export function createGrokBuildAdapter(
 					profile(GROK_BUILD_ROUTE, "xAI Grok Build", session.provider(), undefined, grokBuildFingerprintHeaders()),
 				],
 			]),
-		resolveApiKey: async () =>
+		resolveApiKey: async () =>
 			resolveOAuthToken("Grok Build", async () => {
 				const auth = await session.models.getAuth(XAI_PI_PROVIDER, { minOAuthValidityMs: MIN_OAUTH_VALIDITY_MS });
 				return auth?.auth.apiKey;
-			}),
-		auth: oauthAuthInjection(session, []),
-		resolveAttachments,
+			}),
+		auth: oauthAuthInjection(session, []),
+		resolveAttachments,
 	});
 }
 
@@ -256,7 +256,7 @@ export function createCodingOAuthAdapter(
 		});
 	}
 
-	const inner = new PiAiAdapter({
+	const inner = new PiAiAdapter({
 		profiles: () => {
 			const profiles = new Map<string, ResolvedPiAiProviderProfile>();
 			profiles.set(
@@ -299,7 +299,7 @@ export function createCodingOAuthAdapter(
 			}
 			return profiles;
 		},
-		resolveApiKey: async (provider) => {
+		resolveApiKey: async (provider) => {
 			if (provider === GROK_BUILD_ROUTE) {
 				return resolveOAuthToken("Grok Build", async () => {
 					const auth = await grok.models.getAuth(XAI_PI_PROVIDER, { minOAuthValidityMs: MIN_OAUTH_VALIDITY_MS });
@@ -309,19 +309,19 @@ export function createCodingOAuthAdapter(
 			const session =
 				provider === CODEX_OAUTH_FAST_ROUTE ? byNativeId.get(CODEX_PI_PROVIDER) : byNativeId.get(provider);
 			if (session === undefined) throw new LlmError(`Unknown OAuth provider "${provider}"`, "NO_ADAPTER");
-			return resolveOAuthToken(session.definition.displayName, () => session.resolveAccessToken());
-		},
-		auth: oauthAuthInjection(grok, subscriptions),
-		resolveAttachments,
+			return resolveOAuthToken(session.definition.displayName, () => session.resolveAccessToken());
+		},
+		auth: oauthAuthInjection(grok, subscriptions),
+		resolveAttachments,
 	});
 
-	// The Fast wrapper restores wire/replay model identity to openai-codex.
-	// Keep the opaque envelope untouched and map public Fast source identity to
-	// that native replay provider before PiAiAdapter validates it.
-	const replayProviders = new Map(aliases);
-	replayProviders.set(CODEX_OAUTH_FAST_ROUTE, CODEX_PI_PROVIDER);
-	return new AliasLlmAdapter(inner, aliases, policies, replayProviders);
-}
+	// The Fast wrapper restores wire/replay model identity to openai-codex.
+	// Keep the opaque envelope untouched and map public Fast source identity to
+	// that native replay provider before PiAiAdapter validates it.
+	const replayProviders = new Map(aliases);
+	replayProviders.set(CODEX_OAUTH_FAST_ROUTE, CODEX_PI_PROVIDER);
+	return new AliasLlmAdapter(inner, aliases, policies, replayProviders);
+}
 
 /**
  * Resolve an OAuth access token for one route, translating a failed refresh

package/src/alias-adapter.ts

@@ -36,10 +36,10 @@ export interface AliasLlmRoutePolicy {
 	onAuthFailure?: () => Promise<void>;
 }
 
-export function normalizeReplayForRoute(
-	message: GenerateOptions["messages"][number],
-	route: string,
-	nativeReplayProvider: string,
+export function normalizeReplayForRoute(
+	message: GenerateOptions["messages"][number],
+	route: string,
+	nativeReplayProvider: string,
 ): GenerateOptions["messages"][number] {
 	if (message.role !== "assistant" || message.source.kind !== "model") return message;
 	if (message.source.provider !== route) {
@@ -47,10 +47,10 @@ export function normalizeReplayForRoute(
 		const { replayState: _foreignReplay, ...source } = message.source;
 		return { ...message, source };
 	}
-	// The rc.2 envelope stays entirely opaque. PiAiAdapter only keys replay
-	// validation from source.provider, so restore the native provider identity
-	// without inspecting or changing replayState.
-	return { ...message, source: { ...message.source, provider: nativeReplayProvider } };
+	// The rc.2 envelope stays entirely opaque. PiAiAdapter only keys replay
+	// validation from source.provider, so restore the native provider identity
+	// without inspecting or changing replayState.
+	return { ...message, source: { ...message.source, provider: nativeReplayProvider } };
 }
 
 /**
@@ -58,11 +58,11 @@ export function normalizeReplayForRoute(
  * Harness route names. Every public operation translates exactly once.
  */
 export class AliasLlmAdapter extends LlmAdapter {
-	constructor(
-		private readonly inner: LlmAdapter,
-		private readonly aliases: ReadonlyMap<string, string>,
-		private readonly policies: ReadonlyMap<string, AliasLlmRoutePolicy> = new Map(),
-		private readonly replayProviders: ReadonlyMap<string, string> = aliases,
+	constructor(
+		private readonly inner: LlmAdapter,
+		private readonly aliases: ReadonlyMap<string, string>,
+		private readonly policies: ReadonlyMap<string, AliasLlmRoutePolicy> = new Map(),
+		private readonly replayProviders: ReadonlyMap<string, string> = aliases,
 	) {
 		super();
 	}
@@ -109,9 +109,9 @@ export class AliasLlmAdapter extends LlmAdapter {
 	async *stream(options: GenerateOptions): AsyncIterable<StreamChunk> {
 		const route = options.provider;
 		const native = this.nativeProvider(route);
-		const messages = options.messages.map((message) =>
-			normalizeReplayForRoute(message, route, this.replayProviders.get(route) ?? native),
-		);
+		const messages = options.messages.map((message) =>
+			normalizeReplayForRoute(message, route, this.replayProviders.get(route) ?? native),
+		);
 		let authFailureNotified = false;
 		for await (const raw of this.inner.stream({ ...options, provider: native, messages })) {
 			const chunk =
@@ -141,7 +141,7 @@ export class AliasLlmAdapter extends LlmAdapter {
 					}
 				}
 			}
-			yield chunk;
+			yield chunk;
 		}
 	}
 }

package/src/capability-runtime.ts

@@ -302,6 +302,7 @@ function sameSettings(left: CapabilitySettings, right: CapabilitySettings): bool
 		left.codexSearch === right.codexSearch &&
 		left.codexImages === right.codexImages &&
 		left.codexImageEdits === right.codexImageEdits &&
+		left.codexImagesAnyModel === right.codexImagesAnyModel &&
 		left.codexUsage === right.codexUsage &&
 		left.codexFast === right.codexFast &&
 		left.grokImagineImage === right.grokImagineImage &&

package/src/capability-settings.ts

@@ -18,6 +18,7 @@ export const CAPABILITY_FLAG_KEYS = [
 	"codexSearch",
 	"codexImages",
 	"codexImageEdits",
+	"codexImagesAnyModel",
 	"codexUsage",
 	"codexFast",
 	"grokImagineImage",
@@ -39,6 +40,8 @@ export interface CapabilitySettings {
 	readonly codexSearch: boolean;
 	readonly codexImages: boolean;
 	readonly codexImageEdits: boolean;
+	/** Allow non-Codex-route models to use the Codex image generate/edit tools. */
+	readonly codexImagesAnyModel: boolean;
 	readonly codexUsage: boolean;
 	readonly codexFast: boolean;
 	readonly grokImagineImage: boolean;
@@ -67,6 +70,7 @@ export const DEFAULT_CAPABILITY_SETTINGS: CapabilitySettings = Object.freeze({
 	codexSearch: false,
 	codexImages: false,
 	codexImageEdits: false,
+	codexImagesAnyModel: false,
 	codexUsage: false,
 	codexFast: false,
 	grokImagineImage: false,
@@ -84,6 +88,7 @@ export const CapabilitySettingsSchema = Schema.object({
 	codexSearch: Schema.boolean().default(false),
 	codexImages: Schema.boolean().default(false),
 	codexImageEdits: Schema.boolean().default(false),
+	codexImagesAnyModel: Schema.boolean().default(false),
 	codexUsage: Schema.boolean().default(false),
 	codexFast: Schema.boolean().default(false),
 	grokImagineImage: Schema.boolean().default(false),
@@ -238,6 +243,7 @@ export function capabilityFlags(settings: CapabilitySettings): Pick<CapabilitySe
 		codexSearch: settings.codexSearch,
 		codexImages: settings.codexImages,
 		codexImageEdits: settings.codexImageEdits,
+		codexImagesAnyModel: settings.codexImagesAnyModel,
 		codexUsage: settings.codexUsage,
 		codexFast: settings.codexFast,
 		grokImagineImage: settings.grokImagineImage,
@@ -272,10 +278,15 @@ export function resolveCapabilitySettings(
  */
 export function normalizeCapabilitySettings(input?: unknown): CapabilitySettings {
 	const patch = normalizeCapabilitySettingsPatch(input);
+	const codexImages = patch.codexImages ?? DEFAULT_CAPABILITY_SETTINGS.codexImages;
 	return Object.freeze({
 		codexSearch: patch.codexSearch ?? DEFAULT_CAPABILITY_SETTINGS.codexSearch,
-		codexImages: patch.codexImages ?? DEFAULT_CAPABILITY_SETTINGS.codexImages,
+		codexImages,
 		codexImageEdits: patch.codexImageEdits ?? DEFAULT_CAPABILITY_SETTINGS.codexImageEdits,
+		// any-model is meaningless without images; clear at admit so UI cascade alone cannot leave it on
+		codexImagesAnyModel: codexImages
+			? (patch.codexImagesAnyModel ?? DEFAULT_CAPABILITY_SETTINGS.codexImagesAnyModel)
+			: false,
 		codexUsage: patch.codexUsage ?? DEFAULT_CAPABILITY_SETTINGS.codexUsage,
 		codexFast: patch.codexFast ?? DEFAULT_CAPABILITY_SETTINGS.codexFast,
 		grokImagineImage: patch.grokImagineImage ?? DEFAULT_CAPABILITY_SETTINGS.grokImagineImage,
@@ -296,6 +307,7 @@ export function normalizeCapabilitySettingsPatch(input?: unknown): CapabilitySet
 		codexSearch?: boolean;
 		codexImages?: boolean;
 		codexImageEdits?: boolean;
+		codexImagesAnyModel?: boolean;
 		codexUsage?: boolean;
 		codexFast?: boolean;
 		grokImagineImage?: boolean;
@@ -308,6 +320,7 @@ export function normalizeCapabilitySettingsPatch(input?: unknown): CapabilitySet
 	assignFlag(patch, "codexSearch", flags["codexSearch"]);
 	assignFlag(patch, "codexImages", flags["codexImages"]);
 	assignFlag(patch, "codexImageEdits", flags["codexImageEdits"]);
+	assignFlag(patch, "codexImagesAnyModel", flags["codexImagesAnyModel"]);
 	assignFlag(patch, "codexUsage", flags["codexUsage"]);
 	assignFlag(patch, "codexFast", flags["codexFast"]);
 	assignFlag(patch, "grokImagineImage", flags["grokImagineImage"]);

package/src/capability-tools.ts

@@ -22,6 +22,7 @@ import {
 	type CodexImageQuality,
 	type CodexImageResult,
 	type CodexImageRoute,
+	type CodexImageRoutePolicy,
 	type CodexImageSessionContext,
 	type CodexImageSize,
 	createCodexImageController,
@@ -72,7 +73,18 @@ const IMAGINE_MEDIA_PREFIX = "/plugins/dsh-grok-build/imagine/media/";
 export type CapabilityImagineClient = Pick<GrokImagineClient, "generateImage" | "startVideo" | "videoStatus">;
 
 /** Per-exec Codex controller factory. Tests inject a fake; production binds auth + attachments. */
-export type CreateCodexImageController = (session: CodexImageSessionContext) => CodexImageController;
+export type CreateCodexImageController = (
+	session: CodexImageSessionContext,
+	routePolicy: CodexImageRoutePolicy,
+) => CodexImageController;
+
+/**
+ * Route gate for the Codex image tools. `codexImagesAnyModel` relaxes the
+ * Codex-route requirement; otherwise the gate stays `codex-capable`.
+ */
+export function codexImageRoutePolicy(settings: CapabilitySettings): CodexImageRoutePolicy {
+	return settings.codexImagesAnyModel ? "any" : "codex-capable";
+}
 
 /** Resolve authoritative host model metadata for the calling route. */
 export type ResolveCodexImageRoute = (exec: ToolRunContext) => Promise<CodexImageRoute | undefined>;
@@ -390,11 +402,12 @@ export async function createCapabilityTools(options: CapabilityToolsOptions): Pr
 	const { defineTool } = await import("@deepseek-ai/dsh-tools");
 	const createController: CreateCodexImageController =
 		options.createCodexController ??
-		((session) =>
+		((session, routePolicy) =>
 			createCodexImageController({
 				auth: options.auth,
 				attachments: options.attachments,
 				session,
+				routePolicy,
 			}));
 
 	const generate = defineTool({
@@ -438,7 +451,10 @@ export async function createCapabilityTools(options: CapabilityToolsOptions): Pr
 			const settings = options.current();
 			if (!settings.codexImages) disabled(CODEX_IMAGE_GENERATE_TOOL);
 			const n = resolveImageCount(args.n, settings);
-			const result = await createController(await generateSession(exec, options.resolveCodexImageRoute)).generate(
+			const result = await createController(
+				await generateSession(exec, options.resolveCodexImageRoute),
+				codexImageRoutePolicy(settings),
+			).generate(
 				{
 					prompt: args.prompt,
 					n,
@@ -499,7 +515,10 @@ export async function createCapabilityTools(options: CapabilityToolsOptions): Pr
 			const settings = options.current();
 			if (!settings.codexImageEdits || !settings.codexImages) disabled(CODEX_IMAGE_EDIT_TOOL);
 			const n = resolveImageCount(args.n, settings);
-			const result = await createController(await requireEditSession(exec, options.resolveCodexImageRoute)).edit(
+			const result = await createController(
+				await requireEditSession(exec, options.resolveCodexImageRoute),
+				codexImageRoutePolicy(settings),
+			).edit(
 				{
 					prompt: args.prompt,
 					imageIds: args.imageIds,

package/src/client/GrokBuildSettings.tsx

@@ -416,9 +416,10 @@ export function GrokBuildSettings({ t }: GrokBuildSettingsProps) {
 	const patchCapability = async (key: CapabilitySettingKey, value: boolean | number): Promise<boolean> => {
 		if (capabilities === undefined || !capabilities.writable) return false;
 		if (key === "codexImageEdits" && value === true && !capabilities.value.codexImages) return false;
+		if (key === "codexImagesAnyModel" && value === true && !capabilities.value.codexImages) return false;
 		const patch: Partial<CapabilitySettingsView> =
-			key === "codexImages" && value === false && capabilities.value.codexImageEdits
-				? { codexImages: false, codexImageEdits: false }
+			key === "codexImages" && value === false
+				? { codexImages: false, codexImageEdits: false, codexImagesAnyModel: false }
 				: ({ [key]: value } as Partial<CapabilitySettingsView>);
 		setCapabilitiesBusy(true);
 		try {