dsh-openai-subscription 0.1.2 → 0.1.3

package/README.md

@@ -22,12 +22,6 @@ Use a ChatGPT subscription with Codex access in [DeepSeek Harness](https://githu
 - A [ChatGPT plan with Codex access](https://help.openai.com/en/articles/11369540-use-codex-with-a-chatgpt-plan) and device-code authorization enabled
 - Network access to `auth.openai.com` and `chatgpt.com`
 
-Install or update DSH when needed:
-
-```sh
-npm install -g pnpm @deepseek-ai/dsh@next
-```
-
 ## Installation
 
 Install the plugin into the Web profile:
@@ -80,7 +74,8 @@ Restart the Web profile and refresh the page afterward.
 ## Troubleshooting
 
 - **The settings entry is missing:** confirm the plugin is installed in the `web` profile with `dsh plugin --profile web why dsh-openai-subscription`, then restart DSH and refresh the page.
-- **Authorization cannot start:** update DSH, confirm `node --version` meets the requirement, and check access to the OpenAI authentication service.
+- **Authorization cannot start:** confirm `node --version` meets the requirement and check access to the OpenAI authentication service.
+- **Sign-in component unavailable:** the sign-in module is taken first from the `llm-pi-ai` adapter dependency bundled with the running DSH (no separate `pi` CLI install is needed); npm/nvm/bun-managed global `pi` installs are only a fallback. If the message persists, restart DSH and try again.
 - **The device code is rejected:** enable device-code authorization in ChatGPT security settings and start a new connection.
 - **Models need syncing:** select **Sync models**. If an explicit list already exists, review the confirmation and continue; local edits are preserved.
 - **Model sync fails:** existing settings remain unchanged. Check access to `chatgpt.com` and authorization status, then retry; refresh authorization first if needed.
@@ -88,7 +83,7 @@ Restart the Web profile and refresh the page afterward.
 
 ## Compatibility notes
 
-Dynamic discovery uses the backend endpoint used by the official ChatGPT Codex client, but that endpoint is not a public, stability-guaranteed OpenAI API and may change. It does not provide complete output-limit, cost, or wire-compatibility metadata. `llm-pi-ai` fills metadata for known models; unknown models use adapter defaults. Catalog presence also does not guarantee that an older adapter supports every new model capability, so update DSH first when calls reveal compatibility problems.
+Dynamic discovery uses the backend endpoint used by the official ChatGPT Codex client, but that endpoint is not a public, stability-guaranteed OpenAI API and may change. It does not provide complete output-limit, cost, or wire-compatibility metadata. `llm-pi-ai` fills metadata for known models; unknown models use adapter defaults. Catalog presence also does not guarantee that the installed adapter supports every new model capability.
 
 ## Security and privacy
 

package/README.zh.md

@@ -22,12 +22,6 @@
 - [包含 Codex 权限的 ChatGPT 套餐](https://help.openai.com/en/articles/11369540-use-codex-with-a-chatgpt-plan)，并已启用设备码授权
 - 能够访问 `auth.openai.com` 和 `chatgpt.com`
 
-如需安装或更新 DSH：
-
-```sh
-npm install -g pnpm @deepseek-ai/dsh@next
-```
-
 ## 安装
 
 将插件安装到 Web profile：
@@ -80,7 +74,8 @@ dsh plugin --profile web remove dsh-openai-subscription
 ## 故障排查
 
 - **设置中没有入口：** 使用 `dsh plugin --profile web why dsh-openai-subscription` 确认插件已安装到 `web` profile，然后重启 DSH 并刷新页面。
-- **无法开始授权：** 更新 DSH，确认 `node --version` 满足要求，并检查 OpenAI 登录服务是否可访问。
+- **无法开始授权：** 确认 `node --version` 满足要求，并检查 OpenAI 登录服务是否可访问。
+- **提示登录组件不可用：** 登录组件优先取自当前 DSH 自带的 `llm-pi-ai` 适配器依赖（无需单独安装 `pi` CLI），找不到时才会回退到 npm/nvm/bun 全局安装的 `pi` 所携带的副本。若仍提示不可用，请重启 DSH 后重试。
 - **设备码被拒绝：** 在 ChatGPT 安全设置中启用设备码授权，然后重新连接。
 - **模型需要同步：** 点击 **同步模型**。若已有显式模型列表，请阅读确认提示后继续；插件会保留本地编辑。
 - **模型同步失败：** 现有设置会保持不变。检查 `chatgpt.com` 的网络访问和授权状态，稍后重试；必要时先刷新授权。
@@ -88,7 +83,7 @@ dsh plugin --profile web remove dsh-openai-subscription
 
 ## 兼容性说明
 
-动态目录使用 ChatGPT 官方 Codex 客户端所使用的后端接口，但它不是公开、稳定承诺的 OpenAI API，未来可能变化。接口不提供完整的输出上限、费用或 wire compatibility 元数据；已知模型由 `llm-pi-ai` 补全，未知模型使用适配器默认值。目录中出现模型也不保证旧版适配器支持其所有新能力，遇到调用兼容问题时请先更新 DSH。
+动态目录使用 ChatGPT 官方 Codex 客户端所使用的后端接口，但它不是公开、稳定承诺的 OpenAI API，未来可能变化。接口不提供完整的输出上限、费用或 wire compatibility 元数据；已知模型由 `llm-pi-ai` 补全，未知模型使用适配器默认值。目录中出现模型也不保证当前安装的适配器支持其所有新能力。
 
 ## 安全与隐私
 

package/dist/host.d.ts

@@ -54,6 +54,17 @@ type PollResult = {
     outcome: FlowState['outcome'];
     error: string | null;
 };
+/**
+ * Filesystem candidates for the OpenAI auth module, derived from the running
+ * DSH process. The first candidate that exists is used, so the module always
+ * matches the pi-ai version bundled with the installed DSH regardless of how
+ * `pi` (or DSH itself) was installed; the shell locator below only runs when
+ * none of these probes hit.
+ */
+export declare function authModuleCandidates(entryScript: string | undefined, nodeBinary: string | undefined, env: {
+    NODE_PATH?: string | undefined;
+    HOME?: string | undefined;
+} | undefined): string[];
 declare class OpenAISubscriptionController extends TypertRemoteService {
     private registeredAuthorization;
     private cachedModule;
@@ -69,6 +80,11 @@ declare class OpenAISubscriptionController extends TypertRemoteService {
     private authorization;
     private llm;
     private ensureAuthorizationFlow;
+    /**
+     * Locate the OpenAI auth module without spawning a shell. Probes the pi-ai
+     * copy shipped inside the running DSH first; returns '' when nothing hits.
+     */
+    private probeInProcessModule;
     private locateAuthModule;
     private runDevice;
     private runRefresh;

package/dist/host.js

@@ -1,5 +1,7 @@
 // Host service for ChatGPT subscription authorization in DSH.
 // OAuth is delegated to the OpenAI Codex integration bundled with DSH.
+import { existsSync } from 'node:fs';
+import { delimiter as pathDelimiter, dirname, join, resolve } from 'node:path';
 import { Remote, TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
 import { normalizeOAuthCredential } from './oauth.js';
 import { discoverOpenAIModels, mergeModelCatalog, removeManagedModels, } from './models.js';
@@ -27,6 +29,12 @@ const LOCATE_SCRIPT = [
     'fi',
     'printf "%s" "$CAND"',
 ].join('\n');
+/**
+ * The OpenAI Codex OAuth implementation, relative to a `node_modules` root.
+ * DSH's `llm-pi-ai` adapter already depends on this package, so the copy that
+ * matches the running DSH is the preferred source for device authorization.
+ */
+const AUTH_MODULE_PACKAGE_RELATIVE = '@earendil-works/pi-ai/dist/auth/oauth/openai-codex.js';
 const DRIVER_DEVICE = [
     "import { pathToFileURL } from 'node:url'",
     "const { openaiCodexOAuth } = await import(pathToFileURL(process.argv[1]).href)",
@@ -114,6 +122,68 @@ function unionModelCatalog(remote, builtin) {
 function settingsConflict(error) {
     return recordOf(error)?.code === 'SETTINGS_CONFLICT';
 }
+/**
+ * Filesystem candidates for the OpenAI auth module, derived from the running
+ * DSH process. The first candidate that exists is used, so the module always
+ * matches the pi-ai version bundled with the installed DSH regardless of how
+ * `pi` (or DSH itself) was installed; the shell locator below only runs when
+ * none of these probes hit.
+ */
+export function authModuleCandidates(entryScript, nodeBinary, env) {
+    const candidates = [];
+    const seen = new Set();
+    const push = (value) => {
+        if (!value)
+            return;
+        const normalized = resolve(value);
+        if (seen.has(normalized))
+            return;
+        seen.add(normalized);
+        candidates.push(normalized);
+    };
+    // Walk up from the running DSH entry script. This finds the pi-ai copy
+    // bundled inside DSH's own installation for npm-, nvm-, and yarn-style
+    // layouts (global or workspace), even when `pi` is a standalone binary
+    // or missing entirely.
+    if (entryScript) {
+        let dir = dirname(entryScript);
+        for (let depth = 0; depth < 40 && dir; depth++) {
+            push(join(dir, 'node_modules', AUTH_MODULE_PACKAGE_RELATIVE));
+            const parent = dirname(dir);
+            if (parent === dir)
+                break;
+            dir = parent;
+        }
+    }
+    // Node's global module roots, mirroring how `module.globalPaths` is built:
+    // NODE_PATH entries plus the lib/node_modules directory beside the Node
+    // binary (also covers nvm-managed Node on macOS and Linux).
+    const globalRoots = [];
+    if (nodeBinary) {
+        globalRoots.push(resolve(dirname(nodeBinary), '../lib/node_modules'));
+        globalRoots.push(join(dirname(nodeBinary), 'node_modules'));
+    }
+    const nodePath = env?.NODE_PATH;
+    if (nodePath) {
+        for (const entry of nodePath.split(pathDelimiter)) {
+            if (entry)
+                globalRoots.push(entry);
+        }
+    }
+    for (const root of globalRoots) {
+        // A directly installed pi-ai, or the hoisted copy under a globally
+        // installed DSH (npm hoists transitive dependencies into DSH's own
+        // node_modules; the nested path covers version-conflicted installs).
+        push(join(root, 'node_modules', AUTH_MODULE_PACKAGE_RELATIVE));
+        push(join(root, AUTH_MODULE_PACKAGE_RELATIVE));
+        push(join(root, '@deepseek-ai/dsh/node_modules', AUTH_MODULE_PACKAGE_RELATIVE));
+        push(join(root, '@deepseek-ai/dsh/node_modules/@deepseek-ai/dsh-llm-pi-ai/node_modules', AUTH_MODULE_PACKAGE_RELATIVE));
+    }
+    // bun's global install root, matching the shell locator fallback.
+    if (env?.HOME)
+        push(join(env.HOME, '.bun/install/global/node_modules', AUTH_MODULE_PACKAGE_RELATIVE));
+    return candidates;
+}
 //#endregion
 /** Register source-mode remote methods without decorator syntax. */
 const REMOTE_METHODS = ['status', 'authorize', 'poll', 'cancel', 'syncModels', 'logout'];
@@ -172,12 +242,34 @@ class OpenAISubscriptionController extends TypertRemoteService {
             return;
         this.registerAuthorizationFlow(authorization);
     }
+    /**
+     * Locate the OpenAI auth module without spawning a shell. Probes the pi-ai
+     * copy shipped inside the running DSH first; returns '' when nothing hits.
+     */
+    probeInProcessModule() {
+        if (typeof process === 'undefined' || !Array.isArray(process.argv))
+            return '';
+        const candidates = authModuleCandidates(process.argv[1], process.execPath, process.env);
+        for (const candidate of candidates) {
+            try {
+                if (existsSync(candidate))
+                    return candidate;
+            }
+            catch {
+                // Unreadable or unavailable path: keep probing the remaining roots.
+            }
+        }
+        return '';
+    }
     async locateAuthModule() {
         if (this.cachedModule !== null)
             return this.cachedModule;
         if (this.locatingModule !== null)
             return this.locatingModule;
         const pending = (async () => {
+            const probed = this.probeInProcessModule();
+            if (probed)
+                return probed;
             const shell = this.shell();
             if (shell === undefined)
                 return '';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-openai-subscription",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "ChatGPT subscription sign-in for DeepSeek Harness via OpenAI device authorization.",
   "type": "module",
   "packageManager": "pnpm@10.6.3",