dsh-use-codex 0.0.0-stage → 0.3.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dsh-use-codex contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.en.md

@@ -0,0 +1,390 @@
+# DSH Use Codex
+
+> Delegate a task from DeepSeek Harness to your local Codex CLI with one natural-language request, then bring the result back to the conversation.
+
+English | [简体中文](README.md)
+
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+![Node.js](https://img.shields.io/badge/node-%3E%3D20-339933?logo=node.js&logoColor=white)
+![DSH Plugin](https://img.shields.io/badge/DeepSeek%20Harness-plugin-4B6BFB)
+![Status](https://img.shields.io/badge/status-experimental-orange)
+
+`dsh-use-codex` adds a small set of tools to [DeepSeek Harness (DSH)](https://github.com/deepseek-ai) for delegating one-shot tasks to the local [OpenAI Codex CLI](https://github.com/openai/codex). It is designed for code changes, debugging, repository analysis, and batch file processing while keeping execution inside explicitly authorized workspaces.
+
+## Contents
+
+- [Features](#features)
+- [Requirements](#requirements)
+- [Installation](#installation)
+- [Configuration](#configuration)
+- [Usage](#usage)
+- [Tool reference](#tool-reference)
+- [How it works](#how-it-works)
+- [Security model](#security-model)
+- [Development and testing](#development-and-testing)
+- [FAQ](#faq)
+- [Project status](#project-status)
+- [License](#license)
+
+## Features
+
+- **Natural-language delegation**: ask DSH to "let Codex do..." or "hand this to Codex".
+- **Three built-in tools**: run a task, inspect status, and toggle the plugin.
+- **Workspace allowlist**: Codex can only run in explicitly authorized, real directories.
+- **Symlink escape protection**: both the requested directory and configured roots are resolved to real paths.
+- **Safe sandbox default**: `workspace-write` is used unless the caller requests otherwise.
+- **Two-step dangerous-mode approval**: `danger-full-access` also requires explicit host configuration.
+- **No shell interpolation**: the task is passed as a single argv value.
+- **Process-group cleanup**: the complete Codex process group is terminated on timeout or cancellation.
+- **Bounded output**: stdout and stderr are capped before being returned to the conversation.
+- **Minimal state**: only the runtime toggle and update timestamp are persisted.
+- **Zero runtime dependencies**: the plugin itself needs no additional npm packages.
+
+## Requirements
+
+| Component | Requirement |
+|---|---|
+| Node.js | `>= 20` |
+| DSH | A version supporting Cordis bundle patches and tool registration |
+| Codex CLI | Supports `codex exec`, `-C`, `-s`, and `--ephemeral` |
+| Operating system | macOS or Linux; Windows has not been validated |
+
+Validated combination:
+
+- DeepSeek Harness `0.2.1-rc.2`
+- Node.js `22.x`
+- Codex CLI `0.166.0`
+
+Verify the Codex CLI first:
+
+```bash
+codex --version
+codex login status
+```
+
+> When using a custom OpenAI-compatible provider, a logged-out result from `codex login status` may not indicate a problem. The authoritative check is whether `codex exec` can complete a task.
+
+## Installation
+
+### Install through the DSH plugin market index
+
+In DSH, open **Discover → Plugin Market → Add index source** and add:
+
+```text
+https://raw.githubusercontent.com/chaorenzeng/dsh-use-codex/main/market/index.json
+```
+
+Search for **DSH Use Codex** and install it. The market index pins an immutable Git commit; the actual installation source remains this repository.
+
+### 1. Get the source
+
+```bash
+git clone git@github.com:chaorenzeng/dsh-use-codex.git "$HOME/Projects/dsh-use-codex"
+cd "$HOME/Projects/dsh-use-codex"
+```
+
+### 2. Register the dependency and bundle in a DSH profile
+
+Edit the target DSH profile's `package.json`, for example `~/.dsh/profiles/web/package.json`:
+
+```json
+{
+  "dependencies": {
+    "dsh-use-codex": "file:/absolute/path/to/dsh-use-codex"
+  },
+  "dsh": {
+    "profile": {
+      "bundles": [
+        "dsh-use-codex"
+      ]
+    }
+  }
+}
+```
+
+Keep the existing dependencies and bundles in that file. Then install the profile dependencies:
+
+```bash
+cd ~/.dsh/profiles/web
+pnpm install
+```
+
+If the profile uses another package manager, use the equivalent install command.
+
+### 3. Add local configuration
+
+Override the plugin configuration in the target DSH profile's `cordis.patch.yml`:
+
+```yaml
+- id: use-codex
+  name: dsh-use-codex
+  config:
+    enabled: true
+    bin: /absolute/path/to/codex
+    defaultCwd: /absolute/path/to/workspace
+    allowedRoots:
+      - /absolute/path/to/workspace
+    allowDangerFullAccess: false
+    timeoutSec: 900
+    maxOutputChars: 20000
+```
+
+> Local paths, Codex credentials, and provider settings belong in machine-local configuration and must not be committed to a public repository.
+
+### 4. Restart DSH
+
+Restart the DSH host so the profile loads the plugin for the first time. If it is managed by a macOS LaunchAgent:
+
+```bash
+launchctl kickstart -k "gui/$(id -u)/<YOUR_DSH_LAUNCHD_LABEL>"
+```
+
+After restarting, **create a new DSH conversation**. Existing conversations do not automatically receive newly registered tools.
+
+### 5. Verify the integration
+
+Send this in a new conversation:
+
+```text
+Let Codex do: reply only with USE_CODEX_OK. Do not read or modify any files.
+```
+
+A `USE_CODEX_OK` response confirms that the plugin, Codex CLI, and tool-call path are working.
+
+## Configuration
+
+### Plugin options
+
+| Option | Default | Description |
+|---|---|---|
+| `enabled` | `false` | Register tools when DSH starts; when disabled, no tools are registered |
+| `bin` | `codex` | Codex CLI executable path; supports `~` expansion |
+| `defaultCwd` | DSH process working directory | Used when `cwd` is omitted; must be an absolute directory inside the allowlist |
+| `allowedRoots` | `[defaultCwd]` | Real directories in which Codex may run |
+| `allowDangerFullAccess` | `false` | Allow an individual call to request `danger-full-access` |
+| `timeoutSec` | `900` | Maximum run timeout, from `1` to `3600` seconds |
+| `maxOutputChars` | `20000` | Maximum retained characters for stdout and stderr separately, from `1000` to `200000` |
+
+The public [`cordis.patch.yml`](cordis.patch.yml) uses `/tmp` as a safe placeholder and sets `enabled: false`. Production settings should be kept in the machine-local profile patch.
+
+### Environment variables
+
+| Variable | Description |
+|---|---|
+| `CODEX_BIN` | Codex CLI path used when `bin` is not configured |
+| `USE_CODEX_STATE` | Overrides the runtime toggle state-file path |
+| `DSH_HOME` | DSH data directory; state defaults to `use-codex.json` under this directory |
+
+The runtime toggle state file defaults to:
+
+```text
+${DSH_HOME:-~/.dsh}/use-codex.json
+```
+
+It is created with mode `0600` and contains only:
+
+```json
+{
+  "enabled": true,
+  "updatedAt": "2026-01-01T00:00:00.000Z"
+}
+```
+
+## Usage
+
+### Natural-language delegation
+
+```text
+Let Codex do: inspect why the tests are failing, identify the root cause, and fix it. Do not commit.
+```
+
+```text
+Hand this to Codex: analyze duplicated code under src and propose a plan before changing anything.
+```
+
+DSH decides when to call `codex_run`. Give Codex a clear objective, scope, constraints, and acceptance criteria so it can complete the task independently.
+
+### Specify a workspace and sandbox
+
+```text
+Ask Codex to summarize the architecture of /absolute/path/to/repo using the read-only sandbox.
+```
+
+### Check status
+
+```text
+Check the status of Use Codex.
+```
+
+### Disable immediately
+
+```text
+Disable Use Codex.
+```
+
+New `codex_run` calls are rejected immediately. Re-enabling the plugin does not require a DSH restart.
+
+### Raw tool arguments
+
+```json
+{
+  "task": "Run the relevant tests and fix the failures. Do not commit.",
+  "cwd": "/absolute/path/to/repository",
+  "sandbox": "workspace-write",
+  "timeoutSec": 600
+}
+```
+
+## Tool reference
+
+### `codex_run`
+
+Starts one non-interactive `codex exec` task in the requested workspace.
+
+| Argument | Type | Required | Description |
+|---|---|---|---|
+| `task` | `string` | Yes | Complete task instructions; up to `100000` characters |
+| `cwd` | `string` | No | Absolute workspace path that resolves inside `allowedRoots` |
+| `sandbox` | `string` | No | `read-only`, `workspace-write`, or `danger-full-access` |
+| `timeoutSec` | `number` | No | Per-call timeout, capped by the plugin's configured `timeoutSec` |
+
+The default sandbox is `workspace-write`. `danger-full-access` is rejected unless the host sets `allowDangerFullAccess: true`.
+
+### `codex_status`
+
+Reports:
+
+- current runtime toggle state
+- `codex --version`
+- `codex login status`
+- effective workspace allowlist
+- whether dangerous mode is allowed
+- timeout and output limits
+- a summary of the most recent run in the current DSH process
+
+### `codex_switch`
+
+| Argument | Type | Required | Description |
+|---|---|---|---|
+| `enabled` | `boolean` | Yes | `true` enables the plugin; `false` disables it |
+
+The runtime toggle is persisted separately and does not affect other DSH plugins.
+
+## How it works
+
+```mermaid
+flowchart LR
+    U[DSH user] --> A[DSH agent]
+    A -->|codex_run| B[dsh-use-codex]
+    B --> C{Validate workspace<br/>and security policy}
+    C -->|allowed| D[Codex CLI<br/>codex exec]
+    D --> W[Authorized workspace]
+    D --> B
+    B --> A
+    A --> U
+    C -->|rejected| A
+```
+
+The effective command is equivalent to:
+
+```bash
+codex exec \
+  -C /absolute/path/to/workspace \
+  -s workspace-write \
+  --skip-git-repo-check \
+  --ephemeral \
+  --color never \
+  -- "task text"
+```
+
+`--ephemeral` disables Codex session reuse; it does not make the run read-only. With `workspace-write`, Codex may modify files inside the authorized workspace.
+
+## Security model
+
+This plugin allows DSH to start the local Codex CLI. Treat any DSH conversation that can access the plugin as having controlled local execution capability.
+
+### Built-in protections
+
+- The workspace must exist, be absolute, and resolve to a real filesystem path.
+- The resolved workspace must remain inside `allowedRoots`.
+- Symlinks cannot be used to escape an allowed root.
+- The task is passed as one argv value without a shell.
+- Timeout and cancellation terminate the Codex process group.
+- stdout and stderr are bounded.
+- Task text, working directories, and outputs are not written to plugin state.
+- The public bundle disables dangerous mode by default.
+
+### Deployment guidance
+
+- Install only in a trusted local DSH instance; never expose it to untrusted users.
+- Keep `allowedRoots` as narrow as practical.
+- Do not enable `allowDangerFullAccess` without additional host-level isolation.
+- The Codex child inherits the DSH environment, which may contain credentials.
+- `workspace-write` can still modify allowed files; do not allowlist sensitive directories.
+- Although task text is not stored in plugin state, it may appear in DSH conversation history, host logs, or Codex logs.
+- Keep DSH, Codex CLI, and dependencies up to date.
+
+See [SECURITY.md](SECURITY.md) for the full security policy.
+
+## Development and testing
+
+```bash
+git clone https://github.com/chaorenzeng/dsh-use-codex.git
+cd dsh-use-codex
+npm test
+```
+
+Tests use temporary directories and a fake Codex executable. They do not call a network service, model, or private workspace. Coverage includes:
+
+- plugin metadata and registration of all three tools
+- empty tasks, missing paths, and paths outside the allowlist
+- symlink escapes
+- dangerous-mode rejection by default
+- runtime toggling
+- `workspace-write` and `--ephemeral` arguments
+- process-group termination on timeout
+- minimal state persistence
+
+Inspect the actual npm package contents before publishing:
+
+```bash
+npm pack --dry-run
+```
+
+Issues and pull requests are welcome. Do not include credentials, private paths, full logs, or other sensitive information in public issues. Report security problems through the private process described in [SECURITY.md](SECURITY.md).
+
+## FAQ
+
+### Why are the tools missing in a new conversation?
+
+Confirm that `dsh.profile.bundles` in `package.json` includes `dsh-use-codex`, `enabled` is `true` in the profile patch, and DSH was restarted. Then create a new conversation.
+
+### Why is the working directory rejected?
+
+`cwd` must be absolute, exist, and resolve inside `allowedRoots`. Invalid allowlist entries are ignored during startup.
+
+### Why does a call fail when `cwd` is omitted?
+
+`defaultCwd` must exist and be inside the allowlist. Set both `defaultCwd` and the corresponding `allowedRoots` entry explicitly.
+
+### Why does `codex_status` report a logged-out state?
+
+With a custom OpenAI-compatible provider, `codex login status` may not reflect actual availability. Verify by running a real `codex exec` task instead.
+
+### Why does a task take so long?
+
+One run may wait up to `900` seconds by default. Set `timeoutSec` within the configured maximum when a shorter or longer limit is required.
+
+### Is a restart required after disabling the plugin?
+
+No. `codex_switch` takes effect immediately. A restart is only required when changing registration-time settings such as `enabled` in the profile configuration.
+
+## Project status
+
+The project is experimental at the `0.x` stage. Tool arguments, configuration fields, and response formats may change as DSH and Codex CLI evolve. Pin validated DSH and Codex CLI versions and rerun the end-to-end check after upgrades.
+
+This is an independent community plugin, not affiliated with or endorsed by DeepSeek or OpenAI. DeepSeek Harness, Codex, and related names and trademarks belong to their respective owners.
+
+## License
+
+[MIT](LICENSE) © 2026 dsh-use-codex contributors

package/README.md

@@ -1,3 +1,390 @@
-# Temporary Holding Version
+# DSH Use Codex
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+> 在 DeepSeek Harness 中用一句话把任务交给本机 Codex CLI，安全执行后把结果带回当前会话。
+
+简体中文 | [English](README.en.md)
+
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+![Node.js](https://img.shields.io/badge/node-%3E%3D20-339933?logo=node.js&logoColor=white)
+![DSH Plugin](https://img.shields.io/badge/DeepSeek%20Harness-plugin-4B6BFB)
+![Status](https://img.shields.io/badge/status-experimental-orange)
+
+`dsh-use-codex` 为 [DeepSeek Harness (DSH)](https://github.com/deepseek-ai) 提供一组工具，把独立任务委派给本机 [OpenAI Codex CLI](https://github.com/openai/codex) 执行。它适合代码修改、故障排查、仓库分析和批量文件处理等一次性任务，并将执行结果返回 DSH 当前会话。
+
+## 目录
+
+- [功能特性](#功能特性)
+- [运行要求](#运行要求)
+- [安装](#安装)
+- [配置](#配置)
+- [使用方式](#使用方式)
+- [工具参考](#工具参考)
+- [运行原理](#运行原理)
+- [安全模型](#安全模型)
+- [开发与测试](#开发与测试)
+- [常见问题](#常见问题)
+- [项目状态](#项目状态)
+- [许可证](#许可证)
+
+## 功能特性
+
+- **自然语言委派**：在 DSH 中说“让 Codex 做……”或“交给 Codex 执行……”。
+- **三个内置工具**：任务执行、状态检查、即时开关。
+- **工作目录白名单**：只允许 Codex 在显式授权的真实目录中运行。
+- **软链逃逸防护**：同时解析工作目录与白名单的真实路径。
+- **默认安全沙箱**：默认使用 Codex 的 `workspace-write` 模式。
+- **危险模式双重授权**：`danger-full-access` 必须由宿主配置显式允许。
+- **无 shell 拼接**：任务正文作为单个 argv 参数传递，避免 shell 注入。
+- **进程组清理**：超时或取消时终止完整 Codex 进程组。
+- **输出限长**：限制 stdout/stderr，避免单次结果淹没会话。
+- **最小状态持久化**：状态文件只记录开关与更新时间，不保存任务、目录或输出。
+- **零运行时依赖**：插件本身不需要额外 npm 依赖。
+
+## 运行要求
+
+| 组件 | 要求 |
+|---|---|
+| Node.js | `>= 20` |
+| DSH | 支持 Cordis bundle patch 与工具注册的版本 |
+| Codex CLI | 支持 `codex exec`、`-C`、`-s`、`--ephemeral` |
+| 操作系统 | macOS 或 Linux；Windows 尚未验证 |
+
+已验证组合：
+
+- DeepSeek Harness `0.2.1-rc.2`
+- Node.js `22.x`
+- Codex CLI `0.166.0`
+
+先确认 Codex CLI 可用：
+
+```bash
+codex --version
+codex login status
+```
+
+> 如果使用自定义 OpenAI-compatible provider，`codex login status` 显示未登录不一定是错误。请以 Codex CLI 能否实际执行 `codex exec` 为准。
+
+## 安装
+
+### 通过 DSH 插件市场索引安装
+
+在 DSH 的「发现 → 插件市场 → 添加索引源」中添加：
+
+```text
+https://raw.githubusercontent.com/chaorenzeng/dsh-use-codex/main/market/index.json
+```
+
+然后搜索 **DSH Use Codex** 并安装。市场索引固定到不可变的 Git 提交，实际安装来源仍是本仓库。
+
+### 1. 获取源码
+
+```bash
+git clone git@github.com:chaorenzeng/dsh-use-codex.git "$HOME/Projects/dsh-use-codex"
+cd "$HOME/Projects/dsh-use-codex"
+```
+
+### 2. 在 DSH profile 中登记依赖与 bundle
+
+编辑目标 DSH profile 的 `package.json`，例如 `~/.dsh/profiles/web/package.json`：
+
+```json
+{
+  "dependencies": {
+    "dsh-use-codex": "file:/absolute/path/to/dsh-use-codex"
+  },
+  "dsh": {
+    "profile": {
+      "bundles": [
+        "dsh-use-codex"
+      ]
+    }
+  }
+}
+```
+
+保留该文件中已有的依赖和 bundle，不要清空其他配置。然后同步 profile 依赖：
+
+```bash
+cd ~/.dsh/profiles/web
+pnpm install
+```
+
+如果 DSH profile 使用其他包管理器，请使用对应命令安装依赖。
+
+### 3. 添加本机配置
+
+在目标 DSH profile 的 `cordis.patch.yml` 中覆盖插件配置：
+
+```yaml
+- id: use-codex
+  name: dsh-use-codex
+  config:
+    enabled: true
+    bin: /absolute/path/to/codex
+    defaultCwd: /absolute/path/to/workspace
+    allowedRoots:
+      - /absolute/path/to/workspace
+    allowDangerFullAccess: false
+    timeoutSec: 900
+    maxOutputChars: 20000
+```
+
+> 真实路径、Codex 凭据和 provider 设置属于本机配置，不应提交到开源仓库。
+
+### 4. 重启 DSH
+
+重启 DSH 宿主，使 profile 首次加载插件和配置。若由 macOS LaunchAgent 管理，可使用：
+
+```bash
+launchctl kickstart -k "gui/$(id -u)/<YOUR_DSH_LAUNCHD_LABEL>"
+```
+
+重启后必须**新建一个 DSH 会话**，旧会话不会自动获得新注册的工具。
+
+### 5. 验证
+
+在新建会话中发送：
+
+```text
+让 Codex 做：只回复 USE_CODEX_OK，不要读取或修改任何文件。
+```
+
+如果返回 `USE_CODEX_OK`，说明插件、Codex CLI 和工具调用链均正常。
+
+## 配置
+
+### 插件配置
+
+| 配置项 | 默认值 | 说明 |
+|---|---|---|
+| `enabled` | `false` | 是否在 DSH 启动时注册工具；关闭时不注册任何工具 |
+| `bin` | `codex` | Codex CLI 可执行文件路径；支持 `~` 展开 |
+| `defaultCwd` | DSH 进程工作目录 | 未传 `cwd` 时使用，必须是白名单内的绝对目录 |
+| `allowedRoots` | `[defaultCwd]` | 允许 Codex 工作的真实目录列表 |
+| `allowDangerFullAccess` | `false` | 是否允许单次调用选择 `danger-full-access` |
+| `timeoutSec` | `900` | 单次调用超时上限，范围 `1–3600` 秒 |
+| `maxOutputChars` | `20000` | stdout 和 stderr 各自最多保留的字符数，范围 `1000–200000` |
+
+公开仓库中的 [`cordis.patch.yml`](cordis.patch.yml) 使用 `/tmp` 作为安全占位目录，并默认设置 `enabled: false`。部署时应只在个人 profile patch 中覆盖为真实配置。
+
+### 环境变量
+
+| 环境变量 | 说明 |
+|---|---|
+| `CODEX_BIN` | 未配置 `bin` 时使用的 Codex CLI 路径 |
+| `USE_CODEX_STATE` | 覆盖即时开关状态文件路径 |
+| `DSH_HOME` | DSH 数据目录；状态默认写入其下的 `use-codex.json` |
+
+即时开关状态文件默认位于：
+
+```text
+${DSH_HOME:-~/.dsh}/use-codex.json
+```
+
+文件权限为 `0600`，内容仅包含：
+
+```json
+{
+  "enabled": true,
+  "updatedAt": "2026-01-01T00:00:00.000Z"
+}
+```
+
+## 使用方式
+
+### 自然语言调用
+
+```text
+让 Codex 做：检查当前仓库为什么测试失败，定位原因并修复；不要提交 commit。
+```
+
+```text
+交给 Codex 执行：分析 src 目录中的重复代码，先给出方案，不要直接修改。
+```
+
+DSH 的模型会按需调用 `codex_run`。任务应写清目标、范围、约束和验收标准，以便 Codex 独立完成。
+
+### 指定工作目录和沙箱
+
+```text
+让 Codex 做：只读取这个仓库并总结架构。工作目录使用 /absolute/path/to/repo，使用 read-only 沙箱。
+```
+
+### 查看状态
+
+```text
+检查 Codex 委派的状态。
+```
+
+### 即时关闭
+
+```text
+关闭 Codex 委派。
+```
+
+关闭后 `codex_run` 会立即拒绝新任务；重新打开不需要重启 DSH。
+
+### 直接调用工具参数
+
+```json
+{
+  "task": "运行相关测试并修复失败原因，不要提交 commit。",
+  "cwd": "/absolute/path/to/repository",
+  "sandbox": "workspace-write",
+  "timeoutSec": 600
+}
+```
+
+## 工具参考
+
+### `codex_run`
+
+在指定工作目录中启动一次非交互式 `codex exec` 任务。
+
+| 参数 | 类型 | 必填 | 说明 |
+|---|---|---|---|
+| `task` | `string` | 是 | 完整任务说明；最大 `100000` 字符 |
+| `cwd` | `string` | 否 | 绝对工作目录，必须位于 `allowedRoots` 内 |
+| `sandbox` | `string` | 否 | `read-only`、`workspace-write` 或 `danger-full-access` |
+| `timeoutSec` | `number` | 否 | 本次超时，不能超过插件配置的 `timeoutSec` |
+
+默认沙箱为 `workspace-write`。`danger-full-access` 默认拒绝，只有在宿主配置中设置 `allowDangerFullAccess: true` 后才可选择。
+
+### `codex_status`
+
+只读检查以下信息：
+
+- 即时开关状态
+- `codex --version`
+- `codex login status`
+- 有效目录白名单
+- 危险模式是否允许
+- 超时与输出限制
+- 当前 DSH 进程内最近一次调用的结果摘要
+
+### `codex_switch`
+
+| 参数 | 类型 | 必填 | 说明 |
+|---|---|---|---|
+| `enabled` | `boolean` | 是 | `true` 打开，`false` 关闭 |
+
+即时开关持久化到状态文件，不影响 DSH 宿主中的其他插件。
+
+## 运行原理
+
+```mermaid
+flowchart LR
+    U[DSH 用户] --> A[DSH Agent]
+    A -->|codex_run| B[dsh-use-codex]
+    B --> C{目录与安全校验}
+    C -->|通过| D[Codex CLI<br/>codex exec]
+    D --> W[授权工作目录]
+    D --> B
+    B --> A
+    A --> U
+    C -->|拒绝| A
+```
+
+插件最终执行的核心命令等价于：
+
+```bash
+codex exec \
+  -C /absolute/path/to/workspace \
+  -s workspace-write \
+  --skip-git-repo-check \
+  --ephemeral \
+  --color never \
+  -- "任务正文"
+```
+
+`--ephemeral` 表示不复用 Codex 会话，不表示只读。若 Codex 获得 `workspace-write`，它仍可能修改允许目录中的文件。
+
+## 安全模型
+
+本插件允许 DSH 启动本机 Codex，因此应把 DSH 会话视为具备受控本机执行能力。
+
+### 已有防护
+
+- 工作目录必须存在、为绝对路径，并通过真实路径解析。
+- 工作目录必须位于 `allowedRoots` 内。
+- 解析软链后仍须位于白名单内，阻止软链逃逸。
+- 任务作为单个 argv 参数传入，不经过 shell。
+- 超时或取消时终止 Codex 进程组。
+- stdout/stderr 有长度上限。
+- 插件状态不保存任务正文、工作目录或执行输出。
+- 公共 bundle 默认关闭危险模式。
+
+### 部署建议
+
+- 只安装在可信的本机 DSH 中，不要把 DSH 暴露给不可信用户。
+- 将 `allowedRoots` 收窄到实际需要的仓库或目录。
+- 除非宿主机已做额外隔离，否则不要开启 `allowDangerFullAccess`。
+- Codex 子进程会继承 DSH 环境变量，其中可能包含凭据；请检查 DSH 运行环境。
+- `workspace-write` 仍允许修改工作区，不应把敏感目录加入白名单。
+- 任务正文虽不写入插件状态，但仍可能出现在 DSH 对话记录、宿主日志或 Codex 自身日志中。
+- 保持 DSH、Codex CLI 和依赖项更新。
+
+完整安全说明见 [SECURITY.md](SECURITY.md)。
+
+## 开发与测试
+
+```bash
+git clone https://github.com/chaorenzeng/dsh-use-codex.git
+cd dsh-use-codex
+npm test
+```
+
+测试使用临时目录和假 Codex 可执行文件，不访问网络、真实模型或私有工作区。当前覆盖：
+
+- 插件元数据与三个工具注册
+- 空任务、无效目录和白名单外目录
+- 软链逃逸
+- 危险模式默认拒绝
+- 即时开关
+- `workspace-write` 与 `--ephemeral` 参数
+- 超时进程组终止
+- 状态文件最小化持久化
+
+提交前可检查 npm 实际打包内容：
+
+```bash
+npm pack --dry-run
+```
+
+欢迎提交 Issue 和 Pull Request。请勿在公开 Issue 中提交凭据、私有路径、完整日志或其他敏感信息；安全问题请参考 [SECURITY.md](SECURITY.md) 的私密报告流程。
+
+## 常见问题
+
+### 为什么新建会话后看不到工具？
+
+先确认 `package.json` 的 `dsh.profile.bundles` 包含 `dsh-use-codex`，profile patch 中 `enabled` 为 `true`，然后重启 DSH 并新建会话。
+
+### 为什么提示工作目录不在白名单内？
+
+`cwd` 必须是绝对路径、真实存在，并在解析软链后位于 `allowedRoots` 内。白名单中的无效目录也会被忽略。
+
+### 为什么不传 `cwd` 会失败？
+
+`defaultCwd` 必须存在且位于白名单内。推荐在 profile 配置中同时显式设置 `defaultCwd` 和对应的 `allowedRoots`。
+
+### 为什么 `codex_status` 显示未登录？
+
+使用自定义 OpenAI-compatible provider 时，`codex login status` 可能不反映实际可用性。请直接验证 `codex exec` 是否能完成任务。
+
+### 为什么任务执行很久？
+
+单次执行默认最多等待 `900` 秒。可以在配置范围内通过 `timeoutSec` 调整，超出上限的值会被限制到插件配置的最大值。
+
+### 关闭插件后是否还需要重启？
+
+不需要。`codex_switch` 的关闭状态立即生效。若要在启动时不注册工具，则需在 profile 配置中设置 `enabled: false` 并重启 DSH。
+
+## 项目状态
+
+项目处于 `0.x` 实验阶段，工具参数、配置字段和返回格式可能随 DSH 与 Codex CLI 的演进调整。发布前建议固定已验证的 DSH 和 Codex CLI 版本，并在更新后进行端到端验证。
+
+本项目是独立的社区插件，与 DeepSeek 或 OpenAI 无隶属或官方背书关系。DeepSeek Harness、Codex 及相关名称和商标归各自权利人所有。
+
+## License
+
+[MIT](LICENSE) © 2026 dsh-use-codex contributors

package/SECURITY.md

@@ -0,0 +1,30 @@
+# Security Policy
+
+## Threat model
+
+`dsh-use-codex` lets a DSH tool call start the local Codex CLI. The person or agent controlling DSH can therefore request local code execution within the configured boundary.
+
+Only install this plugin in a trusted local DSH instance. Do not expose DSH or the plugin to untrusted users.
+
+## Defaults
+
+- `enabled: false` in the public bundle patch
+- `workspace-write` sandbox for normal runs
+- `danger-full-access` disabled unless the host explicitly enables it
+- Required working directory must resolve inside `allowedRoots`
+- Symlink escapes are rejected
+- The task is passed as an argv value without a shell
+- Timeouts terminate the Codex process group
+- Tasks, working directories, and outputs are not persisted by the plugin
+
+## Operator responsibilities
+
+- Keep `allowedRoots` as narrow as possible
+- Do not set `allowDangerFullAccess: true` unless the host is externally isolated
+- Review Codex configuration and provider endpoints
+- Treat inherited environment variables as available to the Codex child process
+- Keep Codex CLI and DSH updated
+
+## Reporting
+
+Please report vulnerabilities through the GitHub repository's private security advisory channel rather than a public issue. Include reproduction steps, affected versions, and the expected impact.

package/cordis.patch.yml

@@ -0,0 +1,19 @@
+# Public-safe default bundle patch for dsh-use-codex.
+# Keep machine-specific paths in your DSH profile patch, not in this repository.
+#
+# Security defaults:
+#   - enabled: false until the host explicitly opts in
+#   - workspace-write sandbox for codex_run
+#   - danger-full-access disabled
+- insert:
+    - id: use-codex
+      name: dsh-use-codex
+      config:
+        enabled: false
+        bin: codex
+        defaultCwd: /tmp
+        allowedRoots:
+          - /tmp
+        allowDangerFullAccess: false
+        timeoutSec: 900
+        maxOutputChars: 20000

package/lib/index.js

@@ -0,0 +1,464 @@
+/**
+ * dsh-use-codex — 让 DeepSeek Harness 通过工具调用本机 Codex CLI。
+ *
+ * 安全边界：
+ *   1. 工作目录必须是白名单内的真实绝对路径；软链逃逸会被拒绝。
+ *   2. 默认使用 workspace-write，危险模式需由宿主配置显式开启。
+ *   3. 不经过 shell，任务作为单个 argv 传给 Codex。
+ *   4. 超时或取消时终止 Codex 进程组，并限制输出大小。
+ *   5. 不持久化任务正文、工作目录或输出；状态文件只记录即时开关。
+ */
+import { spawn } from 'node:child_process';
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  renameSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs';
+import { homedir, tmpdir } from 'node:os';
+import { isAbsolute, join, resolve, sep } from 'node:path';
+
+export const name = 'use-codex';
+export const inject = ['tools'];
+
+const DEFAULT_TIMEOUT_SEC = 900;
+const DEFAULT_MAX_OUTPUT_CHARS = 20_000;
+const MAX_TASK_CHARS = 100_000;
+const STATE_FILE = process.env.USE_CODEX_STATE
+  || join(process.env.DSH_HOME || join(homedir(), '.dsh'), 'use-codex.json');
+
+function finiteNumber(value, fallback) {
+  const number = Number(value);
+  return Number.isFinite(number) ? number : fallback;
+}
+
+function clamp(value, min, max) {
+  return Math.min(Math.max(value, min), max);
+}
+
+function expandHome(input) {
+  const value = String(input ?? '').trim();
+  if (value === '~') return homedir();
+  if (value.startsWith(`~${sep}`)) return join(homedir(), value.slice(2));
+  return value;
+}
+
+function readState() {
+  try {
+    const parsed = JSON.parse(readFileSync(STATE_FILE, 'utf8'));
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+function writeState(patch) {
+  const next = { ...readState(), ...patch, updatedAt: new Date().toISOString() };
+  const temp = `${STATE_FILE}.${process.pid}.tmp`;
+  try {
+    mkdirSync(join(STATE_FILE, '..'), { recursive: true, mode: 0o700 });
+    writeFileSync(temp, `${JSON.stringify(next, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    renameSync(temp, STATE_FILE);
+    return true;
+  } catch {
+    try { writeFileSync(temp, '', 'utf8'); } catch { /* ignore */ }
+    return false;
+  }
+}
+
+function resolveExistingDirectory(input) {
+  const expanded = expandHome(input);
+  if (!expanded) throw new Error('工作目录不能为空');
+  if (!isAbsolute(expanded)) throw new Error(`工作目录必须是绝对路径：${expanded}`);
+
+  const absolute = resolve(expanded);
+  if (!existsSync(absolute)) throw new Error(`工作目录不存在：${absolute}`);
+
+  let real;
+  try {
+    real = realpathSync.native(absolute);
+  } catch {
+    throw new Error(`无法解析工作目录：${absolute}`);
+  }
+
+  if (!statSync(real).isDirectory()) throw new Error(`工作目录不是文件夹：${absolute}`);
+  return real;
+}
+
+function isInside(target, root) {
+  return target === root || target.startsWith(`${root}${sep}`);
+}
+
+function createLimitedBuffer(limit) {
+  let text = '';
+  let totalChars = 0;
+
+  return {
+    append(value) {
+      const chunk = String(value ?? '');
+      totalChars += chunk.length;
+      if (text.length < limit) text += chunk.slice(0, limit - text.length);
+    },
+    finish() {
+      const trimmed = text.trim();
+      if (totalChars <= limit) return trimmed;
+      return `${trimmed}\n…（已截断：原始 ${totalChars} 字符，上限 ${limit} 字符）`;
+    },
+  };
+}
+
+function killProcessTree(child, signal) {
+  if (!child?.pid) return;
+  try {
+    process.kill(-child.pid, signal);
+  } catch {
+    try { child.kill(signal); } catch { /* 已退出 */ }
+  }
+}
+
+function getAbortSignal(context) {
+  if (context?.signal && typeof context.signal.addEventListener === 'function') return context.signal;
+  if (context?.abortSignal && typeof context.abortSignal.addEventListener === 'function') {
+    return context.abortSignal;
+  }
+  return null;
+}
+
+function runCodex(bin, argv, { cwd, timeoutMs, maxChars, signal }) {
+  return new Promise((resolvePromise) => {
+    const started = Date.now();
+    const stdout = createLimitedBuffer(maxChars);
+    const stderr = createLimitedBuffer(maxChars);
+    let child;
+    let timeoutTimer;
+    let hardKillTimer;
+    let finished = false;
+    let timedOut = false;
+    let aborted = false;
+
+    const cleanup = () => {
+      clearTimeout(timeoutTimer);
+      clearTimeout(hardKillTimer);
+      signal?.removeEventListener?.('abort', onAbort);
+    };
+
+    const finish = (code, spawnError = '') => {
+      if (finished) return;
+      finished = true;
+      cleanup();
+      const ok = code === 0 && !timedOut && !aborted && !spawnError;
+      resolvePromise({
+        ok,
+        code: timedOut ? 'timeout' : aborted ? 'aborted' : spawnError ? 'spawn-error' : code,
+        stdout: stdout.finish(),
+        stderr: stderr.finish(),
+        error: spawnError,
+        ms: Date.now() - started,
+      });
+    };
+
+    const onAbort = () => {
+      aborted = true;
+      killProcessTree(child, 'SIGTERM');
+      clearTimeout(hardKillTimer);
+      hardKillTimer = setTimeout(() => killProcessTree(child, 'SIGKILL'), 1_500);
+    };
+
+    if (signal?.aborted) {
+      aborted = true;
+      finish('aborted');
+      return;
+    }
+
+    try {
+      child = spawn(bin, argv, {
+        cwd,
+        detached: process.platform !== 'win32',
+        windowsHide: true,
+        env: { ...process.env, NO_COLOR: '1', CI: '1' },
+        stdio: ['ignore', 'pipe', 'pipe'],
+      });
+    } catch (error) {
+      finish('spawn-error', String(error?.message || error));
+      return;
+    }
+
+    child.stdout?.setEncoding('utf8');
+    child.stderr?.setEncoding('utf8');
+    child.stdout?.on('data', (chunk) => stdout.append(chunk));
+    child.stderr?.on('data', (chunk) => stderr.append(chunk));
+
+    child.on('error', (error) => finish('spawn-error', String(error?.message || error)));
+    child.on('close', (code, closeSignal) => {
+      finish(code ?? (closeSignal ? `signal:${closeSignal}` : 'unknown'));
+    });
+
+    timeoutTimer = setTimeout(() => {
+      timedOut = true;
+      killProcessTree(child, 'SIGTERM');
+      hardKillTimer = setTimeout(() => killProcessTree(child, 'SIGKILL'), 1_500);
+    }, timeoutMs);
+
+    signal?.addEventListener?.('abort', onAbort, { once: true });
+  });
+}
+
+function textTool({ name: toolName, description, parameters, timeoutMs, execute }) {
+  return {
+    name: toolName,
+    description,
+    parameters,
+    output: {
+      schema: { type: 'string' },
+      render: (_args, value) => [{ type: 'text', text: String(value ?? '') }],
+    },
+    ...(timeoutMs ? { timeoutMs } : {}),
+    execute,
+  };
+}
+
+export function apply(ctx, config = {}) {
+  if (config.enabled === false) {
+    ctx.logger?.info?.('[use-codex] disabled by configuration');
+    return;
+  }
+
+  const bin = expandHome(config.bin || process.env.CODEX_BIN || 'codex');
+  const defaultCwd = expandHome(config.defaultCwd || process.cwd());
+  const rawRoots = Array.isArray(config.allowedRoots) && config.allowedRoots.length
+    ? config.allowedRoots
+    : [defaultCwd];
+  const allowDanger = config.allowDangerFullAccess === true;
+  const maxTimeoutSec = clamp(
+    finiteNumber(config.timeoutSec, DEFAULT_TIMEOUT_SEC),
+    1,
+    3_600,
+  );
+  const maxOutputChars = Math.round(clamp(
+    finiteNumber(config.maxOutputChars, DEFAULT_MAX_OUTPUT_CHARS),
+    1_000,
+    200_000,
+  ));
+
+  const allowedRoots = [];
+  const rootWarnings = [];
+  for (const rawRoot of rawRoots) {
+    try {
+      const real = resolveExistingDirectory(rawRoot);
+      if (!allowedRoots.includes(real)) allowedRoots.push(real);
+    } catch (error) {
+      rootWarnings.push(String(error?.message || error));
+    }
+  }
+
+  const warnings = [...rootWarnings];
+  if (allowedRoots.length === 0) warnings.push('没有可用的白名单目录，codex_run 将拒绝执行');
+  try {
+    const realDefault = resolveExistingDirectory(defaultCwd);
+    if (!allowedRoots.some((root) => isInside(realDefault, root))) {
+      warnings.push('defaultCwd 不在白名单内，未显式提供 cwd 时 codex_run 将拒绝执行');
+    }
+  } catch (error) {
+    warnings.push(`defaultCwd 不可用：${String(error?.message || error)}`);
+  }
+
+  const enabledNow = () => readState().enabled !== false;
+  let lastRun = null;
+
+  const resolveRunCwd = (input) => {
+    const requested = String(input ?? '').trim() || defaultCwd;
+    const real = resolveExistingDirectory(requested);
+    if (!allowedRoots.some((root) => isInside(real, root))) {
+      throw new Error(`工作目录不在白名单内：${real}`);
+    }
+    return real;
+  };
+
+  const safeStatusCwd = () => {
+    try { return resolveRunCwd(defaultCwd); } catch { return tmpdir(); }
+  };
+
+  const tools = [
+    textTool({
+      name: 'codex_run',
+      description:
+        '让本机 OpenAI Codex CLI 执行一段独立任务并返回结果。'
+        + '当用户说“让 Codex 做……”“交给 Codex 执行……”，或希望把编码、排障、批量文件处理任务委派出去时调用。'
+        + '工作目录必须在 DSH 配置的白名单内；默认使用 workspace-write 沙箱；失败时如实返回失败原因。',
+      parameters: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+          task: {
+            type: 'string',
+            minLength: 1,
+            maxLength: MAX_TASK_CHARS,
+            description: '完整、明确的任务说明，包含目标、约束和验收标准。',
+          },
+          cwd: {
+            type: 'string',
+            description: '可选的绝对工作目录，必须真实存在且位于白名单内；省略时使用 defaultCwd。',
+          },
+          sandbox: {
+            type: 'string',
+            enum: ['read-only', 'workspace-write', 'danger-full-access'],
+            description: 'Codex 沙箱模式，默认 workspace-write；danger-full-access 需宿主配置显式允许。',
+          },
+          timeoutSec: {
+            type: 'number',
+            minimum: 1,
+            description: '本次超时秒数，不超过插件配置的 timeoutSec。',
+          },
+        },
+        required: ['task'],
+      },
+      async execute(args, context) {
+        if (!enabledNow()) {
+          return '⛔ Codex 委派已关闭。请先用 codex_switch 打开。';
+        }
+
+        const task = String(args?.task ?? '').trim();
+        if (!task) return '❌ 任务不能为空。';
+        if (task.length > MAX_TASK_CHARS) return `❌ 任务过长，最多 ${MAX_TASK_CHARS} 字符。`;
+
+        const sandbox = String(args?.sandbox || 'workspace-write');
+        if (!['read-only', 'workspace-write', 'danger-full-access'].includes(sandbox)) {
+          return `❌ 不支持的沙箱模式：${sandbox}`;
+        }
+        if (sandbox === 'danger-full-access' && !allowDanger) {
+          return '❌ danger-full-access 未获宿主配置许可，拒绝执行。';
+        }
+
+        let cwd;
+        try {
+          cwd = resolveRunCwd(args?.cwd);
+        } catch (error) {
+          return `❌ ${String(error?.message || error)}`;
+        }
+
+        if (!existsSync(bin) && bin.includes(sep)) {
+          return `❌ 找不到 Codex 可执行文件：${bin}`;
+        }
+
+        const timeoutSec = clamp(
+          finiteNumber(args?.timeoutSec, maxTimeoutSec),
+          1,
+          maxTimeoutSec,
+        );
+        const argv = [
+          'exec',
+          '-C', cwd,
+          '-s', sandbox,
+          '--skip-git-repo-check',
+          '--ephemeral',
+          '--color', 'never',
+          '--',
+          task,
+        ];
+        const result = await runCodex(bin, argv, {
+          cwd,
+          timeoutMs: Math.round(timeoutSec * 1_000),
+          maxChars: maxOutputChars,
+          signal: getAbortSignal(context),
+        });
+
+        lastRun = {
+          at: new Date().toISOString(),
+          ok: result.ok,
+          code: result.code,
+          ms: result.ms,
+          sandbox,
+        };
+
+        const status = result.ok
+          ? `✅ Codex 执行完成（${(result.ms / 1_000).toFixed(1)}s，${sandbox}）`
+          : `❌ Codex 执行失败（${result.code}，${(result.ms / 1_000).toFixed(1)}s，${sandbox}）`;
+        const sections = [status];
+        if (result.stdout) sections.push(`--- stdout ---\n${result.stdout}`);
+        if (result.stderr) sections.push(`--- stderr ---\n${result.stderr}`);
+        if (result.error) sections.push(`--- error ---\n${result.error}`);
+        if (sections.length === 1) sections.push('(无输出)');
+        return sections.join('\n\n');
+      },
+    }),
+
+    textTool({
+      name: 'codex_status',
+      description: '检查 Codex 委派插件的开关、Codex CLI 版本、认证状态、目录白名单和安全配置。',
+      parameters: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {},
+      },
+      timeoutMs: 35_000,
+      async execute() {
+        const statusCwd = safeStatusCwd();
+        const version = await runCodex(bin, ['--version'], {
+          cwd: statusCwd,
+          timeoutMs: 15_000,
+          maxChars: 2_000,
+        });
+        const login = await runCodex(bin, ['login', 'status'], {
+          cwd: statusCwd,
+          timeoutMs: 15_000,
+          maxChars: 2_000,
+        });
+
+        const lines = [
+          `🔌 开关：${enabledNow() ? '打开' : '关闭'}`,
+          `📦 Codex：${version.ok ? version.stdout : `不可用（${version.error || version.stderr || version.code}）`}`,
+          `🔑 认证：${login.stdout || login.stderr || (login.ok ? '未知' : login.code)}`,
+          `📁 白名单：${allowedRoots.length ? allowedRoots.join('、') : '（空）'}`,
+          `🛡 危险模式：${allowDanger ? '允许（危险）' : '禁止'}`,
+          `⏱ 超时上限：${maxTimeoutSec}s`,
+          `📏 输出上限：${maxOutputChars} 字符`,
+        ];
+        if (warnings.length) lines.push(`⚠️ 配置提示：${warnings.join('；')}`);
+        if (lastRun) {
+          lines.push(`🕘 本进程最近调用：${lastRun.at}｜${lastRun.ok ? '成功' : '失败'}｜${lastRun.ms}ms｜${lastRun.sandbox}`);
+        }
+        return lines.join('\n');
+      },
+    }),
+
+    textTool({
+      name: 'codex_switch',
+      description: '即时打开或关闭 Codex 委派，不需要重启 DSH；关闭后 codex_run 会拒绝执行。',
+      parameters: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+          enabled: {
+            type: 'boolean',
+            description: 'true 为打开，false 为关闭。',
+          },
+        },
+        required: ['enabled'],
+      },
+      timeoutMs: 10_000,
+      async execute(args) {
+        const enabled = args?.enabled === true;
+        if (!writeState({ enabled })) {
+          return '❌ 无法写入 Codex 委派状态，请检查 DSH 状态目录权限。';
+        }
+        return enabled
+          ? '🔓 Codex 委派已打开。'
+          : '🔒 Codex 委派已关闭；codex_run 从现在起拒绝执行。';
+      },
+    }),
+  ];
+
+  for (const tool of tools) {
+    const dispose = ctx.tools.register(tool);
+    if (typeof dispose === 'function') {
+      ctx.effect?.(() => dispose);
+    }
+  }
+
+  ctx.logger?.info?.(`[use-codex] registered ${tools.length} tools; allowed roots=${allowedRoots.length}; enabled=${enabledNow()}`);
+}
+
+export default { name, inject, apply };

package/package.json

@@ -1,6 +1,56 @@
 {
   "name": "dsh-use-codex",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "displayName": "DSH Use Codex",
+  "description": "通过 DeepSeek Harness 工具调用本机 Codex CLI 执行独立任务。",
+  "version": "0.3.0",
+  "type": "module",
+  "main": "lib/index.js",
+  "exports": {
+    ".": "./lib/index.js",
+    "./package.json": "./package.json"
+  },
+  "license": "MIT",
+  "engines": {
+    "node": ">=20",
+    "dsh": ">=0.2.1-rc.1 <0.3.0"
+  },
+  "files": [
+    "lib/",
+    "README.md",
+    "README.en.md",
+    "SECURITY.md",
+    "LICENSE",
+    "cordis.patch.yml"
+  ],
+  "keywords": [
+    "dsh-plugin",
+    "deepseek-harness",
+    "codex",
+    "codex-cli",
+    "agent",
+    "delegation"
+  ],
+  "scripts": {
+    "test": "node selftest.mjs",
+    "prepack": "npm test"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "install": {
+      "preferred": "tarball",
+      "tarball": "https://github.com/chaorenzeng/dsh-use-codex/archive/refs/heads/main.tar.gz",
+      "git": "https://github.com/chaorenzeng/dsh-use-codex.git"
+    }
+  },
+  "author": "chaorenzeng",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/chaorenzeng/dsh-use-codex.git"
+  },
+  "homepage": "https://github.com/chaorenzeng/dsh-use-codex#readme",
+  "bugs": {
+    "url": "https://github.com/chaorenzeng/dsh-use-codex/issues"
+  }
+}