pi-openai-codex-compat 0.0.5 → 0.0.7-alpha.0

package/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 ## Unreleased
 
+### Security
+
+- Require npm releases to match a locally built SHA-256 recorded in an SSH-signed release commit before trusted publishing can stage the package.
+
+## 0.0.6 - 2026-08-10
+
+### Added
+
+- Add `npm run pack:dry` to inspect the npm package contents before release.
+
+### Changed
+
+- Require Pi 0.84.x, use Pi 0.84.1 as the development integration baseline, and preserve Pi 0.84 header removals across Codex tools and native compaction.
+
+### Fixed
+
+- Support Pi 0.84's subscription-aware default footer without crashing during startup.
+
 ## 0.0.5 - 2026-08-07
 
 ### Fixed

package/README.md

@@ -20,7 +20,7 @@ Pi provides the Codex OAuth flow and model catalog. At session start, this packa
 ## Requirements
 
 - Node.js 22.19 or newer
-- Pi `>=0.83.0 <0.84.0`
+- Pi `>=0.84.0 <0.85.0`
 - An OpenAI Codex login in Pi
 
 Authenticate through Pi if needed:
@@ -379,6 +379,7 @@ mise install
 npm install
 npm run check
 npm test
+npm run pack:dry
 ```
 
 Run the credentialed Pi/Codex integration tests separately. They load the real
@@ -403,7 +404,13 @@ search, and compaction continuation.
 
 ## Release staging
 
-The GitHub Actions workflow stages npm releases when a `v*` tag is pushed. The tag must match the `package.json` version, point at a commit whose subject is `release: v<version>`, and be a lightweight tag. Create it with `git tag v<version>`; do not use `git tag -a`, `git tag -s`, `git tag -m`, or `cog bump --annotated`.
+1. Run `npm run release -- X.Y.Z` from a clean, synchronized `main`.
+2. The command builds the exact package locally, records its SHA-256 in an SSH-signed release commit, proves a clean rebuild is reproducible, and creates a lightweight tag.
+3. Inspect the result, then push atomically with `git push --atomic origin main vX.Y.Z`.
+4. A read-only GitHub Actions job validates and packs the package. A separate GitHub-owned job verifies the signature and signed digest before attesting and staging that exact archive through npm trusted publishing.
+5. Approve the staged package on npmjs.com, or with `npm stage approve <stage-id>`.
+
+Stable releases use `latest`; prereleases derive their npm dist-tag from the first prerelease identifier.
 
 ## Acknowledgements
 

package/extensions/openai-codex-compat/codex-protocol.ts

@@ -1,4 +1,4 @@
-import { calculateCost, type Model, type Usage } from "@earendil-works/pi-ai";
+import { calculateCost, type Model, type ProviderHeaders, type Usage } from "@earendil-works/pi-ai";
 
 export const REMOTE_COMPACTION_BETA = "remote_compaction_v2";
 export const RETAINED_CONTEXT_BUDGET = 64_000;
@@ -327,10 +327,14 @@ function accountIdFromToken(token: string): string {
 
 export function remoteCompactionHeaders(options: {
   token: string;
-  providerHeaders?: Record<string, string> | undefined;
+  providerHeaders?: ProviderHeaders | undefined;
   sessionId: string;
 }): Headers {
-  const headers = new Headers(options.providerHeaders);
+  const headers = new Headers();
+  for (const [name, value] of Object.entries(options.providerHeaders ?? {})) {
+    if (value === null) headers.delete(name);
+    else headers.set(name, value);
+  }
   headers.set("authorization", `Bearer ${options.token}`);
   headers.set("chatgpt-account-id", accountIdFromToken(options.token));
   headers.set("originator", "pi");

package/extensions/openai-codex-compat/codex-stream.ts

@@ -14,7 +14,7 @@ import { isObject, type JsonRecord } from "./codex-protocol.ts";
 import { CODEX_NAMESPACED_TOOL_NAMES, namespacedToolCallName } from "./namespaced-tools.ts";
 
 /**
- * Focused adaptation of @earendil-works/pi-ai@0.83.0
+ * Focused adaptation of @earendil-works/pi-ai@0.84.1
  * src/api/openai-responses-shared.ts stream processing.
  */
 

package/extensions/openai-codex-compat/codex-transport.ts

@@ -21,7 +21,7 @@ import { normalizeReplayItem, stableResponsesJson } from "./responses-replay.ts"
 import { applyResponsesLiteHeaders, responsesLiteSsePayload } from "./responses-lite.ts";
 
 /**
- * Focused adaptation of @earendil-works/pi-ai@0.83.0
+ * Focused adaptation of @earendil-works/pi-ai@0.84.1
  * src/api/openai-codex-responses.ts transport behavior.
  */
 

package/extensions/openai-codex-compat/footer.ts

@@ -59,6 +59,15 @@ function footerSession(ctx: ExtensionContext, resolveConfig: ConfigResolver): Fo
           model && model.provider === provider && ctx.modelRegistry.isUsingOAuth(model),
         );
       },
+      isUsingSubscription(provider: string) {
+        const model = ctx.model;
+        return Boolean(
+          model &&
+          model.provider === provider &&
+          ctx.modelRegistry.isUsingOAuth(model) &&
+          ctx.modelRegistry.getProvider(provider)?.auth.oauth?.isSubscription === true,
+        );
+      },
     },
   } as unknown as FooterSession;
 }

package/extensions/openai-codex-compat/remote-compaction.ts

@@ -6,7 +6,7 @@ import type {
   SessionEntry,
   ToolInfo,
 } from "@earendil-works/pi-coding-agent";
-import type { Model, OpenAICodexResponsesOptions } from "@earendil-works/pi-ai";
+import type { Model, OpenAICodexResponsesOptions, ProviderHeaders } from "@earendil-works/pi-ai";
 import { addRemoteCompactionFeature, type JsonRecord } from "./codex-protocol.ts";
 import {
   activeResponsesTools,
@@ -40,12 +40,10 @@ function appendFeatureHeader(headers: Record<string, string | null>): void {
   else headers["x-codex-beta-features"] = addRemoteCompactionFeature(undefined);
 }
 
-function featureHeaders(headers: Record<string, string> | undefined): Record<string, string> {
-  const result: Record<string, string | null> = { ...headers };
+function featureHeaders(headers: ProviderHeaders | undefined): ProviderHeaders {
+  const result: ProviderHeaders = { ...headers };
   appendFeatureHeader(result);
-  return Object.fromEntries(
-    Object.entries(result).filter((entry): entry is [string, string] => entry[1] !== null),
-  );
+  return result;
 }
 
 function markerSummary(): string {

package/extensions/openai-codex-compat/tool-runtime.ts

@@ -1,5 +1,5 @@
 import type { ExtensionAPI, ExtensionContext, SessionEntry } from "@earendil-works/pi-coding-agent";
-import type { Model } from "@earendil-works/pi-ai";
+import type { Model, ProviderHeaders } from "@earendil-works/pi-ai";
 import { providerHistory } from "./compaction-checkpoint.ts";
 import type { ImageDetail } from "./config.ts";
 import type { ResponsesItem } from "./codex-protocol.ts";
@@ -7,7 +7,7 @@ import type { ResponsesItem } from "./codex-protocol.ts";
 export async function codexToolAuthentication(
   ctx: ExtensionContext,
   model: Model<any>,
-): Promise<{ apiKey: string; headers?: Record<string, string> }> {
+): Promise<{ apiKey: string; headers?: ProviderHeaders }> {
   const authentication = await ctx.modelRegistry.getApiKeyAndHeaders(model);
   if (!authentication.ok) throw new Error(authentication.error);
   if (!authentication.apiKey) throw new Error("OpenAI Codex authentication is unavailable.");

package/extensions/openai-codex-compat/vendor/pi-ai/README.md

@@ -2,7 +2,7 @@
 
 This directory intentionally contains only the Pi AI methods needed to serialize checkpoint and native replay history for OpenAI's Responses API. It does not contain Pi AI's complete source dependency graph.
 
-[`openai-responses-serialization.ts`](openai-responses-serialization.ts) adapts the relevant methods from `@earendil-works/pi-ai@0.83.0`. Its header lists the upstream source files. Keep the behavioral equivalence test in [`test/pi-ai-serialization.test.ts`](../../../../test/pi-ai-serialization.test.ts) passing when updating the Pi dependencies.
+[`openai-responses-serialization.ts`](openai-responses-serialization.ts) adapts the relevant methods from `@earendil-works/pi-ai@0.84.1`. Its header lists the upstream source files. Keep the behavioral equivalence test in [`test/pi-ai-serialization.test.ts`](../../../../test/pi-ai-serialization.test.ts) passing when updating the Pi dependencies.
 
 The optional `namespacedToolNames`, `textContentItemToolResultNames`, and `toolResultImageDetail` paths are extension-owned additions. Without those options, serialization must continue to match Pi AI. `namespacedToolNames` groups only the fixed Codex allowlist into native Responses namespaces and replays namespace/member call identities. `textContentItemToolResultNames` preserves Codex tools such as `web.run` whose successful text output is transported as an `input_text` content-item array instead of Pi's usual plain string. `toolResultImageDetail` overrides the otherwise canonical `auto` detail used for image tool-result content.
 

package/extensions/openai-codex-compat/vendor/pi-ai/openai-responses-serialization.ts

@@ -13,7 +13,7 @@ import type {
 
 /**
  * Focused copies of the methods used to serialize Pi messages for OpenAI's
- * Responses API. Adapted from @earendil-works/pi-ai@0.83.0:
+ * Responses API. Adapted from @earendil-works/pi-ai@0.84.1:
  *
  * - src/api/openai-responses-shared.ts
  * - src/api/transform-messages.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-openai-codex-compat",
-  "version": "0.0.5",
+  "version": "0.0.7-alpha.0",
   "description": "OpenAI Codex compatibility for Pi with native compaction, fast mode, and Codex-optimized capabilities",
   "keywords": [
     "pi-package"
@@ -32,14 +32,16 @@
     "check": "hk check --all --check",
     "test": "node --test --test-concurrency=1 test/*.test.ts",
     "test:live:codex": "PI_CODEX_LIVE_TEST=1 node --test --test-concurrency=1 test/codex-host.live.test.ts",
+    "pack:dry": "npm pack --dry-run --allow-directory=all",
+    "release": "node scripts/release.ts",
     "fmt": "oxfmt",
     "lint": "oxlint",
     "lint:fix": "oxlint --fix"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "0.83.0",
-    "@earendil-works/pi-coding-agent": "0.83.0",
-    "@earendil-works/pi-tui": "0.83.0",
+    "@earendil-works/pi-ai": "0.84.1",
+    "@earendil-works/pi-coding-agent": "0.84.1",
+    "@earendil-works/pi-tui": "0.84.1",
     "@types/node": "22.20.1",
     "oxfmt": "0.60.0",
     "oxlint": "1.75.0",
@@ -48,9 +50,9 @@
     "typescript": "7.0.2"
   },
   "peerDependencies": {
-    "@earendil-works/pi-ai": ">=0.83.0 <0.84.0",
-    "@earendil-works/pi-coding-agent": ">=0.83.0 <0.84.0",
-    "@earendil-works/pi-tui": ">=0.83.0 <0.84.0",
+    "@earendil-works/pi-ai": ">=0.84.0 <0.85.0",
+    "@earendil-works/pi-coding-agent": ">=0.84.0 <0.85.0",
+    "@earendil-works/pi-tui": ">=0.84.0 <0.85.0",
     "typebox": "*"
   },
   "engines": {