What's new
- Uses the signed-in ChatGPT/Codex subscription managed by
dsh-codex-connectby default, soOPENAI_API_KEYis no longer required. - Refreshes near-expiry connector credentials safely, tracks refresh work through plugin teardown, and falls back to a configured API key only in
authMode: auto. - Pins OAuth image requests to
https://chatgpt.com/backend-api/codex/images/generationswith Codex account/turn headers and redirect rejection. - Keeps the Codex-style developing animation for the subscription endpoint's JSON response; API-key mode retains up to three real streamed partial previews.
- Improves completed-card copy while preserving durable attachment replay, Blob preview, lightbox, and download.
Verification
- 28 keyless tests plus Host/Client typecheck, production build, built-artifact smoke, Publint, and
npm audit --omit=dev(0 vulnerabilities). - Real signed-in Codex subscription smoke: generated a 1672×941 PNG, saved 2,388,237 bytes to DSH attachments, replayed the authorized bytes after a cold Host restart, and rendered the completed browser card with preview/download and no console errors.
- Verified with DeepSeek Harness
0.1.0-rc.6,dsh-codex-connect0.1.0-alpha.4.4, Node.js24.15.0, and Windows 11.
See the README authentication section before upgrading. Subscription mode currently returns PNG and does not expose provider partial frames.