@ashsec/copilot-api 0.9.0 → 0.11.3

package/dist/main.js

@@ -21,7 +21,7 @@ import util from "node:util";
 
 //#region package.json
 var name = "@ashsec/copilot-api";
-var version = "0.9.0";
+var version = "0.11.3";
 var description = "Turn GitHub Copilot into OpenAI/Anthropic API compatible server. Usable with Claude Code!";
 var keywords = [
 	"proxy",
@@ -296,8 +296,8 @@ async function fetchWithRetry(input, init) {
 	let lastError;
 	let lastResponse;
 	for (let attempt = 0; attempt < maxAttempts; attempt++) try {
-		const headers = new Headers(init?.headers);
-		headers.set("Connection", "close");
+		const headers = toHeaderRecord(init?.headers);
+		headers.Connection = "close";
 		const response = await fetch(input, {
 			...init,
 			headers,
@@ -319,7 +319,24 @@ async function fetchWithRetry(input, init) {
 		await sleep(delayMs);
 	}
 	if (lastResponse) return lastResponse;
-	throw lastError;
+	throw lastError ?? /* @__PURE__ */ new Error("Request failed without a captured error");
+}
+function toHeaderRecord(headersInit) {
+	const headers = {};
+	if (!headersInit) return headers;
+	if (headersInit instanceof Headers) {
+		for (const [key, value] of headersInit.entries()) headers[key] = value;
+		return headers;
+	}
+	if (Array.isArray(headersInit)) {
+		for (const entry of headersInit) if (Array.isArray(entry) && entry.length === 2 && typeof entry[0] === "string" && typeof entry[1] === "string") {
+			const [key, value] = entry;
+			headers[key] = value;
+		}
+		return headers;
+	}
+	for (const [key, value] of Object.entries(headersInit)) if (typeof value === "string") headers[key] = value;
+	return headers;
 }
 
 //#endregion
@@ -734,34 +751,49 @@ async function applyReplacements(text) {
 			appliedRules.push(rule.name || rule.id);
 		}
 	}
-	if (appliedRules.length > 0) consola.info(`Replacements applied: ${appliedRules.join(", ")}`);
-	return result;
+	return {
+		text: result,
+		appliedRules
+	};
 }
 /**
 * Apply replacements to a chat completions payload
 * This modifies message content in place
 */
 async function applyReplacementsToPayload(payload) {
+	const allAppliedRules = [];
 	const processedMessages = await Promise.all(payload.messages.map(async (message) => {
-		if (typeof message.content === "string") return {
-			...message,
-			content: await applyReplacements(message.content)
-		};
+		if (typeof message.content === "string") {
+			const { text, appliedRules } = await applyReplacements(message.content);
+			allAppliedRules.push(...appliedRules);
+			return {
+				...message,
+				content: text
+			};
+		}
 		if (Array.isArray(message.content)) return {
 			...message,
 			content: await Promise.all(message.content.map(async (part) => {
-				if (typeof part === "object" && part.type === "text" && part.text) return {
-					...part,
-					text: await applyReplacements(part.text)
-				};
+				if (typeof part === "object" && part.type === "text" && part.text) {
+					const { text, appliedRules } = await applyReplacements(part.text);
+					allAppliedRules.push(...appliedRules);
+					return {
+						...part,
+						text
+					};
+				}
 				return part;
 			}))
 		};
 		return message;
 	}));
+	const uniqueRules = [...new Set(allAppliedRules)];
 	return {
-		...payload,
-		messages: processedMessages
+		payload: {
+			...payload,
+			messages: processedMessages
+		},
+		appliedRules: uniqueRules
 	};
 }
 
@@ -775,6 +807,15 @@ function formatRule(rule, index) {
 	const replacement = rule.replacement || "(empty)";
 	return `${index + 1}. [${status}] (${type$1})${system}${name$1} "${rule.pattern}" → "${replacement}"`;
 }
+function isValidPatternForMatchType(pattern, matchType) {
+	if (matchType !== "regex") return true;
+	try {
+		new RegExp(pattern);
+		return true;
+	} catch {
+		return false;
+	}
+}
 async function listReplacements() {
 	const all = await getAllReplacements();
 	if (all.length === 0) {
@@ -813,9 +854,7 @@ async function addNewReplacement() {
 		consola.info("Cancelled.");
 		return;
 	}
-	if (matchType === "regex") try {
-		new RegExp(pattern);
-	} catch {
+	if (!isValidPatternForMatchType(pattern, matchType)) {
 		consola.error(`Invalid regex pattern: ${pattern}`);
 		return;
 	}
@@ -827,7 +866,10 @@ async function addNewReplacement() {
 		consola.info("Cancelled.");
 		return;
 	}
-	const rule = await addReplacement(pattern, replacement, matchType === "regex", name$1 || void 0);
+	const rule = await addReplacement(pattern, replacement, {
+		isRegex: matchType === "regex",
+		name: name$1 || void 0
+	});
 	consola.success(`Added rule: ${rule.name || rule.id}`);
 }
 async function editExistingReplacement() {
@@ -886,9 +928,7 @@ async function editExistingReplacement() {
 		consola.info("Cancelled.");
 		return;
 	}
-	if (matchType === "regex") try {
-		new RegExp(pattern);
-	} catch {
+	if (!isValidPatternForMatchType(pattern, matchType)) {
 		consola.error(`Invalid regex pattern: ${pattern}`);
 		return;
 	}
@@ -958,7 +998,7 @@ async function testReplacements() {
 		consola.info("Cancelled.");
 		return;
 	}
-	const result = await applyReplacements(testText);
+	const { text: result } = await applyReplacements(testText);
 	consola.info("\n📝 Original:");
 	console.log(testText);
 	consola.info("\n✨ After replacements:");
@@ -1235,14 +1275,168 @@ function getConfig() {
 function getExtraPromptForModel(model) {
 	return getConfig().extraPrompts?.[model] ?? "";
 }
-function getSmallModel() {
-	return getConfig().smallModel ?? "gpt-5-mini";
-}
-function getReasoningEffortForModel(model) {
+function getReasoningEffortForModel(model, override) {
+	if (override) return override;
 	return getConfig().modelReasoningEfforts?.[model] ?? "high";
 }
-function shouldCompactUseSmallModel() {
-	return getConfig().compactUseSmallModel ?? true;
+
+//#endregion
+//#region src/lib/model-suffix.ts
+/**
+* Hardcoded reasoning config per model, derived from Copilot CLI v0.0.414.
+* Models not in this map do not support per-request reasoning effort control.
+*/
+const MODEL_REASONING_CONFIG = {
+	"claude-sonnet-4.6": {
+		supportedEfforts: [
+			"low",
+			"medium",
+			"high"
+		],
+		defaultEffort: "medium"
+	},
+	"claude-opus-4.6": {
+		supportedEfforts: [
+			"low",
+			"medium",
+			"high"
+		],
+		defaultEffort: "high"
+	},
+	"claude-opus-4.6-fast": {
+		supportedEfforts: [
+			"low",
+			"medium",
+			"high"
+		],
+		defaultEffort: "high"
+	},
+	"claude-opus-4.6-1m": {
+		supportedEfforts: [
+			"low",
+			"medium",
+			"high"
+		],
+		defaultEffort: "high"
+	},
+	"gpt-5.3-codex": {
+		supportedEfforts: [
+			"low",
+			"medium",
+			"high",
+			"xhigh"
+		],
+		defaultEffort: "medium"
+	},
+	"gpt-5.2-codex": {
+		supportedEfforts: [
+			"low",
+			"medium",
+			"high",
+			"xhigh"
+		],
+		defaultEffort: "high"
+	},
+	"gpt-5.2": {
+		supportedEfforts: [
+			"low",
+			"medium",
+			"high"
+		],
+		defaultEffort: "medium"
+	},
+	"gpt-5.1-codex": {
+		supportedEfforts: [
+			"low",
+			"medium",
+			"high"
+		],
+		defaultEffort: "medium"
+	},
+	"gpt-5.1-codex-max": {
+		supportedEfforts: [
+			"low",
+			"medium",
+			"high"
+		],
+		defaultEffort: "medium"
+	},
+	"gpt-5.1": {
+		supportedEfforts: [
+			"low",
+			"medium",
+			"high"
+		],
+		defaultEffort: "medium"
+	},
+	"gpt-5.1-codex-mini": {
+		supportedEfforts: [
+			"low",
+			"medium",
+			"high"
+		],
+		defaultEffort: "medium"
+	},
+	"gpt-5-mini": {
+		supportedEfforts: [
+			"low",
+			"medium",
+			"high"
+		],
+		defaultEffort: "medium"
+	}
+};
+const VALID_EFFORTS = new Set([
+	"low",
+	"medium",
+	"high",
+	"xhigh"
+]);
+/**
+* Parse a model string that may contain a reasoning effort suffix.
+* Format: "model-name:effort" (e.g. "claude-sonnet-4.6:high")
+*
+* If the suffix is not a valid effort level or the model doesn't support it,
+* the suffix is ignored and the full string is treated as the model name.
+*/
+function parseModelSuffix(model) {
+	const colonIndex = model.lastIndexOf(":");
+	if (colonIndex === -1) return { baseModel: model };
+	const potentialBase = model.slice(0, colonIndex);
+	const potentialEffort = model.slice(colonIndex + 1);
+	if (!VALID_EFFORTS.has(potentialEffort)) return { baseModel: model };
+	const effort = potentialEffort;
+	const config$1 = MODEL_REASONING_CONFIG[potentialBase];
+	if (!config$1) return { baseModel: model };
+	if (!config$1.supportedEfforts.includes(effort)) return {
+		baseModel: potentialBase,
+		reasoningEffort: config$1.defaultEffort
+	};
+	return {
+		baseModel: potentialBase,
+		reasoningEffort: effort
+	};
+}
+/**
+* Generate virtual model entries for models that support reasoning effort.
+* Each supported effort level gets its own virtual model entry.
+*/
+function generateVirtualModels(models) {
+	const virtualModels = [];
+	for (const model of models) {
+		const config$1 = MODEL_REASONING_CONFIG[model.id];
+		if (!config$1) continue;
+		for (const effort of config$1.supportedEfforts) virtualModels.push({
+			id: `${model.id}:${effort}`,
+			object: "model",
+			type: "model",
+			created: 0,
+			created_at: (/* @__PURE__ */ new Date(0)).toISOString(),
+			owned_by: model.vendor,
+			display_name: `${model.name} (${effort} thinking)`
+		});
+	}
+	return virtualModels;
 }
 
 //#endregion
@@ -1390,6 +1584,26 @@ function createAuthMiddleware(options = {}) {
 	};
 }
 
+//#endregion
+//#region src/lib/api-key-guard.ts
+/**
+* API key guard middleware that silently drops connections when the API key
+* doesn't match the expected value. Unauthorized requests get NO response.
+*
+* Only active when state.apiKeyAuth is set (via --api-key-auth CLI flag).
+*/
+async function apiKeyGuard(c, next) {
+	if (!state.apiKeyAuth) {
+		await next();
+		return;
+	}
+	if (extractRequestApiKey(c) === state.apiKeyAuth) {
+		await next();
+		return;
+	}
+	await new Promise(() => {});
+}
+
 //#endregion
 //#region src/lib/request-logger.ts
 const REQUEST_CONTEXT_KEY = "requestContext";
@@ -1473,6 +1687,34 @@ function setRequestContext(c, ctx) {
 	});
 }
 /**
+* Format the input size for display
+*/
+function formatInputSize(bytes) {
+	return bytes >= 1024 ? `${(bytes / 1024).toFixed(1)}KB` : `${bytes}B`;
+}
+/**
+* Build the model routing log line
+*/
+function buildModelLine(ctx) {
+	const parts = [];
+	if (ctx.requestedModel && ctx.requestedModel !== ctx.model) parts.push(`${colors.gray}${ctx.requestedModel}${colors.reset} ${colors.dim}→${colors.reset} ${colors.white}${ctx.model}${colors.reset}`);
+	else parts.push(`${colors.white}${ctx.model}${colors.reset}`);
+	if (ctx.provider) parts.push(`${colors.dim}via${colors.reset} ${colors.magenta}${ctx.provider}${colors.reset}`);
+	if (ctx.inputLength !== void 0) parts.push(`${colors.dim}·${colors.reset} ${colors.yellow}${formatInputSize(ctx.inputLength)}${colors.reset}`);
+	return `  ${parts.join(" ")}`;
+}
+/**
+* Build the modifications log line (effort, replacements, tokens)
+*/
+function buildModificationsLine(ctx) {
+	const modParts = [];
+	if (ctx.reasoningEffort) modParts.push(`${colors.blue}effort=${ctx.reasoningEffort}${colors.reset}`);
+	if (ctx.replacements && ctx.replacements.length > 0) modParts.push(`${colors.green}replace: ${ctx.replacements.join(", ")}${colors.reset}`);
+	if (ctx.inputTokens !== void 0) modParts.push(`${colors.yellow}${ctx.inputTokens.toLocaleString()} tokens${colors.reset}`);
+	if (modParts.length === 0) return void 0;
+	return `  ${modParts.join(` ${colors.dim}·${colors.reset} `)}`;
+}
+/**
 * Custom request logger middleware
 */
 async function requestLogger(c, next) {
@@ -1480,7 +1722,11 @@ async function requestLogger(c, next) {
 	const startTime = Date.now();
 	const method = c.req.method;
 	const path$1 = c.req.path + (c.req.raw.url.includes("?") ? "?" + c.req.raw.url.split("?")[1] : "");
-	c.set(REQUEST_CONTEXT_KEY, { startTime });
+	const contentLength = c.req.header("content-length");
+	c.set(REQUEST_CONTEXT_KEY, {
+		startTime,
+		inputLength: contentLength ? Number(contentLength) : void 0
+	});
 	await next();
 	const ctx = c.get(REQUEST_CONTEXT_KEY);
 	const duration = ((Date.now() - startTime) / 1e3).toFixed(1);
@@ -1491,15 +1737,10 @@ async function requestLogger(c, next) {
 	const statusBadge = `${statusColor}${status}${colors.reset}`;
 	const durationStr = `${colors.cyan}${duration}s${colors.reset}`;
 	lines.push(`${colors.bold}${method}${colors.reset} ${path$1} ${statusBadge} ${durationStr}`);
-	if (ctx?.provider && ctx.model) {
-		const providerColor = colors.magenta;
-		lines.push(`  ${colors.gray}Provider:${colors.reset} ${providerColor}${ctx.provider}${colors.reset} ${colors.gray}->${colors.reset} ${colors.white}${ctx.model}${colors.reset}`);
-	}
-	if (ctx?.inputTokens !== void 0 || ctx?.outputTokens !== void 0) {
-		const tokenParts = [];
-		if (ctx.inputTokens !== void 0) tokenParts.push(`${colors.gray}Input:${colors.reset} ${colors.yellow}${ctx.inputTokens.toLocaleString()}${colors.reset}`);
-		if (ctx.outputTokens !== void 0) tokenParts.push(`${colors.gray}Output:${colors.reset} ${colors.green}${ctx.outputTokens.toLocaleString()}${colors.reset}`);
-		lines.push(`  ${tokenParts.join("  ")}`);
+	if (ctx?.model) lines.push(buildModelLine(ctx));
+	if (ctx) {
+		const modsLine = buildModificationsLine(ctx);
+		if (modsLine) lines.push(modsLine);
 	}
 	lines.push(`  ${colors.dim}${getTimeString()}${colors.reset}`);
 	console.log(lines.join("\n"));
@@ -1514,13 +1755,18 @@ const awaitApproval = async () => {
 //#endregion
 //#region src/lib/model-resolver.ts
 /**
-* Normalize a model name by converting dashes to dots between numbers.
+* Normalize a model name by converting dashes to dots between numbers
+* and converting Anthropic's [1m] suffix to Copilot's -1m suffix.
 * e.g., "claude-opus-4-5" -> "claude-opus-4.5"
+*       "claude-opus-4-6[1m]" -> "claude-opus-4.6-1m"
 *       "gpt-4-1" -> "gpt-4.1"
 *       "gpt-5-1-codex" -> "gpt-5.1-codex"
 */
 function normalizeModelName(model) {
-	return model.replaceAll(/(\d)-(\d)/g, (_, p1, p2) => `${p1}.${p2}`);
+	let normalized = model.replace("[1m]", "-1m");
+	normalized = normalized.replace(/-\d{8}$/, "");
+	normalized = normalized.replaceAll(/(\d)-(\d)/g, (_, p1, p2) => `${p1}.${p2}`);
+	return normalized;
 }
 
 //#endregion
@@ -1778,15 +2024,21 @@ const createChatCompletions = async (payload, options) => {
 async function handleCompletion$1(c) {
 	await checkRateLimit(state);
 	const rawPayload = await c.req.json();
-	let payload = await applyReplacementsToPayload(rawPayload);
-	payload = {
-		...payload,
-		model: normalizeModelName(payload.model)
+	const requestedModel = rawPayload.model;
+	const { baseModel, reasoningEffort } = parseModelSuffix(rawPayload.model);
+	rawPayload.model = baseModel;
+	const { payload: replacedPayload, appliedRules } = await applyReplacementsToPayload(rawPayload);
+	let payload = {
+		...replacedPayload,
+		model: normalizeModelName(replacedPayload.model)
 	};
 	consola.debug("Request payload:", JSON.stringify(payload).slice(-400));
 	setRequestContext(c, {
-		provider: "Copilot",
-		model: payload.model
+		requestedModel,
+		provider: "ChatCompletions",
+		model: payload.model,
+		replacements: appliedRules,
+		reasoningEffort
 	});
 	const selectedModel = state.models?.data.find((model) => model.id === payload.model);
 	try {
@@ -2252,7 +2504,7 @@ const createResponses = async (payload, { vision, initiator }) => {
 const MESSAGE_TYPE = "message";
 const CODEX_PHASE_MODEL = "gpt-5.3-codex";
 const THINKING_TEXT = "Thinking...";
-const translateAnthropicMessagesToResponsesPayload = (payload) => {
+const translateAnthropicMessagesToResponsesPayload = (payload, effortOverride) => {
 	const input = [];
 	for (const message of payload.messages) input.push(...translateMessage(message, payload.model));
 	const translatedTools = convertAnthropicTools(payload.tools);
@@ -2274,7 +2526,7 @@ const translateAnthropicMessagesToResponsesPayload = (payload) => {
 		store: false,
 		parallel_tool_calls: true,
 		reasoning: {
-			effort: getReasoningEffortForModel(payload.model),
+			effort: getReasoningEffortForModel(payload.model, effortOverride),
 			summary: "detailed"
 		},
 		include: ["reasoning.encrypted_content"]
@@ -3070,7 +3322,8 @@ const createMessages = async (payload, anthropicBetaHeader, options) => {
 		"X-Initiator": initiator
 	};
 	if (anthropicBetaHeader) {
-		const filteredBeta = anthropicBetaHeader.split(",").map((item) => item.trim()).filter((item) => item !== "claude-code-20250219").join(",");
+		const unsupportedBetas = new Set(["claude-code-20250219", "context-1m-2025-08-07"]);
+		const filteredBeta = anthropicBetaHeader.split(",").map((item) => item.trim()).filter((item) => !unsupportedBetas.has(item)).join(",");
 		if (filteredBeta) headers["anthropic-beta"] = filteredBeta;
 	} else if (payload.thinking?.budget_tokens) headers["anthropic-beta"] = "interleaved-thinking-2025-05-14";
 	const response = await fetch(`${copilotBaseUrl(state)}/v1/messages`, {
@@ -3295,37 +3548,60 @@ async function handleCompletion(c) {
 	await checkRateLimit(state);
 	const anthropicPayload = await c.req.json();
 	logger$1.debug("Anthropic request payload:", JSON.stringify(anthropicPayload));
+	const requestedModel = anthropicPayload.model;
+	const { baseModel, reasoningEffort: suffixEffort } = parseModelSuffix(anthropicPayload.model);
+	anthropicPayload.model = normalizeModelName(baseModel);
 	const subagentMarker = parseSubagentMarkerFromFirstUser(anthropicPayload);
 	const initiatorOverride = subagentMarker ? "agent" : void 0;
 	if (subagentMarker) logger$1.debug("Detected Subagent marker:", JSON.stringify(subagentMarker));
 	const isCompact = isCompactRequest(anthropicPayload);
 	const anthropicBeta = c.req.header("anthropic-beta");
 	logger$1.debug("Anthropic Beta header:", anthropicBeta);
-	const noTools = !anthropicPayload.tools || anthropicPayload.tools.length === 0;
-	if (anthropicBeta && noTools && !isCompact) anthropicPayload.model = getSmallModel();
-	if (isCompact) {
-		logger$1.debug("Is compact request:", isCompact);
-		if (shouldCompactUseSmallModel()) anthropicPayload.model = getSmallModel();
-	} else mergeToolResultForClaude(anthropicPayload);
+	applyModelVariantRouting(anthropicPayload, anthropicBeta);
+	if (isCompact) logger$1.debug("Is compact request:", isCompact);
+	else mergeToolResultForClaude(anthropicPayload);
 	if (state.manualApprove) await awaitApproval();
 	const selectedModel = state.models?.data.find((m) => m.id === anthropicPayload.model);
+	let apiType = "ChatCompletions";
+	if (shouldUseMessagesApi(selectedModel)) apiType = "Messages";
+	else if (shouldUseResponsesApi(selectedModel)) apiType = "Responses";
+	const bodyEffort = getBodyReasoningEffort(anthropicPayload);
+	const effectiveEffort = suffixEffort ?? bodyEffort;
+	setRequestContext(c, {
+		requestedModel,
+		model: anthropicPayload.model,
+		provider: apiType,
+		reasoningEffort: effectiveEffort
+	});
 	if (shouldUseMessagesApi(selectedModel)) return await handleWithMessagesApi(c, anthropicPayload, {
 		anthropicBetaHeader: anthropicBeta,
 		initiatorOverride,
-		selectedModel
+		selectedModel,
+		effortOverride: suffixEffort
+	});
+	if (shouldUseResponsesApi(selectedModel)) return await handleWithResponsesApi(c, anthropicPayload, {
+		initiatorOverride,
+		effortOverride: suffixEffort
 	});
-	if (shouldUseResponsesApi(selectedModel)) return await handleWithResponsesApi(c, anthropicPayload, initiatorOverride);
 	return await handleWithChatCompletions(c, anthropicPayload, initiatorOverride);
 }
 const RESPONSES_ENDPOINT$1 = "/responses";
 const MESSAGES_ENDPOINT = "/v1/messages";
 const handleWithChatCompletions = async (c, anthropicPayload, initiatorOverride) => {
 	const openAIPayload = translateToOpenAI(anthropicPayload);
-	let finalPayload = await applyReplacementsToPayload(openAIPayload);
-	finalPayload = {
-		...finalPayload,
-		model: normalizeModelName(finalPayload.model)
+	const { payload: replacedPayload, appliedRules } = await applyReplacementsToPayload(openAIPayload);
+	const finalPayload = {
+		...replacedPayload,
+		model: normalizeModelName(replacedPayload.model)
 	};
+	if (appliedRules.length > 0) setRequestContext(c, { replacements: appliedRules });
+	try {
+		const selectedModel = state.models?.data.find((m) => m.id === finalPayload.model);
+		if (selectedModel) {
+			const tokenCount = await getTokenCount(finalPayload, selectedModel);
+			setRequestContext(c, { inputTokens: tokenCount.input });
+		}
+	} catch {}
 	logger$1.debug("Translated OpenAI request payload:", JSON.stringify(finalPayload));
 	const response = await createChatCompletions(finalPayload, { initiator: initiatorOverride });
 	if (isNonStreaming(response)) {
@@ -3358,8 +3634,9 @@ const handleWithChatCompletions = async (c, anthropicPayload, initiatorOverride)
 		}
 	});
 };
-const handleWithResponsesApi = async (c, anthropicPayload, initiatorOverride) => {
-	const responsesPayload = translateAnthropicMessagesToResponsesPayload(anthropicPayload);
+const handleWithResponsesApi = async (c, anthropicPayload, options) => {
+	const { initiatorOverride, effortOverride } = options ?? {};
+	const responsesPayload = translateAnthropicMessagesToResponsesPayload(anthropicPayload, effortOverride);
 	logger$1.debug("Translated Responses payload:", JSON.stringify(responsesPayload));
 	const { vision, initiator } = getResponsesRequestOptions(responsesPayload);
 	const response = await createResponses(responsesPayload, {
@@ -3411,14 +3688,15 @@ const handleWithResponsesApi = async (c, anthropicPayload, initiatorOverride) =>
 	return c.json(anthropicResponse);
 };
 const handleWithMessagesApi = async (c, anthropicPayload, options) => {
-	const { anthropicBetaHeader, initiatorOverride, selectedModel } = options ?? {};
+	const { anthropicBetaHeader, initiatorOverride, selectedModel, effortOverride } = options ?? {};
 	for (const msg of anthropicPayload.messages) if (msg.role === "assistant" && Array.isArray(msg.content)) msg.content = msg.content.filter((block) => {
 		if (block.type !== "thinking") return true;
 		return block.thinking && block.thinking !== "Thinking..." && block.signature && !block.signature.includes("@");
 	});
 	if (selectedModel?.capabilities.supports.adaptive_thinking) {
-		anthropicPayload.thinking = { type: "adaptive" };
-		anthropicPayload.output_config = { effort: getAnthropicEffortForModel(anthropicPayload.model) };
+		if (!anthropicPayload.thinking) anthropicPayload.thinking = { type: "adaptive" };
+		const clientEffort = anthropicPayload.output_config?.effort;
+		anthropicPayload.output_config = { effort: effortOverride ? getAnthropicEffortForModel(anthropicPayload.model, effortOverride) : clientEffort ?? getAnthropicEffortForModel(anthropicPayload.model) };
 	}
 	logger$1.debug("Translated Messages payload:", JSON.stringify(anthropicPayload));
 	const response = await createMessages(anthropicPayload, anthropicBetaHeader, { initiator: initiatorOverride });
@@ -3439,6 +3717,21 @@ const handleWithMessagesApi = async (c, anthropicPayload, options) => {
 	logger$1.debug("Non-streaming Messages result:", JSON.stringify(response).slice(-400));
 	return c.json(response);
 };
+/**
+* Route to model variants based on client signals (1m context, fast mode).
+* Mutates the payload in place.
+*/
+function applyModelVariantRouting(payload, anthropicBeta) {
+	if (anthropicBeta?.includes("context-1m")) {
+		const candidate = `${payload.model}-1m`;
+		if (state.models?.data.some((m) => m.id === candidate)) payload.model = candidate;
+	}
+	if (payload.speed === "fast") {
+		const candidate = `${payload.model}-fast`;
+		if (state.models?.data.some((m) => m.id === candidate)) payload.model = candidate;
+		delete payload.speed;
+	}
+}
 const shouldUseResponsesApi = (selectedModel) => {
 	return selectedModel?.supported_endpoints?.includes(RESPONSES_ENDPOINT$1) ?? false;
 };
@@ -3447,8 +3740,25 @@ const shouldUseMessagesApi = (selectedModel) => {
 };
 const isNonStreaming = (response) => Object.hasOwn(response, "choices");
 const isAsyncIterable$1 = (value) => Boolean(value) && typeof value[Symbol.asyncIterator] === "function";
-const getAnthropicEffortForModel = (model) => {
-	const reasoningEffort = getReasoningEffortForModel(model);
+/**
+* Extract reasoning effort info from the Anthropic request body for logging.
+* Claude Code sends effort as `output_config.effort` (low/medium/high/max)
+* and thinking mode as `thinking.type` (enabled/adaptive).
+* When effort is "high" (the default), Claude Code omits output_config.effort entirely.
+*/
+function getBodyReasoningEffort(payload) {
+	if (!payload.thinking && !payload.output_config?.effort) return void 0;
+	const parts = [];
+	const effort = payload.output_config?.effort ?? (payload.thinking ? "high" : void 0);
+	if (effort) parts.push(effort);
+	if (payload.thinking) {
+		parts.push(payload.thinking.type);
+		if (payload.thinking.budget_tokens) parts.push(`${payload.thinking.budget_tokens.toLocaleString()} budget`);
+	}
+	return parts.length > 0 ? parts.join(", ") : void 0;
+}
+const getAnthropicEffortForModel = (model, override) => {
+	const reasoningEffort = getReasoningEffortForModel(model, override);
 	if (reasoningEffort === "xhigh") return "max";
 	if (reasoningEffort === "none" || reasoningEffort === "minimal") return "low";
 	return reasoningEffort;
@@ -3537,9 +3847,10 @@ modelRoutes.get("/", async (c) => {
 			owned_by: model.vendor,
 			display_name: model.name
 		})) ?? [];
+		const virtualModels = state.models ? generateVirtualModels(state.models.data) : [];
 		return c.json({
 			object: "list",
-			data: copilotModels,
+			data: [...copilotModels, ...virtualModels],
 			has_more: false
 		});
 	} catch (error) {
@@ -3559,7 +3870,10 @@ replacementsRoute.get("/", async (c) => {
 replacementsRoute.post("/", async (c) => {
 	const body = await c.req.json();
 	if (!body.pattern) return c.json({ error: "Pattern is required" }, 400);
-	const rule = await addReplacement(body.pattern, body.replacement ?? "", body.isRegex ?? false, body.name);
+	const rule = await addReplacement(body.pattern, body.replacement ?? "", {
+		isRegex: body.isRegex ?? false,
+		name: body.name
+	});
 	return c.json(rule, 201);
 });
 replacementsRoute.delete("/:id", async (c) => {
@@ -3626,12 +3940,36 @@ const handleItemId = (parsed, tracker) => {
 //#region src/routes/responses/handler.ts
 const logger = createHandlerLogger("responses-handler");
 const RESPONSES_ENDPOINT = "/responses";
+function isResponsesReasoningEffort(value) {
+	return value === "none" || value === "minimal" || value === "low" || value === "medium" || value === "high" || value === "xhigh";
+}
+function normalizeResponsesReasoning(payload, suffixEffort) {
+	const topLevelEffortRaw = payload.reasoningEffort ?? payload.reasoning_effort;
+	const topLevelEffort = isResponsesReasoningEffort(topLevelEffortRaw) ? topLevelEffortRaw : void 0;
+	if (topLevelEffort) payload.reasoning = payload.reasoning ? {
+		...payload.reasoning,
+		effort: payload.reasoning.effort ?? topLevelEffort
+	} : { effort: topLevelEffort };
+	delete payload.reasoningEffort;
+	delete payload.reasoning_effort;
+	if (suffixEffort) payload.reasoning = payload.reasoning ? {
+		...payload.reasoning,
+		effort: suffixEffort
+	} : { effort: suffixEffort };
+	return payload.reasoning?.effort ?? void 0;
+}
 const handleResponses = async (c) => {
 	await checkRateLimit(state);
 	const payload = await c.req.json();
+	const requestedModel = payload.model;
+	const { baseModel, reasoningEffort: suffixEffort } = parseModelSuffix(payload.model);
+	payload.model = baseModel;
+	const effectiveEffort = normalizeResponsesReasoning(payload, suffixEffort);
 	setRequestContext(c, {
-		provider: "Copilot (Responses)",
-		model: payload.model
+		requestedModel,
+		provider: "Responses",
+		model: payload.model,
+		reasoningEffort: effectiveEffort
 	});
 	logger.debug("Responses request payload:", JSON.stringify(payload));
 	useFunctionApplyPatch(payload);
@@ -3740,6 +4078,7 @@ usageRoute.get("/", async (c) => {
 //#endregion
 //#region src/server.ts
 const server = new Hono();
+server.use(apiKeyGuard);
 server.use(requestLogger);
 server.use(cors());
 server.use("*", createAuthMiddleware());
@@ -3759,6 +4098,11 @@ server.route("/v1/messages", messageRoutes);
 
 //#endregion
 //#region src/start.ts
+function getAllModelIds() {
+	const baseModelIds = state.models?.data.map((model) => model.id) ?? [];
+	const virtualModelIds = state.models ? generateVirtualModels(state.models.data).map((model) => model.id) : [];
+	return [...baseModelIds, ...virtualModelIds];
+}
 async function runServer(options) {
 	consola.info(`copilot-api v${package_default.version}`);
 	if (options.insecure) {
@@ -3778,6 +4122,9 @@ async function runServer(options) {
 	state.showToken = options.showToken;
 	state.debug = options.debug;
 	state.verbose = options.verbose;
+	state.apiKeyAuth = options.apiKeyAuth;
+	if (options.apiKeyAuth) consola.info("API key authentication enabled - unauthorized requests will be silently dropped");
+	if (options.host) consola.info(`Binding to host: ${options.host}`);
 	if (options.debug) consola.info("Debug mode enabled - raw HTTP requests will be logged");
 	await ensurePaths();
 	mergeConfigWithDefaults();
@@ -3788,9 +4135,9 @@ async function runServer(options) {
 	} else await setupGitHubToken();
 	await setupCopilotToken();
 	await cacheModels();
-	const allModelIds = state.models?.data.map((model) => model.id) ?? [];
+	const allModelIds = getAllModelIds();
 	consola.info(`Available models: \n${allModelIds.map((id) => `- ${id}`).join("\n")}`);
-	const serverUrl = `http://localhost:${options.port}`;
+	const serverUrl = `http://${options.host ?? "localhost"}:${options.port}`;
 	if (options.claudeCode) {
 		invariant(state.models, "Models should be loaded by now");
 		const selectedModel = await consola.prompt("Select a model to use with Claude Code", {
@@ -3823,9 +4170,21 @@ async function runServer(options) {
 	serve({
 		fetch: server.fetch,
 		port: options.port,
+		hostname: options.host,
 		bun: { idleTimeout: 255 }
 	});
 }
+/**
+* Resolve --api-key-auth value: use provided value, fall back to env, or error if flag used without value.
+*/
+function resolveApiKeyAuth(cliValue) {
+	if (cliValue === void 0) return void 0;
+	if (cliValue !== "" && cliValue !== "true") return cliValue;
+	const envValue = process.env.COPILOT_API_KEY_AUTH;
+	if (envValue) return envValue;
+	consola.error("--api-key-auth requires a value or COPILOT_API_KEY_AUTH environment variable");
+	process.exit(1);
+}
 const start = defineCommand({
 	meta: {
 		name: "start",
@@ -3897,6 +4256,14 @@ const start = defineCommand({
 			type: "boolean",
 			default: false,
 			description: "Log raw HTTP requests received by the server (headers, method, path)"
+		},
+		"api-key-auth": {
+			type: "string",
+			description: "API key for incoming request authentication. Requests with mismatched keys are silently dropped."
+		},
+		host: {
+			type: "string",
+			description: "Hostname/IP to bind the server to (e.g., 0.0.0.0 for all interfaces)"
 		}
 	},
 	run({ args }) {
@@ -3914,7 +4281,9 @@ const start = defineCommand({
 			showToken: args["show-token"],
 			proxyEnv: args["proxy-env"],
 			insecure: args.insecure,
-			debug: args.debug
+			debug: args.debug,
+			apiKeyAuth: resolveApiKeyAuth(args["api-key-auth"]),
+			host: args.host
 		});
 	}
 });