@dianshuv/copilot-api 0.10.1 → 0.11.1

package/README.md

@@ -57,7 +57,7 @@ make down
 | Option | Description | Default |
 |--------|-------------|---------|
 | `--port`, `-p` | Port to listen on | 4141 |
-| `--host`, `-H` | Host/interface to bind to | (all interfaces) |
+| `--host`, `-H` | Host/interface to bind to (`0.0.0.0` = all interfaces) | `127.0.0.1` |
 | `--verbose`, `-v` | Enable verbose logging | false |
 | `--account-type`, `-a` | Account type (individual, business, enterprise) | individual |
 | `--manual` | Manual request approval mode | false |
@@ -200,17 +200,23 @@ The startup banner prints whether auth is on/off and, when on, the source
 
 ### Network binding
 
-The proxy **binds all interfaces (`0.0.0.0`) by default**, so a key-less
-instance is reachable from anywhere on your network. For a local-only,
-unauthenticated instance, bind loopback explicitly:
+The proxy **binds loopback (`127.0.0.1`) by default**, so an unconfigured
+instance is reachable only from the local machine. To expose it on your network
+— behind auth, a tunnel, or inside a container — opt into an all-interfaces
+bind explicitly:
 
 ```sh
-copilot-api start --host 127.0.0.1
+copilot-api start --host 0.0.0.0
 ```
 
-The startup banner reports the **real** bind address (`0.0.0.0` for an
-all-interfaces bind, or the narrowed host you passed), so a wide-open bind is
-never hidden.
+The bind host resolves with **`--host` flag > `HOST` env > `127.0.0.1`**. Note
+that a `HOST` env var — inherited from your shell or a container — also widens
+the bind: `HOST=0.0.0.0` opens all interfaces just like the flag. A *blank*
+`HOST` (`HOST=`, or `HOST=$UNSET`) is ignored and falls back to the loopback
+default, so an accidentally-empty env var can't silently expose the proxy. The
+startup banner always reports the **real** bind address (`127.0.0.1` for the
+loopback default, `0.0.0.0` for an all-interfaces bind, or the narrowed host you
+passed), so a wide-open bind is never hidden.
 
 ### Choosing a key
 
@@ -277,8 +283,8 @@ a custom header, so when auth is on they stop working:
 
 Workarounds:
 
-- Run a **separate local, unauthenticated instance** (`--host 127.0.0.1` with no
-  `--api-key`) for the browser UI, or
+- Run a **separate local, unauthenticated instance** (no `--api-key`; the
+  default `127.0.0.1` bind keeps it local) for the browser UI, or
 - Hit the history JSON API directly with a key, e.g.
   `curl -H "Authorization: Bearer $COPILOT_API_KEY" http://127.0.0.1:4141/history/api/entries`.
 

package/dist/main.mjs

@@ -1348,7 +1348,7 @@ const patchClaude = defineCommand({
 
 //#endregion
 //#region package.json
-var version = "0.10.1";
+var version = "0.11.1";
 
 //#endregion
 //#region src/lib/adaptive-rate-limiter.ts
@@ -1762,6 +1762,44 @@ function resolveProxyApiKey(sources) {
 	};
 }
 /**
+* Resolve the hostname the server will *actually* bind to, decided at the CLI
+* edge with flag-over-env precedence and a **safe loopback default** — the same
+* flag-over-env shape this codebase already uses to reconcile a CLI flag with
+* its env twin (`--api-key`/`COPILOT_API_KEY`, `--github-token`/`GH_TOKEN`).
+*
+*  - `--host` flag wins when present; otherwise the `HOST` env; otherwise the
+*    default `127.0.0.1`.
+*  - The default is **loopback, not all-interfaces**: an unconfigured instance
+*    must not expose `/token` (which echoes the plaintext Copilot token) and the
+*    otherwise-unauthenticated API to the whole network. Binding every interface
+*    is now an explicit opt-in — pass `--host 0.0.0.0` (or `HOST=0.0.0.0`).
+*  - **flag vs env asymmetry on a blank value** (the security-critical part): an
+*    explicit `--host` flag is the operator's deliberate choice, so a blank flag
+*    (`--host ""` / whitespace) is taken as the wildcard-bind escape hatch and
+*    canonicalized to an explicit `0.0.0.0` (rather than left as `""` to lean on
+*    srvx's undocumented empty-string handling). But a *set-but-blank* `HOST` env
+*    (`HOST=`, or `HOST=$UNSET` in a shell / compose where the var is unset →
+*    empty — NOT a deliberate keystroke) is accidental plumbing, so it is treated
+*    as **not provided** and falls through to the loopback default. This mirrors
+*    `resolveProxyApiKey` trimming `""` to not-provided, so an empty `HOST` can't
+*    silently reopen the all-interfaces-unauthenticated exposure the loopback
+*    default exists to prevent.
+*  - **Both sources are trimmed**: a padded `--host " 10.0.0.5 "` or
+*    `HOST=" 10.0.0.5 "` would otherwise reach the socket bind verbatim and fail
+*    with `ENOTFOUND`. Trimming also decides blank-ness for the rules above.
+*
+* `env` is passed in (not read here) to keep the function pure and unit-testable.
+*/
+function resolveBindHost(flag, env) {
+	if (flag !== void 0) {
+		const trimmed = flag.trim();
+		return trimmed === "" ? "0.0.0.0" : trimmed;
+	}
+	const envTrimmed = env?.trim() ?? "";
+	if (envTrimmed !== "") return envTrimmed;
+	return "127.0.0.1";
+}
+/**
 * Resolve the address the server will *actually* bind to for the startup banner
 * (Issue 04).
 *
@@ -8014,10 +8052,11 @@ function translateErrorToAnthropicErrorEvent(error) {
 //#endregion
 //#region src/routes/messages/tool-call-recovery.ts
 const ENVELOPE = String.raw`(?:<(?:antml:)?function_calls>|call)`;
-const INVOKE_BODY = String.raw`<(?:antml:)?invoke\s+name="[^"]+">[\s\S]*?</(?:antml:)?invoke>`;
-const LEAKED_REGION_RE = new RegExp(String.raw`(?:^|\n)[ \t]*` + ENVELOPE + String.raw`[ \t\n]*(?:` + INVOKE_BODY + String.raw`\s*)+(?:</(?:antml:)?function_calls>)?`, "g");
-const INCOMPLETE_LEAK_TAIL_RE = new RegExp(String.raw`(?:^|\n)[ \t]*` + ENVELOPE + String.raw`[ \t\n]*<(?:antml:)?invoke\b[\s\S]*$`);
-const LEAK_OPEN_RE = new RegExp(String.raw`(?:^|\n)[ \t]*` + ENVELOPE + String.raw`[ \t\n]*<(?:antml:)?invoke\s+name="`);
+const INVOKE_BODY = String.raw`<(?:antml:)?invoke\s+name="[^"]+">(?:(?!<(?:antml:)?invoke\b)[\s\S])*?</(?:antml:)?invoke>`;
+const LEAKED_REGION_RE = new RegExp(String.raw`(?:^|\n)[ \t]*(?:` + ENVELOPE + String.raw`[ \t\n]*(?:` + INVOKE_BODY + String.raw`\s*)+(?:</(?:antml:)?function_calls>)?|` + INVOKE_BODY + String.raw`)`, "g");
+const STARTS_WITH_ENVELOPE_RE = new RegExp(String.raw`^[ \t\n]*` + ENVELOPE);
+const INVOKE_OPENER_RE = new RegExp(String.raw`(?:^|\n)[ \t]*(?:` + ENVELOPE + String.raw`[ \t\n]*)?<(?:antml:)?invoke\b[^\n>]*>?`, "g");
+const LEAK_OPEN_RE = new RegExp(String.raw`(?:^|\n)[ \t]*(?:` + ENVELOPE + String.raw`[ \t\n]*)?<(?:antml:)?invoke\s+name="`, "g");
 const INVOKE_RE = /<(?:antml:)?invoke\s+name="([^"]+)">([\s\S]*?)<\/(?:antml:)?invoke>/g;
 const PARAMETER_RE = /<(?:antml:)?parameter\s+name="([^"]+)">([\s\S]*?)<\/(?:antml:)?parameter>/g;
 function coerceParamValue(raw) {
@@ -8043,19 +8082,43 @@ function parseRegionInvokes(region, knownTools) {
 	}
 	return calls;
 }
+const FENCE_DELIM_RE = /(?:^|\n)[ \t]*```/g;
+function insideFence(text, pos) {
+	let openAt = -1;
+	for (const m of text.matchAll(FENCE_DELIM_RE)) if (openAt === -1) {
+		if (m.index >= pos) break;
+		openAt = m.index;
+	} else if (m.index > pos) return true;
+	else openAt = -1;
+	return false;
+}
+function regionIsLeak(region, offset, fullText, knownTools) {
+	if (insideFence(fullText, offset)) return false;
+	if (STARTS_WITH_ENVELOPE_RE.test(region)) return true;
+	if (!knownTools) return false;
+	return parseRegionInvokes(region, knownTools).length > 0;
+}
 /**
 * Split assistant text into ordered segments — dropping leaked envelope markup
 * (and undeclared-tool invokes) while preserving the natural-language on either
 * side and the pre/tool/post ordering. Returns a single text segment when there
 * is no leak. Shared by both response recovery paths so they cannot diverge.
+*
+* `from` restricts the EMITTED window to `text.slice(from)` while still
+* classifying against the FULL `text` — so a streaming capture that started just
+* after an opening ``` fence still sees that fence (and the now-arrived closing
+* one) when deciding whether the region is documentation.
 */
-function recoverSegments(text, knownTools) {
+function recoverSegments(text, knownTools, from = 0) {
 	const segments = [];
-	let cursor = 0;
+	let cursor = from;
 	let sawRegion = false;
 	for (const region of text.matchAll(LEAKED_REGION_RE)) {
+		const idx = region.index;
+		if (idx < from) continue;
+		if (!regionIsLeak(region[0], idx, text, knownTools)) continue;
 		sawRegion = true;
-		const pre = text.slice(cursor, region.index);
+		const pre = text.slice(cursor, idx);
 		if (pre.trim() !== "") segments.push({
 			kind: "text",
 			text: pre
@@ -8064,11 +8127,11 @@ function recoverSegments(text, knownTools) {
 			kind: "tool",
 			call
 		});
-		cursor = region.index + region[0].length;
+		cursor = idx + region[0].length;
 	}
 	if (!sawRegion) return [{
 		kind: "text",
-		text
+		text: text.slice(from)
 	}];
 	const post = text.slice(cursor);
 	if (post.trim() !== "") segments.push({
@@ -8077,19 +8140,20 @@ function recoverSegments(text, knownTools) {
 	});
 	return segments;
 }
-/** True when `text` contains at least one complete, envelope-wrapped leak. */
-function containsLeakedToolCall(text) {
+/** True when `text` contains at least one real leak (see `regionIsLeak`). */
+function containsLeakedToolCall(text, knownTools) {
 	if (!text.includes("invoke")) return false;
-	for (const _region of text.matchAll(LEAKED_REGION_RE)) return true;
+	for (const region of text.matchAll(LEAKED_REGION_RE)) if (regionIsLeak(region[0], region.index, text, knownTools)) return true;
 	return false;
 }
 /**
-* Remove complete leaked tool-call regions from assistant text, preserving the
-* surrounding natural-language on both sides.
+* Remove real leaked tool-call regions from assistant text, preserving the
+* surrounding natural-language on both sides. Regions that are not leaks (an
+* envelope-less <invoke> that names no declared tool) round-trip untouched.
 */
-function stripLeakedToolCalls(text) {
+function stripLeakedToolCalls(text, knownTools) {
 	if (!text.includes("invoke")) return text;
-	const stripped = text.replaceAll(LEAKED_REGION_RE, "");
+	const stripped = text.replaceAll(LEAKED_REGION_RE, (match, offset) => regionIsLeak(match, offset, text, knownTools) ? "" : match);
 	if (stripped === text) return text;
 	return stripped.replace(/[ \t\n]+$/, "");
 }
@@ -8103,14 +8167,27 @@ function toolNameSet(tools) {
 	return new Set((tools ?? []).filter((tool) => !isServerToolType(tool.type)).map((tool) => tool.name));
 }
 const EMPTIED_ASSISTANT_PLACEHOLDER = "[malformed tool call removed by proxy]";
-function historyHasLeak(text) {
+const INVOKE_NAME_RE = /<(?:antml:)?invoke\s+name="([^"]+)"/;
+function findIncompleteLeakTail(text, knownTools) {
+	let last;
+	for (const m of text.matchAll(INVOKE_OPENER_RE)) last = m;
+	if (!last || last.index === void 0) return -1;
+	if (text.includes("</invoke>", last.index + last[0].length)) return -1;
+	if (insideFence(text, last.index)) return -1;
+	if (STARTS_WITH_ENVELOPE_RE.test(last[0])) return last.index;
+	if (!knownTools) return -1;
+	const name = INVOKE_NAME_RE.exec(last[0]);
+	return name && knownTools.has(name[1]) ? last.index : -1;
+}
+function historyHasLeak(text, knownTools) {
 	if (!text.includes("invoke")) return false;
-	return containsLeakedToolCall(text) || INCOMPLETE_LEAK_TAIL_RE.test(text);
+	return containsLeakedToolCall(text, knownTools) || findIncompleteLeakTail(text, knownTools) !== -1;
 }
-function scrubHistoryText(text) {
-	const stripped = stripLeakedToolCalls(text);
-	const final = stripped.replace(INCOMPLETE_LEAK_TAIL_RE, "");
-	return final === stripped ? stripped : final.replace(/[ \t\n]+$/, "");
+function scrubHistoryText(text, knownTools) {
+	const stripped = stripLeakedToolCalls(text, knownTools);
+	const tailStart = findIncompleteLeakTail(stripped, knownTools);
+	if (tailStart === -1) return stripped;
+	return stripped.slice(0, tailStart).replace(/[ \t\n]+$/, "");
 }
 /**
 * Request-side de-poison. Strips leaked tool-call markup (complete and truncated)
@@ -8121,6 +8198,7 @@ function scrubHistoryText(text) {
 */
 function dePoisonAssistantMessages(payload) {
 	if (!payload.messages.some((m) => m.role === "assistant" && (typeof m.content === "string" ? m.content.includes("invoke") : m.content.some((b) => b.type === "text" && b.text.includes("invoke"))))) return payload;
+	const knownTools = toolNameSet(payload.tools);
 	let changed = false;
 	const messages = [];
 	for (const msg of payload.messages) {
@@ -8129,26 +8207,26 @@ function dePoisonAssistantMessages(payload) {
 			continue;
 		}
 		if (typeof msg.content === "string") {
-			if (!historyHasLeak(msg.content)) {
+			if (!historyHasLeak(msg.content, knownTools)) {
 				messages.push(msg);
 				continue;
 			}
 			changed = true;
-			const cleaned = scrubHistoryText(msg.content);
+			const cleaned = scrubHistoryText(msg.content, knownTools);
 			messages.push({
 				...msg,
 				content: cleaned.trim() === "" ? EMPTIED_ASSISTANT_PLACEHOLDER : cleaned
 			});
 			continue;
 		}
-		if (!msg.content.some((b) => b.type === "text" && historyHasLeak(b.text))) {
+		if (!msg.content.some((b) => b.type === "text" && historyHasLeak(b.text, knownTools))) {
 			messages.push(msg);
 			continue;
 		}
 		changed = true;
 		const content = msg.content.flatMap((b) => {
-			if (b.type !== "text" || !historyHasLeak(b.text)) return [b];
-			const cleaned = scrubHistoryText(b.text);
+			if (b.type !== "text" || !historyHasLeak(b.text, knownTools)) return [b];
+			const cleaned = scrubHistoryText(b.text, knownTools);
 			return cleaned.trim() === "" ? [] : [{
 				...b,
 				text: cleaned
@@ -8184,7 +8262,7 @@ function recoverLeakedToolCallsInResponse(response, knownTools) {
 	let recoveredCall = false;
 	const content = [];
 	for (const block of response.content) {
-		if (block.type !== "text" || !containsLeakedToolCall(block.text)) {
+		if (block.type !== "text" || !containsLeakedToolCall(block.text, knownTools)) {
 			content.push(block);
 			continue;
 		}
@@ -8290,12 +8368,16 @@ var LeakedToolCallStreamRecovery = class {
 			if (t.buffer.length - t.captureStart > MAX_CAPTURE) return this.abandonCapture(t);
 			return [];
 		}
-		if (!t.abandoned) {
-			const open = LEAK_OPEN_RE.exec(t.buffer);
-			if (open) return this.beginCapture(t, open.index);
+		if (!t.abandoned && t.buffer.includes("invoke")) {
+			for (const open of t.buffer.matchAll(LEAK_OPEN_RE)) if (this.shouldArmCapture(open[0], t.buffer, open.index)) return this.beginCapture(t, open.index);
 		}
 		return this.flushSafe(t);
 	}
+	shouldArmCapture(opener, buffer, openerIndex) {
+		if (insideFence(buffer, openerIndex)) return false;
+		if (STARTS_WITH_ENVELOPE_RE.test(opener)) return true;
+		return this.knownTools !== void 0 && this.knownTools.size > 0;
+	}
 	onBlockStop(event, rawData) {
 		const t = this.text;
 		if (!t || event.index !== t.upstreamIndex) return [this.reindexed(event, rawData)];
@@ -8441,7 +8523,7 @@ var LeakedToolCallStreamRecovery = class {
 		return events;
 	}
 	finishCapture(t) {
-		const segments = recoverSegments(t.buffer.slice(t.captureStart), this.knownTools);
+		const segments = recoverSegments(t.buffer, this.knownTools, t.captureStart);
 		const hasTool = segments.some((s) => s.kind === "tool");
 		const base = t.upstreamIndex + this.extraBlocks;
 		const events = [];
@@ -9756,7 +9838,7 @@ async function runServer(options) {
 	const visibleModels = allModels.filter((m) => !isHiddenModel(m.id, state.showAllModels));
 	if (visibleModels.length === 0) consola.warn("All upstream models are filtered by the hardcoded blacklist. /v1/models will return an empty list, but explicit POSTs with a hidden id still pass through to upstream. Restart with --show-all-models to see the full catalogue.");
 	else consola.info(`Available models:\n${visibleModels.map((m) => formatModelInfo(m)).join("\n")}`);
-	const serverUrl = `http://${resolveClientHost(options.host, process.env.HOST)}:${options.port}`;
+	const serverUrl = `http://${resolveClientHost(options.host, void 0)}:${options.port}`;
 	if (options.claudeCode) {
 		if (visibleModels.length === 0) {
 			consola.error("--claude-code interactive setup needs at least one visible model. Restart with --show-all-models or update src/lib/hidden-models.ts.");
@@ -9792,7 +9874,7 @@ async function runServer(options) {
 	consola.box(`🌐 Usage Viewer: https://ericc-ch.github.io/copilot-api?endpoint=${serverUrl}/usage${options.history ? `\n📜 History UI: ${serverUrl}/history` : ""}`);
 	for (const line of buildStartupAuthLines({
 		source: options.apiKeySource,
-		bindAddress: resolveBindAddress(options.host, process.env.HOST)
+		bindAddress: resolveBindAddress(options.host, void 0)
 	})) process.stdout.write(`${line}\n`);
 	setupShutdownHandlers();
 	setServerInstance(serve({
@@ -9842,7 +9924,7 @@ const start = defineCommand({
 		host: {
 			alias: "H",
 			type: "string",
-			description: "Host/interface to bind to (e.g., 127.0.0.1 for localhost only, 0.0.0.0 for all interfaces)"
+			description: "Host/interface to bind to. Default: 127.0.0.1 (loopback only); pass 0.0.0.0 to bind all interfaces. Falls back to the HOST env var when the flag is omitted."
 		},
 		verbose: {
 			alias: "v",
@@ -9968,7 +10050,7 @@ const start = defineCommand({
 		});
 		return runServer({
 			port: Number.parseInt(args.port, 10),
-			host: args.host,
+			host: resolveBindHost(args.host, process.env.HOST),
 			verbose: args.verbose,
 			accountType: args["account-type"],
 			manual: args.manual,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dianshuv/copilot-api",
-  "version": "0.10.1",
+  "version": "0.11.1",
   "description": "Turn GitHub Copilot into OpenAI/Anthropic API compatible server. Usable with Claude Code!",
   "author": "dianshuv",
   "type": "module",