@jeffreycao/copilot-api 1.0.9 → 1.1.0

package/README.md

@@ -183,6 +183,9 @@ The following command line options are available for the `start` command:
 - **Default shape:**
   ```json
   {
+    "auth": {
+      "apiKeys": []
+    },
     "extraPrompts": {
       "gpt-5-mini": "<built-in exploration prompt>",
       "gpt-5.1-codex-max": "<built-in exploration prompt>"
@@ -195,6 +198,7 @@ The following command line options are available for the `start` command:
     "compactUseSmallModel": true
   }
   ```
+- **auth.apiKeys:** API keys used for request authentication. Supports multiple keys for rotation. Requests can authenticate with either `x-api-key: <key>` or `Authorization: Bearer <key>`. If empty or omitted, authentication is disabled.
 - **extraPrompts:** Map of `model -> prompt` appended to the first system prompt when translating Anthropic-style requests to Copilot. Use this to inject guardrails or guidance per model. Missing default entries are auto-added without overwriting your custom prompts.
 - **smallModel:** Fallback model used for tool-less warmup messages (e.g., Claude Code probe requests) to avoid spending premium requests; defaults to `gpt-5-mini`.
 - **modelReasoningEfforts:** Per-model `reasoning.effort` sent to the Copilot Responses API. Allowed values are `none`, `minimal`, `low`, `medium`, `high`, and `xhigh`. If a model isn’t listed, `high` is used by default.
@@ -203,6 +207,22 @@ The following command line options are available for the `start` command:
 
 Edit this file to customize prompts or swap in your own fast model. Restart the server (or rerun the command) after changes so the cached config is refreshed.
 
+## API Authentication
+
+- **Protected routes:** All routes except `/` require authentication when `auth.apiKeys` is configured and non-empty.
+- **Allowed auth headers:**
+  - `x-api-key: <your_key>`
+  - `Authorization: Bearer <your_key>`
+- **CORS preflight:** `OPTIONS` requests are always allowed.
+- **When no keys are configured:** Server starts normally and allows requests (authentication disabled).
+
+Example request:
+
+```sh
+curl http://localhost:4141/v1/models \
+  -H "x-api-key: your_api_key"
+```
+
 ## API Endpoints
 
 The server exposes several endpoints to interact with the Copilot API. It provides OpenAI-compatible endpoints and now also includes support for Anthropic-compatible endpoints, allowing for greater flexibility with different tools and services.

package/dist/{config-BdFPeNSG.js → config-Cx3UwWih.js}

@@ -172,10 +172,31 @@ const gpt5ExplorationPrompt = `## Exploration and reading files
 - **multi_tool_use.parallel** Use multi_tool_use.parallel to parallelize tool calls and only this.
 - **Only make sequential calls if you truly cannot know the next file without seeing a result first.**
 - **Workflow:** (a) plan all needed reads → (b) issue one parallel batch → (c) analyze results → (d) repeat if new, unpredictable reads arise.`;
+const gpt5CommentaryPrompt = `# Working with the user
+
+You interact with the user through a terminal. You have 2 ways of communicating with the users:  
+- Share intermediary updates in \`commentary\` channel.  
+- After you have completed all your work, send a message to the \`final\` channel.  
+
+## Intermediary updates
+
+- Intermediary updates go to the \`commentary\` channel.
+- User updates are short updates while you are working, they are NOT final answers.
+- You use 1-2 sentence user updates to communicate progress and new information to the user as you are doing work.
+- Do not begin responses with conversational interjections or meta commentary. Avoid openers such as acknowledgements (“Done —”, “Got it”, “Great question, ”) or framing phrases.
+- You provide user updates frequently, every 20s.
+- Before exploring or doing substantial work, you start with a user update acknowledging the request and explaining your first step. You should include your understanding of the user request and explain what you will do. Avoid commenting on the request or using starters such as "Got it -" or "Understood -" etc.
+- When exploring, e.g. searching, reading files, you provide user updates as you go, every 20s, explaining what context you are gathering and what you've learned. Vary your sentence structure when providing these updates to avoid sounding repetitive - in particular, don't start each sentence the same way.
+- After you have sufficient context, and the work is substantial, you provide a longer plan (this is the only user update that may be longer than 2 sentences and can contain formatting).
+- Before performing file edits of any kind, you provide updates explaining what edits you are making.
+- As you are thinking, you very frequently provide updates even if not taking any actions, informing the user of your progress. You interrupt your thinking and send multiple updates in a row if thinking for more than 100 words.
+- Tone of your updates MUST match your personality.`;
 const defaultConfig = {
+	auth: { apiKeys: [] },
 	extraPrompts: {
 		"gpt-5-mini": gpt5ExplorationPrompt,
-		"gpt-5.1-codex-max": gpt5ExplorationPrompt
+		"gpt-5.1-codex-max": gpt5ExplorationPrompt,
+		"gpt-5.3-codex": gpt5CommentaryPrompt
 	},
 	smallModel: "gpt-5-mini",
 	modelReasoningEfforts: { "gpt-5-mini": "low" },
@@ -258,4 +279,4 @@ function shouldCompactUseSmallModel() {
 
 //#endregion
 export { GITHUB_API_BASE_URL, GITHUB_APP_SCOPES, GITHUB_BASE_URL, GITHUB_CLIENT_ID, HTTPError, PATHS, cacheModels, cacheVSCodeVersion, copilotBaseUrl, copilotHeaders, ensurePaths, forwardError, getConfig, getCopilotUsage, getExtraPromptForModel, getReasoningEffortForModel, getSmallModel, githubHeaders, isNullish, mergeConfigWithDefaults, shouldCompactUseSmallModel, sleep, standardHeaders, state };
-//# sourceMappingURL=config-BdFPeNSG.js.map
+//# sourceMappingURL=config-Cx3UwWih.js.map

package/dist/config-Cx3UwWih.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-Cx3UwWih.js","names":["state: State","state","headers: Record<string, string>","errorJson: unknown","defaultConfig: AppConfig","cachedConfig: AppConfig | null","fs"],"sources":["../src/lib/paths.ts","../src/lib/state.ts","../src/lib/api-config.ts","../src/lib/error.ts","../src/services/copilot/get-models.ts","../src/services/get-vscode-version.ts","../src/lib/utils.ts","../src/services/github/get-copilot-usage.ts","../src/lib/config.ts"],"sourcesContent":["import fs from \"node:fs/promises\"\nimport os from \"node:os\"\nimport path from \"node:path\"\n\nconst APP_DIR = path.join(os.homedir(), \".local\", \"share\", \"copilot-api\")\n\nconst GITHUB_TOKEN_PATH = path.join(APP_DIR, \"github_token\")\nconst CONFIG_PATH = path.join(APP_DIR, \"config.json\")\n\nexport const PATHS = {\n  APP_DIR,\n  GITHUB_TOKEN_PATH,\n  CONFIG_PATH,\n}\n\nexport async function ensurePaths(): Promise<void> {\n  await fs.mkdir(PATHS.APP_DIR, { recursive: true })\n  await ensureFile(PATHS.GITHUB_TOKEN_PATH)\n  await ensureFile(PATHS.CONFIG_PATH)\n}\n\nasync function ensureFile(filePath: string): Promise<void> {\n  try {\n    await fs.access(filePath, fs.constants.W_OK)\n  } catch {\n    await fs.writeFile(filePath, \"\")\n    await fs.chmod(filePath, 0o600)\n  }\n}\n","import type { ModelsResponse } from \"~/services/copilot/get-models\"\n\nexport interface State {\n  githubToken?: string\n  copilotToken?: string\n\n  accountType: string\n  models?: ModelsResponse\n  vsCodeVersion?: string\n\n  manualApprove: boolean\n  rateLimitWait: boolean\n  showToken: boolean\n\n  // Rate limiting configuration\n  rateLimitSeconds?: number\n  lastRequestTimestamp?: number\n  verbose: boolean\n}\n\nexport const state: State = {\n  accountType: \"individual\",\n  manualApprove: false,\n  rateLimitWait: false,\n  showToken: false,\n  verbose: false,\n}\n","import { randomUUID } from \"node:crypto\"\n\nimport type { State } from \"./state\"\n\nexport const standardHeaders = () => ({\n  \"content-type\": \"application/json\",\n  accept: \"application/json\",\n})\n\nconst COPILOT_VERSION = \"0.37.4\"\nconst EDITOR_PLUGIN_VERSION = `copilot-chat/${COPILOT_VERSION}`\nconst USER_AGENT = `GitHubCopilotChat/${COPILOT_VERSION}`\n\nconst API_VERSION = \"2025-10-01\"\n\nexport const copilotBaseUrl = (state: State) =>\n  state.accountType === \"individual\" ?\n    \"https://api.githubcopilot.com\"\n  : `https://api.${state.accountType}.githubcopilot.com`\nexport const copilotHeaders = (state: State, vision: boolean = false) => {\n  const headers: Record<string, string> = {\n    Authorization: `Bearer ${state.copilotToken}`,\n    \"content-type\": standardHeaders()[\"content-type\"],\n    \"copilot-integration-id\": \"vscode-chat\",\n    \"editor-version\": `vscode/${state.vsCodeVersion}`,\n    \"editor-plugin-version\": EDITOR_PLUGIN_VERSION,\n    \"user-agent\": USER_AGENT,\n    \"openai-intent\": \"conversation-agent\",\n    \"x-github-api-version\": API_VERSION,\n    \"x-request-id\": randomUUID(),\n    \"x-vscode-user-agent-library-version\": \"electron-fetch\",\n  }\n\n  if (vision) headers[\"copilot-vision-request\"] = \"true\"\n\n  return headers\n}\n\nexport const GITHUB_API_BASE_URL = \"https://api.github.com\"\nexport const githubHeaders = (state: State) => ({\n  ...standardHeaders(),\n  authorization: `token ${state.githubToken}`,\n  \"editor-version\": `vscode/${state.vsCodeVersion}`,\n  \"editor-plugin-version\": EDITOR_PLUGIN_VERSION,\n  \"user-agent\": USER_AGENT,\n  \"x-github-api-version\": API_VERSION,\n  \"x-vscode-user-agent-library-version\": \"electron-fetch\",\n})\n\nexport const GITHUB_BASE_URL = \"https://github.com\"\nexport const GITHUB_CLIENT_ID = \"Iv1.b507a08c87ecfe98\"\nexport const GITHUB_APP_SCOPES = [\"read:user\"].join(\" \")\n","import type { Context } from \"hono\"\nimport type { ContentfulStatusCode } from \"hono/utils/http-status\"\n\nimport consola from \"consola\"\n\nexport class HTTPError extends Error {\n  response: Response\n\n  constructor(message: string, response: Response) {\n    super(message)\n    this.response = response\n  }\n}\n\nexport async function forwardError(c: Context, error: unknown) {\n  consola.error(\"Error occurred:\", error)\n\n  if (error instanceof HTTPError) {\n    const errorText = await error.response.text()\n    let errorJson: unknown\n    try {\n      errorJson = JSON.parse(errorText)\n    } catch {\n      errorJson = errorText\n    }\n    consola.error(\"HTTP error:\", errorJson)\n    return c.json(\n      {\n        error: {\n          message: errorText,\n          type: \"error\",\n        },\n      },\n      error.response.status as ContentfulStatusCode,\n    )\n  }\n\n  return c.json(\n    {\n      error: {\n        message: (error as Error).message,\n        type: \"error\",\n      },\n    },\n    500,\n  )\n}\n","import { copilotBaseUrl, copilotHeaders } from \"~/lib/api-config\"\nimport { HTTPError } from \"~/lib/error\"\nimport { state } from \"~/lib/state\"\n\nexport const getModels = async () => {\n  const response = await fetch(`${copilotBaseUrl(state)}/models`, {\n    headers: copilotHeaders(state),\n  })\n\n  if (!response.ok) throw new HTTPError(\"Failed to get models\", response)\n\n  return (await response.json()) as ModelsResponse\n}\n\nexport interface ModelsResponse {\n  data: Array<Model>\n  object: string\n}\n\ninterface ModelLimits {\n  max_context_window_tokens?: number\n  max_output_tokens?: number\n  max_prompt_tokens?: number\n  max_inputs?: number\n}\n\ninterface ModelSupports {\n  max_thinking_budget?: number\n  min_thinking_budget?: number\n  tool_calls?: boolean\n  parallel_tool_calls?: boolean\n  dimensions?: boolean\n  streaming?: boolean\n  structured_outputs?: boolean\n  vision?: boolean\n  adaptive_thinking?: boolean\n}\n\ninterface ModelCapabilities {\n  family: string\n  limits: ModelLimits\n  object: string\n  supports: ModelSupports\n  tokenizer: string\n  type: string\n}\n\nexport interface Model {\n  capabilities: ModelCapabilities\n  id: string\n  model_picker_enabled: boolean\n  name: string\n  object: string\n  preview: boolean\n  vendor: string\n  version: string\n  policy?: {\n    state: string\n    terms: string\n  }\n  supported_endpoints?: Array<string>\n}\n","const FALLBACK = \"1.109.2\"\n\nexport async function getVSCodeVersion() {\n  const controller = new AbortController()\n  const timeout = setTimeout(() => {\n    controller.abort()\n  }, 5000)\n\n  try {\n    const response = await fetch(\n      \"https://aur.archlinux.org/cgit/aur.git/plain/PKGBUILD?h=visual-studio-code-bin\",\n      {\n        signal: controller.signal,\n      },\n    )\n\n    const pkgbuild = await response.text()\n    const pkgverRegex = /pkgver=([0-9.]+)/\n    const match = pkgbuild.match(pkgverRegex)\n\n    if (match) {\n      if (match[1] === \"1.109.0\") {\n        return FALLBACK\n      }\n      return match[1]\n    }\n\n    return FALLBACK\n  } catch {\n    return FALLBACK\n  } finally {\n    clearTimeout(timeout)\n  }\n}\n\nawait getVSCodeVersion()\n","import consola from \"consola\"\n\nimport { getModels } from \"~/services/copilot/get-models\"\nimport { getVSCodeVersion } from \"~/services/get-vscode-version\"\n\nimport { state } from \"./state\"\n\nexport const sleep = (ms: number) =>\n  new Promise((resolve) => {\n    setTimeout(resolve, ms)\n  })\n\nexport const isNullish = (value: unknown): value is null | undefined =>\n  value === null || value === undefined\n\nexport async function cacheModels(): Promise<void> {\n  const models = await getModels()\n  state.models = models\n}\n\nexport const cacheVSCodeVersion = async () => {\n  const response = await getVSCodeVersion()\n  state.vsCodeVersion = response\n\n  consola.info(`Using VSCode version: ${response}`)\n}\n","import { GITHUB_API_BASE_URL, githubHeaders } from \"~/lib/api-config\"\nimport { HTTPError } from \"~/lib/error\"\nimport { state } from \"~/lib/state\"\n\nexport const getCopilotUsage = async (): Promise<CopilotUsageResponse> => {\n  const response = await fetch(`${GITHUB_API_BASE_URL}/copilot_internal/user`, {\n    headers: githubHeaders(state),\n  })\n\n  if (!response.ok) {\n    throw new HTTPError(\"Failed to get Copilot usage\", response)\n  }\n\n  return (await response.json()) as CopilotUsageResponse\n}\n\nexport interface QuotaDetail {\n  entitlement: number\n  overage_count: number\n  overage_permitted: boolean\n  percent_remaining: number\n  quota_id: string\n  quota_remaining: number\n  remaining: number\n  unlimited: boolean\n}\n\ninterface QuotaSnapshots {\n  chat: QuotaDetail\n  completions: QuotaDetail\n  premium_interactions: QuotaDetail\n}\n\ninterface CopilotUsageResponse {\n  access_type_sku: string\n  analytics_tracking_id: string\n  assigned_date: string\n  can_signup_for_limited: boolean\n  chat_enabled: boolean\n  copilot_plan: string\n  organization_login_list: Array<unknown>\n  organization_list: Array<unknown>\n  quota_reset_date: string\n  quota_snapshots: QuotaSnapshots\n}\n","import consola from \"consola\"\nimport fs from \"node:fs\"\n\nimport { PATHS } from \"./paths\"\n\nexport interface AppConfig {\n  auth?: {\n    apiKeys?: Array<string>\n  }\n  extraPrompts?: Record<string, string>\n  smallModel?: string\n  modelReasoningEfforts?: Record<\n    string,\n    \"none\" | \"minimal\" | \"low\" | \"medium\" | \"high\" | \"xhigh\"\n  >\n  useFunctionApplyPatch?: boolean\n  compactUseSmallModel?: boolean\n}\n\nconst gpt5ExplorationPrompt = `## Exploration and reading files\n- **Think first.** Before any tool call, decide ALL files/resources you will need.\n- **Batch everything.** If you need multiple files (even from different places), read them together.\n- **multi_tool_use.parallel** Use multi_tool_use.parallel to parallelize tool calls and only this.\n- **Only make sequential calls if you truly cannot know the next file without seeing a result first.**\n- **Workflow:** (a) plan all needed reads → (b) issue one parallel batch → (c) analyze results → (d) repeat if new, unpredictable reads arise.`\n\nconst gpt5CommentaryPrompt = `# Working with the user\n\nYou interact with the user through a terminal. You have 2 ways of communicating with the users:  \n- Share intermediary updates in \\`commentary\\` channel.  \n- After you have completed all your work, send a message to the \\`final\\` channel.  \n\n## Intermediary updates\n\n- Intermediary updates go to the \\`commentary\\` channel.\n- User updates are short updates while you are working, they are NOT final answers.\n- You use 1-2 sentence user updates to communicate progress and new information to the user as you are doing work.\n- Do not begin responses with conversational interjections or meta commentary. Avoid openers such as acknowledgements (“Done —”, “Got it”, “Great question, ”) or framing phrases.\n- You provide user updates frequently, every 20s.\n- Before exploring or doing substantial work, you start with a user update acknowledging the request and explaining your first step. You should include your understanding of the user request and explain what you will do. Avoid commenting on the request or using starters such as \"Got it -\" or \"Understood -\" etc.\n- When exploring, e.g. searching, reading files, you provide user updates as you go, every 20s, explaining what context you are gathering and what you've learned. Vary your sentence structure when providing these updates to avoid sounding repetitive - in particular, don't start each sentence the same way.\n- After you have sufficient context, and the work is substantial, you provide a longer plan (this is the only user update that may be longer than 2 sentences and can contain formatting).\n- Before performing file edits of any kind, you provide updates explaining what edits you are making.\n- As you are thinking, you very frequently provide updates even if not taking any actions, informing the user of your progress. You interrupt your thinking and send multiple updates in a row if thinking for more than 100 words.\n- Tone of your updates MUST match your personality.`\n\nconst defaultConfig: AppConfig = {\n  auth: {\n    apiKeys: [],\n  },\n  extraPrompts: {\n    \"gpt-5-mini\": gpt5ExplorationPrompt,\n    \"gpt-5.1-codex-max\": gpt5ExplorationPrompt,\n    \"gpt-5.3-codex\": gpt5CommentaryPrompt,\n  },\n  smallModel: \"gpt-5-mini\",\n  modelReasoningEfforts: {\n    \"gpt-5-mini\": \"low\",\n  },\n  useFunctionApplyPatch: true,\n  compactUseSmallModel: true,\n}\n\nlet cachedConfig: AppConfig | null = null\n\nfunction ensureConfigFile(): void {\n  try {\n    fs.accessSync(PATHS.CONFIG_PATH, fs.constants.R_OK | fs.constants.W_OK)\n  } catch {\n    fs.mkdirSync(PATHS.APP_DIR, { recursive: true })\n    fs.writeFileSync(\n      PATHS.CONFIG_PATH,\n      `${JSON.stringify(defaultConfig, null, 2)}\\n`,\n      \"utf8\",\n    )\n    try {\n      fs.chmodSync(PATHS.CONFIG_PATH, 0o600)\n    } catch {\n      return\n    }\n  }\n}\n\nfunction readConfigFromDisk(): AppConfig {\n  ensureConfigFile()\n  try {\n    const raw = fs.readFileSync(PATHS.CONFIG_PATH, \"utf8\")\n    if (!raw.trim()) {\n      fs.writeFileSync(\n        PATHS.CONFIG_PATH,\n        `${JSON.stringify(defaultConfig, null, 2)}\\n`,\n        \"utf8\",\n      )\n      return defaultConfig\n    }\n    return JSON.parse(raw) as AppConfig\n  } catch (error) {\n    consola.error(\"Failed to read config file, using default config\", error)\n    return defaultConfig\n  }\n}\n\nfunction mergeDefaultExtraPrompts(config: AppConfig): {\n  mergedConfig: AppConfig\n  changed: boolean\n} {\n  const extraPrompts = config.extraPrompts ?? {}\n  const defaultExtraPrompts = defaultConfig.extraPrompts ?? {}\n\n  const missingExtraPromptModels = Object.keys(defaultExtraPrompts).filter(\n    (model) => !Object.hasOwn(extraPrompts, model),\n  )\n\n  if (missingExtraPromptModels.length === 0) {\n    return { mergedConfig: config, changed: false }\n  }\n\n  return {\n    mergedConfig: {\n      ...config,\n      extraPrompts: {\n        ...defaultExtraPrompts,\n        ...extraPrompts,\n      },\n    },\n    changed: true,\n  }\n}\n\nexport function mergeConfigWithDefaults(): AppConfig {\n  const config = readConfigFromDisk()\n  const { mergedConfig, changed } = mergeDefaultExtraPrompts(config)\n\n  if (changed) {\n    try {\n      fs.writeFileSync(\n        PATHS.CONFIG_PATH,\n        `${JSON.stringify(mergedConfig, null, 2)}\\n`,\n        \"utf8\",\n      )\n    } catch (writeError) {\n      consola.warn(\n        \"Failed to write merged extraPrompts to config file\",\n        writeError,\n      )\n    }\n  }\n\n  cachedConfig = mergedConfig\n  return mergedConfig\n}\n\nexport function getConfig(): AppConfig {\n  cachedConfig ??= readConfigFromDisk()\n  return cachedConfig\n}\n\nexport function getExtraPromptForModel(model: string): string {\n  const config = getConfig()\n  return config.extraPrompts?.[model] ?? \"\"\n}\n\nexport function getSmallModel(): string {\n  const config = getConfig()\n  return config.smallModel ?? \"gpt-5-mini\"\n}\n\nexport function getReasoningEffortForModel(\n  model: string,\n): \"none\" | \"minimal\" | \"low\" | \"medium\" | \"high\" | \"xhigh\" {\n  const config = getConfig()\n  return config.modelReasoningEfforts?.[model] ?? \"high\"\n}\n\nexport function shouldCompactUseSmallModel(): boolean {\n  const config = getConfig()\n  return config.compactUseSmallModel ?? true\n}\n"],"mappings":";;;;;;;;AAIA,MAAM,UAAU,KAAK,KAAK,GAAG,SAAS,EAAE,UAAU,SAAS,cAAc;AAEzE,MAAM,oBAAoB,KAAK,KAAK,SAAS,eAAe;AAC5D,MAAM,cAAc,KAAK,KAAK,SAAS,cAAc;AAErD,MAAa,QAAQ;CACnB;CACA;CACA;CACD;AAED,eAAsB,cAA6B;AACjD,OAAM,GAAG,MAAM,MAAM,SAAS,EAAE,WAAW,MAAM,CAAC;AAClD,OAAM,WAAW,MAAM,kBAAkB;AACzC,OAAM,WAAW,MAAM,YAAY;;AAGrC,eAAe,WAAW,UAAiC;AACzD,KAAI;AACF,QAAM,GAAG,OAAO,UAAU,GAAG,UAAU,KAAK;SACtC;AACN,QAAM,GAAG,UAAU,UAAU,GAAG;AAChC,QAAM,GAAG,MAAM,UAAU,IAAM;;;;;;ACNnC,MAAaA,QAAe;CAC1B,aAAa;CACb,eAAe;CACf,eAAe;CACf,WAAW;CACX,SAAS;CACV;;;;ACtBD,MAAa,yBAAyB;CACpC,gBAAgB;CAChB,QAAQ;CACT;AAED,MAAM,kBAAkB;AACxB,MAAM,wBAAwB,gBAAgB;AAC9C,MAAM,aAAa,qBAAqB;AAExC,MAAM,cAAc;AAEpB,MAAa,kBAAkB,YAC7BC,QAAM,gBAAgB,eACpB,kCACA,eAAeA,QAAM,YAAY;AACrC,MAAa,kBAAkB,SAAc,SAAkB,UAAU;CACvE,MAAMC,UAAkC;EACtC,eAAe,UAAUD,QAAM;EAC/B,gBAAgB,iBAAiB,CAAC;EAClC,0BAA0B;EAC1B,kBAAkB,UAAUA,QAAM;EAClC,yBAAyB;EACzB,cAAc;EACd,iBAAiB;EACjB,wBAAwB;EACxB,gBAAgB,YAAY;EAC5B,uCAAuC;EACxC;AAED,KAAI,OAAQ,SAAQ,4BAA4B;AAEhD,QAAO;;AAGT,MAAa,sBAAsB;AACnC,MAAa,iBAAiB,aAAkB;CAC9C,GAAG,iBAAiB;CACpB,eAAe,SAASA,QAAM;CAC9B,kBAAkB,UAAUA,QAAM;CAClC,yBAAyB;CACzB,cAAc;CACd,wBAAwB;CACxB,uCAAuC;CACxC;AAED,MAAa,kBAAkB;AAC/B,MAAa,mBAAmB;AAChC,MAAa,oBAAoB,CAAC,YAAY,CAAC,KAAK,IAAI;;;;AC9CxD,IAAa,YAAb,cAA+B,MAAM;CACnC;CAEA,YAAY,SAAiB,UAAoB;AAC/C,QAAM,QAAQ;AACd,OAAK,WAAW;;;AAIpB,eAAsB,aAAa,GAAY,OAAgB;AAC7D,SAAQ,MAAM,mBAAmB,MAAM;AAEvC,KAAI,iBAAiB,WAAW;EAC9B,MAAM,YAAY,MAAM,MAAM,SAAS,MAAM;EAC7C,IAAIE;AACJ,MAAI;AACF,eAAY,KAAK,MAAM,UAAU;UAC3B;AACN,eAAY;;AAEd,UAAQ,MAAM,eAAe,UAAU;AACvC,SAAO,EAAE,KACP,EACE,OAAO;GACL,SAAS;GACT,MAAM;GACP,EACF,EACD,MAAM,SAAS,OAChB;;AAGH,QAAO,EAAE,KACP,EACE,OAAO;EACL,SAAU,MAAgB;EAC1B,MAAM;EACP,EACF,EACD,IACD;;;;;ACzCH,MAAa,YAAY,YAAY;CACnC,MAAM,WAAW,MAAM,MAAM,GAAG,eAAe,MAAM,CAAC,UAAU,EAC9D,SAAS,eAAe,MAAM,EAC/B,CAAC;AAEF,KAAI,CAAC,SAAS,GAAI,OAAM,IAAI,UAAU,wBAAwB,SAAS;AAEvE,QAAQ,MAAM,SAAS,MAAM;;;;;ACX/B,MAAM,WAAW;AAEjB,eAAsB,mBAAmB;CACvC,MAAM,aAAa,IAAI,iBAAiB;CACxC,MAAM,UAAU,iBAAiB;AAC/B,aAAW,OAAO;IACjB,IAAK;AAER,KAAI;EAUF,MAAM,SAFW,OAPA,MAAM,MACrB,kFACA,EACE,QAAQ,WAAW,QACpB,CACF,EAE+B,MAAM,EAEf,MADH,mBACqB;AAEzC,MAAI,OAAO;AACT,OAAI,MAAM,OAAO,UACf,QAAO;AAET,UAAO,MAAM;;AAGf,SAAO;SACD;AACN,SAAO;WACC;AACR,eAAa,QAAQ;;;AAIzB,MAAM,kBAAkB;;;;AC5BxB,MAAa,SAAS,OACpB,IAAI,SAAS,YAAY;AACvB,YAAW,SAAS,GAAG;EACvB;AAEJ,MAAa,aAAa,UACxB,UAAU,QAAQ,UAAU;AAE9B,eAAsB,cAA6B;AAEjD,OAAM,SADS,MAAM,WAAW;;AAIlC,MAAa,qBAAqB,YAAY;CAC5C,MAAM,WAAW,MAAM,kBAAkB;AACzC,OAAM,gBAAgB;AAEtB,SAAQ,KAAK,yBAAyB,WAAW;;;;;ACpBnD,MAAa,kBAAkB,YAA2C;CACxE,MAAM,WAAW,MAAM,MAAM,GAAG,oBAAoB,yBAAyB,EAC3E,SAAS,cAAc,MAAM,EAC9B,CAAC;AAEF,KAAI,CAAC,SAAS,GACZ,OAAM,IAAI,UAAU,+BAA+B,SAAS;AAG9D,QAAQ,MAAM,SAAS,MAAM;;;;;ACM/B,MAAM,wBAAwB;;;;;;AAO9B,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;AAoB7B,MAAMC,gBAA2B;CAC/B,MAAM,EACJ,SAAS,EAAE,EACZ;CACD,cAAc;EACZ,cAAc;EACd,qBAAqB;EACrB,iBAAiB;EAClB;CACD,YAAY;CACZ,uBAAuB,EACrB,cAAc,OACf;CACD,uBAAuB;CACvB,sBAAsB;CACvB;AAED,IAAIC,eAAiC;AAErC,SAAS,mBAAyB;AAChC,KAAI;AACF,OAAG,WAAW,MAAM,aAAaC,KAAG,UAAU,OAAOA,KAAG,UAAU,KAAK;SACjE;AACN,OAAG,UAAU,MAAM,SAAS,EAAE,WAAW,MAAM,CAAC;AAChD,OAAG,cACD,MAAM,aACN,GAAG,KAAK,UAAU,eAAe,MAAM,EAAE,CAAC,KAC1C,OACD;AACD,MAAI;AACF,QAAG,UAAU,MAAM,aAAa,IAAM;UAChC;AACN;;;;AAKN,SAAS,qBAAgC;AACvC,mBAAkB;AAClB,KAAI;EACF,MAAM,MAAMA,KAAG,aAAa,MAAM,aAAa,OAAO;AACtD,MAAI,CAAC,IAAI,MAAM,EAAE;AACf,QAAG,cACD,MAAM,aACN,GAAG,KAAK,UAAU,eAAe,MAAM,EAAE,CAAC,KAC1C,OACD;AACD,UAAO;;AAET,SAAO,KAAK,MAAM,IAAI;UACf,OAAO;AACd,UAAQ,MAAM,oDAAoD,MAAM;AACxE,SAAO;;;AAIX,SAAS,yBAAyB,QAGhC;CACA,MAAM,eAAe,OAAO,gBAAgB,EAAE;CAC9C,MAAM,sBAAsB,cAAc,gBAAgB,EAAE;AAM5D,KAJiC,OAAO,KAAK,oBAAoB,CAAC,QAC/D,UAAU,CAAC,OAAO,OAAO,cAAc,MAAM,CAC/C,CAE4B,WAAW,EACtC,QAAO;EAAE,cAAc;EAAQ,SAAS;EAAO;AAGjD,QAAO;EACL,cAAc;GACZ,GAAG;GACH,cAAc;IACZ,GAAG;IACH,GAAG;IACJ;GACF;EACD,SAAS;EACV;;AAGH,SAAgB,0BAAqC;CACnD,MAAM,SAAS,oBAAoB;CACnC,MAAM,EAAE,cAAc,YAAY,yBAAyB,OAAO;AAElE,KAAI,QACF,KAAI;AACF,OAAG,cACD,MAAM,aACN,GAAG,KAAK,UAAU,cAAc,MAAM,EAAE,CAAC,KACzC,OACD;UACM,YAAY;AACnB,UAAQ,KACN,sDACA,WACD;;AAIL,gBAAe;AACf,QAAO;;AAGT,SAAgB,YAAuB;AACrC,kBAAiB,oBAAoB;AACrC,QAAO;;AAGT,SAAgB,uBAAuB,OAAuB;AAE5D,QADe,WAAW,CACZ,eAAe,UAAU;;AAGzC,SAAgB,gBAAwB;AAEtC,QADe,WAAW,CACZ,cAAc;;AAG9B,SAAgB,2BACd,OAC0D;AAE1D,QADe,WAAW,CACZ,wBAAwB,UAAU;;AAGlD,SAAgB,6BAAsC;AAEpD,QADe,WAAW,CACZ,wBAAwB"}

package/dist/main.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { GITHUB_API_BASE_URL, GITHUB_APP_SCOPES, GITHUB_BASE_URL, GITHUB_CLIENT_ID, HTTPError, PATHS, cacheModels, cacheVSCodeVersion, ensurePaths, getCopilotUsage, githubHeaders, mergeConfigWithDefaults, sleep, standardHeaders, state } from "./config-BdFPeNSG.js";
+import { GITHUB_API_BASE_URL, GITHUB_APP_SCOPES, GITHUB_BASE_URL, GITHUB_CLIENT_ID, HTTPError, PATHS, cacheModels, cacheVSCodeVersion, ensurePaths, getCopilotUsage, githubHeaders, mergeConfigWithDefaults, sleep, standardHeaders, state } from "./config-Cx3UwWih.js";
 import { defineCommand, runMain } from "citty";
 import consola from "consola";
 import fs from "node:fs/promises";
@@ -430,7 +430,7 @@ async function runServer(options) {
 		}
 	}
 	consola.box(`🌐 Usage Viewer: https://ericc-ch.github.io/copilot-api?endpoint=${serverUrl}/usage`);
-	const { server } = await import("./server-C_I3eJ38.js");
+	const { server } = await import("./server-DbxsVRo3.js");
 	serve({
 		fetch: server.fetch,
 		port: options.port,

package/dist/{server-C_I3eJ38.js → server-DbxsVRo3.js}

@@ -1,4 +1,4 @@
-import { HTTPError, PATHS, cacheModels, copilotBaseUrl, copilotHeaders, forwardError, getConfig, getCopilotUsage, getExtraPromptForModel, getReasoningEffortForModel, getSmallModel, isNullish, shouldCompactUseSmallModel, sleep, state } from "./config-BdFPeNSG.js";
+import { HTTPError, PATHS, cacheModels, copilotBaseUrl, copilotHeaders, forwardError, getConfig, getCopilotUsage, getExtraPromptForModel, getReasoningEffortForModel, getSmallModel, isNullish, shouldCompactUseSmallModel, sleep, state } from "./config-Cx3UwWih.js";
 import consola from "consola";
 import path from "node:path";
 import fs from "node:fs";
@@ -9,6 +9,52 @@ import { streamSSE } from "hono/streaming";
 import util from "node:util";
 import { events } from "fetch-event-stream";
 
+//#region src/lib/request-auth.ts
+function normalizeApiKeys(apiKeys) {
+	if (!Array.isArray(apiKeys)) {
+		if (apiKeys !== void 0) consola.warn("Invalid auth.apiKeys config. Expected an array of strings.");
+		return [];
+	}
+	const normalizedKeys = apiKeys.filter((key) => typeof key === "string").map((key) => key.trim()).filter((key) => key.length > 0);
+	if (normalizedKeys.length !== apiKeys.length) consola.warn("Invalid auth.apiKeys entries found. Only non-empty strings are allowed.");
+	return [...new Set(normalizedKeys)];
+}
+function getConfiguredApiKeys() {
+	const config = getConfig();
+	return normalizeApiKeys(config.auth?.apiKeys);
+}
+function extractRequestApiKey(c) {
+	const xApiKey = c.req.header("x-api-key")?.trim();
+	if (xApiKey) return xApiKey;
+	const authorization = c.req.header("authorization");
+	if (!authorization) return null;
+	const [scheme, ...rest] = authorization.trim().split(/\s+/);
+	if (scheme.toLowerCase() !== "bearer") return null;
+	return rest.join(" ").trim() || null;
+}
+function createUnauthorizedResponse(c) {
+	c.header("WWW-Authenticate", "Bearer realm=\"copilot-api\"");
+	return c.json({ error: {
+		message: "Unauthorized",
+		type: "authentication_error"
+	} }, 401);
+}
+function createAuthMiddleware(options = {}) {
+	const getApiKeys = options.getApiKeys ?? getConfiguredApiKeys;
+	const allowUnauthenticatedPaths = options.allowUnauthenticatedPaths ?? ["/"];
+	const allowOptionsBypass = options.allowOptionsBypass ?? true;
+	return async (c, next) => {
+		if (allowOptionsBypass && c.req.method === "OPTIONS") return next();
+		if (allowUnauthenticatedPaths.includes(c.req.path)) return next();
+		const apiKeys = getApiKeys();
+		if (apiKeys.length === 0) return next();
+		const requestApiKey = extractRequestApiKey(c);
+		if (!requestApiKey || !apiKeys.includes(requestApiKey)) return createUnauthorizedResponse(c);
+		return next();
+	};
+}
+
+//#endregion
 //#region src/lib/approval.ts
 const awaitApproval = async () => {
 	if (!await consola.prompt(`Accept incoming request?`, { type: "confirm" })) throw new HTTPError("Request rejected", Response.json({ message: "Request rejected" }, { status: 403 }));
@@ -782,10 +828,11 @@ const createResponses = async (payload, { vision, initiator }) => {
 //#endregion
 //#region src/routes/messages/responses-translation.ts
 const MESSAGE_TYPE = "message";
+const CODEX_PHASE_MODEL = "gpt-5.3-codex";
 const THINKING_TEXT$1 = "Thinking...";
 const translateAnthropicMessagesToResponsesPayload = (payload) => {
 	const input = [];
-	for (const message of payload.messages) input.push(...translateMessage(message));
+	for (const message of payload.messages) input.push(...translateMessage(message, payload.model));
 	const translatedTools = convertAnthropicTools(payload.tools);
 	const toolChoice = convertAnthropicToolChoice(payload.tool_choice);
 	const { safetyIdentifier, promptCacheKey } = parseUserId(payload.metadata?.user_id);
@@ -811,9 +858,9 @@ const translateAnthropicMessagesToResponsesPayload = (payload) => {
 		include: ["reasoning.encrypted_content"]
 	};
 };
-const translateMessage = (message) => {
+const translateMessage = (message, model) => {
 	if (message.role === "user") return translateUserMessage(message);
-	return translateAssistantMessage(message);
+	return translateAssistantMessage(message, model);
 };
 const translateUserMessage = (message) => {
 	if (typeof message.content === "string") return [createMessage("user", message.content)];
@@ -822,36 +869,46 @@ const translateUserMessage = (message) => {
 	const pendingContent = [];
 	for (const block of message.content) {
 		if (block.type === "tool_result") {
-			flushPendingContent("user", pendingContent, items);
+			flushPendingContent(pendingContent, items, { role: "user" });
 			items.push(createFunctionCallOutput(block));
 			continue;
 		}
 		const converted = translateUserContentBlock(block);
 		if (converted) pendingContent.push(converted);
 	}
-	flushPendingContent("user", pendingContent, items);
+	flushPendingContent(pendingContent, items, { role: "user" });
 	return items;
 };
-const translateAssistantMessage = (message) => {
-	if (typeof message.content === "string") return [createMessage("assistant", message.content)];
+const translateAssistantMessage = (message, model) => {
+	const assistantPhase = resolveAssistantPhase(model, message.content);
+	if (typeof message.content === "string") return [createMessage("assistant", message.content, assistantPhase)];
 	if (!Array.isArray(message.content)) return [];
 	const items = [];
 	const pendingContent = [];
 	for (const block of message.content) {
 		if (block.type === "tool_use") {
-			flushPendingContent("assistant", pendingContent, items);
+			flushPendingContent(pendingContent, items, {
+				role: "assistant",
+				phase: assistantPhase
+			});
 			items.push(createFunctionToolCall(block));
 			continue;
 		}
 		if (block.type === "thinking" && block.signature && block.signature.includes("@")) {
-			flushPendingContent("assistant", pendingContent, items);
+			flushPendingContent(pendingContent, items, {
+				role: "assistant",
+				phase: assistantPhase
+			});
 			items.push(createReasoningContent(block));
 			continue;
 		}
 		const converted = translateAssistantContentBlock(block);
 		if (converted) pendingContent.push(converted);
 	}
-	flushPendingContent("assistant", pendingContent, items);
+	flushPendingContent(pendingContent, items, {
+		role: "assistant",
+		phase: assistantPhase
+	});
 	return items;
 };
 const translateUserContentBlock = (block) => {
@@ -867,17 +924,26 @@ const translateAssistantContentBlock = (block) => {
 		default: return;
 	}
 };
-const flushPendingContent = (role, pendingContent, target) => {
+const flushPendingContent = (pendingContent, target, message) => {
 	if (pendingContent.length === 0) return;
 	const messageContent = [...pendingContent];
-	target.push(createMessage(role, messageContent));
+	target.push(createMessage(message.role, messageContent, message.phase));
 	pendingContent.length = 0;
 };
-const createMessage = (role, content) => ({
+const createMessage = (role, content, phase) => ({
 	type: MESSAGE_TYPE,
 	role,
-	content
+	content,
+	...role === "assistant" && phase ? { phase } : {}
 });
+const resolveAssistantPhase = (model, content) => {
+	if (!shouldApplyCodexPhase(model)) return;
+	if (typeof content === "string") return "final_answer";
+	if (!Array.isArray(content)) return;
+	if (!content.some((block) => block.type === "text")) return;
+	return content.some((block) => block.type === "tool_use") ? "commentary" : "final_answer";
+};
+const shouldApplyCodexPhase = (model) => model === CODEX_PHASE_MODEL;
 const createTextContent = (text) => ({
 	type: "input_text",
 	text
@@ -2252,6 +2318,7 @@ usageRoute.get("/", async (c) => {
 const server = new Hono();
 server.use(logger());
 server.use(cors());
+server.use("*", createAuthMiddleware());
 server.get("/", (c) => c.text("Server running"));
 server.route("/chat/completions", completionRoutes);
 server.route("/models", modelRoutes);
@@ -2267,4 +2334,4 @@ server.route("/v1/messages", messageRoutes);
 
 //#endregion
 export { server };
-//# sourceMappingURL=server-C_I3eJ38.js.map
+//# sourceMappingURL=server-DbxsVRo3.js.map