@minniexcode/codex-switch 0.1.4 → 0.2.0

package/dist/runtime/copilot-http-bridge-worker.js

@@ -0,0 +1,228 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const http = __importStar(require("node:http"));
+const https = __importStar(require("node:https"));
+const crypto = __importStar(require("node:crypto"));
+const copilot_token_1 = require("./copilot-token");
+let tokenManager = null;
+function logWorkerEvent(message) {
+    process.stderr.write(`[${new Date().toISOString()}] ${message}\n`);
+}
+async function main() {
+    const provider = process.env.CODEX_SWITCH_BRIDGE_PROVIDER ?? "copilot";
+    const host = process.env.CODEX_SWITCH_BRIDGE_HOST ?? "127.0.0.1";
+    const port = Number(process.env.CODEX_SWITCH_BRIDGE_PORT ?? "41415");
+    const localApiKey = process.env.CODEX_SWITCH_BRIDGE_API_KEY ?? "";
+    const toolHomeDir = process.env.CODEX_SWITCH_TOOL_HOME_DIR || undefined;
+    const staticCopilotToken = process.env.CODEX_SWITCH_BRIDGE_COPILOT_TOKEN || undefined;
+    logWorkerEvent(`worker startup provider=${provider} host=${host} port=${String(port)}`);
+    if (staticCopilotToken) {
+        tokenManager = (0, copilot_token_1.createStaticTokenManager)(staticCopilotToken);
+        logWorkerEvent("copilot token acquired (static), api base: https://api.githubcopilot.com");
+    }
+    else {
+        const githubPat = process.env.CODEX_SWITCH_GITHUB_TOKEN || (0, copilot_token_1.readGithubToken)(toolHomeDir);
+        if (!githubPat) {
+            throw new Error("No GitHub token found. Run `codexs login copilot` first.");
+        }
+        tokenManager = (0, copilot_token_1.createTokenManager)(githubPat);
+        await tokenManager.getToken();
+        logWorkerEvent(`copilot token acquired, api base: ${tokenManager.getApiBaseUrl()}`);
+    }
+    const server = http.createServer(async (req, res) => {
+        try {
+            await handleRequest(req, res, localApiKey);
+        }
+        catch (error) {
+            if (!res.headersSent) {
+                res.writeHead(500, { "content-type": "application/json" });
+                res.end(JSON.stringify({ error: { message: error instanceof Error ? error.message : String(error) } }));
+            }
+        }
+    });
+    const stopWorker = () => {
+        logWorkerEvent(`worker shutdown provider=${provider}`);
+        tokenManager?.stop();
+        server.close();
+        process.exit(0);
+    };
+    process.once("SIGINT", stopWorker);
+    process.once("SIGTERM", stopWorker);
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(port, host, () => {
+            server.off("error", reject);
+            resolve();
+        });
+    });
+    logWorkerEvent(`worker ready provider=${provider} host=${host} port=${String(port)}`);
+}
+async function handleRequest(req, res, localApiKey) {
+    const method = req.method ?? "GET";
+    const url = req.url ?? "/";
+    if (method === "GET" && url === "/healthz") {
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: true }));
+        return;
+    }
+    if (!isAuthorized(req, localApiKey)) {
+        res.writeHead(401, { "content-type": "application/json" });
+        res.end(JSON.stringify({ error: { message: "Unauthorized" } }));
+        return;
+    }
+    if (method === "GET" && url === "/v1/models") {
+        await proxyGet("/models", res);
+        return;
+    }
+    if (method === "POST" && url === "/v1/chat/completions") {
+        await proxyPost("/chat/completions", req, res);
+        return;
+    }
+    if (method === "POST" && url === "/v1/responses") {
+        await proxyPost("/responses", req, res);
+        return;
+    }
+    res.writeHead(404, { "content-type": "application/json" });
+    res.end(JSON.stringify({ error: { message: "Not found" } }));
+}
+async function proxyGet(upstreamPath, res) {
+    const copilotToken = await tokenManager.getToken();
+    const apiBase = tokenManager.getApiBaseUrl();
+    const targetUrl = new URL(upstreamPath, apiBase);
+    const headers = (0, copilot_token_1.getCopilotRequestHeaders)(copilotToken);
+    const upstreamRes = await httpsRequest({
+        method: "GET",
+        url: targetUrl,
+        headers,
+    });
+    res.writeHead(upstreamRes.statusCode, filterResponseHeaders(upstreamRes.headers));
+    upstreamRes.pipe(res);
+}
+async function proxyPost(upstreamPath, req, res) {
+    const body = await readRequestBody(req);
+    const copilotToken = await tokenManager.getToken();
+    const apiBase = tokenManager.getApiBaseUrl();
+    const targetUrl = new URL(upstreamPath, apiBase);
+    const requestId = crypto.randomUUID();
+    const headers = (0, copilot_token_1.getCopilotRequestHeaders)(copilotToken, requestId);
+    // Preserve content-length for the body
+    headers["content-length"] = Buffer.byteLength(body).toString();
+    const upstreamRes = await httpsRequest({
+        method: "POST",
+        url: targetUrl,
+        headers,
+        body,
+    });
+    // If upstream returned 401, try refreshing token once and retry
+    if (upstreamRes.statusCode === 401) {
+        upstreamRes.resume();
+        logWorkerEvent("upstream 401, invalidating token and retrying");
+        tokenManager.invalidate();
+        const freshToken = await tokenManager.getToken();
+        const retryHeaders = (0, copilot_token_1.getCopilotRequestHeaders)(freshToken, crypto.randomUUID());
+        retryHeaders["content-length"] = Buffer.byteLength(body).toString();
+        const retryRes = await httpsRequest({
+            method: "POST",
+            url: targetUrl,
+            headers: retryHeaders,
+            body,
+        });
+        res.writeHead(retryRes.statusCode, filterResponseHeaders(retryRes.headers));
+        retryRes.pipe(res);
+        return;
+    }
+    res.writeHead(upstreamRes.statusCode, filterResponseHeaders(upstreamRes.headers));
+    upstreamRes.pipe(res);
+}
+function httpsRequest(args) {
+    return new Promise((resolve, reject) => {
+        const req = https.request({
+            hostname: args.url.hostname,
+            port: args.url.port || 443,
+            path: args.url.pathname + args.url.search,
+            method: args.method,
+            headers: args.headers,
+        }, (res) => {
+            resolve(res);
+        });
+        req.on("error", reject);
+        if (args.body) {
+            req.write(args.body);
+        }
+        req.end();
+    });
+}
+function readRequestBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        req.on("data", (chunk) => chunks.push(chunk));
+        req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+        req.on("error", reject);
+    });
+}
+function filterResponseHeaders(headers) {
+    const filtered = {};
+    const passthrough = ["content-type", "transfer-encoding", "x-request-id"];
+    for (const key of passthrough) {
+        if (headers[key]) {
+            filtered[key] = headers[key];
+        }
+    }
+    // Always allow cache-control for SSE
+    if (headers["cache-control"]) {
+        filtered["cache-control"] = headers["cache-control"];
+    }
+    return filtered;
+}
+function isAuthorized(req, expectedApiKey) {
+    const authorization = req.headers.authorization;
+    if (!authorization || !authorization.startsWith("Bearer ")) {
+        return false;
+    }
+    return authorization.slice("Bearer ".length) === expectedApiKey;
+}
+if (require.main === module) {
+    process.on("uncaughtException", (error) => {
+        logWorkerEvent(`worker uncaught exception: ${error.message}`);
+    });
+    process.on("unhandledRejection", (reason) => {
+        logWorkerEvent(`worker unhandled rejection: ${reason instanceof Error ? reason.message : String(reason)}`);
+    });
+    void main().catch((error) => {
+        logWorkerEvent(`worker startup failure: ${error instanceof Error ? error.message : String(error)}`);
+        process.exit(1);
+    });
+}

package/dist/runtime/copilot-token.js

@@ -0,0 +1,294 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setCopilotTokenExchangeImplementation = setCopilotTokenExchangeImplementation;
+exports.resetCopilotTokenExchangeImplementation = resetCopilotTokenExchangeImplementation;
+exports.getCopilotRequestHeaders = getCopilotRequestHeaders;
+exports.getGithubTokenPath = getGithubTokenPath;
+exports.readGithubToken = readGithubToken;
+exports.writeGithubToken = writeGithubToken;
+exports.startDeviceFlow = startDeviceFlow;
+exports.pollDeviceFlowToken = pollDeviceFlowToken;
+exports.exchangeForCopilotToken = exchangeForCopilotToken;
+exports.createTokenManager = createTokenManager;
+exports.createStaticTokenManager = createStaticTokenManager;
+const https = __importStar(require("node:https"));
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const crypto = __importStar(require("node:crypto"));
+const codex_paths_1 = require("../storage/codex-paths");
+const errors_1 = require("../domain/errors");
+const GITHUB_OAUTH_CLIENT_ID = "Iv1.b507a08c87ecfe98";
+const GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
+const GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
+const COPILOT_TOKEN_URL = "https://api.github.com/copilot_internal/v2/token";
+const EDITOR_VERSION = "vscode/1.100.0";
+const COPILOT_CHAT_VERSION = "copilot-chat/0.30.0";
+const USER_AGENT = "GitHubCopilotChat/0.30.0";
+let exchangeImplementation = null;
+function setCopilotTokenExchangeImplementation(impl) {
+    exchangeImplementation = impl;
+}
+function resetCopilotTokenExchangeImplementation() {
+    exchangeImplementation = null;
+}
+const SESSION_ID = crypto.randomUUID();
+const MACHINE_ID = crypto.randomBytes(32).toString("hex");
+function getCopilotRequestHeaders(copilotToken, requestId) {
+    return {
+        "authorization": `Bearer ${copilotToken}`,
+        "content-type": "application/json",
+        "copilot-integration-id": "vscode-chat",
+        "editor-version": EDITOR_VERSION,
+        "editor-plugin-version": COPILOT_CHAT_VERSION,
+        "user-agent": USER_AGENT,
+        "openai-intent": "conversation-panel",
+        "x-interaction-type": "conversation-panel",
+        "x-github-api-version": "2026-01-09",
+        "x-request-id": requestId ?? crypto.randomUUID(),
+        "vscode-sessionid": SESSION_ID,
+        "vscode-machineid": MACHINE_ID,
+    };
+}
+function getGithubTokenPath(toolHomeDir) {
+    const home = (0, codex_paths_1.resolveCodexSwitchHome)(toolHomeDir);
+    return path.join(home, "github-token");
+}
+function readGithubToken(toolHomeDir) {
+    const tokenPath = getGithubTokenPath(toolHomeDir);
+    if (!fs.existsSync(tokenPath)) {
+        return null;
+    }
+    return fs.readFileSync(tokenPath, "utf8").trim();
+}
+function writeGithubToken(token, toolHomeDir) {
+    const tokenPath = getGithubTokenPath(toolHomeDir);
+    fs.mkdirSync(path.dirname(tokenPath), { recursive: true });
+    fs.writeFileSync(tokenPath, token, "utf8");
+}
+async function startDeviceFlow() {
+    const body = `client_id=${GITHUB_OAUTH_CLIENT_ID}&scope=read:user`;
+    const response = await httpsPost(GITHUB_DEVICE_CODE_URL, body, {
+        "content-type": "application/x-www-form-urlencoded",
+        "accept": "application/json",
+    });
+    if (!response.ok) {
+        throw (0, errors_1.cliError)("GITHUB_DEVICE_FLOW_FAILED", `GitHub device flow initiation failed: ${response.status}`, {
+            status: response.status,
+            body: response.body,
+        });
+    }
+    const data = JSON.parse(response.body);
+    return {
+        userCode: String(data.user_code ?? ""),
+        verificationUri: String(data.verification_uri ?? "https://github.com/login/device"),
+        deviceCode: String(data.device_code ?? ""),
+        interval: Number(data.interval ?? 5),
+        expiresIn: Number(data.expires_in ?? 900),
+    };
+}
+async function pollDeviceFlowToken(deviceCode, interval, expiresIn) {
+    const deadline = Date.now() + expiresIn * 1000;
+    let pollInterval = interval;
+    while (Date.now() < deadline) {
+        await sleep(pollInterval * 1000);
+        const body = `client_id=${GITHUB_OAUTH_CLIENT_ID}&device_code=${deviceCode}&grant_type=urn:ietf:params:oauth:grant-type:device_code`;
+        const response = await httpsPost(GITHUB_ACCESS_TOKEN_URL, body, {
+            "content-type": "application/x-www-form-urlencoded",
+            "accept": "application/json",
+        });
+        if (!response.ok) {
+            continue;
+        }
+        const data = JSON.parse(response.body);
+        if (data.access_token && typeof data.access_token === "string") {
+            return data.access_token;
+        }
+        const error = String(data.error ?? "");
+        if (error === "authorization_pending") {
+            continue;
+        }
+        if (error === "slow_down") {
+            pollInterval += 5;
+            continue;
+        }
+        if (error === "expired_token" || error === "access_denied") {
+            throw (0, errors_1.cliError)("GITHUB_DEVICE_FLOW_FAILED", `GitHub device flow failed: ${error}`, { error });
+        }
+    }
+    throw (0, errors_1.cliError)("GITHUB_DEVICE_FLOW_FAILED", "GitHub device flow timed out waiting for user authorization.", {});
+}
+async function exchangeForCopilotToken(githubPat) {
+    if (exchangeImplementation) {
+        return exchangeImplementation(githubPat);
+    }
+    const response = await httpsGet(COPILOT_TOKEN_URL, {
+        "authorization": `token ${githubPat}`,
+        "content-type": "application/json",
+        "accept": "application/json",
+        "editor-version": EDITOR_VERSION,
+        "editor-plugin-version": COPILOT_CHAT_VERSION,
+        "user-agent": USER_AGENT,
+        "x-github-api-version": "2026-01-09",
+    });
+    if (!response.ok) {
+        if (response.status === 401) {
+            throw (0, errors_1.cliError)("COPILOT_AUTH_REQUIRED", "GitHub token is invalid or expired. Run `codexs login copilot` to re-authenticate.", {
+                status: response.status,
+            });
+        }
+        throw (0, errors_1.cliError)("COPILOT_TOKEN_EXCHANGE_FAILED", `Failed to exchange GitHub token for Copilot token: HTTP ${response.status}`, {
+            status: response.status,
+            body: response.body,
+        });
+    }
+    const data = JSON.parse(response.body);
+    const token = String(data.token ?? "");
+    if (!token) {
+        throw (0, errors_1.cliError)("COPILOT_TOKEN_EXCHANGE_FAILED", "Copilot token exchange returned empty token.", { data });
+    }
+    const endpoints = data.endpoints;
+    const apiBaseUrl = String(endpoints?.api ?? "https://api.githubcopilot.com");
+    return {
+        token,
+        expiresAt: Number(data.expires_at ?? Date.now() / 1000 + 1800),
+        apiBaseUrl: apiBaseUrl.replace(/\/$/, ""),
+        refreshIn: Number(data.refresh_in ?? 1500),
+    };
+}
+function createTokenManager(githubPat) {
+    let currentToken = null;
+    let refreshTimer = null;
+    let refreshing = null;
+    async function refresh() {
+        currentToken = await exchangeForCopilotToken(githubPat);
+        scheduleRefresh();
+    }
+    function scheduleRefresh() {
+        if (refreshTimer) {
+            clearTimeout(refreshTimer);
+        }
+        const delayMs = Math.max((currentToken.refreshIn - 60) * 1000, 30000);
+        refreshTimer = setTimeout(() => {
+            refreshing = refresh().catch(() => {
+                // retry after 30s on failure
+                refreshTimer = setTimeout(() => { refreshing = refresh(); }, 30000);
+            });
+        }, delayMs);
+        refreshTimer.unref();
+    }
+    return {
+        async getToken() {
+            if (!currentToken || Date.now() / 1000 >= currentToken.expiresAt - 60) {
+                if (!refreshing) {
+                    refreshing = refresh();
+                }
+                await refreshing;
+                refreshing = null;
+            }
+            return currentToken.token;
+        },
+        getApiBaseUrl() {
+            return currentToken?.apiBaseUrl ?? "https://api.githubcopilot.com";
+        },
+        invalidate() {
+            currentToken = null;
+        },
+        stop() {
+            if (refreshTimer) {
+                clearTimeout(refreshTimer);
+                refreshTimer = null;
+            }
+        },
+    };
+}
+function createStaticTokenManager(token) {
+    return {
+        async getToken() {
+            return token;
+        },
+        getApiBaseUrl() {
+            return "https://api.githubcopilot.com";
+        },
+        invalidate() { },
+        stop() { },
+    };
+}
+function httpsPost(url, body, headers) {
+    return new Promise((resolve, reject) => {
+        const parsed = new URL(url);
+        const req = https.request({
+            hostname: parsed.hostname,
+            port: parsed.port || 443,
+            path: parsed.pathname + parsed.search,
+            method: "POST",
+            headers: { ...headers, "content-length": Buffer.byteLength(body).toString() },
+        }, (res) => {
+            const chunks = [];
+            res.on("data", (chunk) => chunks.push(chunk));
+            res.on("end", () => {
+                const responseBody = Buffer.concat(chunks).toString("utf8");
+                resolve({ ok: res.statusCode >= 200 && res.statusCode < 300, status: res.statusCode, body: responseBody });
+            });
+        });
+        req.on("error", reject);
+        req.write(body);
+        req.end();
+    });
+}
+function httpsGet(url, headers) {
+    return new Promise((resolve, reject) => {
+        const parsed = new URL(url);
+        const req = https.request({
+            hostname: parsed.hostname,
+            port: parsed.port || 443,
+            path: parsed.pathname + parsed.search,
+            method: "GET",
+            headers,
+        }, (res) => {
+            const chunks = [];
+            res.on("data", (chunk) => chunks.push(chunk));
+            res.on("end", () => {
+                const responseBody = Buffer.concat(chunks).toString("utf8");
+                resolve({ ok: res.statusCode >= 200 && res.statusCode < 300, status: res.statusCode, body: responseBody });
+            });
+        });
+        req.on("error", reject);
+        req.end();
+    });
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}

package/docs/Design/codex-switch-v0.1.5-design.md

@@ -0,0 +1,17 @@
+# codex-switch v0.1.5 Design
+
+`0.1.5` is a Copilot Bridge process-visibility and redaction patch release.
+
+## Design Notes
+
+- `CopilotBridgeRuntimeEvent` is the stable internal boundary between Copilot SDK session events and the OpenAI-compatible bridge surface.
+- Copilot sessions are created with `streaming: true` and register the generic `session.on("event", handler)` listener alongside the existing `data`, `message`, and `delta` text compatibility listeners.
+- The adapter maps known SDK event names into bridge runtime events for assistant intent, assistant message deltas, assistant reasoning deltas, tool lifecycle, permission lifecycle, user-input requests, exit-plan-mode requests, session idle, and session errors.
+- `assistant.message_delta` is also forwarded as a normal text delta so final response streaming remains compatible with existing Chat Completions and Responses text paths.
+- The bridge worker forwards adapter runtime events through `onRuntimeEvent`, separate from `onTextDelta` and `onTextDone`.
+- Responses streaming projects non-text runtime process events as completed assistant message items with `phase: "commentary"`.
+- Reasoning deltas project as `response.reasoning_summary_part.added` followed by `response.reasoning_summary_text.delta`.
+- Unknown SDK events become `session.unknown`, are omitted from the UI projection path, and are logged with bounded summaries.
+- Unknown summaries redact sensitive key names and obvious token/API-key-like values before truncation.
+- Chat Completions streaming only wires text deltas, so Responses-only commentary events stay out of Chat Completions streams.
+- Internal Copilot tool lifecycle events remain process visibility signals only; they are not emitted as Codex/OpenAI function calls or tool calls.

package/docs/Design/codex-switch-v0.2.0-design.md

@@ -0,0 +1,56 @@
+# codex-switch v0.2.0 Design
+
+`0.2.0` is a major architecture release that replaces the Copilot SDK-based authentication and runtime model with a direct GitHub device-flow token exchange and HTTP proxy bridge.
+
+## Architecture Changes
+
+### Authentication: SDK-based to Device-Flow Token
+
+- The Copilot SDK (`@github/copilot-sdk`) is no longer required for authentication or session management.
+- Authentication is now handled via GitHub OAuth Device Flow (`login copilot`), which produces a GitHub personal access token stored at `<toolHomeDir>/github-token`.
+- The GitHub PAT is exchanged for a short-lived Copilot API token via `POST /copilot_internal/v2/token` before every bridge start or switch operation.
+- `TokenManager` handles background token refresh and expiry-aware caching with a new `invalidate()` method for forced refresh on upstream 401 responses.
+
+### Bridge: SDK Session to HTTP Proxy
+
+- The bridge worker (`copilot-http-bridge-worker.ts`) is now a pure HTTP reverse proxy between the local OpenAI-compatible surface and `api.githubcopilot.com`.
+- Copilot token lifecycle (exchange, refresh, invalidation) is managed inside the worker via `createTokenManager`.
+- On upstream 401, the worker invalidates its cached token and retries once with a freshly exchanged token.
+- A `createStaticTokenManager` variant supports test scenarios where the exchange should be bypassed (`CODEX_SWITCH_BRIDGE_COPILOT_TOKEN` env var).
+
+### Path Resolution: toolHomeDir Propagation
+
+- `toolHomeDir` is now explicitly threaded through all functions that read the GitHub token: `switchProvider`, `startBridge`, `getStatus`, `runDoctor`, and the bridge worker spawn.
+- The bridge worker receives the correct `toolHomeDir` (not `runtimeDir`) via `CODEX_SWITCH_TOOL_HOME_DIR`, ensuring the token is found at `<toolHomeDir>/github-token` rather than a nested runtime subdirectory.
+- `readGithubToken(toolHomeDir?)` resolves the home directory in a consistent order: explicit arg, `CODEXS_HOME` env var, then `~/.config/codex-switch`.
+
+### Provider Runtime Kind
+
+- New providers created via `add --copilot` now use `kind: "copilot-http-proxy"` instead of `kind: "copilot-sdk-bridge"`.
+- Both kinds are accepted by `isCopilotBridgeProvider` for backward compatibility with existing provider files.
+- The distinction is cosmetic; both route through the same HTTP bridge worker.
+
+### Status Contract
+
+- `getStatus` output `copilotSdk` field is simplified to `{ installed: boolean, source: string }` reflecting the presence of a GitHub token rather than an SDK install.
+- `copilotAuth` reflects the token exchange readiness rather than SDK session health.
+- Legacy fields (`installDir`, `packageName`, `packageVersion`) are removed from the status contract.
+
+## Test Infrastructure
+
+- `setCopilotTokenExchangeImplementation` / `resetCopilotTokenExchangeImplementation` provide an in-process mock for the Copilot token exchange, enabling offline test execution.
+- The bridge worker supports `CODEX_SWITCH_BRIDGE_COPILOT_TOKEN` env var to skip the real exchange in spawned child processes during tests.
+- Integration tests that previously relied on fake SDK mock responses now verify state and configuration correctness without making HTTP requests through the bridge (bridge request handling is covered by `copilot-bridge-contract.spec.js`).
+
+## Breaking Changes
+
+- `copilotSdk` status output no longer includes `installDir`, `packageName`, or `packageVersion`.
+- Provider `runtimeKind` for newly-created Copilot providers is `"copilot-http-proxy"` instead of `"copilot-sdk-bridge"`.
+- `switchProvider` requires `toolHomeDir` to be passed explicitly when operating outside the default env-var-resolved home.
+- The Copilot SDK (`@github/copilot-sdk`) is no longer a runtime dependency for authentication flows.
+
+## Non-Goals
+
+- The Copilot SDK is not removed from the repository; existing workflows that depend on it for non-auth purposes remain unchanged.
+- No migration of existing `copilot-sdk-bridge` provider records to `copilot-http-proxy`; both are accepted.
+- No changes to direct (non-Copilot) provider workflows.

package/docs/PRD/codex-switch-prd-v0.1.5.md

@@ -0,0 +1,42 @@
+# codex-switch v0.1.5 PRD
+
+## Version
+
+- Version line: `0.1.5`
+- Target repository package version: `0.1.5`
+
+## Summary
+
+`0.1.5` is a Copilot Bridge process-visibility and redaction patch release. It surfaces assistant progress, reasoning summaries, tool lifecycle, permission, user-input, and exit-plan-mode signals through the existing bridge stream while keeping the provider command surface unchanged.
+
+## Required Outcome
+
+- Copilot SDK streaming sessions must subscribe to the generic session event channel and preserve existing text-delta compatibility listeners.
+- Known SDK process events must map into a stable bridge runtime-event contract instead of leaking SDK-specific shapes.
+- Responses streaming must surface process/status updates as commentary items and reasoning/progress updates as reasoning summary events.
+- Chat Completions streaming must continue to receive text only and must not receive Responses-only commentary events.
+- Unknown SDK events must be ignored by the UI projection path while logging bounded, redacted summaries for diagnostics.
+- Adapter-level tests must cover raw SDK session event normalization, not only bridge-server projection of already-normalized events.
+
+## Release Scope
+
+- Copilot adapter runtime event contract and SDK event normalization.
+- Bridge worker forwarding of adapter runtime events into request handlers.
+- Responses streaming projection for commentary and reasoning summary events.
+- Unknown-event truncation and redaction hardening.
+- Focused regression coverage for raw SDK event mapping and bridge stream projection.
+
+## Non-Goals
+
+- No new provider families.
+- No migration or backward-compatibility shims.
+- No expansion of direct-provider workflows.
+- No conversion of internal Copilot tool lifecycle events into Codex/OpenAI function-call or tool-call payloads.
+
+## Release Acceptance
+
+- `npm test` passes with adapter-level raw event normalization coverage.
+- Responses streaming includes commentary and reasoning summary process events.
+- Final assistant text still streams normally.
+- Unknown events are redacted, truncated, logged for diagnostics, and ignored by the UI projection path.
+- Chat Completions streaming does not emit Responses-only commentary events.

package/docs/Tests/testing.md

@@ -2,7 +2,7 @@
 
 This guide records the current `0.1.x` verification contract for release and review work.
 
-The current repository line is `0.1.4` and remains an unreleased development line until an explicit release task says otherwise.
+The current repository line is `0.1.5` and remains an unreleased development line until an explicit release task says otherwise.
 
 ## Required checks
 
@@ -25,7 +25,7 @@ node dist/cli.js --version
 - `--json` envelope: top-level `ok`, `command`, `data`, `warnings`, and `error` must remain stable
 - `migrate`: advanced adopt helper only
 - `setup`: deprecated entry only
-- Release hygiene: `package.json`, `package-lock.json`, current-line docs, changelog top entry, and current PRD/Design fact sources must agree on the `0.1.4` development line
+- Release hygiene: `package.json`, `package-lock.json`, current-line docs, changelog top entry, and current PRD/Design fact sources must agree on the `0.1.5` development line
 
 ## Fixture guidance