@openhoo/hoopilot 0.10.0 → 1.1.0

package/dist/codexx.js

@@ -3,7 +3,7 @@ import {
   buildCodexxInvocation,
   main,
   verifyCodexxModel
-} from "./chunk-7GSQVYYT.js";
+} from "./chunk-JU6F5L34.js";
 export {
   buildCodexxInvocation,
   main,

package/dist/index.cjs

@@ -63,6 +63,7 @@ __export(index_exports, {
   observeResponseUsage: () => observeResponseUsage,
   parseLogFormat: () => parseLogFormat,
   parseLogLevel: () => parseLogLevel,
+  parseRateLimitHeaders: () => parseRateLimitHeaders,
   readStoredCopilotAuth: () => readStoredCopilotAuth,
   responsesCompactionResult: () => responsesCompactionResult,
   responsesRequestToChatCompletion: () => responsesRequestToChatCompletion,
@@ -1833,6 +1834,38 @@ function applyGithubApiHeaders(headers, token) {
   headers.set("x-github-api-version", COPILOT_USAGE_API_VERSION);
   return headers;
 }
+function parseRateLimitHeaders(headers, nowMs = Date.now()) {
+  const limit = headerInt(headers, "x-ratelimit-limit");
+  const remaining = headerInt(headers, "x-ratelimit-remaining");
+  const used = headerInt(headers, "x-ratelimit-used");
+  const resetEpochSeconds = headerInt(headers, "x-ratelimit-reset");
+  const retryAfterSeconds = headerInt(headers, "retry-after");
+  if (limit === void 0 && remaining === void 0 && used === void 0 && resetEpochSeconds === void 0 && retryAfterSeconds === void 0) {
+    return void 0;
+  }
+  return removeUndefinedRateLimit({
+    limit,
+    observedAtMs: nowMs,
+    remaining,
+    resetEpochSeconds,
+    resource: headers.get("x-ratelimit-resource")?.trim() || "unknown",
+    retryAfterSeconds,
+    used
+  });
+}
+function headerInt(headers, name) {
+  const raw = headers.get(name);
+  if (raw === null) {
+    return void 0;
+  }
+  const value = Number.parseInt(raw.trim(), 10);
+  return Number.isFinite(value) && value >= 0 ? value : void 0;
+}
+function removeUndefinedRateLimit(rateLimit) {
+  return Object.fromEntries(
+    Object.entries(rateLimit).filter(([, value]) => value !== void 0)
+  );
+}
 var CopilotClient = class {
   #auth;
   #allowUnsafeUpstream;
@@ -2249,6 +2282,7 @@ var DURATION_BUCKETS_SECONDS = [0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10, 30, 60];
 var USAGE_BUFFER_LIMIT_BYTES = 16 * 1024 * 1024;
 var MAX_TRACKED_MODELS = 200;
 var MAX_MODEL_LABEL_LENGTH = 200;
+var MAX_TRACKED_RATELIMIT_RESOURCES = 32;
 var LABEL_SEPARATOR = "";
 var UNKNOWN_MODEL = "unknown";
 function emptyModelTotals() {
@@ -2262,6 +2296,7 @@ var MetricsRegistry = class {
   #tokens = /* @__PURE__ */ new Map();
   #upstream = /* @__PURE__ */ new Map();
   #copilotQuota;
+  #githubRateLimit = /* @__PURE__ */ new Map();
   constructor(options = {}) {
     this.#startedAtMs = (options.now ?? Date.now)();
   }
@@ -2299,17 +2334,39 @@ var MetricsRegistry = class {
   recordCopilotQuota(usage) {
     this.#copilotQuota = usage;
   }
-  // Sanitize the model into a bounded, control-char-free label. The model can
-  // originate from a client request, so cap its length, strip characters that
-  // would corrupt the exposition format, and fold overflow past the cardinality
-  // limit into UNKNOWN_MODEL to keep the series count bounded.
+  /**
+   * Store the latest GitHub REST rate-limit budget, keyed by its resource bucket.
+   * A no-op when `rateLimit` is undefined (the response carried no rate-limit
+   * headers) so callers can pass {@link parseRateLimitHeaders} output directly.
+   */
+  recordGithubRateLimit(rateLimit) {
+    if (!rateLimit) {
+      return;
+    }
+    const resource = this.#rateLimitResource(rateLimit.resource);
+    this.#githubRateLimit.set(resource, { ...rateLimit, resource });
+  }
+  // Sanitize the model into a bounded label. The model can originate from a
+  // client request, so cap its length, strip characters that would corrupt the
+  // exposition format, and fold overflow past the cardinality limit into
+  // UNKNOWN_MODEL to keep the series count bounded.
   #modelLabel(model) {
-    const cleaned = model.replace(/[\u0000-\u001f\u007f]/g, "").trim().slice(0, MAX_MODEL_LABEL_LENGTH) || UNKNOWN_MODEL;
+    const cleaned = cleanLabel(model).slice(0, MAX_MODEL_LABEL_LENGTH) || UNKNOWN_MODEL;
     if (!this.#tokens.has(cleaned) && this.#tokens.size >= MAX_TRACKED_MODELS) {
       return UNKNOWN_MODEL;
     }
     return cleaned;
   }
+  // The resource comes from a trusted upstream header, but clean and bound it
+  // with the same discipline as model labels: strip control characters that
+  // would corrupt the exposition format and fold overflow into "unknown".
+  #rateLimitResource(resource) {
+    const cleaned = cleanLabel(resource).slice(0, MAX_MODEL_LABEL_LENGTH) || UNKNOWN_MODEL;
+    if (!this.#githubRateLimit.has(cleaned) && this.#githubRateLimit.size >= MAX_TRACKED_RATELIMIT_RESOURCES) {
+      return UNKNOWN_MODEL;
+    }
+    return cleaned;
+  }
   #observeDuration(route, seconds) {
     const value = Number.isFinite(seconds) && seconds >= 0 ? seconds : 0;
     const entry = this.#durations.get(route) ?? {
@@ -2354,7 +2411,12 @@ var MetricsRegistry = class {
         upstreamErrors += count;
       }
     }
+    const githubRateLimit = {};
+    for (const [resource, rateLimit] of this.#githubRateLimit) {
+      githubRateLimit[resource] = toRateLimitSnapshot(rateLimit);
+    }
     return {
+      githubRateLimit,
       inFlight: this.#inFlight,
       requests: { byRoute, byStatus, total: requestsTotal },
       startedAt: new Date(this.#startedAtMs).toISOString(),
@@ -2425,10 +2487,43 @@ var MetricsRegistry = class {
       lines.push(`hoopilot_request_duration_seconds_sum${labels({ route })} ${entry.sum}`);
       lines.push(`hoopilot_request_duration_seconds_count${labels({ route })} ${entry.count}`);
     }
+    this.#renderGithubRateLimit(lines);
     this.#renderCopilotQuota(lines);
     return `${lines.join("\n")}
 `;
   }
+  #renderGithubRateLimit(lines) {
+    const entries = [...this.#githubRateLimit.values()];
+    if (entries.length === 0) {
+      return;
+    }
+    const gauge = (suffix, help, pick) => {
+      const present = entries.filter((rateLimit) => pick(rateLimit) !== void 0);
+      if (present.length === 0) {
+        return;
+      }
+      lines.push(`# HELP hoopilot_github_ratelimit_${suffix} ${help}`);
+      lines.push(`# TYPE hoopilot_github_ratelimit_${suffix} gauge`);
+      for (const rateLimit of present) {
+        lines.push(
+          `hoopilot_github_ratelimit_${suffix}${labels({ resource: rateLimit.resource })} ${pick(rateLimit)}`
+        );
+      }
+    };
+    gauge("limit", "GitHub REST API request ceiling for the resource window.", (r) => r.limit);
+    gauge("remaining", "Requests remaining in the GitHub REST API window.", (r) => r.remaining);
+    gauge("used", "Requests used in the GitHub REST API window.", (r) => r.used);
+    gauge(
+      "reset_timestamp_seconds",
+      "Unix epoch when the GitHub REST API window resets.",
+      (r) => r.resetEpochSeconds
+    );
+    gauge(
+      "retry_after_seconds",
+      "Seconds to wait after a GitHub secondary-limit response.",
+      (r) => r.retryAfterSeconds
+    );
+  }
   #renderCopilotQuota(lines) {
     const usage = this.#copilotQuota;
     if (!usage) {
@@ -2669,6 +2764,37 @@ function modelText(value) {
 function nonNegative(value) {
   return Number.isFinite(value) && value > 0 ? value : 0;
 }
+function cleanLabel(value) {
+  let result = "";
+  for (const char of value) {
+    const code = char.charCodeAt(0);
+    if (code > 31 && code !== 127) {
+      result += char;
+    }
+  }
+  return result.trim();
+}
+function toRateLimitSnapshot(rateLimit) {
+  const snapshot = {
+    observedAt: new Date(rateLimit.observedAtMs).toISOString()
+  };
+  if (rateLimit.limit !== void 0) {
+    snapshot.limit = rateLimit.limit;
+  }
+  if (rateLimit.remaining !== void 0) {
+    snapshot.remaining = rateLimit.remaining;
+  }
+  if (rateLimit.used !== void 0) {
+    snapshot.used = rateLimit.used;
+  }
+  if (rateLimit.resetEpochSeconds !== void 0) {
+    snapshot.resetAt = new Date(rateLimit.resetEpochSeconds * 1e3).toISOString();
+  }
+  if (rateLimit.retryAfterSeconds !== void 0) {
+    snapshot.retryAfterSeconds = rateLimit.retryAfterSeconds;
+  }
+  return snapshot;
+}
 function labelKey(...parts) {
   return parts.join(LABEL_SEPARATOR);
 }
@@ -2694,7 +2820,8 @@ var IS_STANDALONE_BINARY = BAKED_VERSION !== void 0;
 // src/server.ts
 var DEFAULT_HOST = "127.0.0.1";
 var DEFAULT_PORT = 4141;
-var FORBIDDEN_BROWSER_ORIGIN_MESSAGE = "Browser-origin requests require HOOPILOT_API_KEY unless the Origin is loopback.";
+var FORBIDDEN_BROWSER_ORIGIN_MESSAGE = "Cross-origin browser requests are blocked unless the Origin is loopback or listed in HOOPILOT_ALLOWED_ORIGINS.";
+var WELL_KNOWN_DEMO_API_KEYS = /* @__PURE__ */ new Set(["local-key"]);
 var INVALID_JSON_MESSAGE = "Request body must be valid JSON.";
 var JSON_OBJECT_MESSAGE = "Request body must be a JSON object.";
 var MAX_REQUEST_BODY_BYTES = 16 * 1024 * 1024;
@@ -2710,6 +2837,7 @@ var RequestBodyTooLargeError = class extends Error {
 function createHoopilotHandler(options = {}) {
   const client = new CopilotClient(options);
   const apiKey = options.apiKey ?? envValue(options.env?.HOOPILOT_API_KEY);
+  const allowedOrigins = parseAllowedOrigins(options.env);
   const logger = serverLogger(options);
   const metrics = options.metrics ?? new MetricsRegistry();
   const readUsage = createUsageReader(client, metrics);
@@ -2729,7 +2857,10 @@ function createHoopilotHandler(options = {}) {
       route
     });
     metrics.startRequest();
+    const origin = request.headers.get("origin")?.trim() || void 0;
+    const corsOrigin = resolveCorsAllowOrigin(origin, allowedOrigins);
     const finish = (response) => finishResponse(response, {
+      corsOrigin,
       logger: requestLogger,
       method: request.method,
       metrics,
@@ -2739,11 +2870,11 @@ function createHoopilotHandler(options = {}) {
       closeConnection: bufferProxyBodies,
       trackStreamingBody: !bufferProxyBodies
     });
-    const browserOrigin = forbiddenBrowserOrigin(request, apiKey);
+    const browserOrigin = forbiddenBrowserOrigin(origin, request, allowedOrigins);
     if (browserOrigin) {
       requestLogger.warn(
         { event: "http.request.forbidden_origin", origin: browserOrigin },
-        "blocked unauthenticated browser-origin request"
+        "blocked cross-origin browser request"
       );
       return finish(jsonError(403, "forbidden_origin", FORBIDDEN_BROWSER_ORIGIN_MESSAGE));
     }
@@ -2869,10 +3000,17 @@ function startHoopilotServer(options = {}) {
   const port = normalizeServerPort(options.port ?? envValue(options.env?.PORT) ?? DEFAULT_PORT);
   const apiKey = options.apiKey ?? envValue(options.env?.HOOPILOT_API_KEY);
   const allowUnauthenticated = options.allowUnauthenticated ?? envValue(options.env?.HOOPILOT_ALLOW_UNAUTHENTICATED) === "1";
-  if (!isLoopbackHost(host) && !apiKey && !allowUnauthenticated) {
-    throw new Error(
-      "Refusing to listen on a non-loopback host without HOOPILOT_API_KEY. Set an API key or pass --allow-unauthenticated."
-    );
+  if (!isLoopbackHost(host)) {
+    if (!apiKey && !allowUnauthenticated) {
+      throw new Error(
+        "Refusing to listen on a non-loopback host without HOOPILOT_API_KEY. Set an API key or pass --allow-unauthenticated."
+      );
+    }
+    if (apiKey && isWellKnownDemoApiKey(apiKey)) {
+      throw new Error(
+        "Refusing to listen on a non-loopback host with a well-known demo HOOPILOT_API_KEY. Set a strong, unique API key."
+      );
+    }
   }
   const server = Bun.serve({
     fetch: createHoopilotHandler({
@@ -3185,7 +3323,6 @@ function corsHeaders() {
   return {
     "access-control-allow-headers": "anthropic-beta, anthropic-dangerous-direct-browser-access, anthropic-version, authorization, content-type, x-api-key, x-request-id",
     "access-control-allow-methods": "GET, POST, OPTIONS",
-    "access-control-allow-origin": "*",
     "access-control-expose-headers": "x-request-id"
   };
 }
@@ -3197,17 +3334,34 @@ function isAuthorized(request, apiKey) {
   const bearer = authorization.match(/^Bearer\s+(.+)$/i)?.[1];
   return bearer === apiKey || request.headers.get("x-api-key") === apiKey;
 }
-function forbiddenBrowserOrigin(request, apiKey) {
-  if (apiKey) {
-    return void 0;
-  }
-  const origin = request.headers.get("origin")?.trim();
+function forbiddenBrowserOrigin(origin, request, allowedOrigins) {
   if (origin) {
-    return isLoopbackOrigin(origin) ? void 0 : origin;
+    return isAllowedOrigin(origin, allowedOrigins) ? void 0 : origin;
   }
   const fetchSite = request.headers.get("sec-fetch-site")?.toLowerCase();
   return fetchSite === "cross-site" ? "cross-site" : void 0;
 }
+function parseAllowedOrigins(env) {
+  const raw = envValue(env?.HOOPILOT_ALLOWED_ORIGINS);
+  if (!raw) {
+    return /* @__PURE__ */ new Set();
+  }
+  return new Set(
+    raw.split(",").map((value) => value.trim().toLowerCase()).filter((value) => value.length > 0)
+  );
+}
+function isAllowedOrigin(origin, allowedOrigins) {
+  return isLoopbackOrigin(origin) || allowedOrigins.has(origin.toLowerCase());
+}
+function resolveCorsAllowOrigin(origin, allowedOrigins) {
+  if (!origin) {
+    return "*";
+  }
+  return isAllowedOrigin(origin, allowedOrigins) ? origin : void 0;
+}
+function isWellKnownDemoApiKey(apiKey) {
+  return WELL_KNOWN_DEMO_API_KEYS.has(apiKey.trim().toLowerCase());
+}
 function isUpstreamAuthStatus(status) {
   return status === 401 || status === 403;
 }
@@ -3267,7 +3421,12 @@ function shouldBufferProxyBodies(mode) {
   return process.platform === "win32" && IS_STANDALONE_BINARY;
 }
 function finishResponse(response, options) {
-  const withRequestId = responseWithRequestId(response, options.requestId, options.closeConnection);
+  const withRequestId = responseWithRequestId(
+    response,
+    options.requestId,
+    options.closeConnection,
+    options.corsOrigin
+  );
   const stream = isStreamingResponse(withRequestId);
   const status = withRequestId.status;
   const complete = () => {
@@ -3285,9 +3444,17 @@ function finishResponse(response, options) {
   complete();
   return withRequestId;
 }
-function responseWithRequestId(response, requestId, closeConnection) {
+function responseWithRequestId(response, requestId, closeConnection, corsOrigin) {
   const headers = new Headers(response.headers);
   headers.set("x-request-id", requestId);
+  if (corsOrigin) {
+    headers.set("access-control-allow-origin", corsOrigin);
+    if (corsOrigin !== "*") {
+      headers.append("vary", "Origin");
+    }
+  } else {
+    headers.delete("access-control-allow-origin");
+  }
   if (closeConnection) {
     headers.set("connection", "close");
   }
@@ -3451,6 +3618,7 @@ function createUsageReader(client, metrics, now = Date.now, ttlMs = USAGE_CACHE_
     try {
       const upstream = await client.usage(signal);
       metrics.recordUpstream(usagePath, upstream.ok);
+      metrics.recordGithubRateLimit(parseRateLimitHeaders(upstream.headers, now()));
       if (!upstream.ok) {
         return { error: `GitHub Copilot usage request failed with ${upstream.status}.` };
       }
@@ -3509,6 +3677,7 @@ function safeParseJson(text) {
   observeResponseUsage,
   parseLogFormat,
   parseLogLevel,
+  parseRateLimitHeaders,
   readStoredCopilotAuth,
   responsesCompactionResult,
   responsesRequestToChatCompletion,