@openhoo/hoopilot 0.6.0 → 0.6.1

package/README.md

@@ -97,20 +97,7 @@ $env:OPENAI_BASE_URL = "http://127.0.0.1:4141/v1"
 $env:OPENAI_API_KEY = "local-key"
 ```
 
-Use with Codex CLI after Hoopilot is running:
-
-```powershell
-$env:OPENAI_API_KEY = "local-key"
-codex -m gpt-5.5 -c 'model_reasoning_effort="xhigh"' -c 'openai_base_url="http://127.0.0.1:4141/v1"'
-```
-
-One-line PowerShell form:
-
-```powershell
-$env:OPENAI_API_KEY = "local-key"; codex -m gpt-5.5 -c 'model_reasoning_effort="xhigh"' -c 'openai_base_url="http://127.0.0.1:4141/v1"'
-```
-
-Or use the bundled `codexx` convenience command after Hoopilot is already running:
+Use with Codex CLI after Hoopilot is running, via the bundled `codexx` command. It runs Codex against the local server with the right model provider — selecting `gpt-5.5` over Copilot's Responses API, which a plain `openai_base_url` override does not configure (see the note below):
 
 ```powershell
 $env:HOOPILOT_API_KEY = "local-key"
@@ -203,7 +190,7 @@ Then, in another PowerShell session:
 $env:OPENAI_API_KEY = "local-key"
 Invoke-RestMethod -Headers @{ Authorization = "Bearer $env:OPENAI_API_KEY" } `
   http://127.0.0.1:4141/v1/models
-codex -m gpt-5.5 -c 'model_reasoning_effort="xhigh"' -c 'openai_base_url="http://127.0.0.1:4141/v1"'
+codexx
 ```
 
 If that returns `401 copilot_auth_error`, rerun `npx @openhoo/hoopilot login` and confirm the GitHub account has active Copilot access.
@@ -230,7 +217,7 @@ Options:
 ```txt
 -p, --port <port>                 Port to listen on. Default: 4141
     --host <host>                 Host to listen on. Default: 127.0.0.1
-    --api-key <key>               Require clients to send Authorization: Bearer <key>
+    --api-key <key>               Require clients to send Authorization: Bearer <key> or x-api-key: <key>
     --auth-file <path>            OAuth credential store path
     --copilot-api-base-url <url>  Copilot API base URL override
     --log-level <level>           trace, debug, info, warn, error, fatal, or silent

package/dist/cli.js

@@ -4,7 +4,7 @@
 import { spawn } from "child_process";
 
 // src/auth-store.ts
-import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
 import { dirname, join } from "path";
 function authStorePath(env = process.env) {
   if (env.HOOPILOT_AUTH_FILE) {
@@ -36,25 +36,36 @@ function readStoredCopilotAuth(path = authStorePath()) {
 }
 function writeStoredCopilotAuth(auth, path = authStorePath()) {
   mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(
-    path,
-    `${JSON.stringify(
-      {
-        ...auth,
-        createdAt: auth.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
-      },
-      null,
-      2
-    )}
-`,
-    { mode: 384 }
-  );
+  const data = `${JSON.stringify(
+    {
+      ...auth,
+      createdAt: auth.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
+    },
+    null,
+    2
+  )}
+`;
+  const tmpPath = `${path}.${process.pid}.tmp`;
+  writeFileSync(tmpPath, data, { mode: 384 });
+  renameSync(tmpPath, path);
   try {
     chmodSync(path, 384);
   } catch {
   }
 }
 
+// src/util.ts
+function trimTrailingSlash(value) {
+  return value.replace(/\/+$/, "");
+}
+async function truncatedResponseText(response, max = 500) {
+  const text = await response.text();
+  return text.slice(0, max);
+}
+function asRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+
 // src/auth.ts
 var DEFAULT_COPILOT_API_BASE_URL = "https://api.githubcopilot.com";
 var REFRESH_SKEW_MS = 6e4;
@@ -97,11 +108,19 @@ var CopilotAuth = class {
     return access;
   }
 };
-function trimTrailingSlash(value) {
-  return value.replace(/\/+$/, "");
-}
 
 // src/copilot.ts
+function applyCopilotHeaders(headers, token) {
+  headers.set("accept", headers.get("accept") ?? "application/json");
+  headers.set("authorization", `Bearer ${token}`);
+  headers.set("copilot-integration-id", "vscode-chat");
+  headers.set("editor-plugin-version", "hoopilot/0.1.0");
+  headers.set("editor-version", "Hoopilot/0.1.0");
+  headers.set("openai-intent", "conversation-panel");
+  headers.set("user-agent", "hoopilot/0.1.0");
+  headers.set("x-github-api-version", "2026-06-01");
+  return headers;
+}
 var CopilotClient = class {
   #auth;
   #fetch;
@@ -140,15 +159,7 @@ var CopilotClient = class {
   }
   async fetchCopilot(path, init) {
     const access = await this.#auth.getAccess();
-    const headers = new Headers(init.headers);
-    headers.set("accept", headers.get("accept") ?? "application/json");
-    headers.set("authorization", `Bearer ${access.token}`);
-    headers.set("copilot-integration-id", "vscode-chat");
-    headers.set("editor-plugin-version", "hoopilot/0.1.0");
-    headers.set("editor-version", "Hoopilot/0.1.0");
-    headers.set("openai-intent", "conversation-panel");
-    headers.set("user-agent", "hoopilot/0.1.0");
-    headers.set("x-github-api-version", "2026-06-01");
+    const headers = applyCopilotHeaders(new Headers(init.headers), access.token);
     return this.#fetch(`${access.apiBaseUrl}${path}`, {
       ...init,
       headers
@@ -162,6 +173,7 @@ var DEFAULT_GITHUB_COPILOT_CLIENT_ID = "Ov23li8tweQw6odWQebz";
 var DEFAULT_GITHUB_DOMAIN = "github.com";
 var DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
 var POLLING_SAFETY_MARGIN_MS = 3e3;
+var REQUEST_TIMEOUT_MS = 15e3;
 async function githubCopilotDeviceLogin(options = {}) {
   const env = options.env ?? process.env;
   const fetcher = options.fetch ?? fetch;
@@ -196,16 +208,20 @@ async function requestDeviceCode(fetcher, domain, clientId) {
       scope: "read:user"
     }),
     headers: oauthHeaders(),
-    method: "POST"
+    method: "POST",
+    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
   });
   if (!response.ok) {
     throw new Error(
-      `GitHub device authorization failed with ${response.status}: ${await safeResponseText(
+      `GitHub device authorization failed with ${response.status}: ${await truncatedResponseText(
         response
       )}`
     );
   }
-  return await response.json();
+  return parseJsonResponse(
+    response,
+    "GitHub device authorization response was not valid JSON"
+  );
 }
 async function pollForAccessToken(fetcher, sleeper, domain, clientId, device) {
   let intervalMs = device.interval * 1e3 + POLLING_SAFETY_MARGIN_MS;
@@ -219,16 +235,20 @@ async function pollForAccessToken(fetcher, sleeper, domain, clientId, device) {
         grant_type: DEVICE_GRANT_TYPE
       }),
       headers: oauthHeaders(),
-      method: "POST"
+      method: "POST",
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
     });
     if (!response.ok) {
       throw new Error(
-        `GitHub device token exchange failed with ${response.status}: ${await safeResponseText(
+        `GitHub device token exchange failed with ${response.status}: ${await truncatedResponseText(
           response
         )}`
       );
     }
-    const data = await response.json();
+    const data = await parseJsonResponse(
+      response,
+      "GitHub device token response was not valid JSON"
+    );
     if (data.access_token) {
       return data.access_token;
     }
@@ -264,9 +284,13 @@ function normalizeDomain(value) {
 function positiveSeconds(value, fallback) {
   return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : fallback;
 }
-async function safeResponseText(response) {
+async function parseJsonResponse(response, context) {
   const text = await response.text();
-  return text.slice(0, 500);
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new Error(`${context}: ${text.slice(0, 500)}`);
+  }
 }
 
 // src/logger.ts
@@ -369,6 +393,16 @@ function shouldCreateLogger(options) {
     options.logger || options.logFormat || options.logLevel || options.env?.HOOPILOT_LOG_FORMAT || options.env?.HOOPILOT_LOG_LEVEL
   );
 }
+function errorDetails(error) {
+  if (error instanceof Error) {
+    return {
+      message: error.message,
+      name: error.name,
+      stack: error.stack
+    };
+  }
+  return { message: String(error) };
+}
 function isLogFormat(value) {
   return LOG_FORMATS.includes(value);
 }
@@ -476,9 +510,6 @@ function firstChoice(completion) {
 function removeUndefined(record) {
   return Object.fromEntries(Object.entries(record).filter(([, value]) => value !== void 0));
 }
-function asRecord(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
-}
 function randomId() {
   return crypto.randomUUID().replaceAll("-", "");
 }
@@ -668,6 +699,9 @@ async function handleCompletions(client, request, logger) {
     return proxyError(upstream, logger);
   }
   logUpstreamSuccess(logger, "/chat/completions", upstream.status);
+  if (isStreamingResponse(upstream)) {
+    return proxyResponse(upstream);
+  }
   return jsonResponse(chatCompletionToCompletion(await upstream.json()));
 }
 async function handleResponses(client, request, logger) {
@@ -710,8 +744,7 @@ function proxyResponse(upstream) {
 }
 async function readJson(request) {
   try {
-    const value = await request.json();
-    return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+    return asRecord(await request.json());
   } catch {
     throw new Error(INVALID_JSON_MESSAGE);
   }
@@ -882,16 +915,6 @@ function logUpstreamSuccess(logger, upstreamPath, status) {
     "copilot upstream request completed"
   );
 }
-function errorDetails(error) {
-  if (error instanceof Error) {
-    return {
-      message: error.message,
-      name: error.name,
-      stack: error.stack
-    };
-  }
-  return { message: String(error) };
-}
 
 // src/update.ts
 import { execFileSync } from "child_process";
@@ -902,7 +925,7 @@ import {
   existsSync,
   mkdirSync as mkdirSync2,
   realpathSync,
-  renameSync,
+  renameSync as renameSync2,
   rmSync
 } from "fs";
 import { readFile, writeFile } from "fs/promises";
@@ -1116,7 +1139,7 @@ async function getVersion() {
 }
 
 // src/update.ts
-var REQUEST_TIMEOUT_MS = 8e3;
+var REQUEST_TIMEOUT_MS2 = 8e3;
 var SHA256SUMS = "SHA256SUMS";
 function userAgent(version) {
   return `hoopilot/${version}`;
@@ -1153,7 +1176,7 @@ async function fetchLatest(version, etag) {
     }
     const response = await fetch(latestReleaseApiUrl(), {
       headers,
-      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS2)
     });
     if (response.status === 304) {
       return { status: 304, etag: etag ?? null, release: null };
@@ -1192,7 +1215,7 @@ async function maybeNotifyUpdate(currentVersion, kind, logger) {
     logger?.debug({ event: "update.check.refresh_queued" }, "queued update check refresh");
     void refreshState(currentVersion, state.etag ?? null, logger).catch((error) => {
       logger?.debug(
-        { err: errorDetails2(error), event: "update.check.refresh_failed" },
+        { err: errorDetails(error), event: "update.check.refresh_failed" },
         "update check refresh failed"
       );
     });
@@ -1254,7 +1277,7 @@ async function downloadToFile(url, dest, version) {
   const response = await fetch(url, {
     headers: { "User-Agent": userAgent(version) },
     redirect: "follow",
-    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS * 10)
+    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS2 * 10)
   });
   if (!response.ok || !response.body) {
     throw new Error(`Download failed (${response.status}) for ${url}`);
@@ -1274,7 +1297,7 @@ async function verifyChecksum(release, assetName, file, version) {
   const response = await fetch(sums.url, {
     headers: { "User-Agent": userAgent(version) },
     redirect: "follow",
-    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS2)
   });
   if (!response.ok) {
     throw new Error(`Could not download ${SHA256SUMS} (${response.status}).`);
@@ -1295,15 +1318,15 @@ function swapBinary(tmpFile, exePath) {
       rmSync(oldExe, { force: true });
     } catch {
     }
-    renameSync(exePath, oldExe);
+    renameSync2(exePath, oldExe);
     const restore = () => {
       try {
-        renameSync(oldExe, exePath);
+        renameSync2(oldExe, exePath);
       } catch {
       }
     };
     try {
-      renameSync(tmpFile, exePath);
+      renameSync2(tmpFile, exePath);
     } catch (error) {
       if (error.code === "EXDEV") {
         try {
@@ -1320,7 +1343,7 @@ function swapBinary(tmpFile, exePath) {
     return;
   }
   try {
-    renameSync(tmpFile, exePath);
+    renameSync2(tmpFile, exePath);
   } catch (error) {
     const code = error.code;
     if (code === "EXDEV") {
@@ -1416,19 +1439,8 @@ async function runUpdate(currentVersion, logger) {
     console.log("Restart hoopilot to run the new version.");
   }
 }
-function errorDetails2(error) {
-  if (error instanceof Error) {
-    return {
-      message: error.message,
-      name: error.name,
-      stack: error.stack
-    };
-  }
-  return { message: String(error) };
-}
 
 // src/cli.ts
-var DEFAULT_COPILOT_API_BASE_URL2 = "https://api.githubcopilot.com";
 async function main(argv = Bun.argv.slice(2)) {
   cleanupOldBinary();
   const command = argv[0];
@@ -1438,11 +1450,7 @@ async function main(argv = Bun.argv.slice(2)) {
       console.log(helpText(await getVersion()));
       return;
     }
-    const logger2 = createHoopilotLogger({
-      env: args2.env,
-      format: args2.logFormat,
-      level: args2.logLevel
-    }).child({ component: "cli", command });
+    const logger2 = commandLogger(args2, command);
     await runUpdate(await getVersion(), logger2);
     return;
   }
@@ -1452,11 +1460,7 @@ async function main(argv = Bun.argv.slice(2)) {
       console.log(helpText(await getVersion()));
       return;
     }
-    args2.logger = createHoopilotLogger({
-      env: args2.env,
-      format: args2.logFormat,
-      level: args2.logLevel
-    }).child({ component: "cli", command: "login" });
+    args2.logger = commandLogger(args2, "login");
     await runLogin(args2);
     return;
   }
@@ -1466,11 +1470,7 @@ async function main(argv = Bun.argv.slice(2)) {
       console.log(helpText(await getVersion()));
       return;
     }
-    args2.logger = createHoopilotLogger({
-      env: args2.env,
-      format: args2.logFormat,
-      level: args2.logLevel
-    }).child({ component: "cli", command: "models" });
+    args2.logger = commandLogger(args2, "models");
     await runModels(args2);
     return;
   }
@@ -1483,11 +1483,7 @@ async function main(argv = Bun.argv.slice(2)) {
     console.log(await getVersion());
     return;
   }
-  const logger = createHoopilotLogger({
-    env: args.env,
-    format: args.logFormat,
-    level: args.logLevel
-  }).child({ component: "cli", command: "serve" });
+  const logger = commandLogger(args, "serve");
   args.logger = logger;
   const started = startHoopilotServer(args);
   logger.info(
@@ -1498,7 +1494,7 @@ async function main(argv = Bun.argv.slice(2)) {
     },
     "hoopilot server started"
   );
-  if (!args.noUpdateCheck && process.env.HOOPILOT_NO_UPDATE_CHECK !== "1") {
+  if (!args.noUpdateCheck) {
     void maybeNotifyUpdate(
       await getVersion(),
       IS_STANDALONE_BINARY ? "binary" : "npm",
@@ -1604,7 +1600,7 @@ async function runModels(options = {}) {
   logger.debug({ event: "models.list.started" }, "fetching github copilot models");
   const response = await new CopilotClient(options).models();
   if (!response.ok) {
-    const message = `GitHub Copilot API model list failed with ${response.status}: ${await safeResponseText2(response)}`;
+    const message = `GitHub Copilot API model list failed with ${response.status}: ${await truncatedResponseText(response)}`;
     if (response.status === 401 || response.status === 403) {
       throw new CopilotAuthError(message);
     }
@@ -1624,16 +1620,16 @@ async function runModels(options = {}) {
   return ids;
 }
 async function verifyCopilotOAuthToken(token, options = {}) {
-  const apiBaseUrl = trimTrailingSlash2(
-    options.copilotApiBaseUrl ?? options.env?.COPILOT_API_BASE_URL ?? DEFAULT_COPILOT_API_BASE_URL2
+  const apiBaseUrl = trimTrailingSlash(
+    options.copilotApiBaseUrl ?? options.env?.COPILOT_API_BASE_URL ?? DEFAULT_COPILOT_API_BASE_URL
   );
   const fetcher = options.fetch ?? fetch;
   const response = await fetcher(`${apiBaseUrl}/models`, {
-    headers: copilotHeaders(token),
+    headers: applyCopilotHeaders(new Headers(), token),
     method: "GET"
   });
   if (!response.ok) {
-    const message = `GitHub Copilot API verification failed with ${response.status}: ${await safeResponseText2(response)}`;
+    const message = `GitHub Copilot API verification failed with ${response.status}: ${await truncatedResponseText(response)}`;
     if (response.status === 401 || response.status === 403) {
       throw new CopilotAuthError(message);
     }
@@ -1659,32 +1655,13 @@ function openBrowserBestEffort(url) {
   } catch {
   }
 }
-function copilotHeaders(token) {
-  const headers = new Headers();
-  headers.set("accept", "application/json");
-  headers.set("authorization", `Bearer ${token}`);
-  headers.set("copilot-integration-id", "vscode-chat");
-  headers.set("editor-plugin-version", "hoopilot/0.1.0");
-  headers.set("editor-version", "Hoopilot/0.1.0");
-  headers.set("openai-intent", "conversation-panel");
-  headers.set("user-agent", "hoopilot/0.1.0");
-  headers.set("x-github-api-version", "2026-06-01");
-  return headers;
-}
-async function safeResponseText2(response) {
-  const text = await response.text();
-  return text.slice(0, 500);
-}
-function trimTrailingSlash2(value) {
-  return value.replace(/\/+$/, "");
-}
 function modelIdsFromResponse(body) {
-  const record = asRecord2(body);
+  const record = asRecord(body);
   const data = Array.isArray(record.data) ? record.data : Array.isArray(body) ? body : [];
   const seen = /* @__PURE__ */ new Set();
   const ids = [];
   for (const model of data) {
-    const id = asRecord2(model).id;
+    const id = asRecord(model).id;
     if (typeof id !== "string" || id.length === 0 || seen.has(id)) {
       continue;
     }
@@ -1693,12 +1670,16 @@ function modelIdsFromResponse(body) {
   }
   return ids;
 }
-function asRecord2(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
-}
 function withRuntimeEnv(args) {
   return { ...args, env: process.env };
 }
+function commandLogger(args, command) {
+  return createHoopilotLogger({
+    env: args.env,
+    format: args.logFormat,
+    level: args.logLevel
+  }).child({ command, component: "cli" });
+}
 function helpText(version) {
   return `hoopilot ${version}
 
@@ -1720,7 +1701,7 @@ Commands:
 Options:
   -p, --port <port>                 Port to listen on. Default: 4141
       --host <host>                 Host to listen on. Default: 127.0.0.1
-      --api-key <key>               Require clients to send Authorization: Bearer <key>
+      --api-key <key>               Require clients to send Authorization: Bearer <key> or x-api-key: <key>
       --auth-file <path>            OAuth credential store path
       --copilot-api-base-url <url>  Copilot API base URL override
       --log-level <level>           trace, debug, info, warn, error, fatal, or silent