@openhoo/hoopilot 0.7.2 → 0.7.4

package/dist/index.js

@@ -1,6 +1,56 @@
 // src/auth-store.ts
 import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
 import { dirname, join } from "path";
+
+// src/util.ts
+function trimTrailingSlash(value) {
+  return value.replace(/\/+$/, "");
+}
+function envValue(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : void 0;
+}
+function isTrustedTokenBaseUrl(rawUrl, allowedHttpsHosts, allowUnsafeHttps = false) {
+  const url = parseUrl(rawUrl);
+  if (!url) {
+    return false;
+  }
+  if (url.username || url.password || url.search || url.hash) {
+    return false;
+  }
+  if (url.pathname !== "" && url.pathname !== "/") {
+    return false;
+  }
+  if (isLoopbackHttpUrl(url)) {
+    return true;
+  }
+  if (url.protocol !== "https:") {
+    return false;
+  }
+  const host = url.hostname.toLowerCase();
+  return allowedHttpsHosts.includes(host) || allowUnsafeHttps;
+}
+function parseUrl(rawUrl) {
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    return void 0;
+  }
+  return url;
+}
+function isLoopbackHttpUrl(url) {
+  return url.protocol === "http:" && (url.hostname === "127.0.0.1" || url.hostname === "localhost" || url.hostname === "::1" || url.hostname === "[::1]");
+}
+async function truncatedResponseText(response, max = 500) {
+  const text = await response.text();
+  return text.slice(0, max);
+}
+function asRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+
+// src/auth-store.ts
 var StoredCopilotAuthError = class extends Error {
   constructor(message) {
     super(message);
@@ -8,10 +58,25 @@ var StoredCopilotAuthError = class extends Error {
   }
 };
 function authStorePath(env = process.env) {
-  if (env.HOOPILOT_AUTH_FILE) {
-    return env.HOOPILOT_AUTH_FILE;
+  const explicit = envValue(env.HOOPILOT_AUTH_FILE);
+  if (explicit) {
+    return explicit;
+  }
+  const xdg = envValue(env.XDG_CONFIG_HOME);
+  if (xdg) {
+    return join(xdg, "hoopilot", "auth.json");
+  }
+  const appdata = envValue(env.APPDATA);
+  if (appdata) {
+    return join(appdata, "hoopilot", "auth.json");
   }
-  const base = env.XDG_CONFIG_HOME ?? env.APPDATA ?? (env.HOME ? join(env.HOME, ".config") : join(process.cwd(), ".config"));
+  const home = envValue(env.HOME);
+  if (!home) {
+    throw new StoredCopilotAuthError(
+      "Cannot resolve Hoopilot auth file path without HOOPILOT_AUTH_FILE, XDG_CONFIG_HOME, APPDATA, or HOME."
+    );
+  }
+  const base = join(home, ".config");
   return join(base, "hoopilot", "auth.json");
 }
 function readStoredCopilotAuth(path = authStorePath()) {
@@ -68,30 +133,6 @@ function writeStoredCopilotAuth(auth, path = authStorePath()) {
   }
 }
 
-// src/util.ts
-function trimTrailingSlash(value) {
-  return value.replace(/\/+$/, "");
-}
-function isHttpsOrLoopbackUrl(rawUrl) {
-  let url;
-  try {
-    url = new URL(rawUrl);
-  } catch {
-    return false;
-  }
-  if (url.protocol === "https:") {
-    return true;
-  }
-  return url.protocol === "http:" && (url.hostname === "127.0.0.1" || url.hostname === "localhost" || url.hostname === "::1" || url.hostname === "[::1]");
-}
-async function truncatedResponseText(response, max = 500) {
-  const text = await response.text();
-  return text.slice(0, max);
-}
-function asRecord(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
-}
-
 // src/auth.ts
 var DEFAULT_COPILOT_API_BASE_URL = "https://api.githubcopilot.com";
 var REFRESH_SKEW_MS = 6e4;
@@ -105,11 +146,15 @@ var CopilotAuthError = class extends Error {
 var CopilotAuth = class {
   #authStorePath;
   #copilotApiBaseUrl;
+  #hasCopilotApiBaseUrlOverride;
   #cachedAccess;
   constructor(options = {}) {
-    this.#authStorePath = options.authStorePath ?? options.env?.HOOPILOT_AUTH_FILE;
+    const envAuthStorePath = envValue(options.env?.HOOPILOT_AUTH_FILE);
+    const envCopilotApiBaseUrl = envValue(options.env?.COPILOT_API_BASE_URL);
+    this.#authStorePath = options.authStorePath ?? envAuthStorePath;
+    this.#hasCopilotApiBaseUrlOverride = Boolean(options.copilotApiBaseUrl ?? envCopilotApiBaseUrl);
     this.#copilotApiBaseUrl = trimTrailingSlash(
-      options.copilotApiBaseUrl ?? options.env?.COPILOT_API_BASE_URL ?? DEFAULT_COPILOT_API_BASE_URL
+      options.copilotApiBaseUrl ?? envCopilotApiBaseUrl ?? DEFAULT_COPILOT_API_BASE_URL
     );
   }
   async getAccess() {
@@ -127,7 +172,9 @@ var CopilotAuth = class {
     }
     if (stored) {
       return this.#cacheAccess({
-        apiBaseUrl: trimTrailingSlash(stored.apiBaseUrl ?? this.#copilotApiBaseUrl),
+        apiBaseUrl: trimTrailingSlash(
+          this.#hasCopilotApiBaseUrlOverride ? this.#copilotApiBaseUrl : stored.apiBaseUrl ?? this.#copilotApiBaseUrl
+        ),
         expiresAtMs: Date.now() + STORED_TOKEN_TTL_MS,
         source: "github-copilot-oauth",
         token: stored.token
@@ -145,6 +192,8 @@ var CopilotAuth = class {
 
 // src/copilot.ts
 var DEFAULT_GITHUB_API_BASE_URL = "https://api.github.com";
+var ALLOWED_COPILOT_API_HOSTS = ["api.githubcopilot.com"];
+var ALLOWED_GITHUB_API_HOSTS = ["api.github.com"];
 var COPILOT_USAGE_API_VERSION = "2025-04-01";
 function applyCopilotHeaders(headers, token) {
   headers.set("accept", headers.get("accept") ?? "application/json");
@@ -168,13 +217,15 @@ function applyGithubApiHeaders(headers, token) {
 }
 var CopilotClient = class {
   #auth;
+  #allowUnsafeUpstream;
   #fetch;
   #githubApiBaseUrl;
   constructor(options = {}) {
     this.#auth = new CopilotAuth(options);
+    this.#allowUnsafeUpstream = envValue(options.env?.HOOPILOT_ALLOW_UNSAFE_UPSTREAM) === "1";
     this.#fetch = options.fetch ?? fetch;
     this.#githubApiBaseUrl = trimTrailingSlash(
-      options.githubApiBaseUrl ?? options.env?.HOOPILOT_GITHUB_API_BASE_URL ?? DEFAULT_GITHUB_API_BASE_URL
+      options.githubApiBaseUrl ?? envValue(options.env?.HOOPILOT_GITHUB_API_BASE_URL) ?? DEFAULT_GITHUB_API_BASE_URL
     );
   }
   /**
@@ -183,9 +234,13 @@ var CopilotClient = class {
    * accepted directly here — no Copilot token exchange is required to read quota.
    */
   async usage(signal) {
-    if (!isHttpsOrLoopbackUrl(this.#githubApiBaseUrl)) {
+    if (!isTrustedTokenBaseUrl(
+      this.#githubApiBaseUrl,
+      ALLOWED_GITHUB_API_HOSTS,
+      this.#allowUnsafeUpstream
+    )) {
       throw new Error(
-        `Refusing to send the GitHub OAuth token to a non-HTTPS host: ${this.#githubApiBaseUrl}`
+        `Refusing to send the GitHub OAuth token to an untrusted GitHub API host: ${this.#githubApiBaseUrl}`
       );
     }
     const access = await this.#auth.getAccess();
@@ -227,9 +282,13 @@ var CopilotClient = class {
   }
   async fetchCopilot(path, init) {
     const access = await this.#auth.getAccess();
-    if (!isHttpsOrLoopbackUrl(access.apiBaseUrl)) {
+    if (!isTrustedTokenBaseUrl(
+      access.apiBaseUrl,
+      ALLOWED_COPILOT_API_HOSTS,
+      this.#allowUnsafeUpstream
+    )) {
       throw new Error(
-        `Refusing to send the GitHub OAuth token to a non-HTTPS host: ${access.apiBaseUrl}`
+        `Refusing to send the GitHub OAuth token to an untrusted Copilot API host: ${access.apiBaseUrl}`
       );
     }
     const headers = applyCopilotHeaders(new Headers(init.headers), access.token);
@@ -315,9 +374,9 @@ async function githubCopilotDeviceLogin(options = {}) {
   const fetcher = options.fetch ?? fetch;
   const sleeper = options.sleep ?? sleep;
   const domain = normalizeDomain(
-    options.domain ?? env.HOOPILOT_GITHUB_DOMAIN ?? DEFAULT_GITHUB_DOMAIN
+    options.domain ?? envValue(env.HOOPILOT_GITHUB_DOMAIN) ?? DEFAULT_GITHUB_DOMAIN
   );
-  const clientId = options.clientId ?? env.HOOPILOT_GITHUB_CLIENT_ID ?? env.COPILOT_GITHUB_CLIENT_ID ?? DEFAULT_GITHUB_COPILOT_CLIENT_ID;
+  const clientId = options.clientId ?? envValue(env.HOOPILOT_GITHUB_CLIENT_ID) ?? envValue(env.COPILOT_GITHUB_CLIENT_ID) ?? DEFAULT_GITHUB_COPILOT_CLIENT_ID;
   const device = await requestDeviceCode(fetcher, domain, clientId);
   const verificationUrl = device.verification_uri;
   const userCode = device.user_code;
@@ -475,8 +534,8 @@ var noopLogger = {
 };
 function createHoopilotLogger(options = {}) {
   const env = options.env ?? process.env;
-  const level = parseLogLevel(options.level ?? env.HOOPILOT_LOG_LEVEL);
-  const format = parseLogFormat(options.format ?? env.HOOPILOT_LOG_FORMAT);
+  const level = parseLogLevel(options.level ?? envValue(env.HOOPILOT_LOG_LEVEL));
+  const format = parseLogFormat(options.format ?? envValue(env.HOOPILOT_LOG_FORMAT));
   const pinoOptions = {
     base: {
       service: "hoopilot",
@@ -526,7 +585,7 @@ function parseLogLevel(value) {
 }
 function shouldCreateLogger(options) {
   return Boolean(
-    options.logger || options.logFormat || options.logLevel || options.env?.HOOPILOT_LOG_FORMAT || options.env?.HOOPILOT_LOG_LEVEL
+    options.logger || options.logFormat || options.logLevel || envValue(options.env?.HOOPILOT_LOG_FORMAT) || envValue(options.env?.HOOPILOT_LOG_LEVEL)
   );
 }
 function errorDetails(error) {
@@ -548,6 +607,12 @@ function isLogLevel(value) {
 
 // src/openai.ts
 var DEFAULT_MODEL = "gpt-4.1";
+var OpenAICompatibilityError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "OpenAICompatibilityError";
+  }
+};
 function responsesRequestToChatCompletion(request) {
   const messages = [];
   const instructions = contentToText(request.instructions);
@@ -581,13 +646,22 @@ function normalizeChatCompletionRequest(request) {
   });
 }
 function completionsRequestToChatCompletion(request) {
+  assertSupportedLegacyCompletionRequest(request);
   return removeUndefined({
+    frequency_penalty: request.frequency_penalty,
+    logit_bias: request.logit_bias,
     max_tokens: request.max_tokens,
-    messages: [{ content: promptToText(request.prompt), role: "user" }],
+    messages: [{ content: legacyPromptToText(request.prompt), role: "user" }],
     model: normalizeRequestedModel(request.model),
+    n: request.n,
+    presence_penalty: request.presence_penalty,
+    seed: request.seed,
+    stop: request.stop,
     stream: request.stream === true,
+    stream_options: request.stream_options,
     temperature: request.temperature,
-    top_p: request.top_p
+    top_p: request.top_p,
+    user: request.user
   });
 }
 function normalizeRequestedModel(model) {
@@ -623,21 +697,21 @@ function chatCompletionToResponse(completion, responseId) {
   });
 }
 function chatCompletionToCompletion(completion) {
-  const choice = firstChoice(completion);
-  const message = asRecord(choice.message);
   return removeUndefined({
-    choices: [
-      {
+    choices: completionChoices(completion).map((choice, index) => {
+      const message = asRecord(choice.message);
+      return {
         finish_reason: choice.finish_reason ?? "stop",
-        index: 0,
-        logprobs: null,
-        text: contentToText(message.content)
-      }
-    ],
+        index: typeof choice.index === "number" ? choice.index : index,
+        logprobs: choice.logprobs ?? null,
+        text: contentToText(choice.text) || contentToText(message.content)
+      };
+    }),
     created: completion.created ?? epochSeconds(),
     id: completion.id ?? `cmpl_${randomId()}`,
     model: completion.model ?? DEFAULT_MODEL,
     object: "text_completion",
+    system_fingerprint: completion.system_fingerprint,
     usage: completion.usage
   });
 }
@@ -645,12 +719,15 @@ function completionStreamFromChatStream(chatStream) {
   const encoder = new TextEncoder();
   const decoder = new TextDecoder();
   let buffer = "";
-  let sawDone = false;
+  let sawTerminalEvent = false;
   return new ReadableStream({
     async start(controller) {
       const enqueue = (data) => {
         controller.enqueue(encoder.encode(encodeDataSse(data)));
       };
+      const markTerminal = () => {
+        sawTerminalEvent = true;
+      };
       const reader = chatStream.getReader();
       try {
         while (true) {
@@ -659,20 +736,17 @@ function completionStreamFromChatStream(chatStream) {
             break;
           }
           buffer += decoder.decode(result.value, { stream: true });
-          const lines = buffer.split(/\r?\n/);
-          buffer = lines.pop() ?? "";
-          for (const line of lines) {
-            processCompletionSseLine(line, enqueue, () => {
-              sawDone = true;
-            });
+          const blocks = buffer.split(/\r?\n\r?\n/);
+          buffer = blocks.pop() ?? "";
+          for (const block of blocks) {
+            processCompletionSseBlock(block, enqueue, markTerminal);
           }
         }
-        if (buffer) {
-          processCompletionSseLine(buffer, enqueue, () => {
-            sawDone = true;
-          });
+        const tail = `${buffer}${decoder.decode()}`;
+        if (tail.trim()) {
+          processCompletionSseBlock(tail, enqueue, markTerminal);
         }
-        if (!sawDone) {
+        if (!sawTerminalEvent) {
           enqueue("[DONE]");
         }
         controller.close();
@@ -901,7 +975,8 @@ function inputToMessages(input) {
   const messages = [];
   for (const item of input) {
     const record = asRecord(item);
-    if (record.type === "function_call_output") {
+    const type = contentToText(record.type);
+    if (type === "function_call_output") {
       messages.push({
         content: contentToText(record.output),
         role: "tool",
@@ -909,7 +984,7 @@ function inputToMessages(input) {
       });
       continue;
     }
-    if (record.type === "function_call") {
+    if (type === "function_call") {
       messages.push({
         role: "assistant",
         tool_calls: [
@@ -925,7 +1000,10 @@ function inputToMessages(input) {
       });
       continue;
     }
-    const role = roleToChatRole(contentToText(record.role));
+    if (type && type !== "message") {
+      unsupportedResponsesFeature(`input item type "${type}"`);
+    }
+    const role = responsesRoleToChatRole(contentToText(record.role));
     const content = chatMessageContent(record.content);
     if (role && content !== void 0) {
       messages.push({ content, role });
@@ -938,7 +1016,10 @@ function chatMessageContent(content) {
     return content;
   }
   if (!Array.isArray(content)) {
-    return contentToText(content) || void 0;
+    if (content === void 0 || content === null) {
+      return void 0;
+    }
+    unsupportedResponsesFeature("non-array message content objects");
   }
   const parts = [];
   for (const part of content) {
@@ -946,13 +1027,31 @@ function chatMessageContent(content) {
     const type = contentToText(record.type);
     if (type === "input_text" || type === "output_text" || type === "text") {
       parts.push({ text: contentToText(record.text), type: "text" });
+      continue;
     }
     if (type === "input_image") {
+      if (contentToText(record.file_id)) {
+        unsupportedResponsesFeature("input_image file_id parts");
+      }
       const imageUrl = contentToText(record.image_url);
-      if (imageUrl) {
-        parts.push({ image_url: { url: imageUrl }, type: "image_url" });
+      if (!imageUrl) {
+        unsupportedResponsesFeature("input_image parts without image_url");
       }
+      const image = { url: imageUrl };
+      const detail = contentToText(record.detail);
+      if (detail) {
+        image.detail = detail;
+      }
+      parts.push({ image_url: image, type: "image_url" });
+      continue;
+    }
+    if (type === "input_file") {
+      unsupportedResponsesFeature("input_file parts");
     }
+    if (type === "input_audio") {
+      unsupportedResponsesFeature("input_audio parts");
+    }
+    unsupportedResponsesFeature(`content part type "${type || "unknown"}"`);
   }
   if (parts.length === 0) {
     return void 0;
@@ -962,11 +1061,38 @@ function chatMessageContent(content) {
   }
   return parts;
 }
-function promptToText(prompt) {
-  if (Array.isArray(prompt)) {
-    return prompt.map((item) => contentToText(item)).join("\n");
+function legacyPromptToText(prompt) {
+  if (typeof prompt === "string") {
+    return prompt;
+  }
+  if (Array.isArray(prompt) && prompt.length === 1 && typeof prompt[0] === "string") {
+    return prompt[0];
+  }
+  throw new OpenAICompatibilityError(
+    "Hoopilot legacy completions compatibility supports exactly one string prompt per request."
+  );
+}
+function assertSupportedLegacyCompletionRequest(request) {
+  if (request.echo === true) {
+    throw new OpenAICompatibilityError(
+      "Hoopilot legacy completions compatibility does not support echo=true."
+    );
+  }
+  if (typeof request.best_of === "number" && request.best_of > 1) {
+    throw new OpenAICompatibilityError(
+      "Hoopilot legacy completions compatibility does not support best_of greater than 1."
+    );
+  }
+  if (typeof request.logprobs === "number" && request.logprobs > 0) {
+    throw new OpenAICompatibilityError(
+      "Hoopilot legacy completions compatibility does not support legacy logprobs."
+    );
+  }
+  if (contentToText(request.suffix)) {
+    throw new OpenAICompatibilityError(
+      "Hoopilot legacy completions compatibility does not support suffix."
+    );
   }
-  return contentToText(prompt);
 }
 function contentToText(content) {
   if (typeof content === "string") {
@@ -990,25 +1116,35 @@ function contentToText(content) {
   }
   return "";
 }
-function roleToChatRole(role) {
-  if (role === "assistant" || role === "developer" || role === "system" || role === "tool") {
+function responsesRoleToChatRole(role) {
+  if (!role) {
+    return "user";
+  }
+  if (role === "assistant" || role === "developer" || role === "system" || role === "tool" || role === "user") {
     return role === "developer" ? "system" : role;
   }
-  return "user";
+  unsupportedResponsesFeature(`message role "${role}"`);
 }
 function chatTools(tools) {
   if (!Array.isArray(tools)) {
     return void 0;
   }
-  const converted = tools.map((tool) => asRecord(tool)).filter((tool) => tool.type === "function").map((tool) => ({
-    function: removeUndefined({
-      description: tool.description,
-      name: tool.name,
-      parameters: tool.parameters,
-      strict: tool.strict
-    }),
-    type: "function"
-  }));
+  const converted = tools.map((tool) => {
+    const record = asRecord(tool);
+    const type = contentToText(record.type);
+    if (type !== "function") {
+      unsupportedResponsesFeature(`tool type "${type || "unknown"}"`);
+    }
+    return {
+      function: removeUndefined({
+        description: record.description,
+        name: record.name,
+        parameters: record.parameters,
+        strict: record.strict
+      }),
+      type: "function"
+    };
+  });
   return converted.length > 0 ? converted : void 0;
 }
 function chatToolChoice(toolChoice) {
@@ -1016,10 +1152,16 @@ function chatToolChoice(toolChoice) {
     return toolChoice;
   }
   const record = asRecord(toolChoice);
-  if (record.type === "function" && typeof record.name === "string") {
+  const type = contentToText(record.type);
+  if (type === "function" && typeof record.name === "string") {
     return { function: { name: record.name }, type: "function" };
   }
-  return toolChoice;
+  unsupportedResponsesFeature(`tool_choice type "${type || "unknown"}"`);
+}
+function unsupportedResponsesFeature(feature) {
+  throw new OpenAICompatibilityError(
+    `Hoopilot Responses-to-chat compatibility does not support ${feature}.`
+  );
 }
 function outputItemsFromMessage(message) {
   const output = [];
@@ -1134,20 +1276,29 @@ function firstNumber(...values) {
   return void 0;
 }
 function firstChoice(completion) {
-  const choices = Array.isArray(completion.choices) ? completion.choices : [];
-  return asRecord(choices[0]);
+  return completionChoices(completion)[0] ?? {};
 }
-function processCompletionSseLine(line, enqueue, markDone) {
-  const trimmed = line.trim();
-  if (!trimmed.startsWith("data:")) {
-    return;
+function completionChoices(completion) {
+  const choices = Array.isArray(completion.choices) ? completion.choices : [];
+  return choices.map((choice) => asRecord(choice));
+}
+function processCompletionSseBlock(block, enqueue, markTerminal) {
+  let event = "message";
+  const dataLines = [];
+  for (const line of block.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("event:")) {
+      event = trimmed.slice("event:".length).trim() || event;
+    } else if (trimmed.startsWith("data:")) {
+      dataLines.push(trimmed.slice("data:".length).trim());
+    }
   }
-  const data = trimmed.slice("data:".length).trim();
+  const data = dataLines.join("\n");
   if (!data) {
     return;
   }
   if (data === "[DONE]") {
-    markDone();
+    markTerminal();
     enqueue("[DONE]");
     return;
   }
@@ -1155,25 +1306,34 @@ function processCompletionSseLine(line, enqueue, markDone) {
   if (!parsed) {
     return;
   }
-  const choice = firstChoice(parsed);
-  const delta = asRecord(choice.delta);
-  const text = contentToText(delta.content);
-  const finishReason = choice.finish_reason ?? null;
+  const error = completionStreamError(event, parsed);
+  if (error) {
+    markTerminal();
+    enqueue({ error });
+    return;
+  }
+  const choices = completionChoices(parsed).map((choice, index) => {
+    const delta = asRecord(choice.delta);
+    const text = contentToText(delta.content);
+    const finishReason = choice.finish_reason ?? null;
+    if (!text && finishReason === null) {
+      return void 0;
+    }
+    return {
+      finish_reason: finishReason,
+      index: typeof choice.index === "number" ? choice.index : index,
+      logprobs: choice.logprobs ?? null,
+      text
+    };
+  }).filter((choice) => choice !== void 0);
   const usage = asRecord(parsed.usage);
   const hasUsage = Object.keys(usage).length > 0;
-  if (!text && finishReason === null && !hasUsage) {
+  if (choices.length === 0 && !hasUsage) {
     return;
   }
   enqueue(
     removeUndefined({
-      choices: text || finishReason !== null ? [
-        {
-          finish_reason: finishReason,
-          index: typeof choice.index === "number" ? choice.index : 0,
-          logprobs: null,
-          text
-        }
-      ] : [],
+      choices,
       created: typeof parsed.created === "number" ? parsed.created : epochSeconds(),
       id: contentToText(parsed.id) || `cmpl_${randomId()}`,
       model: contentToText(parsed.model) || DEFAULT_MODEL,
@@ -1182,6 +1342,22 @@ function processCompletionSseLine(line, enqueue, markDone) {
     })
   );
 }
+function completionStreamError(event, parsed) {
+  const responseError = asRecord(asRecord(parsed.response).error);
+  const directError = asRecord(parsed.error);
+  const error = Object.keys(directError).length > 0 ? directError : Object.keys(responseError).length > 0 ? responseError : void 0;
+  if (error) {
+    return error;
+  }
+  if (event === "error" || parsed.type === "response.failed") {
+    return removeUndefined({
+      code: contentToText(parsed.code) || void 0,
+      message: contentToText(parsed.message) || "Upstream streaming request failed.",
+      type: contentToText(parsed.type) || "upstream_stream_error"
+    });
+  }
+  return void 0;
+}
 function processChatSseLine(line, handlers) {
   const trimmed = line.trim();
   if (!trimmed.startsWith("data:")) {
@@ -1631,10 +1807,19 @@ var DEFAULT_HOST = "127.0.0.1";
 var DEFAULT_PORT = 4141;
 var FORBIDDEN_BROWSER_ORIGIN_MESSAGE = "Browser-origin requests require HOOPILOT_API_KEY unless the Origin is loopback.";
 var INVALID_JSON_MESSAGE = "Request body must be valid JSON.";
+var MAX_REQUEST_BODY_BYTES = 16 * 1024 * 1024;
+var REQUEST_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
+var REQUEST_TOO_LARGE_MESSAGE = `Request body must be ${MAX_REQUEST_BODY_BYTES} bytes or smaller.`;
 var USAGE_CACHE_TTL_MS = 6e4;
+var RequestBodyTooLargeError = class extends Error {
+  constructor() {
+    super(REQUEST_TOO_LARGE_MESSAGE);
+    this.name = "RequestBodyTooLargeError";
+  }
+};
 function createHoopilotHandler(options = {}) {
   const client = new CopilotClient(options);
-  const apiKey = options.apiKey ?? options.env?.HOOPILOT_API_KEY;
+  const apiKey = options.apiKey ?? envValue(options.env?.HOOPILOT_API_KEY);
   const logger = serverLogger(options);
   const metrics = options.metrics ?? new MetricsRegistry();
   const readUsage = createUsageReader(client, metrics);
@@ -1720,6 +1905,18 @@ function createHoopilotHandler(options = {}) {
           "request body was invalid json"
         );
         return finish(jsonError(400, "invalid_request_error", message));
+      } else if (error instanceof OpenAICompatibilityError) {
+        requestLogger.warn(
+          { err: errorDetails(error), event: "http.request.failed" },
+          "request body used unsupported OpenAI compatibility fields"
+        );
+        return finish(jsonError(400, "invalid_request_error", message));
+      } else if (error instanceof RequestBodyTooLargeError) {
+        requestLogger.warn(
+          { err: errorDetails(error), event: "http.request.failed" },
+          "request body exceeded size limit"
+        );
+        return finish(jsonError(413, "request_too_large", message));
       } else {
         requestLogger.error(
           { err: errorDetails(error), event: "http.request.failed" },
@@ -1731,10 +1928,10 @@ function createHoopilotHandler(options = {}) {
   };
 }
 function startHoopilotServer(options = {}) {
-  const host = options.host ?? options.env?.HOST ?? DEFAULT_HOST;
-  const port = normalizeServerPort(options.port ?? options.env?.PORT ?? DEFAULT_PORT);
-  const apiKey = options.apiKey ?? options.env?.HOOPILOT_API_KEY;
-  const allowUnauthenticated = options.allowUnauthenticated ?? options.env?.HOOPILOT_ALLOW_UNAUTHENTICATED === "1";
+  const host = options.host ?? envValue(options.env?.HOST) ?? DEFAULT_HOST;
+  const port = normalizeServerPort(options.port ?? envValue(options.env?.PORT) ?? DEFAULT_PORT);
+  const apiKey = options.apiKey ?? envValue(options.env?.HOOPILOT_API_KEY);
+  const allowUnauthenticated = options.allowUnauthenticated ?? envValue(options.env?.HOOPILOT_ALLOW_UNAUTHENTICATED) === "1";
   if (!isLoopbackHost(host) && !apiKey && !allowUnauthenticated) {
     throw new Error(
       "Refusing to listen on a non-loopback host without HOOPILOT_API_KEY. Set an API key or pass --allow-unauthenticated."
@@ -1752,7 +1949,7 @@ function startHoopilotServer(options = {}) {
   });
   return {
     server,
-    url: `http://${host}:${server.port}`
+    url: `http://${urlHost(host)}:${server.port}`
   };
 }
 async function handleModels(client, metrics, signal, logger) {
@@ -1861,14 +2058,15 @@ function proxyResponse(upstream) {
   });
 }
 async function readJson(request) {
+  const text = await readRequestText(request);
   try {
-    return asRecord(await request.json());
+    return asRecord(JSON.parse(text));
   } catch {
     throw new Error(INVALID_JSON_MESSAGE);
   }
 }
 async function readJsonText(request) {
-  const text = await request.text();
+  const text = await readRequestText(request);
   try {
     JSON.parse(text);
     return text;
@@ -1876,6 +2074,40 @@ async function readJsonText(request) {
     throw new Error(INVALID_JSON_MESSAGE);
   }
 }
+async function readRequestText(request) {
+  const contentLength = request.headers.get("content-length");
+  if (contentLength) {
+    const declaredBytes = Number(contentLength);
+    if (Number.isFinite(declaredBytes) && declaredBytes > MAX_REQUEST_BODY_BYTES) {
+      throw new RequestBodyTooLargeError();
+    }
+  }
+  const body = request.body;
+  if (!body) {
+    return "";
+  }
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let bytes = 0;
+  let text = "";
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) {
+        return `${text}${decoder.decode()}`;
+      }
+      bytes += value.byteLength;
+      if (bytes > MAX_REQUEST_BODY_BYTES) {
+        await reader.cancel().catch(() => {
+        });
+        throw new RequestBodyTooLargeError();
+      }
+      text += decoder.decode(value, { stream: true });
+    }
+  } finally {
+    reader.releaseLock();
+  }
+}
 function jsonResponse(body, status = 200) {
   return new Response(JSON.stringify(body), {
     headers: {
@@ -1948,6 +2180,9 @@ function upstreamAuthMessage(message) {
 function isLoopbackHost(host) {
   return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
 }
+function urlHost(host) {
+  return host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+}
 function isLoopbackOrigin(origin) {
   try {
     return isLoopbackHost(new URL(origin).hostname.toLowerCase());
@@ -2055,7 +2290,7 @@ function logRequestCompleted(logger, status, stream, durationMs) {
 }
 function requestIdFor(request) {
   const existing = request.headers.get("x-request-id")?.trim();
-  return existing || crypto.randomUUID();
+  return existing && REQUEST_ID_PATTERN.test(existing) ? existing : crypto.randomUUID();
 }
 function canonicalApiPath(path) {
   const withoutTrailingSlash = path.length > 1 ? path.replace(/\/+$/, "") : path;