@openhoo/hoopilot 1.3.0 → 2.1.0

package/dist/cli.js

@@ -2,18 +2,27 @@
 import {
   asRecord,
   envValue,
+  errorMessage,
+  firstNumber,
+  isLoopbackHostname,
   isTrustedTokenBaseUrl,
   main,
+  modelIdsFromResponse,
+  parseJsonObject,
+  parseStreamingProxyMode,
+  randomId,
+  removeUndefined,
+  safeJsonParse,
   trimTrailingSlash,
   truncatedResponseText
-} from "./chunk-JU6F5L34.js";
+} from "./chunk-6ALEIJJM.js";
 
 // src/cli.ts
 import { spawn } from "child_process";
 import { readFileSync as readFileSync2 } from "fs";
 
 // src/auth-store.ts
-import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
+import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "fs";
 import { dirname, join } from "path";
 var StoredCopilotAuthError = class extends Error {
   constructor(message) {
@@ -64,7 +73,7 @@ function readStoredCopilotAuth(path = authStorePath()) {
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new StoredCopilotAuthError(`Hoopilot auth file at ${path} must contain a JSON object.`);
   }
-  const record = parsed;
+  const record = asRecord(parsed);
   const token = typeof record.token === "string" ? record.token.trim() : "";
   if (!token) {
     throw new StoredCopilotAuthError(`Hoopilot auth file at ${path} does not contain a token.`);
@@ -90,7 +99,15 @@ function writeStoredCopilotAuth(auth, path = authStorePath()) {
 `;
   const tmpPath = `${path}.${process.pid}.tmp`;
   writeFileSync(tmpPath, data, { mode: 384 });
-  renameSync(tmpPath, path);
+  try {
+    renameSync(tmpPath, path);
+  } catch (error) {
+    try {
+      rmSync(tmpPath, { force: true });
+    } catch {
+    }
+    throw error;
+  }
   try {
     chmodSync(path, 384);
   } catch {
@@ -135,23 +152,20 @@ var CopilotAuth = class {
       throw error;
     }
     if (stored) {
-      return this.#cacheAccess({
+      this.#cachedAccess = {
         apiBaseUrl: trimTrailingSlash(
           this.#hasCopilotApiBaseUrlOverride ? this.#copilotApiBaseUrl : stored.apiBaseUrl ?? this.#copilotApiBaseUrl
         ),
         expiresAtMs: Date.now() + STORED_TOKEN_TTL_MS,
         source: "github-copilot-oauth",
         token: stored.token
-      });
+      };
+      return this.#cachedAccess;
     }
     throw new CopilotAuthError(
       "No GitHub Copilot OAuth credential found. Run `hoopilot login` to sign in through your browser."
     );
   }
-  #cacheAccess(access) {
-    this.#cachedAccess = access;
-    return access;
-  }
 };
 
 // src/copilot.ts
@@ -159,23 +173,26 @@ var DEFAULT_GITHUB_API_BASE_URL = "https://api.github.com";
 var ALLOWED_COPILOT_API_HOSTS = ["api.githubcopilot.com"];
 var ALLOWED_GITHUB_API_HOSTS = ["api.github.com"];
 var COPILOT_USAGE_API_VERSION = "2025-04-01";
+var EDITOR_PLUGIN_VERSION = "hoopilot/0.1.0";
+var EDITOR_VERSION = "Hoopilot/0.1.0";
+var HOOPILOT_USER_AGENT = "hoopilot/0.1.0";
 function applyCopilotHeaders(headers, token) {
   headers.set("accept", headers.get("accept") ?? "application/json");
   headers.set("authorization", `Bearer ${token}`);
   headers.set("copilot-integration-id", "vscode-chat");
-  headers.set("editor-plugin-version", "hoopilot/0.1.0");
-  headers.set("editor-version", "Hoopilot/0.1.0");
+  headers.set("editor-plugin-version", EDITOR_PLUGIN_VERSION);
+  headers.set("editor-version", EDITOR_VERSION);
   headers.set("openai-intent", "conversation-panel");
-  headers.set("user-agent", "hoopilot/0.1.0");
+  headers.set("user-agent", HOOPILOT_USER_AGENT);
   headers.set("x-github-api-version", "2026-06-01");
   return headers;
 }
 function applyGithubApiHeaders(headers, token) {
   headers.set("accept", headers.get("accept") ?? "application/json");
   headers.set("authorization", `token ${token}`);
-  headers.set("editor-plugin-version", "hoopilot/0.1.0");
-  headers.set("editor-version", "Hoopilot/0.1.0");
-  headers.set("user-agent", "hoopilot/0.1.0");
+  headers.set("editor-plugin-version", EDITOR_PLUGIN_VERSION);
+  headers.set("editor-version", EDITOR_VERSION);
+  headers.set("user-agent", HOOPILOT_USER_AGENT);
   headers.set("x-github-api-version", COPILOT_USAGE_API_VERSION);
   return headers;
 }
@@ -188,7 +205,7 @@ function parseRateLimitHeaders(headers, nowMs = Date.now()) {
   if (limit === void 0 && remaining === void 0 && used === void 0 && resetEpochSeconds === void 0 && retryAfterSeconds === void 0) {
     return void 0;
   }
-  return removeUndefinedRateLimit({
+  return removeUndefined({
     limit,
     observedAtMs: nowMs,
     remaining,
@@ -206,11 +223,6 @@ function headerInt(headers, name) {
   const value = Number.parseInt(raw.trim(), 10);
   return Number.isFinite(value) && value >= 0 ? value : void 0;
 }
-function removeUndefinedRateLimit(rateLimit) {
-  return Object.fromEntries(
-    Object.entries(rateLimit).filter(([, value]) => value !== void 0)
-  );
-}
 var CopilotClient = class {
   #auth;
   #allowUnsafeUpstream;
@@ -307,7 +319,7 @@ function normalizeCopilotUsage(body) {
     for (const category of /* @__PURE__ */ new Set([...Object.keys(remaining), ...Object.keys(monthly)])) {
       const entitlement = numberOrUndefined(monthly[category]);
       const left = numberOrUndefined(remaining[category]);
-      quotas[category] = removeUndefinedQuota({
+      quotas[category] = removeUndefined({
         entitlement,
         percentRemaining: entitlement !== void 0 && entitlement > 0 && left !== void 0 ? left / entitlement * 100 : void 0,
         remaining: left,
@@ -315,7 +327,7 @@ function normalizeCopilotUsage(body) {
       });
     }
   }
-  return removeUndefinedUsage({
+  return removeUndefined({
     accessTypeSku: stringOrUndefined(record.access_type_sku),
     chatEnabled: typeof record.chat_enabled === "boolean" ? record.chat_enabled : void 0,
     plan: stringOrUndefined(record.copilot_plan),
@@ -327,7 +339,7 @@ function normalizeQuotaDetail(detail) {
   const entitlement = numberOrUndefined(detail.entitlement);
   const overageCount = numberOrUndefined(detail.overage_count);
   const remaining = numberOrUndefined(detail.remaining) ?? numberOrUndefined(detail.quota_remaining);
-  return removeUndefinedQuota({
+  return removeUndefined({
     entitlement,
     hasQuota: typeof detail.has_quota === "boolean" ? detail.has_quota : void 0,
     overageCount,
@@ -351,21 +363,10 @@ function usedFrom(entitlement, remaining, overageCount) {
   const overage = remaining === 0 ? overageCount ?? 0 : 0;
   return Math.max(0, base + overage);
 }
-function numberOrUndefined(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-}
+var numberOrUndefined = firstNumber;
 function stringOrUndefined(value) {
   return typeof value === "string" && value.length > 0 ? value : void 0;
 }
-function removeUndefinedQuota(quota) {
-  return Object.fromEntries(
-    Object.entries(quota).filter(([, value]) => value !== void 0)
-  );
-}
-function removeUndefinedUsage(usage) {
-  const entries = Object.entries(usage).filter(([, value]) => value !== void 0);
-  return Object.fromEntries(entries);
-}
 
 // src/github-device.ts
 import { setTimeout as sleep } from "timers/promises";
@@ -497,11 +498,16 @@ function positiveSeconds(value, fallback) {
 }
 async function parseJsonResponse(response, context) {
   const text = await response.text();
+  let value;
   try {
-    return JSON.parse(text);
+    value = JSON.parse(text);
   } catch {
     throw new Error(`${context}: ${text.slice(0, 500)}`);
   }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${context}: ${text.slice(0, 500)}`);
+  }
+  return value;
 }
 
 // src/logger.ts
@@ -565,21 +571,29 @@ function createHoopilotLogger(options = {}) {
     timestamp: pino.stdTimeFunctions.isoTime
   };
   if (format === "pretty") {
-    return pino(
-      pinoOptions,
-      pretty({
-        colorize: options.colorize ?? process.stderr.isTTY,
-        destination: options.stream ?? 1,
-        ignore: "pid,hostname",
-        singleLine: true,
-        translateTime: "SYS:standard"
-      })
+    return asHoopilotLogger(
+      pino(
+        pinoOptions,
+        pretty({
+          // Probe the same sink we write to (stdout / fd 1), so colors are not
+          // emitted into a redirected file when only stderr is a TTY. A custom
+          // stream's TTY-ness is unknown, so default to no color there.
+          colorize: options.colorize ?? (options.stream ? false : process.stdout.isTTY),
+          destination: options.stream ?? 1,
+          ignore: "pid,hostname",
+          singleLine: true,
+          translateTime: "SYS:standard"
+        })
+      )
     );
   }
   if (options.stream) {
-    return pino(pinoOptions, options.stream);
+    return asHoopilotLogger(pino(pinoOptions, options.stream));
   }
-  return pino(pinoOptions);
+  return asHoopilotLogger(pino(pinoOptions));
+}
+function asHoopilotLogger(logger) {
+  return logger;
 }
 function parseLogFormat(value) {
   if (!value) {
@@ -621,6 +635,10 @@ function isLogLevel(value) {
   return LOG_LEVELS.includes(value);
 }
 
+// src/server.ts
+import { createHash, timingSafeEqual } from "crypto";
+import { Elysia } from "elysia";
+
 // src/openai.ts
 var DEFAULT_MODEL = "gpt-4.1";
 var OpenAICompatibilityError = class extends Error {
@@ -693,13 +711,6 @@ function compactionOutputFromResponsesSse(text) {
   }
   return deltas ? [messageOutputItem(deltas)] : [];
 }
-function safeJsonParse(text) {
-  try {
-    return JSON.parse(text);
-  } catch {
-    return void 0;
-  }
-}
 function chatCompletionToCompletion(completion) {
   return removeUndefined({
     choices: completionChoices(completion).map((choice, index) => {
@@ -895,21 +906,18 @@ function extractTokenUsage(usage) {
     asRecord(record.prompt_tokens_details).cached_tokens,
     asRecord(record.input_tokens_details).cached_tokens
   );
-  return removeUndefined({
-    cachedTokens: cached,
+  const result = {
     completionTokens,
     promptTokens,
-    reasoningTokens: reasoning,
     totalTokens: total ?? promptTokens + completionTokens
-  });
-}
-function firstNumber(...values) {
-  for (const value of values) {
-    if (typeof value === "number" && Number.isFinite(value)) {
-      return value;
-    }
+  };
+  if (cached !== void 0) {
+    result.cachedTokens = cached;
   }
-  return void 0;
+  if (reasoning !== void 0) {
+    result.reasoningTokens = reasoning;
+  }
+  return result;
 }
 function completionChoices(completion) {
   const choices = Array.isArray(completion.choices) ? completion.choices : [];
@@ -935,7 +943,7 @@ function processCompletionSseBlock(block, enqueue, markTerminal) {
     enqueue("[DONE]");
     return;
   }
-  const parsed = parseJson(data);
+  const parsed = parseJsonObject(data);
   if (!parsed) {
     return;
   }
@@ -999,19 +1007,6 @@ function encodeDataSse(data) {
 
 `;
 }
-function parseJson(data) {
-  try {
-    return asRecord(JSON.parse(data));
-  } catch {
-    return void 0;
-  }
-}
-function removeUndefined(record) {
-  return Object.fromEntries(Object.entries(record).filter(([, value]) => value !== void 0));
-}
-function randomId() {
-  return crypto.randomUUID().replaceAll("-", "");
-}
 function epochSeconds() {
   return Math.floor(Date.now() / 1e3);
 }
@@ -1024,13 +1019,13 @@ var AnthropicCompatibilityError = class extends Error {
   }
 };
 function anthropicMessagesToResponsesRequest(request) {
-  return removeUndefined2({
+  return removeUndefined({
     input: anthropicMessagesToResponsesInput(request.messages),
     instructions: anthropicSystemToInstructions(request.system),
     max_output_tokens: typeof request.max_tokens === "number" && Number.isFinite(request.max_tokens) ? request.max_tokens : void 0,
     metadata: request.metadata,
     model: normalizeRequestedModel(request.model),
-    parallel_tool_calls: true,
+    parallel_tool_calls: asRecord(request.tool_choice).disable_parallel_tool_use !== true,
     reasoning: anthropicThinkingToReasoning(request.thinking),
     stop: anthropicStopSequences(request.stop_sequences),
     stream: request.stream === true,
@@ -1045,7 +1040,7 @@ function responsesResponseToAnthropicMessage(response, fallbackModel) {
   const usage = anthropicUsage(response.usage);
   return {
     content,
-    id: textValue(response.id) || `msg_${randomId2()}`,
+    id: textValue(response.id) || `msg_${randomId()}`,
     model: textValue(response.model) || fallbackModel,
     role: "assistant",
     stop_reason: anthropicStopReason(response, content),
@@ -1122,7 +1117,7 @@ function createAnthropicStreamState(options) {
   return {
     blocks: /* @__PURE__ */ new Map(),
     completed: false,
-    messageId: options.messageId ?? `msg_${randomId2()}`,
+    messageId: options.messageId ?? `msg_${randomId()}`,
     model: options.model,
     nextBlockIndex: 0,
     sawToolUse: false,
@@ -1176,7 +1171,7 @@ function anthropicMessagesToResponsesInput(messages) {
         flushMessage();
         input.push({
           arguments: JSON.stringify(asRecord(part.input)),
-          call_id: textValue(part.id) || `call_${randomId2()}`,
+          call_id: textValue(part.id) || `call_${randomId()}`,
           name: textValue(part.name),
           type: "function_call"
         });
@@ -1287,7 +1282,7 @@ function anthropicTools(tools) {
   }
   const converted = tools.map((tool) => {
     const record = asRecord(tool);
-    return removeUndefined2({
+    return removeUndefined({
       description: record.description,
       name: record.name,
       parameters: record.input_schema,
@@ -1358,7 +1353,7 @@ function anthropicContentFromResponsesOutput(response) {
     }
     if (type === "function_call") {
       content.push({
-        id: textValue(record.call_id) || textValue(record.id) || `call_${randomId2()}`,
+        id: textValue(record.call_id) || textValue(record.id) || `call_${randomId()}`,
         input: parseToolInput(textValue(record.arguments)),
         name: textValue(record.name),
         type: "tool_use"
@@ -1385,12 +1380,12 @@ function anthropicStopReason(response, content) {
 }
 function anthropicUsage(usage) {
   const record = asRecord(usage);
-  const inputTokens = firstNumber2(record.input_tokens, record.prompt_tokens) ?? 0;
-  const outputTokens = firstNumber2(record.output_tokens, record.completion_tokens) ?? 0;
+  const inputTokens = firstNumber(record.input_tokens, record.prompt_tokens) ?? 0;
+  const outputTokens = firstNumber(record.output_tokens, record.completion_tokens) ?? 0;
   const details = asRecord(record.input_tokens_details);
-  return removeUndefined2({
-    cache_creation_input_tokens: firstNumber2(record.cache_creation_input_tokens),
-    cache_read_input_tokens: firstNumber2(record.cache_read_input_tokens, details.cached_tokens) ?? void 0,
+  return removeUndefined({
+    cache_creation_input_tokens: firstNumber(record.cache_creation_input_tokens),
+    cache_read_input_tokens: firstNumber(record.cache_read_input_tokens, details.cached_tokens) ?? void 0,
     input_tokens: inputTokens,
     output_tokens: outputTokens
   });
@@ -1572,7 +1567,7 @@ function ensureToolBlock(state, payload, item, enqueue) {
     state.blocks.set(key, block);
     enqueue("content_block_start", {
       content_block: {
-        id: textValue(item.call_id) || textValue(item.id) || `call_${randomId2()}`,
+        id: textValue(item.call_id) || textValue(item.id) || `call_${randomId()}`,
         input: {},
         name: textValue(item.name),
         type: "tool_use"
@@ -1606,13 +1601,6 @@ function parseSseBlock(block) {
   }
   return { data: data.join("\n"), event };
 }
-function parseJsonObject(text) {
-  try {
-    return asRecord(JSON.parse(text));
-  } catch {
-    return void 0;
-  }
-}
 function parseToolInput(argumentsText) {
   const parsed = parseJsonObject(argumentsText);
   return parsed ?? {};
@@ -1644,29 +1632,15 @@ function textValue(value) {
   }
   return "";
 }
-function firstNumber2(...values) {
-  for (const value of values) {
-    if (typeof value === "number" && Number.isFinite(value)) {
-      return value;
-    }
-  }
-  return void 0;
-}
 function indexValue(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : 0;
 }
-function removeUndefined2(record) {
-  return Object.fromEntries(Object.entries(record).filter(([, value]) => value !== void 0));
-}
 function encodeSse(event, data) {
   return `event: ${event}
 data: ${JSON.stringify(data)}
 
 `;
 }
-function randomId2() {
-  return crypto.randomUUID().replaceAll("-", "");
-}
 
 // src/dashboard.ts
 var DASHBOARD_HTML = `<!doctype html>
@@ -2068,21 +2042,24 @@ footer.foot .end { margin-left:auto; }
   function mk(tag, cls, txt){ var e = document.createElement(tag); if (cls) e.className = cls; if (txt !== undefined && txt !== null) e.textContent = txt; return e; }
 
   // Set numeric text and flash on discrete change.
-  function setNum(id, value, kind){
+  function setNum(id, value, kind, num){
     var el = byId(id); if (!el) return;
     el.classList.remove("skel");
     var s = String(value);
     if (el.textContent !== s){
       el.textContent = s;
+      // Compare on the raw number (num) when provided, so directional flash works
+      // even when value is a pre-formatted display string.
+      var n = (num !== undefined) ? num : value;
       var prev = lastRender[id];
       if (prev !== undefined){
         var cls = "flash";
-        if (kind === "delta" && typeof value === "number" && typeof prev === "number"){
-          cls = value > prev ? "flash-up" : (value < prev ? "flash-down" : null);
+        if (kind === "delta" && typeof n === "number" && typeof prev === "number"){
+          cls = n > prev ? "flash-up" : (n < prev ? "flash-down" : null);
         }
         if (cls){ el.classList.remove("flash","flash-up","flash-down"); void el.offsetWidth; el.classList.add(cls); }
       }
-      lastRender[id] = value;
+      lastRender[id] = n;
     }
   }
   function setText(id, s){ var el = byId(id); if (el){ el.classList.remove("skel"); el.textContent = s; } }
@@ -2163,7 +2140,7 @@ footer.foot .end { margin-left:auto; }
     if (beat && dot){ dot.classList.remove("heartbeat"); void dot.offsetWidth; dot.classList.add("heartbeat"); }
   }
   function showBanner(text, ok){
-    var b = byId("banner"); b.textContent = text; b.className = "banner show" + (ok ? " ok" : ""); b.classList.add("show");
+    var b = byId("banner"); b.textContent = text; b.className = "show" + (ok ? " ok" : "");
     if (ok){ setTimeout(function(){ b.classList.remove("show"); }, 2000); }
   }
   function hideBanner(){ byId("banner").classList.remove("show"); }
@@ -2270,7 +2247,7 @@ footer.foot .end { margin-left:auto; }
     if (isFinite(reqPerSec)){ pushHist(hist.req, reqPerSec); setNum("req-num", rate(reqPerSec)); } else setText("req-num","\\u2014");
     if (isFinite(tokPerSec)){ pushHist(hist.tok, tokPerSec); setNum("tok-num", humanInt(tokPerSec)); } else setText("tok-num","\\u2014");
     var inflight = proxy.inFlight || 0;
-    pushHist(hist.inflight, inflight); setNum("inflight-num", String(inflight), "delta");
+    pushHist(hist.inflight, inflight); setNum("inflight-num", String(inflight), "delta", inflight);
     byId("v-inflight").classList.toggle("active", inflight > 0);
     setText("uptime-num", fmtUptime(proxy.uptimeSeconds || 0));
 
@@ -2413,7 +2390,7 @@ footer.foot .end { margin-left:auto; }
 
   function renderUpstream(up, delta, restarted){
     setNum("up-total", humanInt(up.total||0));
-    setNum("up-errors", humanInt(up.errors||0), "delta");
+    setNum("up-errors", humanInt(up.errors||0), "delta", up.errors||0);
     var er = up.total ? (up.errors/up.total*100) : 0;
     var rt = byId("up-rate"); rt.textContent = pct(er); rt.className = "v rate " + (er > 5 ? "danger" : er > 1 ? "warn" : "ok");
     byId("up-errblk").classList.toggle("hot", (up.errors||0) > 0);
@@ -2558,26 +2535,23 @@ var MetricsRegistry = class {
     const resource = this.#rateLimitResource(rateLimit.resource);
     this.#githubRateLimit.set(resource, { ...rateLimit, resource });
   }
-  // Sanitize the model into a bounded label. The model can originate from a
-  // client request, so cap its length, strip characters that would corrupt the
-  // exposition format, and fold overflow past the cardinality limit into
-  // UNKNOWN_MODEL to keep the series count bounded.
-  #modelLabel(model) {
-    const cleaned = cleanLabel(model).slice(0, MAX_MODEL_LABEL_LENGTH) || UNKNOWN_MODEL;
-    if (!this.#tokens.has(cleaned) && this.#tokens.size >= MAX_TRACKED_MODELS) {
+  // Clean a raw value into a bounded exposition-format label: cap its length,
+  // strip characters that would corrupt the format, and fold overflow past the
+  // cardinality limit into UNKNOWN_MODEL so the series count stays bounded.
+  #boundedLabel(value, tracked, maxEntries) {
+    const cleaned = cleanLabel(value).slice(0, MAX_MODEL_LABEL_LENGTH) || UNKNOWN_MODEL;
+    if (!tracked.has(cleaned) && tracked.size >= maxEntries) {
       return UNKNOWN_MODEL;
     }
     return cleaned;
   }
-  // The resource comes from a trusted upstream header, but clean and bound it
-  // with the same discipline as model labels: strip control characters that
-  // would corrupt the exposition format and fold overflow into "unknown".
+  // The model can originate from a (possibly hostile) client request.
+  #modelLabel(model) {
+    return this.#boundedLabel(model, this.#tokens, MAX_TRACKED_MODELS);
+  }
+  // The resource comes from a trusted upstream header, but is bounded the same way.
   #rateLimitResource(resource) {
-    const cleaned = cleanLabel(resource).slice(0, MAX_MODEL_LABEL_LENGTH) || UNKNOWN_MODEL;
-    if (!this.#githubRateLimit.has(cleaned) && this.#githubRateLimit.size >= MAX_TRACKED_RATELIMIT_RESOURCES) {
-      return UNKNOWN_MODEL;
-    }
-    return cleaned;
+    return this.#boundedLabel(resource, this.#githubRateLimit, MAX_TRACKED_RATELIMIT_RESOURCES);
   }
   #observeDuration(route, seconds) {
     const value = Number.isFinite(seconds) && seconds >= 0 ? seconds : 0;
@@ -2903,7 +2877,7 @@ function recordResponseTextUsage(text, isSse, fallbackModel, onUsage, onOutcome)
       considerSseLine(line, accumulator.consider);
     }
   } else {
-    const parsed = safeParse(text);
+    const parsed = safeJsonParse(text);
     if (parsed !== void 0) {
       accumulator.consider(parsed);
     }
@@ -2965,7 +2939,7 @@ async function consumeUsage(stream, isSse, fallbackModel, onUsage, signal, onOut
         considerSseLine(finalBuffer, accumulator.consider);
       }
     } else if (!overflowed && finalBuffer) {
-      const parsed = safeParse(finalBuffer);
+      const parsed = safeJsonParse(finalBuffer);
       if (parsed !== void 0) {
         accumulator.consider(parsed);
       }
@@ -3008,18 +2982,11 @@ function considerSseLine(line, consider) {
   if (!data || data === "[DONE]") {
     return;
   }
-  const parsed = safeParse(data);
+  const parsed = safeJsonParse(data);
   if (parsed !== void 0) {
     consider(parsed);
   }
 }
-function safeParse(text) {
-  try {
-    return JSON.parse(text);
-  } catch {
-    return void 0;
-  }
-}
 function modelText(value) {
   return typeof value === "string" ? value.trim() : "";
 }
@@ -3109,8 +3076,9 @@ async function getVersion() {
     resolved = BAKED_VERSION;
   } else {
     try {
-      const manifest = await Bun.file(new URL("../package.json", import.meta.url)).json();
-      resolved = typeof manifest.version === "string" ? manifest.version : "0.0.0";
+      const manifest = asRecord(await Bun.file(new URL("../package.json", import.meta.url)).json());
+      const version = manifest.version;
+      resolved = typeof version === "string" ? version : "0.0.0";
     } catch {
       resolved = "0.0.0";
     }
@@ -3136,6 +3104,18 @@ var RequestBodyTooLargeError = class extends Error {
     this.name = "RequestBodyTooLargeError";
   }
 };
+var InvalidJsonError = class extends Error {
+  constructor() {
+    super(INVALID_JSON_MESSAGE);
+    this.name = "InvalidJsonError";
+  }
+};
+var JsonNotObjectError = class extends Error {
+  constructor() {
+    super(JSON_OBJECT_MESSAGE);
+    this.name = "JsonNotObjectError";
+  }
+};
 function createHoopilotHandler(options = {}) {
   const client = new CopilotClient(options);
   const apiKey = options.apiKey ?? envValue(options.env?.HOOPILOT_API_KEY);
@@ -3145,8 +3125,19 @@ function createHoopilotHandler(options = {}) {
   const readUsage = createUsageReader(client, metrics);
   const recordTokens = (model, usage) => metrics.recordTokens(model, usage);
   const recordExtraction = (extracted) => metrics.recordTokenExtraction(extracted);
-  const streamingProxyMode = resolveStreamingProxyMode(options);
-  const bufferProxyBodies = shouldBufferProxyBodies(streamingProxyMode);
+  const bufferProxyBodies = shouldBufferProxyBodies(resolveStreamingProxyMode(options));
+  const requestContext = /* @__PURE__ */ new WeakMap();
+  const app = buildApp({
+    apiKey,
+    allowedOrigins,
+    bufferProxyBodies,
+    client,
+    metrics,
+    readUsage,
+    recordExtraction,
+    recordTokens,
+    requestContext
+  });
   return async (request) => {
     const startedAt = performance.now();
     const url = new URL(request.url);
@@ -3162,7 +3153,24 @@ function createHoopilotHandler(options = {}) {
     metrics.startRequest();
     const origin = request.headers.get("origin")?.trim() || void 0;
     const corsOrigin = resolveCorsAllowOrigin(origin, allowedOrigins);
-    const finish = (response) => finishResponse(response, {
+    const inner = normalizeInnerRequest(request, apiPath, url);
+    requestContext.set(inner, {
+      apiPath,
+      logger: requestLogger,
+      origin,
+      originalPath: url.pathname
+    });
+    let response;
+    try {
+      response = await app.handle(inner);
+    } catch (error) {
+      requestLogger.error(
+        { err: errorDetails(error), event: "http.request.failed" },
+        "request failed"
+      );
+      response = jsonError(500, "internal_error", errorMessage(error));
+    }
+    return finishResponse(response, {
       corsOrigin,
       logger: requestLogger,
       method: request.method,
@@ -3173,144 +3181,175 @@ function createHoopilotHandler(options = {}) {
       closeConnection: bufferProxyBodies,
       trackStreamingBody: !bufferProxyBodies
     });
+  };
+}
+function buildApp(deps) {
+  const {
+    apiKey,
+    allowedOrigins,
+    bufferProxyBodies,
+    client,
+    metrics,
+    readUsage,
+    recordExtraction,
+    recordTokens,
+    requestContext
+  } = deps;
+  const contextFor = (request) => {
+    const stored = requestContext.get(request);
+    if (stored) {
+      return stored;
+    }
+    const originalPath = new URL(request.url).pathname;
+    return {
+      apiPath: canonicalApiPath(originalPath),
+      logger: noopLogger,
+      origin: request.headers.get("origin")?.trim() || void 0,
+      originalPath
+    };
+  };
+  const loggerFor = (request) => contextFor(request).logger;
+  const noBody = { parse: "none" };
+  return new Elysia().onRequest(({ request }) => {
+    const { apiPath, logger, origin } = contextFor(request);
     const browserOrigin = forbiddenBrowserOrigin(origin, request, allowedOrigins);
     if (browserOrigin) {
-      requestLogger.warn(
+      logger.warn(
         { event: "http.request.forbidden_origin", origin: browserOrigin },
         "blocked cross-origin browser request"
       );
-      return finish(jsonError(403, "forbidden_origin", FORBIDDEN_BROWSER_ORIGIN_MESSAGE));
+      return jsonError(403, "forbidden_origin", FORBIDDEN_BROWSER_ORIGIN_MESSAGE);
     }
     if (request.method === "OPTIONS") {
-      return finish(new Response(null, { headers: corsHeaders() }));
+      return new Response(null, { headers: corsHeaders() });
     }
     if (request.method === "GET" && apiPath === "/dashboard") {
-      return finish(dashboardResponse());
+      return dashboardResponse();
     }
     if (!isAuthorized(request, apiKey)) {
-      requestLogger.warn({ event: "http.request.unauthorized" }, "invalid hoopilot api key");
-      return finish(jsonError(401, "invalid_api_key", "Invalid or missing Hoopilot API key."));
+      logger.warn({ event: "http.request.unauthorized" }, "invalid hoopilot api key");
+      return jsonError(401, "invalid_api_key", "Invalid or missing Hoopilot API key.");
+    }
+  }).onError(({ code, error, request }) => {
+    const { logger, originalPath } = contextFor(request);
+    if (code === "NOT_FOUND") {
+      return jsonError(404, "not_found", `No route for ${request.method} ${originalPath}.`);
+    }
+    if (error instanceof CopilotAuthError) {
+      logger.warn(
+        { err: errorDetails(error), event: "copilot.auth.missing" },
+        "copilot auth failed"
+      );
+      return jsonError(401, "copilot_auth_error", error.message);
     }
-    try {
-      if (request.method === "GET" && (apiPath === "/" || apiPath === "/healthz")) {
-        return finish(jsonResponse({ name: "hoopilot", object: "health", status: "ok" }));
-      }
-      if (request.method === "GET" && apiPath === "/metrics") {
-        return finish(metricsResponse(metrics));
-      }
-      if (request.method === "GET" && apiPath === "/v1/usage") {
-        return finish(await handleUsage(metrics, readUsage, request.signal));
-      }
-      if (request.method === "GET" && apiPath === "/v1/responses") {
-        return finish(websocketUnsupportedResponse());
-      }
-      if (request.method === "GET" && apiPath === "/v1/models") {
-        return finish(await handleModels(client, metrics, request.signal, requestLogger));
-      }
-      if (request.method === "POST" && apiPath === "/v1/messages") {
-        return finish(
-          await handleAnthropicMessages(
-            client,
-            metrics,
-            recordTokens,
-            recordExtraction,
-            request,
-            requestLogger,
-            bufferProxyBodies
-          )
-        );
-      }
-      if (request.method === "POST" && apiPath === "/v1/messages/count_tokens") {
-        return finish(handleAnthropicCountTokens(await readJson(request)));
-      }
-      if (request.method === "POST" && apiPath === "/v1/chat/completions") {
-        return finish(
-          await handleChatCompletions(
-            client,
-            metrics,
-            recordTokens,
-            recordExtraction,
-            request,
-            requestLogger,
-            bufferProxyBodies
-          )
-        );
-      }
-      if (request.method === "POST" && apiPath === "/v1/completions") {
-        return finish(
-          await handleCompletions(
-            client,
-            metrics,
-            recordTokens,
-            recordExtraction,
-            request,
-            requestLogger,
-            bufferProxyBodies
-          )
-        );
-      }
-      if (request.method === "POST" && apiPath === "/v1/responses/compact") {
-        return finish(
-          await handleResponsesCompact(
-            client,
-            metrics,
-            recordTokens,
-            recordExtraction,
-            request,
-            requestLogger
-          )
-        );
-      }
-      if (request.method === "POST" && apiPath === "/v1/responses") {
-        return finish(
-          await handleResponses(
-            client,
-            metrics,
-            recordTokens,
-            recordExtraction,
-            request,
-            requestLogger,
-            bufferProxyBodies
-          )
-        );
-      }
-      return finish(jsonError(404, "not_found", `No route for ${request.method} ${url.pathname}.`));
-    } catch (error) {
-      if (error instanceof CopilotAuthError) {
-        requestLogger.warn(
-          { err: errorDetails(error), event: "copilot.auth.missing" },
-          "copilot auth failed"
-        );
-        return finish(jsonError(401, "copilot_auth_error", error.message));
-      }
-      const message = errorMessage(error);
-      if (message === INVALID_JSON_MESSAGE || message === JSON_OBJECT_MESSAGE) {
-        requestLogger.warn(
-          { err: errorDetails(error), event: "http.request.failed" },
-          "request body was not usable json"
-        );
-        return finish(jsonError(400, "invalid_request_error", message));
-      } else if (error instanceof OpenAICompatibilityError || error instanceof AnthropicCompatibilityError) {
-        requestLogger.warn(
-          { err: errorDetails(error), event: "http.request.failed" },
-          "request body used unsupported compatibility fields"
-        );
-        return finish(jsonError(400, "invalid_request_error", message));
-      } else if (error instanceof RequestBodyTooLargeError) {
-        requestLogger.warn(
-          { err: errorDetails(error), event: "http.request.failed" },
-          "request body exceeded size limit"
-        );
-        return finish(jsonError(413, "request_too_large", message));
-      } else {
-        requestLogger.error(
-          { err: errorDetails(error), event: "http.request.failed" },
-          "request failed"
-        );
-      }
-      return finish(jsonError(500, "internal_error", message));
+    const message = errorMessage(error);
+    if (error instanceof InvalidJsonError || error instanceof JsonNotObjectError) {
+      logger.warn(
+        { err: errorDetails(error), event: "http.request.failed" },
+        "request body was not usable json"
+      );
+      return jsonError(400, "invalid_request_error", message);
+    }
+    if (error instanceof OpenAICompatibilityError || error instanceof AnthropicCompatibilityError) {
+      logger.warn(
+        { err: errorDetails(error), event: "http.request.failed" },
+        "request body used unsupported compatibility fields"
+      );
+      return jsonError(400, "invalid_request_error", message);
     }
+    if (error instanceof RequestBodyTooLargeError) {
+      logger.warn(
+        { err: errorDetails(error), event: "http.request.failed" },
+        "request body exceeded size limit"
+      );
+      return jsonError(413, "request_too_large", message);
+    }
+    logger.error({ err: errorDetails(error), event: "http.request.failed" }, "request failed");
+    return jsonError(500, "internal_error", message);
+  }).get("/", () => jsonResponse({ name: "hoopilot", object: "health", status: "ok" })).get("/healthz", () => jsonResponse({ name: "hoopilot", object: "health", status: "ok" })).get("/metrics", () => metricsResponse(metrics)).get("/v1/usage", ({ request }) => handleUsage(metrics, readUsage, request.signal)).get(
+    "/v1/models",
+    ({ request }) => handleModels(client, metrics, request.signal, loggerFor(request))
+  ).get("/v1/responses", () => websocketUnsupportedResponse()).post(
+    "/v1/messages",
+    ({ request }) => handleAnthropicMessages(
+      client,
+      metrics,
+      recordTokens,
+      recordExtraction,
+      request,
+      loggerFor(request),
+      bufferProxyBodies
+    ),
+    noBody
+  ).post(
+    "/v1/messages/count_tokens",
+    ({ request }) => handleAnthropicCountTokens(request),
+    noBody
+  ).post(
+    "/v1/chat/completions",
+    ({ request }) => handleChatCompletions(
+      client,
+      metrics,
+      recordTokens,
+      recordExtraction,
+      request,
+      loggerFor(request),
+      bufferProxyBodies
+    ),
+    noBody
+  ).post(
+    "/v1/completions",
+    ({ request }) => handleCompletions(
+      client,
+      metrics,
+      recordTokens,
+      recordExtraction,
+      request,
+      loggerFor(request),
+      bufferProxyBodies
+    ),
+    noBody
+  ).post(
+    "/v1/responses/compact",
+    ({ request }) => handleResponsesCompact(
+      client,
+      metrics,
+      recordTokens,
+      recordExtraction,
+      request,
+      loggerFor(request)
+    ),
+    noBody
+  ).post(
+    "/v1/responses",
+    ({ request }) => handleResponses(
+      client,
+      metrics,
+      recordTokens,
+      recordExtraction,
+      request,
+      loggerFor(request),
+      bufferProxyBodies
+    ),
+    noBody
+  );
+}
+function normalizeInnerRequest(request, canonicalPath, url) {
+  if (canonicalPath === url.pathname) {
+    return request;
+  }
+  const target = new URL(url);
+  target.pathname = canonicalPath;
+  const init = {
+    headers: request.headers,
+    method: request.method,
+    signal: request.signal
   };
+  if (request.body) {
+    init.body = request.body;
+    init.duplex = "half";
+  }
+  return new Request(target, init);
 }
 function startHoopilotServer(options = {}) {
   const host = options.host ?? envValue(options.env?.HOST) ?? DEFAULT_HOST;
@@ -3389,7 +3428,8 @@ async function handleAnthropicMessages(client, metrics, recordTokens, recordExtr
   recordExtraction(usage !== void 0);
   return jsonResponse(responsesResponseToAnthropicMessage(body, model));
 }
-function handleAnthropicCountTokens(body) {
+async function handleAnthropicCountTokens(request) {
+  const body = await readJson(request);
   return jsonResponse(estimateAnthropicMessageTokens(body));
 }
 async function handleModels(client, metrics, signal, logger) {
@@ -3475,14 +3515,14 @@ async function handleCompletions(client, metrics, recordTokens, recordExtraction
   return jsonResponse(chatCompletionToCompletion(completion));
 }
 async function handleResponses(client, metrics, recordTokens, recordExtraction, request, logger, bufferProxyBodies) {
-  const body = await readJsonText(request);
+  const { json, text: body } = await readJsonText(request);
   const upstream = await client.responses(body, request.signal);
   metrics.recordUpstream("/responses", upstream.ok);
   if (!upstream.ok) {
     return proxyError(upstream, logger);
   }
   logUpstreamSuccess(logger, "/responses", upstream.status);
-  const model = normalizeRequestedModel(asRecord(safeParseJson(body)).model);
+  const model = normalizeRequestedModel(json.model);
   return proxyResponse(
     await responseWithObservedUsage(
       upstream,
@@ -3570,17 +3610,16 @@ function parseJsonObject2(text) {
   try {
     parsed = JSON.parse(text);
   } catch {
-    throw new Error(INVALID_JSON_MESSAGE);
+    throw new InvalidJsonError();
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error(JSON_OBJECT_MESSAGE);
+    throw new JsonNotObjectError();
   }
   return parsed;
 }
 async function readJsonText(request) {
   const text = await readRequestText(request);
-  parseJsonObject2(text);
-  return text;
+  return { json: parseJsonObject2(text), text };
 }
 async function readRequestText(request) {
   const contentLength = request.headers.get("content-length");
@@ -3638,7 +3677,7 @@ function jsonError(status, code, message) {
   );
 }
 function upstreamErrorResponse(status, text) {
-  const parsedError = asRecord(asRecord(safeParseJson(text)).error);
+  const parsedError = asRecord(asRecord(safeJsonParse(text)).error);
   if (Object.keys(parsedError).length > 0) {
     return jsonResponse({ error: parsedError }, status);
   }
@@ -3660,13 +3699,18 @@ function corsHeaders() {
     "access-control-expose-headers": "x-request-id"
   };
 }
+function secretEquals(candidate, secret) {
+  const a = createHash("sha256").update(candidate).digest();
+  const b = createHash("sha256").update(secret).digest();
+  return timingSafeEqual(a, b);
+}
 function isAuthorized(request, apiKey) {
   if (!apiKey) {
     return true;
   }
   const authorization = request.headers.get("authorization") ?? "";
   const bearer = authorization.match(/^Bearer\s+(.+)$/i)?.[1];
-  return bearer === apiKey || request.headers.get("x-api-key") === apiKey;
+  return bearer !== void 0 && secretEquals(bearer, apiKey) || secretEquals(request.headers.get("x-api-key") ?? "", apiKey);
 }
 function forbiddenBrowserOrigin(origin, request, allowedOrigins) {
   if (origin) {
@@ -3703,7 +3747,7 @@ function upstreamAuthMessage(message) {
   return `GitHub Copilot rejected the credential or account access: ${message}`;
 }
 function isLoopbackHost(host) {
-  return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+  return isLoopbackHostname(host);
 }
 function urlHost(host) {
   return host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
@@ -3722,9 +3766,6 @@ function normalizeServerPort(value) {
   }
   return port;
 }
-function errorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
-}
 function serverLogger(options) {
   if (options.logger) {
     return options.logger.child({ component: "server" });
@@ -3740,10 +3781,7 @@ function serverLogger(options) {
 }
 function resolveStreamingProxyMode(options) {
   const value = options.streamingProxyMode ?? envValue(options.env?.HOOPILOT_STREAM_MODE) ?? envValue(options.env?.HOOPILOT_STREAMING_PROXY_MODE) ?? "auto";
-  if (value === "auto" || value === "buffer" || value === "live") {
-    return value;
-  }
-  throw new Error(`Invalid stream mode: ${value}. Expected auto, live, or buffer.`);
+  return parseStreamingProxyMode(value);
 }
 function shouldBufferProxyBodies(mode) {
   if (mode === "buffer") {
@@ -3801,11 +3839,13 @@ function responseWithRequestId(response, requestId, closeConnection, corsOrigin)
 function trackStreamCompletion(body, onComplete) {
   const reader = body.getReader();
   let fired = false;
-  const fire = () => {
-    if (!fired) {
-      fired = true;
-      onComplete();
+  const release = () => {
+    if (fired) {
+      return;
     }
+    fired = true;
+    onComplete();
+    reader.releaseLock();
   };
   return new ReadableStream({
     async pull(controller) {
@@ -3813,18 +3853,25 @@ function trackStreamCompletion(body, onComplete) {
         const { done, value } = await reader.read();
         if (done) {
           controller.close();
-          fire();
+          release();
           return;
         }
         controller.enqueue(value);
       } catch (error) {
-        fire();
+        release();
         controller.error(error);
       }
     },
-    cancel(reason) {
-      fire();
-      return reader.cancel(reason);
+    async cancel(reason) {
+      if (!fired) {
+        fired = true;
+        onComplete();
+      }
+      try {
+        await reader.cancel(reason);
+      } finally {
+        reader.releaseLock();
+      }
     }
   });
 }
@@ -3872,47 +3919,26 @@ function canonicalApiPath(path) {
       return withoutTrailingSlash;
   }
 }
+var API_ROUTES = [
+  { method: "GET", path: "/", name: "health" },
+  { method: "GET", path: "/healthz", name: "health" },
+  { method: "GET", path: "/dashboard", name: "dashboard" },
+  { method: "GET", path: "/metrics", name: "metrics" },
+  { method: "GET", path: "/v1/usage", name: "usage" },
+  { method: "GET", path: "/v1/models", name: "models" },
+  { method: "GET", path: "/v1/responses", name: "responses_websocket" },
+  { method: "POST", path: "/v1/messages", name: "anthropic_messages" },
+  { method: "POST", path: "/v1/messages/count_tokens", name: "anthropic_count_tokens" },
+  { method: "POST", path: "/v1/chat/completions", name: "chat_completions" },
+  { method: "POST", path: "/v1/completions", name: "completions" },
+  { method: "POST", path: "/v1/responses/compact", name: "responses_compact" },
+  { method: "POST", path: "/v1/responses", name: "responses" }
+];
 function routeFor(method, path) {
   if (method === "OPTIONS") {
     return "cors.preflight";
   }
-  if (method === "GET" && (path === "/" || path === "/healthz")) {
-    return "health";
-  }
-  if (method === "GET" && path === "/dashboard") {
-    return "dashboard";
-  }
-  if (method === "GET" && path === "/metrics") {
-    return "metrics";
-  }
-  if (method === "GET" && path === "/v1/usage") {
-    return "usage";
-  }
-  if (method === "GET" && path === "/v1/models") {
-    return "models";
-  }
-  if (method === "POST" && path === "/v1/messages") {
-    return "anthropic_messages";
-  }
-  if (method === "POST" && path === "/v1/messages/count_tokens") {
-    return "anthropic_count_tokens";
-  }
-  if (method === "POST" && path === "/v1/chat/completions") {
-    return "chat_completions";
-  }
-  if (method === "POST" && path === "/v1/completions") {
-    return "completions";
-  }
-  if (method === "POST" && path === "/v1/responses/compact") {
-    return "responses_compact";
-  }
-  if (method === "POST" && path === "/v1/responses") {
-    return "responses";
-  }
-  if (method === "GET" && path === "/v1/responses") {
-    return "responses_websocket";
-  }
-  return "not_found";
+  return API_ROUTES.find((entry) => entry.method === method && entry.path === path)?.name ?? "not_found";
 }
 function isStreamingResponse(response) {
   return response.headers.get("content-type")?.includes("text/event-stream") ?? false;
@@ -3990,17 +4016,10 @@ function createUsageReader(client, metrics, now = Date.now, ttlMs = USAGE_CACHE_
     }
   };
 }
-function safeParseJson(text) {
-  try {
-    return JSON.parse(text);
-  } catch {
-    return void 0;
-  }
-}
 
 // src/update.ts
 import { execFileSync } from "child_process";
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import {
   chmodSync as chmodSync2,
   copyFileSync,
@@ -4008,7 +4027,7 @@ import {
   mkdirSync as mkdirSync2,
   realpathSync,
   renameSync as renameSync2,
-  rmSync,
+  rmSync as rmSync2,
   writeFileSync as writeFileSync2
 } from "fs";
 import { readFile, writeFile } from "fs/promises";
@@ -4182,10 +4201,11 @@ Run: ${upgradeCommandFor(kind)}
 function parseState(text) {
   try {
     const data = JSON.parse(text);
+    const record = data && typeof data === "object" ? data : {};
     return {
-      lastCheck: typeof data.lastCheck === "number" ? data.lastCheck : 0,
-      latestVersion: typeof data.latestVersion === "string" ? data.latestVersion : null,
-      etag: typeof data.etag === "string" ? data.etag : null
+      lastCheck: typeof record.lastCheck === "number" ? record.lastCheck : 0,
+      latestVersion: typeof record.latestVersion === "string" ? record.latestVersion : null,
+      etag: typeof record.etag === "string" ? record.etag : null
     };
   } catch {
     return { lastCheck: 0, latestVersion: null, etag: null };
@@ -4239,6 +4259,7 @@ function latestReleaseApiUrl() {
 
 // src/update.ts
 var REQUEST_TIMEOUT_MS2 = 8e3;
+var DOWNLOAD_TIMEOUT_MS = REQUEST_TIMEOUT_MS2 * 10;
 var SHA256SUMS = "SHA256SUMS";
 function userAgent(version) {
   return `hoopilot/${version}`;
@@ -4376,15 +4397,15 @@ async function downloadToFile(url, dest, version) {
   const response = await fetch(url, {
     headers: { "User-Agent": userAgent(version) },
     redirect: "follow",
-    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS2 * 10)
+    signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS)
   });
   if (!response.ok || !response.body) {
     throw new Error(`Download failed (${response.status}) for ${url}`);
   }
-  await writeFile(dest, new Uint8Array(await response.arrayBuffer()));
+  await Bun.write(dest, response);
 }
 async function sha256File(path) {
-  return createHash("sha256").update(await readFile(path)).digest("hex");
+  return createHash2("sha256").update(await readFile(path)).digest("hex");
 }
 async function verifyChecksum(release, assetName, file, version) {
   const sums = release.assets.find((asset) => asset.name === SHA256SUMS);
@@ -4396,7 +4417,7 @@ async function verifyChecksum(release, assetName, file, version) {
   const response = await fetch(sums.url, {
     headers: { "User-Agent": userAgent(version) },
     redirect: "follow",
-    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS2)
+    signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS)
   });
   if (!response.ok) {
     throw new Error(`Could not download ${SHA256SUMS} (${response.status}).`);
@@ -4414,7 +4435,7 @@ function swapBinary(tmpFile, exePath) {
   if (process.platform === "win32") {
     const oldExe = `${exePath}.old`;
     try {
-      rmSync(oldExe, { force: true });
+      rmSync2(oldExe, { force: true });
     } catch {
     }
     renameSync2(exePath, oldExe);
@@ -4471,7 +4492,7 @@ function refreshCodexxShim(dir, logger) {
       { err: errorDetails(error), event: "update.codexx_shim_failed" },
       "could not refresh codexx shim"
     );
-    console.warn(`Updated hoopilot, but could not refresh the codexx shim: ${errorMessage2(error)}`);
+    console.warn(`Updated hoopilot, but could not refresh the codexx shim: ${errorMessage(error)}`);
   }
 }
 function cleanupOldBinary() {
@@ -4479,7 +4500,7 @@ function cleanupOldBinary() {
     return;
   }
   try {
-    rmSync(`${realpathSync(process.execPath)}.old`, { force: true });
+    rmSync2(`${realpathSync(process.execPath)}.old`, { force: true });
   } catch {
   }
 }
@@ -4543,7 +4564,7 @@ async function runUpdate(currentVersion, logger) {
     throw error;
   } finally {
     try {
-      rmSync(tmpFile, { force: true });
+      rmSync2(tmpFile, { force: true });
     } catch {
     }
   }
@@ -4556,12 +4577,8 @@ async function runUpdate(currentVersion, logger) {
     console.log("Restart hoopilot to run the new version.");
   }
 }
-function errorMessage2(error) {
-  return error instanceof Error ? error.message : String(error);
-}
 
 // src/cli.ts
-var ALLOWED_COPILOT_API_HOSTS2 = ["api.githubcopilot.com"];
 async function main2(argv = Bun.argv.slice(2)) {
   cleanupOldBinary();
   const command = argv[0];
@@ -4694,7 +4711,7 @@ function parseArgs(argv) {
         args.logLevel = parseLogLevel(optionValue(name, inlineValue, rest));
         break;
       case "--stream-mode":
-        args.streamingProxyMode = parseStreamMode(optionValue(name, inlineValue, rest));
+        args.streamingProxyMode = parseStreamingProxyMode(optionValue(name, inlineValue, rest));
         break;
       case "--host":
         args.host = optionValue(name, inlineValue, rest);
@@ -4714,12 +4731,6 @@ function parseArgs(argv) {
   }
   return args;
 }
-function parseStreamMode(value) {
-  if (value === "auto" || value === "buffer" || value === "live") {
-    return value;
-  }
-  throw new Error(`Invalid stream mode: ${value}. Expected auto, live, or buffer.`);
-}
 function optionValue(name, inlineValue, rest) {
   const value = inlineValue ?? rest.shift();
   if (!value) {
@@ -4780,11 +4791,7 @@ async function runModels(options = {}) {
   logger.debug({ event: "models.list.started" }, "fetching github copilot models");
   const response = await new CopilotClient(options).models();
   if (!response.ok) {
-    const message = `GitHub Copilot API model list failed with ${response.status}: ${await truncatedResponseText(response)}`;
-    if (response.status === 401 || response.status === 403) {
-      throw new CopilotAuthError(message);
-    }
-    throw new Error(message);
+    await throwForCopilotResponse(response, "GitHub Copilot API model list");
   }
   const ids = modelIdsFromResponse(await response.json().catch(() => void 0));
   if (ids.length === 0) {
@@ -4804,11 +4811,7 @@ async function runUsage(options = {}) {
   logger.debug({ event: "usage.fetch.started" }, "fetching github copilot quota");
   const response = await new CopilotClient(options).usage();
   if (!response.ok) {
-    const message = `GitHub Copilot usage request failed with ${response.status}: ${await truncatedResponseText(response)}`;
-    if (response.status === 401 || response.status === 403) {
-      throw new CopilotAuthError(message);
-    }
-    throw new Error(message);
+    await throwForCopilotResponse(response, "GitHub Copilot usage request");
   }
   const rateLimit = parseRateLimitHeaders(response.headers);
   const usage = normalizeCopilotUsage(await response.json().catch(() => ({})));
@@ -4908,7 +4911,7 @@ async function verifyCopilotOAuthToken(token, options = {}) {
     options.copilotApiBaseUrl ?? envValue(options.env?.COPILOT_API_BASE_URL) ?? DEFAULT_COPILOT_API_BASE_URL
   );
   const allowUnsafeUpstream = envValue(options.env?.HOOPILOT_ALLOW_UNSAFE_UPSTREAM) === "1";
-  if (!isTrustedTokenBaseUrl(apiBaseUrl, ALLOWED_COPILOT_API_HOSTS2, allowUnsafeUpstream)) {
+  if (!isTrustedTokenBaseUrl(apiBaseUrl, ALLOWED_COPILOT_API_HOSTS, allowUnsafeUpstream)) {
     throw new Error(
       `Refusing to send the GitHub OAuth token to an untrusted Copilot API host: ${apiBaseUrl}`
     );
@@ -4919,19 +4922,22 @@ async function verifyCopilotOAuthToken(token, options = {}) {
     method: "GET"
   });
   if (!response.ok) {
-    const message = `GitHub Copilot API verification failed with ${response.status}: ${await truncatedResponseText(response)}`;
-    if (response.status === 401 || response.status === 403) {
-      throw new CopilotAuthError(message);
-    }
-    throw new Error(message);
+    await throwForCopilotResponse(response, "GitHub Copilot API verification");
   }
   return {
     apiBaseUrl,
-    expiresAtMs: Date.now() + 10 * 6e4,
+    expiresAtMs: Date.now() + STORED_TOKEN_TTL_MS,
     source: "github-copilot-oauth",
     token
   };
 }
+async function throwForCopilotResponse(response, label) {
+  const message = `${label} failed with ${response.status}: ${await truncatedResponseText(response)}`;
+  if (response.status === 401 || response.status === 403) {
+    throw new CopilotAuthError(message);
+  }
+  throw new Error(message);
+}
 function openBrowserBestEffort(url, spawnOpener = spawn) {
   const platform = process.platform;
   const command = platform === "win32" ? "cmd" : platform === "darwin" ? "open" : "xdg-open";
@@ -4947,21 +4953,6 @@ function openBrowserBestEffort(url, spawnOpener = spawn) {
   } catch {
   }
 }
-function modelIdsFromResponse(body) {
-  const record = asRecord(body);
-  const data = Array.isArray(record.data) ? record.data : Array.isArray(body) ? body : [];
-  const seen = /* @__PURE__ */ new Set();
-  const ids = [];
-  for (const model of data) {
-    const id = asRecord(model).id;
-    if (typeof id !== "string" || id.length === 0 || seen.has(id)) {
-      continue;
-    }
-    seen.add(id);
-    ids.push(id);
-  }
-  return ids;
-}
 function withRuntimeEnv(args) {
   return { ...args, env: process.env };
 }
@@ -5045,7 +5036,7 @@ Environment:
 }
 if (import.meta.main) {
   main2().catch((error) => {
-    console.error(error instanceof Error ? error.message : String(error));
+    console.error(errorMessage(error));
     process.exit(1);
   });
 }