@openhoo/hoopilot 2.1.3 → 2.1.5

package/dist/codexx.js

@@ -3,7 +3,7 @@ import {
   buildCodexxInvocation,
   main,
   verifyCodexxModel
-} from "./chunk-CYR6I4C3.js";
+} from "./chunk-4ZG5QEYJ.js";
 export {
   buildCodexxInvocation,
   main,

package/dist/index.d.ts

@@ -40,11 +40,11 @@ declare class MetricsRegistry {
     renderPrometheus(now?: () => number): string;
 }
 /**
- * Tee `response`'s body so the client receives an unchanged copy while a
- * background reader extracts token usage. Returns a new Response carrying the
- * client-facing branch and the original status/headers. Usage extraction never
- * throws into the client stream: a parse failure or an aborted client simply
- * yields no usage. When the body is absent the response is returned untouched.
+ * Wrap `response`'s body so the client receives unchanged bytes while the same
+ * read pass extracts token usage. Returns a new Response carrying the observed
+ * body and the original status/headers. Usage extraction never throws into the
+ * client stream: a parse failure or an aborted client simply yields no usage.
+ * When the body is absent the response is returned untouched.
  *
  * Pass the request's `signal` so a client disconnect cancels the observer
  * branch; combined with the runtime cancelling the client branch, that releases
@@ -93,6 +93,8 @@ interface CopilotAuthOptions {
     env?: NodeJS.ProcessEnv;
     fetch?: FetchLike;
     githubApiBaseUrl?: string;
+    upstreamStreamIdleTimeoutMs?: number;
+    upstreamTimeoutMs?: number;
 }
 interface CopilotAccess {
     apiBaseUrl: string;

package/dist/index.js

@@ -2005,6 +2005,14 @@ var COPILOT_USAGE_API_VERSION = "2025-04-01";
 var EDITOR_PLUGIN_VERSION = "hoopilot/0.1.0";
 var EDITOR_VERSION = "Hoopilot/0.1.0";
 var HOOPILOT_USER_AGENT = "hoopilot/0.1.0";
+var DEFAULT_UPSTREAM_TIMEOUT_MS = 12e4;
+var DEFAULT_UPSTREAM_STREAM_IDLE_TIMEOUT_MS = 12e4;
+var CopilotUpstreamTimeoutError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CopilotUpstreamTimeoutError";
+  }
+};
 function applyCopilotHeaders(headers, token) {
   headers.set("accept", headers.get("accept") ?? "application/json");
   headers.set("authorization", `Bearer ${token}`);
@@ -2057,6 +2065,8 @@ var CopilotClient = class {
   #allowUnsafeUpstream;
   #fetch;
   #githubApiBaseUrl;
+  #upstreamStreamIdleTimeoutMs;
+  #upstreamTimeoutMs;
   constructor(options = {}) {
     this.#auth = new CopilotAuth(options);
     this.#allowUnsafeUpstream = envValue(options.env?.HOOPILOT_ALLOW_UNSAFE_UPSTREAM) === "1";
@@ -2064,6 +2074,18 @@ var CopilotClient = class {
     this.#githubApiBaseUrl = trimTrailingSlash(
       options.githubApiBaseUrl ?? envValue(options.env?.HOOPILOT_GITHUB_API_BASE_URL) ?? DEFAULT_GITHUB_API_BASE_URL
     );
+    this.#upstreamTimeoutMs = parseTimeoutMs(
+      options.upstreamTimeoutMs,
+      options.env?.HOOPILOT_UPSTREAM_TIMEOUT_MS,
+      DEFAULT_UPSTREAM_TIMEOUT_MS,
+      "HOOPILOT_UPSTREAM_TIMEOUT_MS"
+    );
+    this.#upstreamStreamIdleTimeoutMs = parseTimeoutMs(
+      options.upstreamStreamIdleTimeoutMs,
+      options.env?.HOOPILOT_UPSTREAM_STREAM_IDLE_TIMEOUT_MS,
+      DEFAULT_UPSTREAM_STREAM_IDLE_TIMEOUT_MS,
+      "HOOPILOT_UPSTREAM_STREAM_IDLE_TIMEOUT_MS"
+    );
   }
   /**
    * Fetch the Copilot account's quota / premium-request usage from the GitHub
@@ -2082,7 +2104,7 @@ var CopilotClient = class {
     }
     const access = await this.#auth.getAccess();
     const headers = applyGithubApiHeaders(new Headers(), access.token);
-    return this.#fetch(`${this.#githubApiBaseUrl}/copilot_internal/user`, {
+    return this.#fetchWithTimeout(`${this.#githubApiBaseUrl}/copilot_internal/user`, {
       headers,
       method: "GET",
       signal
@@ -2129,12 +2151,139 @@ var CopilotClient = class {
       );
     }
     const headers = applyCopilotHeaders(new Headers(init.headers), access.token);
-    return this.#fetch(`${access.apiBaseUrl}${path}`, {
+    return this.#fetchWithTimeout(`${access.apiBaseUrl}${path}`, {
       ...init,
       headers
     });
   }
+  async #fetchWithTimeout(input, init) {
+    const timeout = abortSignalWithTimeout(init.signal ?? void 0, this.#upstreamTimeoutMs);
+    try {
+      const response = await this.#fetch(input, {
+        ...init,
+        signal: timeout.signal
+      });
+      return responseWithStreamIdleTimeout(response, this.#upstreamStreamIdleTimeoutMs, input);
+    } catch (error) {
+      if (timeout.timedOut()) {
+        throw new CopilotUpstreamTimeoutError(
+          `Copilot upstream request timed out after ${this.#upstreamTimeoutMs} ms before response headers arrived.`
+        );
+      }
+      throw error;
+    } finally {
+      timeout.cleanup();
+    }
+  }
 };
+function parseTimeoutMs(optionValue, envRaw, fallback, name) {
+  const raw = optionValue ?? envValue(envRaw);
+  if (raw === void 0) {
+    return fallback;
+  }
+  const value = typeof raw === "number" ? raw : Number(raw);
+  if (!Number.isInteger(value) || value < 0) {
+    throw new Error(`${name} must be a non-negative integer number of milliseconds.`);
+  }
+  return value;
+}
+function abortSignalWithTimeout(parent, timeoutMs) {
+  if (timeoutMs === 0) {
+    return { cleanup: () => {
+    }, signal: parent, timedOut: () => false };
+  }
+  const controller = new AbortController();
+  let timedOut = false;
+  const timer = setTimeout(() => {
+    if (controller.signal.aborted) {
+      return;
+    }
+    timedOut = true;
+    controller.abort(
+      new CopilotUpstreamTimeoutError(`Copilot upstream request timed out after ${timeoutMs} ms.`)
+    );
+  }, timeoutMs);
+  const onAbort = () => controller.abort(parent?.reason);
+  if (parent?.aborted) {
+    controller.abort(parent.reason);
+  } else {
+    parent?.addEventListener("abort", onAbort, { once: true });
+  }
+  return {
+    cleanup: () => {
+      clearTimeout(timer);
+      parent?.removeEventListener("abort", onAbort);
+    },
+    signal: controller.signal,
+    timedOut: () => timedOut
+  };
+}
+function responseWithStreamIdleTimeout(response, idleTimeoutMs, input) {
+  if (!response.body || idleTimeoutMs === 0) {
+    return response;
+  }
+  return new Response(streamWithIdleTimeout(response.body, idleTimeoutMs, input), {
+    headers: response.headers,
+    status: response.status,
+    statusText: response.statusText
+  });
+}
+function streamWithIdleTimeout(body, idleTimeoutMs, input) {
+  const reader = body.getReader();
+  let released = false;
+  const release = () => {
+    if (!released) {
+      released = true;
+      reader.releaseLock();
+    }
+  };
+  return new ReadableStream({
+    async pull(controller) {
+      let timer;
+      const read = reader.read();
+      read.catch(() => {
+      });
+      try {
+        const result = await Promise.race([
+          read,
+          new Promise((_, reject) => {
+            timer = setTimeout(() => {
+              reject(
+                new CopilotUpstreamTimeoutError(
+                  `Copilot upstream stream was idle for ${idleTimeoutMs} ms while reading ${input}.`
+                )
+              );
+            }, idleTimeoutMs);
+          })
+        ]);
+        if (timer) {
+          clearTimeout(timer);
+        }
+        if (result.done) {
+          controller.close();
+          release();
+          return;
+        }
+        controller.enqueue(result.value);
+      } catch (error) {
+        if (timer) {
+          clearTimeout(timer);
+        }
+        await reader.cancel(error).catch(() => {
+        });
+        controller.error(error);
+        release();
+      }
+    },
+    async cancel(reason) {
+      try {
+        await reader.cancel(reason);
+      } finally {
+        release();
+      }
+    }
+  });
+}
 function normalizeCopilotUsage(body) {
   const record = asRecord(body);
   const quotas = {};
@@ -2871,17 +3020,15 @@ function observeResponseUsage(response, fallbackModel, onUsage, signal, onOutcom
   if (!body) {
     return response;
   }
-  const [clientBranch, observerBranch] = body.tee();
   const isSse = response.headers.get("content-type")?.includes("text/event-stream") ?? false;
-  void consumeUsage(observerBranch, isSse, fallbackModel, onUsage, signal, onOutcome).catch(
-    () => {
+  return new Response(
+    streamWithUsageObservation(body, isSse, fallbackModel, onUsage, signal, onOutcome),
+    {
+      headers: response.headers,
+      status: response.status,
+      statusText: response.statusText
     }
   );
-  return new Response(clientBranch, {
-    headers: response.headers,
-    status: response.status,
-    statusText: response.statusText
-  });
 }
 function recordResponseTextUsage(text, isSse, fallbackModel, onUsage, onOutcome) {
   const accumulator = createUsageAccumulator(fallbackModel, onUsage, onOutcome);
@@ -2897,13 +3044,16 @@ function recordResponseTextUsage(text, isSse, fallbackModel, onUsage, onOutcome)
   }
   accumulator.finish();
 }
-async function consumeUsage(stream, isSse, fallbackModel, onUsage, signal, onOutcome) {
+function streamWithUsageObservation(stream, isSse, fallbackModel, onUsage, signal, onOutcome) {
   const reader = stream.getReader();
+  let aborted = signal?.aborted ?? false;
+  let released = false;
   const onAbort = () => {
+    aborted = true;
     reader.cancel().catch(() => {
     });
   };
-  if (signal?.aborted) {
+  if (aborted) {
     reader.cancel().catch(() => {
     });
   } else {
@@ -2911,7 +3061,7 @@ async function consumeUsage(stream, isSse, fallbackModel, onUsage, signal, onOut
   }
   const decoder = new TextDecoder();
   const guardedOutcome = onOutcome ? (extracted) => {
-    if (!signal?.aborted) {
+    if (!aborted) {
       onOutcome(extracted);
     }
   } : void 0;
@@ -2919,33 +3069,40 @@ async function consumeUsage(stream, isSse, fallbackModel, onUsage, signal, onOut
   let buffer = "";
   let bufferedBytes = 0;
   let overflowed = false;
-  try {
-    while (true) {
-      const result = await reader.read();
-      if (result.done) {
-        break;
+  const release = () => {
+    if (released) {
+      return;
+    }
+    released = true;
+    signal?.removeEventListener("abort", onAbort);
+    reader.releaseLock();
+  };
+  const observeChunk = (chunkBytes) => {
+    const chunk = decoder.decode(chunkBytes, { stream: true });
+    if (isSse) {
+      buffer += chunk;
+      const lines = buffer.split(/\r?\n/);
+      buffer = lines.pop() ?? "";
+      for (const line of lines) {
+        considerSseLine(line, accumulator.consider);
       }
-      const chunk = decoder.decode(result.value, { stream: true });
-      if (isSse) {
-        buffer += chunk;
-        const lines = buffer.split(/\r?\n/);
-        buffer = lines.pop() ?? "";
-        for (const line of lines) {
-          considerSseLine(line, accumulator.consider);
-        }
-        if (buffer.length > USAGE_BUFFER_LIMIT_BYTES) {
-          buffer = "";
-        }
-      } else if (!overflowed) {
-        bufferedBytes += result.value.byteLength;
-        if (bufferedBytes > USAGE_BUFFER_LIMIT_BYTES) {
-          overflowed = true;
-          buffer = "";
-        } else {
-          buffer += chunk;
-        }
+      if (buffer.length > USAGE_BUFFER_LIMIT_BYTES) {
+        buffer = "";
       }
+      return;
     }
+    if (overflowed) {
+      return;
+    }
+    bufferedBytes += chunkBytes.byteLength;
+    if (bufferedBytes > USAGE_BUFFER_LIMIT_BYTES) {
+      overflowed = true;
+      buffer = "";
+      return;
+    }
+    buffer += chunk;
+  };
+  const finishObservation = () => {
     const finalBuffer = buffer + decoder.decode();
     if (isSse) {
       if (finalBuffer) {
@@ -2957,11 +3114,41 @@ async function consumeUsage(stream, isSse, fallbackModel, onUsage, signal, onOut
         accumulator.consider(parsed);
       }
     }
-  } finally {
-    signal?.removeEventListener("abort", onAbort);
-    reader.releaseLock();
-  }
-  accumulator.finish();
+    if (!aborted) {
+      safeFinishAccumulator(accumulator);
+    }
+  };
+  return new ReadableStream({
+    async pull(controller) {
+      const result = await reader.read().catch((error) => {
+        release();
+        controller.error(error);
+        return void 0;
+      });
+      if (!result) {
+        return;
+      }
+      if (result.done) {
+        finishObservation();
+        controller.close();
+        release();
+        return;
+      }
+      try {
+        observeChunk(result.value);
+      } catch {
+      }
+      controller.enqueue(result.value);
+    },
+    async cancel(reason) {
+      aborted = true;
+      try {
+        await reader.cancel(reason);
+      } finally {
+        release();
+      }
+    }
+  });
 }
 function createUsageAccumulator(fallbackModel, onUsage, onOutcome) {
   let model = fallbackModel;
@@ -2986,6 +3173,12 @@ function createUsageAccumulator(fallbackModel, onUsage, onOutcome) {
     }
   };
 }
+function safeFinishAccumulator(accumulator) {
+  try {
+    accumulator.finish();
+  } catch {
+  }
+}
 function considerSseLine(line, consider) {
   const trimmed = line.trim();
   if (!trimmed.startsWith("data:")) {
@@ -3916,7 +4109,18 @@ async function getVersion() {
 var DEFAULT_HOST = "127.0.0.1";
 var DEFAULT_PORT = 4141;
 var FORBIDDEN_BROWSER_ORIGIN_MESSAGE = "Cross-origin browser requests are blocked unless the Origin is loopback or listed in HOOPILOT_ALLOWED_ORIGINS.";
-var WELL_KNOWN_DEMO_API_KEYS = /* @__PURE__ */ new Set(["local-key"]);
+var MIN_NON_LOOPBACK_API_KEY_LENGTH = 24;
+var WELL_KNOWN_DEMO_API_KEYS = /* @__PURE__ */ new Set([
+  "changeme",
+  "demo",
+  "example",
+  "hoopilot",
+  "local-key",
+  "password",
+  "password123",
+  "secret",
+  "test"
+]);
 var INVALID_JSON_MESSAGE = "Request body must be valid JSON.";
 var JSON_OBJECT_MESSAGE = "Request body must be a JSON object.";
 var MAX_REQUEST_BODY_BYTES = 16 * 1024 * 1024;
@@ -4089,6 +4293,13 @@ function buildApp(deps) {
       );
       return jsonError(413, "request_too_large", message);
     }
+    if (error instanceof CopilotUpstreamTimeoutError) {
+      logger.warn(
+        { err: errorDetails(error), event: "copilot.request.timeout" },
+        "copilot upstream request timed out"
+      );
+      return jsonError(504, "copilot_timeout", message);
+    }
     logger.error({ err: errorDetails(error), event: "http.request.failed" }, "request failed");
     return jsonError(500, "internal_error", message);
   }).get("/", () => jsonResponse({ name: "hoopilot", object: "health", status: "ok" })).get("/healthz", () => jsonResponse({ name: "hoopilot", object: "health", status: "ok" })).get("/metrics", () => metricsResponse(metrics)).get("/v1/usage", ({ request }) => handleUsage(metrics, readUsage, request.signal)).get(
@@ -4187,10 +4398,9 @@ function startHoopilotServer(options = {}) {
         "Refusing to listen on a non-loopback host without HOOPILOT_API_KEY. Set an API key or pass --allow-unauthenticated."
       );
     }
-    if (apiKey && isWellKnownDemoApiKey(apiKey)) {
-      throw new Error(
-        "Refusing to listen on a non-loopback host with a well-known demo HOOPILOT_API_KEY. Set a strong, unique API key."
-      );
+    const rejection = apiKey ? apiKeyRejectionReason(apiKey) : void 0;
+    if (rejection) {
+      throw new Error(`Refusing to listen on a non-loopback host: ${rejection}`);
     }
   }
   const server = Bun.serve({
@@ -4488,12 +4698,16 @@ async function readRequestText(request) {
   const reader = body.getReader();
   const decoder = new TextDecoder();
   let bytes = 0;
-  let text = "";
+  const chunks = [];
   try {
     while (true) {
       const { done, value } = await reader.read();
       if (done) {
-        return `${text}${decoder.decode()}`;
+        const tail = decoder.decode();
+        if (tail) {
+          chunks.push(tail);
+        }
+        return chunks.join("");
       }
       bytes += value.byteLength;
       if (bytes > MAX_REQUEST_BODY_BYTES) {
@@ -4501,7 +4715,7 @@ async function readRequestText(request) {
         });
         throw new RequestBodyTooLargeError();
       }
-      text += decoder.decode(value, { stream: true });
+      chunks.push(decoder.decode(value, { stream: true }));
     }
   } finally {
     reader.releaseLock();
@@ -4598,8 +4812,18 @@ function resolveCorsAllowOrigin(origin, allowedOrigins) {
   }
   return isAllowedOrigin(origin, allowedOrigins) ? origin : void 0;
 }
-function isWellKnownDemoApiKey(apiKey) {
-  return WELL_KNOWN_DEMO_API_KEYS.has(apiKey.trim().toLowerCase());
+function apiKeyRejectionReason(apiKey) {
+  const normalized = apiKey.trim();
+  if (WELL_KNOWN_DEMO_API_KEYS.has(normalized.toLowerCase())) {
+    return "HOOPILOT_API_KEY is a well-known demo value. Set a strong, unique API key.";
+  }
+  if (normalized.length < MIN_NON_LOOPBACK_API_KEY_LENGTH) {
+    return `HOOPILOT_API_KEY must be at least ${MIN_NON_LOOPBACK_API_KEY_LENGTH} characters when listening on a non-loopback host.`;
+  }
+  if (/^(.)\1+$/.test(normalized)) {
+    return "HOOPILOT_API_KEY must not be a repeated single character. Set a strong, unique API key.";
+  }
+  return void 0;
 }
 function isUpstreamAuthStatus(status) {
   return status === 401 || status === 403;