@openhoo/hoopilot 2.1.6 → 2.1.7

package/dist/cli.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env bun
 import {
+  DEFAULT_MODEL,
   asRecord,
   envValue,
   errorMessage,
@@ -15,7 +16,7 @@ import {
   safeJsonParse,
   trimTrailingSlash,
   truncatedResponseText
-} from "./chunk-4ZG5QEYJ.js";
+} from "./chunk-2GLKVNAA.js";
 
 // src/cli.ts
 import { spawn } from "child_process";
@@ -785,11 +786,51 @@ function isLogLevel(value) {
 }
 
 // src/server.ts
-import { createHash, timingSafeEqual } from "crypto";
 import { Elysia } from "elysia";
 
+// src/sse.ts
+function parseSseBlock(block) {
+  let event = "message";
+  const data = [];
+  for (const line of block.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("event:")) {
+      event = trimmed.slice("event:".length).trim() || event;
+      continue;
+    }
+    const value = sseDataFromLine(trimmed);
+    if (value !== void 0) {
+      data.push(value);
+    }
+  }
+  return { data: data.join("\n"), event };
+}
+function sseDataFromLine(line) {
+  const trimmed = line.trim();
+  if (!trimmed.startsWith("data:")) {
+    return void 0;
+  }
+  return trimmed.slice("data:".length).trim();
+}
+function encodeSseEvent(event, data) {
+  if (data === "[DONE]") {
+    return "data: [DONE]\n\n";
+  }
+  return `event: ${event}
+data: ${JSON.stringify(data)}
+
+`;
+}
+function encodeSseData(data) {
+  if (data === "[DONE]") {
+    return "data: [DONE]\n\n";
+  }
+  return `data: ${JSON.stringify(data)}
+
+`;
+}
+
 // src/openai.ts
-var DEFAULT_MODEL = "gpt-4.1";
 var COMPACTION_SUMMARIZATION_PROMPT = `You are performing a CONTEXT CHECKPOINT COMPACTION. Create a handoff summary for another LLM that will resume the task.
 
 Include:
@@ -904,7 +945,7 @@ function responsesCompactionSseText(upstreamText, isSse, model) {
   const item = compactionOutputItem(compactionSummaryText(upstreamText, isSse));
   const createdAt = epochSeconds();
   let sequenceNumber = 0;
-  const event = (name, data) => encodeSse(name, data === "[DONE]" ? data : { ...data, sequence_number: sequenceNumber++ });
+  const event = (name, data) => encodeSseEvent(name, data === "[DONE]" ? data : { ...data, sequence_number: sequenceNumber++ });
   return [
     event("response.created", {
       response: baseStreamResponse(responseId, model, createdAt, "in_progress", []),
@@ -942,7 +983,7 @@ function compactionSummaryTextFromResponsesSse(text) {
   let deltas = "";
   let completedResponse;
   for (const block of text.split(/\r?\n\r?\n/)) {
-    const data = block.split(/\r?\n/).filter((line) => line.startsWith("data:")).map((line) => line.slice(5).trim()).join("");
+    const { data } = parseSseBlock(block);
     if (!data || data === "[DONE]") {
       continue;
     }
@@ -989,7 +1030,7 @@ function completionStreamFromChatStream(chatStream) {
   return new ReadableStream({
     async start(controller) {
       const enqueue = (data) => {
-        controller.enqueue(encoder.encode(encodeDataSse(data)));
+        controller.enqueue(encoder.encode(encodeSseData(data)));
       };
       const markTerminal = () => {
         sawTerminalEvent = true;
@@ -1030,7 +1071,7 @@ function completionSseTextFromChatSseText(text) {
   const chunks = [];
   let sawTerminalEvent = false;
   const enqueue = (data) => {
-    chunks.push(encodeDataSse(data));
+    chunks.push(encodeSseData(data));
   };
   const markTerminal = () => {
     sawTerminalEvent = true;
@@ -1233,17 +1274,7 @@ function completionChoices(completion) {
   return choices.map((choice) => asRecord(choice));
 }
 function processCompletionSseBlock(block, enqueue, markTerminal) {
-  let event = "message";
-  const dataLines = [];
-  for (const line of block.split(/\r?\n/)) {
-    const trimmed = line.trim();
-    if (trimmed.startsWith("event:")) {
-      event = trimmed.slice("event:".length).trim() || event;
-    } else if (trimmed.startsWith("data:")) {
-      dataLines.push(trimmed.slice("data:".length).trim());
-    }
-  }
-  const data = dataLines.join("\n");
+  const { data, event } = parseSseBlock(block);
   if (!data) {
     return;
   }
@@ -1328,23 +1359,6 @@ function baseStreamResponse(id, model, createdAt, status, output) {
     top_p: null
   };
 }
-function encodeSse(event, data) {
-  if (data === "[DONE]") {
-    return "data: [DONE]\n\n";
-  }
-  return `event: ${event}
-data: ${JSON.stringify(data)}
-
-`;
-}
-function encodeDataSse(data) {
-  if (data === "[DONE]") {
-    return "data: [DONE]\n\n";
-  }
-  return `data: ${JSON.stringify(data)}
-
-`;
-}
 function epochSeconds() {
   return Math.floor(Date.now() / 1e3);
 }
@@ -1398,7 +1412,7 @@ function responsesStreamToAnthropicStream(stream, options) {
   return new ReadableStream({
     async start(controller) {
       const enqueue = (event, data) => {
-        controller.enqueue(encoder.encode(encodeSse2(event, data)));
+        controller.enqueue(encoder.encode(encodeSseEvent(event, data)));
       };
       const reader = stream.getReader();
       try {
@@ -1434,7 +1448,7 @@ function responsesSseTextToAnthropicSseText(text, options) {
   const chunks = [];
   const state = createAnthropicStreamState(options);
   const enqueue = (event, data) => {
-    chunks.push(encodeSse2(event, data));
+    chunks.push(encodeSseEvent(event, data));
   };
   for (const block of text.split(/\r?\n\r?\n/)) {
     if (block.trim()) {
@@ -2018,19 +2032,6 @@ function stopBlock(block, enqueue) {
     type: "content_block_stop"
   });
 }
-function parseSseBlock(block) {
-  let event = "message";
-  const data = [];
-  for (const line of block.split(/\r?\n/)) {
-    const trimmed = line.trim();
-    if (trimmed.startsWith("event:")) {
-      event = trimmed.slice("event:".length).trim() || event;
-    } else if (trimmed.startsWith("data:")) {
-      data.push(trimmed.slice("data:".length).trim());
-    }
-  }
-  return { data: data.join("\n"), event };
-}
 function parseToolInput(argumentsText) {
   const parsed = parseJsonObject(argumentsText);
   return parsed ?? {};
@@ -2065,12 +2066,6 @@ function textValue(value) {
 function indexValue(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : 0;
 }
-function encodeSse2(event, data) {
-  return `event: ${event}
-data: ${JSON.stringify(data)}
-
-`;
-}
 
 // src/dashboard.ts
 var DASHBOARD_HTML = `<!doctype html>
@@ -2881,130 +2876,368 @@ footer.foot .end { margin-left:auto; }
 </html>
 `;
 
-// src/metrics.ts
-var PROMETHEUS_CONTENT_TYPE = "text/plain; version=0.0.4; charset=utf-8";
-var DURATION_BUCKETS_SECONDS = [0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10, 30, 60];
-var USAGE_BUFFER_LIMIT_BYTES = 16 * 1024 * 1024;
-var MAX_TRACKED_MODELS = 200;
-var MAX_MODEL_LABEL_LENGTH = 200;
-var MAX_TRACKED_RATELIMIT_RESOURCES = 32;
-var LABEL_SEPARATOR = "";
-var UNKNOWN_MODEL = "unknown";
-function emptyModelTotals() {
-  return { cached: 0, completion: 0, prompt: 0, reasoning: 0, requests: 0, total: 0 };
-}
-var MetricsRegistry = class {
-  #startedAtMs;
-  #inFlight = 0;
-  #requests = /* @__PURE__ */ new Map();
-  #durations = /* @__PURE__ */ new Map();
-  #inFlightByRoute = /* @__PURE__ */ new Map();
-  #tokens = /* @__PURE__ */ new Map();
-  #upstream = /* @__PURE__ */ new Map();
-  #copilotQuota;
-  #githubRateLimit = /* @__PURE__ */ new Map();
-  #extraction = { extracted: 0, missing: 0 };
-  constructor(options = {}) {
-    this.#startedAtMs = (options.now ?? Date.now)();
+// src/http/body.ts
+var INVALID_JSON_MESSAGE = "Request body must be valid JSON.";
+var JSON_OBJECT_MESSAGE = "Request body must be a JSON object.";
+var MAX_REQUEST_BODY_BYTES = 16 * 1024 * 1024;
+var REQUEST_TOO_LARGE_MESSAGE = `Request body must be ${MAX_REQUEST_BODY_BYTES} bytes or smaller.`;
+var RequestBodyTooLargeError = class extends Error {
+  constructor() {
+    super(REQUEST_TOO_LARGE_MESSAGE);
+    this.name = "RequestBodyTooLargeError";
   }
-  /** Mark a request as started; pair with exactly one {@link observe}. */
-  startRequest(route) {
-    this.#inFlight += 1;
-    if (route) {
-      this.#inFlightByRoute.set(route, (this.#inFlightByRoute.get(route) ?? 0) + 1);
-    }
+};
+var InvalidJsonError = class extends Error {
+  constructor() {
+    super(INVALID_JSON_MESSAGE);
+    this.name = "InvalidJsonError";
   }
-  /** Record a completed request and clear its in-flight slot. */
-  observe(observation) {
-    if (this.#inFlight > 0) {
-      this.#inFlight -= 1;
-    }
-    const inFlightForRoute = this.#inFlightByRoute.get(observation.route) ?? 0;
-    if (inFlightForRoute > 1) {
-      this.#inFlightByRoute.set(observation.route, inFlightForRoute - 1);
-    } else if (inFlightForRoute === 1) {
-      this.#inFlightByRoute.delete(observation.route);
-    }
-    const key = labelKey(observation.route, observation.method, String(observation.status));
-    this.#requests.set(key, (this.#requests.get(key) ?? 0) + 1);
-    this.#observeDuration(observation.route, observation.durationMs / 1e3);
+};
+var JsonNotObjectError = class extends Error {
+  constructor() {
+    super(JSON_OBJECT_MESSAGE);
+    this.name = "JsonNotObjectError";
   }
-  /**
-   * Record whether one upstream completion reported token usage. `missing`
-   * counts responses that carried no usage object — most often streamed Chat
-   * Completions sent without `stream_options: {"include_usage": true}` — so a
-   * rising miss rate flags clients whose token usage is going unaccounted.
-   */
-  recordTokenExtraction(extracted) {
-    if (extracted) {
-      this.#extraction.extracted += 1;
-    } else {
-      this.#extraction.missing += 1;
+};
+async function readJson(request) {
+  const text = await readRequestText(request);
+  return parseJsonObject2(text);
+}
+async function readJsonText(request) {
+  const text = await readRequestText(request);
+  return { json: parseJsonObject2(text), text };
+}
+async function readRequestText(request) {
+  const contentLength = request.headers.get("content-length");
+  if (contentLength) {
+    const declaredBytes = Number(contentLength);
+    if (Number.isFinite(declaredBytes) && declaredBytes > MAX_REQUEST_BODY_BYTES) {
+      throw new RequestBodyTooLargeError();
     }
   }
-  /** Accumulate token counts for a model from one upstream completion. */
-  recordTokens(model, usage) {
-    const name = this.#modelLabel(model);
-    const totals = this.#tokens.get(name) ?? emptyModelTotals();
-    totals.requests += 1;
-    totals.prompt += nonNegative(usage.promptTokens);
-    totals.completion += nonNegative(usage.completionTokens);
-    totals.total += nonNegative(usage.totalTokens);
-    totals.reasoning += nonNegative(usage.reasoningTokens ?? 0);
-    totals.cached += nonNegative(usage.cachedTokens ?? 0);
-    this.#tokens.set(name, totals);
-  }
-  /** Record one upstream Copilot call and whether it succeeded. */
-  recordUpstream(path, ok) {
-    const key = labelKey(path, ok ? "ok" : "error");
-    this.#upstream.set(key, (this.#upstream.get(key) ?? 0) + 1);
-  }
-  /** Store the latest Copilot quota so /metrics can expose it as gauges. */
-  recordCopilotQuota(usage) {
-    this.#copilotQuota = usage;
-  }
-  /**
-   * Store the latest GitHub REST rate-limit budget, keyed by its resource bucket.
-   * A no-op when `rateLimit` is undefined (the response carried no rate-limit
-   * headers) so callers can pass {@link parseRateLimitHeaders} output directly.
-   */
-  recordGithubRateLimit(rateLimit) {
-    if (!rateLimit) {
-      return;
-    }
-    const resource = this.#rateLimitResource(rateLimit.resource);
-    this.#githubRateLimit.set(resource, { ...rateLimit, resource });
+  const body = request.body;
+  if (!body) {
+    return "";
   }
-  // Clean a raw value into a bounded exposition-format label: cap its length,
-  // strip characters that would corrupt the format, and fold overflow past the
-  // cardinality limit into UNKNOWN_MODEL so the series count stays bounded.
-  #boundedLabel(value, tracked, maxEntries) {
-    const cleaned = cleanLabel(value).slice(0, MAX_MODEL_LABEL_LENGTH) || UNKNOWN_MODEL;
-    if (!tracked.has(cleaned) && tracked.size >= maxEntries) {
-      return UNKNOWN_MODEL;
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let bytes = 0;
+  const chunks = [];
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) {
+        const tail = decoder.decode();
+        if (tail) {
+          chunks.push(tail);
+        }
+        return chunks.join("");
+      }
+      bytes += value.byteLength;
+      if (bytes > MAX_REQUEST_BODY_BYTES) {
+        await reader.cancel().catch(() => {
+        });
+        throw new RequestBodyTooLargeError();
+      }
+      chunks.push(decoder.decode(value, { stream: true }));
     }
-    return cleaned;
+  } finally {
+    reader.releaseLock();
   }
-  // The model can originate from a (possibly hostile) client request.
-  #modelLabel(model) {
-    return this.#boundedLabel(model, this.#tokens, MAX_TRACKED_MODELS);
+}
+function parseJsonObject2(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new InvalidJsonError();
   }
-  // The resource comes from a trusted upstream header, but is bounded the same way.
-  #rateLimitResource(resource) {
-    return this.#boundedLabel(resource, this.#githubRateLimit, MAX_TRACKED_RATELIMIT_RESOURCES);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new JsonNotObjectError();
   }
-  #observeDuration(route, seconds) {
-    const value = Number.isFinite(seconds) && seconds >= 0 ? seconds : 0;
-    const entry = this.#durations.get(route) ?? {
-      buckets: new Array(DURATION_BUCKETS_SECONDS.length).fill(0),
-      count: 0,
-      sum: 0
-    };
-    entry.count += 1;
-    entry.sum += value;
-    const index = DURATION_BUCKETS_SECONDS.findIndex((bound) => value <= bound);
-    if (index !== -1) {
-      entry.buckets[index] = (entry.buckets[index] ?? 0) + 1;
+  return parsed;
+}
+
+// src/http/security.ts
+import { createHash, timingSafeEqual } from "crypto";
+var FORBIDDEN_BROWSER_ORIGIN_MESSAGE = "Cross-origin browser requests are blocked unless the Origin is loopback or listed in HOOPILOT_ALLOWED_ORIGINS.";
+var MIN_NON_LOOPBACK_API_KEY_LENGTH = 24;
+var WELL_KNOWN_DEMO_API_KEYS = /* @__PURE__ */ new Set([
+  "changeme",
+  "demo",
+  "example",
+  "hoopilot",
+  "local-key",
+  "password",
+  "password123",
+  "secret",
+  "test"
+]);
+function corsHeaders() {
+  return {
+    "access-control-allow-headers": "anthropic-beta, anthropic-dangerous-direct-browser-access, anthropic-version, authorization, content-type, x-api-key, x-request-id",
+    "access-control-allow-methods": "GET, POST, OPTIONS",
+    "access-control-expose-headers": "x-request-id"
+  };
+}
+function isAuthorized(request, apiKey) {
+  if (!apiKey) {
+    return true;
+  }
+  const authorization = request.headers.get("authorization") ?? "";
+  const bearer = authorization.match(/^Bearer\s+(.+)$/i)?.[1];
+  return bearer !== void 0 && secretEquals(bearer, apiKey) || secretEquals(request.headers.get("x-api-key") ?? "", apiKey);
+}
+function forbiddenBrowserOrigin(origin, request, allowedOrigins) {
+  if (origin) {
+    return isAllowedOrigin(origin, allowedOrigins) ? void 0 : origin;
+  }
+  const fetchSite = request.headers.get("sec-fetch-site")?.toLowerCase();
+  return fetchSite === "cross-site" ? "cross-site" : void 0;
+}
+function parseAllowedOrigins(env) {
+  const raw = envValue(env?.HOOPILOT_ALLOWED_ORIGINS);
+  if (!raw) {
+    return /* @__PURE__ */ new Set();
+  }
+  return new Set(
+    raw.split(",").map((value) => value.trim().toLowerCase()).filter((value) => value.length > 0)
+  );
+}
+function resolveCorsAllowOrigin(origin, allowedOrigins) {
+  if (!origin) {
+    return "*";
+  }
+  return isAllowedOrigin(origin, allowedOrigins) ? origin : void 0;
+}
+function apiKeyRejectionReason(apiKey) {
+  const normalized = apiKey.trim();
+  if (WELL_KNOWN_DEMO_API_KEYS.has(normalized.toLowerCase())) {
+    return "HOOPILOT_API_KEY is a well-known demo value. Set a strong, unique API key.";
+  }
+  if (normalized.length < MIN_NON_LOOPBACK_API_KEY_LENGTH) {
+    return `HOOPILOT_API_KEY must be at least ${MIN_NON_LOOPBACK_API_KEY_LENGTH} characters when listening on a non-loopback host.`;
+  }
+  if (/^(.)\1+$/.test(normalized)) {
+    return "HOOPILOT_API_KEY must not be a repeated single character. Set a strong, unique API key.";
+  }
+  return void 0;
+}
+function isLoopbackHost(host) {
+  return isLoopbackHostname(host);
+}
+function urlHost(host) {
+  return host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+}
+function secretEquals(candidate, secret) {
+  const a = createHash("sha256").update(candidate).digest();
+  const b = createHash("sha256").update(secret).digest();
+  return timingSafeEqual(a, b);
+}
+function isAllowedOrigin(origin, allowedOrigins) {
+  return isLoopbackOrigin(origin) || allowedOrigins.has(origin.toLowerCase());
+}
+function isLoopbackOrigin(origin) {
+  try {
+    return isLoopbackHost(new URL(origin).hostname.toLowerCase());
+  } catch {
+    return false;
+  }
+}
+
+// src/http/responses.ts
+function jsonResponse(body, status = 200) {
+  return new Response(JSON.stringify(body), {
+    headers: {
+      ...corsHeaders(),
+      "content-type": "application/json; charset=utf-8"
+    },
+    status
+  });
+}
+function textResponse(body, contentType, status = 200) {
+  return new Response(body, {
+    headers: {
+      ...corsHeaders(),
+      "content-type": `${contentType}; charset=utf-8`
+    },
+    status
+  });
+}
+function jsonError(status, code, message) {
+  return jsonResponse(
+    {
+      error: {
+        code,
+        message,
+        type: code
+      }
+    },
+    status
+  );
+}
+function responseFromText(source, text) {
+  return new Response(text, {
+    headers: source.headers,
+    status: source.status,
+    statusText: source.statusText
+  });
+}
+function proxyResponse(upstream) {
+  const headers = new Headers(upstream.headers);
+  headers.delete("content-encoding");
+  headers.delete("content-length");
+  headers.delete("transfer-encoding");
+  for (const [key, value] of Object.entries(corsHeaders())) {
+    headers.set(key, value);
+  }
+  return new Response(upstream.body, {
+    headers,
+    status: upstream.status,
+    statusText: upstream.statusText
+  });
+}
+function upstreamErrorResponse(status, text) {
+  const parsedError = asRecord(asRecord(safeJsonParse(text)).error);
+  if (Object.keys(parsedError).length > 0) {
+    return jsonResponse({ error: parsedError }, status);
+  }
+  return jsonError(status, "copilot_error", text);
+}
+function websocketUnsupportedResponse() {
+  const response = jsonError(
+    426,
+    "websocket_not_supported",
+    "Hoopilot does not support Responses WebSocket transport; retry with HTTP Responses API."
+  );
+  response.headers.set("upgrade", "websocket");
+  return response;
+}
+
+// src/metrics.ts
+var PROMETHEUS_CONTENT_TYPE = "text/plain; version=0.0.4; charset=utf-8";
+var DURATION_BUCKETS_SECONDS = [0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10, 30, 60];
+var USAGE_BUFFER_LIMIT_BYTES = 16 * 1024 * 1024;
+var MAX_TRACKED_MODELS = 200;
+var MAX_MODEL_LABEL_LENGTH = 200;
+var MAX_TRACKED_RATELIMIT_RESOURCES = 32;
+var LABEL_SEPARATOR = "";
+var UNKNOWN_MODEL = "unknown";
+function emptyModelTotals() {
+  return { cached: 0, completion: 0, prompt: 0, reasoning: 0, requests: 0, total: 0 };
+}
+var MetricsRegistry = class {
+  #startedAtMs;
+  #inFlight = 0;
+  #requests = /* @__PURE__ */ new Map();
+  #durations = /* @__PURE__ */ new Map();
+  #inFlightByRoute = /* @__PURE__ */ new Map();
+  #tokens = /* @__PURE__ */ new Map();
+  #upstream = /* @__PURE__ */ new Map();
+  #copilotQuota;
+  #githubRateLimit = /* @__PURE__ */ new Map();
+  #extraction = { extracted: 0, missing: 0 };
+  constructor(options = {}) {
+    this.#startedAtMs = (options.now ?? Date.now)();
+  }
+  /** Mark a request as started; pair with exactly one {@link observe}. */
+  startRequest(route) {
+    this.#inFlight += 1;
+    if (route) {
+      this.#inFlightByRoute.set(route, (this.#inFlightByRoute.get(route) ?? 0) + 1);
+    }
+  }
+  /** Record a completed request and clear its in-flight slot. */
+  observe(observation) {
+    if (this.#inFlight > 0) {
+      this.#inFlight -= 1;
+    }
+    const inFlightForRoute = this.#inFlightByRoute.get(observation.route) ?? 0;
+    if (inFlightForRoute > 1) {
+      this.#inFlightByRoute.set(observation.route, inFlightForRoute - 1);
+    } else if (inFlightForRoute === 1) {
+      this.#inFlightByRoute.delete(observation.route);
+    }
+    const key = labelKey(observation.route, observation.method, String(observation.status));
+    this.#requests.set(key, (this.#requests.get(key) ?? 0) + 1);
+    this.#observeDuration(observation.route, observation.durationMs / 1e3);
+  }
+  /**
+   * Record whether one upstream completion reported token usage. `missing`
+   * counts responses that carried no usage object — most often streamed Chat
+   * Completions sent without `stream_options: {"include_usage": true}` — so a
+   * rising miss rate flags clients whose token usage is going unaccounted.
+   */
+  recordTokenExtraction(extracted) {
+    if (extracted) {
+      this.#extraction.extracted += 1;
+    } else {
+      this.#extraction.missing += 1;
+    }
+  }
+  /** Accumulate token counts for a model from one upstream completion. */
+  recordTokens(model, usage) {
+    const name = this.#modelLabel(model);
+    const totals = this.#tokens.get(name) ?? emptyModelTotals();
+    totals.requests += 1;
+    totals.prompt += nonNegative(usage.promptTokens);
+    totals.completion += nonNegative(usage.completionTokens);
+    totals.total += nonNegative(usage.totalTokens);
+    totals.reasoning += nonNegative(usage.reasoningTokens ?? 0);
+    totals.cached += nonNegative(usage.cachedTokens ?? 0);
+    this.#tokens.set(name, totals);
+  }
+  /** Record one upstream Copilot call and whether it succeeded. */
+  recordUpstream(path, ok) {
+    const key = labelKey(path, ok ? "ok" : "error");
+    this.#upstream.set(key, (this.#upstream.get(key) ?? 0) + 1);
+  }
+  /** Store the latest Copilot quota so /metrics can expose it as gauges. */
+  recordCopilotQuota(usage) {
+    this.#copilotQuota = usage;
+  }
+  /**
+   * Store the latest GitHub REST rate-limit budget, keyed by its resource bucket.
+   * A no-op when `rateLimit` is undefined (the response carried no rate-limit
+   * headers) so callers can pass {@link parseRateLimitHeaders} output directly.
+   */
+  recordGithubRateLimit(rateLimit) {
+    if (!rateLimit) {
+      return;
+    }
+    const resource = this.#rateLimitResource(rateLimit.resource);
+    this.#githubRateLimit.set(resource, { ...rateLimit, resource });
+  }
+  // Clean a raw value into a bounded exposition-format label: cap its length,
+  // strip characters that would corrupt the format, and fold overflow past the
+  // cardinality limit into UNKNOWN_MODEL so the series count stays bounded.
+  #boundedLabel(value, tracked, maxEntries) {
+    const cleaned = cleanLabel(value).slice(0, MAX_MODEL_LABEL_LENGTH) || UNKNOWN_MODEL;
+    if (!tracked.has(cleaned) && tracked.size >= maxEntries) {
+      return UNKNOWN_MODEL;
+    }
+    return cleaned;
+  }
+  // The model can originate from a (possibly hostile) client request.
+  #modelLabel(model) {
+    return this.#boundedLabel(model, this.#tokens, MAX_TRACKED_MODELS);
+  }
+  // The resource comes from a trusted upstream header, but is bounded the same way.
+  #rateLimitResource(resource) {
+    return this.#boundedLabel(resource, this.#githubRateLimit, MAX_TRACKED_RATELIMIT_RESOURCES);
+  }
+  #observeDuration(route, seconds) {
+    const value = Number.isFinite(seconds) && seconds >= 0 ? seconds : 0;
+    const entry = this.#durations.get(route) ?? {
+      buckets: new Array(DURATION_BUCKETS_SECONDS.length).fill(0),
+      count: 0,
+      sum: 0
+    };
+    entry.count += 1;
+    entry.sum += value;
+    const index = DURATION_BUCKETS_SECONDS.findIndex((bound) => value <= bound);
+    if (index !== -1) {
+      entry.buckets[index] = (entry.buckets[index] ?? 0) + 1;
     }
     this.#durations.set(route, entry);
   }
@@ -3484,11 +3717,7 @@ function safeFinishAccumulator(accumulator) {
   }
 }
 function considerSseLine(line, consider) {
-  const trimmed = line.trim();
-  if (!trimmed.startsWith("data:")) {
-    return;
-  }
-  const data = trimmed.slice("data:".length).trim();
+  const data = sseDataFromLine(line);
   if (!data || data === "[DONE]") {
     return;
   }
@@ -3600,24 +3829,7 @@ async function getVersion() {
 // src/server.ts
 var DEFAULT_HOST = "127.0.0.1";
 var DEFAULT_PORT = 4141;
-var FORBIDDEN_BROWSER_ORIGIN_MESSAGE = "Cross-origin browser requests are blocked unless the Origin is loopback or listed in HOOPILOT_ALLOWED_ORIGINS.";
-var MIN_NON_LOOPBACK_API_KEY_LENGTH = 24;
-var WELL_KNOWN_DEMO_API_KEYS = /* @__PURE__ */ new Set([
-  "changeme",
-  "demo",
-  "example",
-  "hoopilot",
-  "local-key",
-  "password",
-  "password123",
-  "secret",
-  "test"
-]);
-var INVALID_JSON_MESSAGE = "Request body must be valid JSON.";
-var JSON_OBJECT_MESSAGE = "Request body must be a JSON object.";
-var MAX_REQUEST_BODY_BYTES = 16 * 1024 * 1024;
 var REQUEST_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
-var REQUEST_TOO_LARGE_MESSAGE = `Request body must be ${MAX_REQUEST_BODY_BYTES} bytes or smaller.`;
 var USAGE_CACHE_TTL_MS = 6e4;
 var DASHBOARD_USAGE_VIEW = "dashboard";
 var DASHBOARD_EXCLUDED_ROUTES = [
@@ -3628,24 +3840,6 @@ var DASHBOARD_EXCLUDED_ROUTES = [
   "usage"
 ];
 var DASHBOARD_EXCLUDED_UPSTREAM_PATHS = ["/copilot_internal/user"];
-var RequestBodyTooLargeError = class extends Error {
-  constructor() {
-    super(REQUEST_TOO_LARGE_MESSAGE);
-    this.name = "RequestBodyTooLargeError";
-  }
-};
-var InvalidJsonError = class extends Error {
-  constructor() {
-    super(INVALID_JSON_MESSAGE);
-    this.name = "InvalidJsonError";
-  }
-};
-var JsonNotObjectError = class extends Error {
-  constructor() {
-    super(JSON_OBJECT_MESSAGE);
-    this.name = "JsonNotObjectError";
-  }
-};
 function createHoopilotHandler(options = {}) {
   const client = new CopilotClient(options);
   const apiKey = options.apiKey ?? envValue(options.env?.HOOPILOT_API_KEY);
@@ -4128,13 +4322,6 @@ async function responseWithObservedUsage(response, fallbackModel, recordTokens,
   }
   return observeResponseUsage(response, fallbackModel, recordTokens, signal, recordExtraction);
 }
-function responseFromText(source, text) {
-  return new Response(text, {
-    headers: source.headers,
-    status: source.status,
-    statusText: source.statusText
-  });
-}
 async function proxyError(upstream, logger) {
   const text = await upstream.text();
   if (isUpstreamAuthStatus(upstream.status)) {
@@ -4150,201 +4337,12 @@ async function proxyError(upstream, logger) {
   );
   return upstreamErrorResponse(upstream.status, text || upstream.statusText);
 }
-function proxyResponse(upstream) {
-  const headers = new Headers(upstream.headers);
-  headers.delete("content-encoding");
-  headers.delete("content-length");
-  headers.delete("transfer-encoding");
-  for (const [key, value] of Object.entries(corsHeaders())) {
-    headers.set(key, value);
-  }
-  return new Response(upstream.body, {
-    headers,
-    status: upstream.status,
-    statusText: upstream.statusText
-  });
-}
-async function readJson(request) {
-  const text = await readRequestText(request);
-  return parseJsonObject2(text);
-}
-function parseJsonObject2(text) {
-  let parsed;
-  try {
-    parsed = JSON.parse(text);
-  } catch {
-    throw new InvalidJsonError();
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new JsonNotObjectError();
-  }
-  return parsed;
-}
-async function readJsonText(request) {
-  const text = await readRequestText(request);
-  return { json: parseJsonObject2(text), text };
-}
-async function readRequestText(request) {
-  const contentLength = request.headers.get("content-length");
-  if (contentLength) {
-    const declaredBytes = Number(contentLength);
-    if (Number.isFinite(declaredBytes) && declaredBytes > MAX_REQUEST_BODY_BYTES) {
-      throw new RequestBodyTooLargeError();
-    }
-  }
-  const body = request.body;
-  if (!body) {
-    return "";
-  }
-  const reader = body.getReader();
-  const decoder = new TextDecoder();
-  let bytes = 0;
-  const chunks = [];
-  try {
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done) {
-        const tail = decoder.decode();
-        if (tail) {
-          chunks.push(tail);
-        }
-        return chunks.join("");
-      }
-      bytes += value.byteLength;
-      if (bytes > MAX_REQUEST_BODY_BYTES) {
-        await reader.cancel().catch(() => {
-        });
-        throw new RequestBodyTooLargeError();
-      }
-      chunks.push(decoder.decode(value, { stream: true }));
-    }
-  } finally {
-    reader.releaseLock();
-  }
-}
-function jsonResponse(body, status = 200) {
-  return new Response(JSON.stringify(body), {
-    headers: {
-      ...corsHeaders(),
-      "content-type": "application/json; charset=utf-8"
-    },
-    status
-  });
-}
-function textResponse(body, contentType, status = 200) {
-  return new Response(body, {
-    headers: {
-      ...corsHeaders(),
-      "content-type": `${contentType}; charset=utf-8`
-    },
-    status
-  });
-}
-function jsonError(status, code, message) {
-  return jsonResponse(
-    {
-      error: {
-        code,
-        message,
-        type: code
-      }
-    },
-    status
-  );
-}
-function upstreamErrorResponse(status, text) {
-  const parsedError = asRecord(asRecord(safeJsonParse(text)).error);
-  if (Object.keys(parsedError).length > 0) {
-    return jsonResponse({ error: parsedError }, status);
-  }
-  return jsonError(status, "copilot_error", text);
-}
-function websocketUnsupportedResponse() {
-  const response = jsonError(
-    426,
-    "websocket_not_supported",
-    "Hoopilot does not support Responses WebSocket transport; retry with HTTP Responses API."
-  );
-  response.headers.set("upgrade", "websocket");
-  return response;
-}
-function corsHeaders() {
-  return {
-    "access-control-allow-headers": "anthropic-beta, anthropic-dangerous-direct-browser-access, anthropic-version, authorization, content-type, x-api-key, x-request-id",
-    "access-control-allow-methods": "GET, POST, OPTIONS",
-    "access-control-expose-headers": "x-request-id"
-  };
-}
-function secretEquals(candidate, secret) {
-  const a = createHash("sha256").update(candidate).digest();
-  const b = createHash("sha256").update(secret).digest();
-  return timingSafeEqual(a, b);
-}
-function isAuthorized(request, apiKey) {
-  if (!apiKey) {
-    return true;
-  }
-  const authorization = request.headers.get("authorization") ?? "";
-  const bearer = authorization.match(/^Bearer\s+(.+)$/i)?.[1];
-  return bearer !== void 0 && secretEquals(bearer, apiKey) || secretEquals(request.headers.get("x-api-key") ?? "", apiKey);
-}
-function forbiddenBrowserOrigin(origin, request, allowedOrigins) {
-  if (origin) {
-    return isAllowedOrigin(origin, allowedOrigins) ? void 0 : origin;
-  }
-  const fetchSite = request.headers.get("sec-fetch-site")?.toLowerCase();
-  return fetchSite === "cross-site" ? "cross-site" : void 0;
-}
-function parseAllowedOrigins(env) {
-  const raw = envValue(env?.HOOPILOT_ALLOWED_ORIGINS);
-  if (!raw) {
-    return /* @__PURE__ */ new Set();
-  }
-  return new Set(
-    raw.split(",").map((value) => value.trim().toLowerCase()).filter((value) => value.length > 0)
-  );
-}
-function isAllowedOrigin(origin, allowedOrigins) {
-  return isLoopbackOrigin(origin) || allowedOrigins.has(origin.toLowerCase());
-}
-function resolveCorsAllowOrigin(origin, allowedOrigins) {
-  if (!origin) {
-    return "*";
-  }
-  return isAllowedOrigin(origin, allowedOrigins) ? origin : void 0;
-}
-function apiKeyRejectionReason(apiKey) {
-  const normalized = apiKey.trim();
-  if (WELL_KNOWN_DEMO_API_KEYS.has(normalized.toLowerCase())) {
-    return "HOOPILOT_API_KEY is a well-known demo value. Set a strong, unique API key.";
-  }
-  if (normalized.length < MIN_NON_LOOPBACK_API_KEY_LENGTH) {
-    return `HOOPILOT_API_KEY must be at least ${MIN_NON_LOOPBACK_API_KEY_LENGTH} characters when listening on a non-loopback host.`;
-  }
-  if (/^(.)\1+$/.test(normalized)) {
-    return "HOOPILOT_API_KEY must not be a repeated single character. Set a strong, unique API key.";
-  }
-  return void 0;
-}
 function isUpstreamAuthStatus(status) {
   return status === 401 || status === 403;
 }
 function upstreamAuthMessage(message) {
   return `GitHub Copilot rejected the credential or account access: ${message}`;
 }
-function isLoopbackHost(host) {
-  return isLoopbackHostname(host);
-}
-function urlHost(host) {
-  return host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
-}
-function isLoopbackOrigin(origin) {
-  try {
-    return isLoopbackHost(new URL(origin).hostname.toLowerCase());
-  } catch {
-    return false;
-  }
-}
 function normalizeServerPort(value) {
   const port = Number(value);
   if (!Number.isInteger(port) || port < 0 || port > 65535) {
@@ -5180,6 +5178,7 @@ async function runUpdate(currentVersion, logger) {
 }
 
 // src/cli.ts
+var COPILOT_VERIFY_TIMEOUT_MS = 15e3;
 async function main2(argv = Bun.argv.slice(2)) {
   cleanupOldBinary();
   const command = argv[0];
@@ -5520,7 +5519,8 @@ async function verifyCopilotOAuthToken(token, options = {}) {
   const fetcher = options.fetch ?? fetch;
   const response = await fetcher(`${apiBaseUrl}/models`, {
     headers: applyCopilotHeaders(new Headers(), token),
-    method: "GET"
+    method: "GET",
+    signal: AbortSignal.timeout(options.verifyTimeoutMs ?? COPILOT_VERIFY_TIMEOUT_MS)
   });
   if (!response.ok) {
     await throwForCopilotResponse(response, "GitHub Copilot API verification");