codex-copilot-dx 0.4.15 → 0.4.17

package/README.md

@@ -27,7 +27,7 @@ npx codex-copilot-dx@latest
 > Tip: the `@latest` suffix forces `npx` to fetch the newest release instead of using a stale cached copy.
 
 On first run, it will:
-1. Authenticate with GitHub via device flow (if needed)
+1. Authenticate with GitHub via device flow (if needed), after first trying compatible local Copilot token sources
 2. Print the local package version and warn when a newer npm release is available
 3. Start the adapter on loopback (`127.0.0.1:2026`)
 4. Configure Codex (`~/.codex/config.toml`) to use the adapter, including stale shell env base URLs if present
@@ -36,6 +36,8 @@ On first run, it will:
 
 Claude Code picks up the new `ANTHROPIC_BASE_URL` on its next launch.
 
+If an existing `codex-copilot-dx` adapter is already running on the configured host and port, a second launch reuses it instead of starting another proxy. The second launch still refreshes Codex and Claude Code config, then exits.
+
 Do not set Claude Code by manually exporting `ANTHROPIC_BASE_URL` or `ANTHROPIC_AUTH_TOKEN` in your shell. Let `codex-copilot-dx` write the local config files instead. If you previously exported those variables, remove them from shell startup files and restart the terminal before launching Claude Code.
 
 ### Diagnostics
@@ -48,7 +50,9 @@ codex-copilot-dx doctor
 
 The doctor checks the GitHub token, Codex config, Claude Code settings, Claude App gateway profile, and whether the local adapter port is listening.
 
-If Copilot token refresh fails with `401` or `403`, the saved GitHub token may be expired, revoked, or missing Copilot access. Delete the saved token and start the tool again to trigger GitHub device login:
+When the saved token is missing, `codex-copilot-dx` first looks for compatible local Copilot GitHub tokens, validates them with GitHub and Copilot, and imports a valid one before starting device login. It checks explicit token sources (`CCDX_GITHUB_TOKEN`, `CCDX_GITHUB_TOKEN_PATH`, `CCDX_GITHUB_TOKEN_PATHS`) plus common local `auth.json` layouts under application config directories. It does not rely on a specific app name. If a saved token later fails with `401` or `403`, the adapter repeats that discovery and retries once before asking you to reauthenticate.
+
+If Copilot token refresh still fails with `401` or `403`, the saved GitHub token may be expired, revoked, or missing Copilot access. Delete the saved token and start the tool again to trigger GitHub device login:
 
 ```bash
 rm ~/.local/share/copilot-api/github_token
@@ -71,6 +75,8 @@ CCDX_CONFIGURE_CLAUDE_DESKTOP=1 npx codex-copilot-dx@latest
 
 This writes a local Claude App 3P gateway profile that points to the adapter root URL, such as `http://127.0.0.1:2026`. The profile uses a generated local bearer key unless `CCDX_CLAUDE_DESKTOP_API_KEY` is set. Restart Claude App after running the command.
 
+When reusing an already-running adapter, Claude App profile updates require `CCDX_CLAUDE_DESKTOP_API_KEY` or `CCDX_PROXY_API_KEY` so the profile key matches the running process. Otherwise the existing adapter is left untouched.
+
 ## Configuration
 
 Environment variables:
@@ -90,6 +96,13 @@ Environment variables:
 | `CCDX_CONFIGURE_CLAUDE_DESKTOP` | unset | Set to `1` to write the Claude App 3P gateway profile during startup |
 | `CCDX_CLAUDE_DESKTOP_API_KEY` | generated for opt-in setup | Bearer key written into the Claude App profile and recognized by the adapter for model discovery |
 | `CCDX_CLAUDE_MODEL_ALIASES` | built-in Claude aliases | Comma-separated Desktop-to-upstream aliases, for example `claude-sonnet-4-6=claude-sonnet-4.6` |
+| `CCDX_GITHUB_TOKEN` | unset | Explicit GitHub Copilot OAuth token to validate and import before device login |
+| `CCDX_GITHUB_TOKEN_PATH` | unset | Explicit file containing a GitHub Copilot OAuth token to validate and import before device login |
+| `CCDX_GITHUB_TOKEN_PATHS` | unset | Multiple token files separated by the platform path delimiter (`:` on macOS/Linux, `;` on Windows) |
+| `CCDX_DISABLE_TOKEN_DISCOVERY` | unset | Set to `1` to skip local token discovery and go straight to the saved token or device flow |
+| `CCDX_TOKEN_LOCK_TIMEOUT_MS` | `600000` | Maximum time to wait for another local process to finish GitHub token login/import |
+| `CCDX_TOKEN_LOCK_STALE_MS` | `900000` | Age after which a stale GitHub token lock file can be removed |
+| `CCDX_EXISTING_ADAPTER_TIMEOUT_MS` | `500` | Timeout for detecting an already-running local adapter during startup |
 | `CCDX_USAGE_PATH` | `~/.local/share/codex-copilot-dx/usage.jsonl` | Local JSONL token usage log |
 | `CCDX_DISABLE_USAGE` | unset | Set to `1` to disable usage logging |
 

package/bin/cli.mjs

@@ -11,10 +11,12 @@ import { status } from "../src/status.mjs";
 import { printUsageSummary } from "../src/usage.mjs";
 import { checkForUpdate, localPackageVersion } from "../src/version.mjs";
 import { runDoctor } from "../src/doctor.mjs";
+import { checkRunningAdapter } from "../src/running-adapter.mjs";
 
 const ADAPTER_PORT = parseInt(process.env.ADAPTER_PORT || "2026");
 const ADAPTER_HOST = process.env.ADAPTER_HOST || "127.0.0.1";
 const MODEL_REFRESH_TIMEOUT_MS = parseInt(process.env.CCDX_MODEL_REFRESH_TIMEOUT_MS || "5000", 10);
+const EXISTING_ADAPTER_TIMEOUT_MS = parseInt(process.env.CCDX_EXISTING_ADAPTER_TIMEOUT_MS || "500", 10);
 const LOCAL_VERSION = localPackageVersion();
 const command = process.argv[2];
 const CONFIGURE_CLAUDE_DESKTOP = command === "--configure-claude-desktop" || process.env.CCDX_CONFIGURE_CLAUDE_DESKTOP === "1";
@@ -56,6 +58,49 @@ async function refreshClaudeDesktopModelDefs() {
   }
 }
 
+function currentClaudeDesktopApiKey() {
+  return process.env.CCDX_CLAUDE_DESKTOP_API_KEY || process.env.CCDX_PROXY_API_KEY || "";
+}
+
+async function reuseRunningAdapterIfAvailable() {
+  const running = await checkRunningAdapter({
+    port: ADAPTER_PORT,
+    host: ADAPTER_HOST,
+    timeoutMs: EXISTING_ADAPTER_TIMEOUT_MS,
+  });
+  if (!running.ok) return false;
+
+  console.log(status("ok", `Using existing adapter at ${running.baseUrl}`));
+  ensureCodexConfig(ADAPTER_PORT);
+  ensureClaudeConfig(ADAPTER_PORT);
+
+  if (CONFIGURE_CLAUDE_DESKTOP) {
+    const claudeDesktopApiKey = currentClaudeDesktopApiKey();
+    if (claudeDesktopApiKey) {
+      const result = applyClaudeDesktopConfig({
+        port: ADAPTER_PORT,
+        host: ADAPTER_HOST,
+        gatewayApiKey: claudeDesktopApiKey,
+        modelIds: claudeDesktopModelIds(process.env),
+      });
+      console.log(status("ok", `Configured Claude App gateway profile at ${result.baseUrl}`));
+      console.log(formatClaudeDesktopApplyResult(result));
+    } else {
+      console.log(status("warn", "Existing adapter is running; skip Claude App profile update unless CCDX_CLAUDE_DESKTOP_API_KEY or CCDX_PROXY_API_KEY is set"));
+    }
+  } else {
+    console.log(status("ok", "Claude App support available with --configure-claude-desktop"));
+  }
+
+  openCodex();
+  console.log(`
+  ${status("ok", "Ready, using the existing codex-copilot-dx adapter")}
+
+  Adapter: ${running.baseUrl}
+`);
+  return true;
+}
+
 if (command === "--version" || command === "-v" || command === "version") {
   console.log(`codex-copilot-dx v${LOCAL_VERSION}`);
   process.exit(0);
@@ -83,6 +128,8 @@ checkForUpdate({ currentVersion: LOCAL_VERSION }).then(({ latestVersion, updateA
 });
 
 try {
+  if (await reuseRunningAdapterIfAvailable()) process.exit(0);
+
   // Ensure GitHub login, using device flow if no token exists.
   await ensureAuth();
 
@@ -95,8 +142,8 @@ try {
   }
 
   const claudeDesktopApiKey = CONFIGURE_CLAUDE_DESKTOP
-    ? (process.env.CCDX_CLAUDE_DESKTOP_API_KEY || process.env.CCDX_PROXY_API_KEY || generatedClaudeDesktopApiKey())
-    : (process.env.CCDX_CLAUDE_DESKTOP_API_KEY || process.env.CCDX_PROXY_API_KEY || "");
+    ? (currentClaudeDesktopApiKey() || generatedClaudeDesktopApiKey())
+    : currentClaudeDesktopApiKey();
 
   // Start the in-process adapter.
   await startAdapter(ADAPTER_PORT, ADAPTER_HOST, { claudeDesktopApiKey, claudeDesktopModelDefs });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-copilot-dx",
-  "version": "0.4.15",
+  "version": "0.4.17",
   "description": "Use Codex Desktop, Claude Code, and Claude App with GitHub Copilot",
   "type": "module",
   "bin": {

package/src/adapter.mjs

@@ -8,6 +8,7 @@ import { anthropicToChat, chatToAnthropic, streamAnthropicFromLines, countTokens
 import { claudeDesktopModelsResponse, resolveAnthropicModel } from "./models.mjs";
 import { status } from "./status.mjs";
 import { recordAnthropicUsage, recordResponsesUsage } from "./usage.mjs";
+import { ADAPTER_HEALTH_PATH, adapterHealthPayload } from "./running-adapter.mjs";
 
 // Models that only support Responses API (not chat/completions)
 const RESPONSES_ONLY = new Set([
@@ -574,6 +575,12 @@ export function startAdapter(port = 2026, host = "127.0.0.1", options = {}) {
   const server = http.createServer((req, res) => {
     const pathname = requestPath(req.url);
 
+    if (req.method === "GET" && pathname === ADAPTER_HEALTH_PATH) {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify(adapterHealthPayload()));
+      return;
+    }
+
     if (req.method === "POST" && pathname === "/v1/responses") {
       (async () => {
         const abort = createRequestAbort(req, res);

package/src/auth.mjs

@@ -3,14 +3,25 @@ import path from "node:path";
 import os from "node:os";
 import { spawn } from "node:child_process";
 import { status } from "./status.mjs";
+import { withFileLock } from "./lock.mjs";
 
 const CLIENT_ID = "Iv1.b507a08c87ecfe98"; // Public GitHub Copilot client ID.
 const SCOPE = "read:user";
+const GITHUB_API = "https://api.github.com";
+const COPILOT_TOKEN_URL = `${GITHUB_API}/copilot_internal/v2/token`;
+const DISABLE_TOKEN_DISCOVERY_VALUES = new Set(["1", "true", "yes"]);
+const MAX_AUTH_JSON_BYTES = 1024 * 1024;
+const DEFAULT_TOKEN_LOCK_TIMEOUT_MS = 10 * 60 * 1000;
+const DEFAULT_TOKEN_LOCK_STALE_MS = 15 * 60 * 1000;
 
 export function githubTokenPath(home = os.homedir()) {
   return path.join(home, ".local", "share", "copilot-api", "github_token");
 }
 
+export function githubTokenLockPath(home = os.homedir()) {
+  return `${githubTokenPath(home)}.lock`;
+}
+
 export function githubReauthMessage(reason, home = os.homedir()) {
   const tokenPath = githubTokenPath(home);
   return `${reason}
@@ -31,6 +42,300 @@ export function interpretPoll(data) {
 
 function sleep(ms) { return new Promise((r) => setTimeout(r, ms)); }
 
+function expandHome(filePath, home = os.homedir()) {
+  if (!filePath) return "";
+  if (filePath === "~") return home;
+  if (filePath.startsWith("~/")) return path.join(home, filePath.slice(2));
+  return filePath;
+}
+
+function isTokenDiscoveryDisabled(env = process.env) {
+  return DISABLE_TOKEN_DISCOVERY_VALUES.has(String(env.CCDX_DISABLE_TOKEN_DISCOVERY || "").toLowerCase());
+}
+
+function positiveInt(value, fallback) {
+  const n = Number.parseInt(value, 10);
+  return Number.isFinite(n) && n > 0 ? n : fallback;
+}
+
+function tokenLockOptions(env = process.env) {
+  return {
+    timeoutMs: positiveInt(env.CCDX_TOKEN_LOCK_TIMEOUT_MS, DEFAULT_TOKEN_LOCK_TIMEOUT_MS),
+    staleMs: positiveInt(env.CCDX_TOKEN_LOCK_STALE_MS, DEFAULT_TOKEN_LOCK_STALE_MS),
+  };
+}
+
+function splitPathList(value) {
+  return String(value || "")
+    .split(path.delimiter)
+    .map((item) => item.trim())
+    .filter(Boolean);
+}
+
+function localAuthRoots(home, env = process.env) {
+  const roots = [
+    path.join(home, "Library", "Application Support"),
+    env.APPDATA ? expandHome(env.APPDATA, home) : "",
+    env.XDG_CONFIG_HOME ? expandHome(env.XDG_CONFIG_HOME, home) : path.join(home, ".config"),
+  ].filter(Boolean);
+  return [...new Set(roots)];
+}
+
+function addAuthJsonSource(sources, seen, filePath) {
+  if (seen.has(filePath)) return;
+  if (!fs.existsSync(filePath)) return;
+  seen.add(filePath);
+  sources.push({ type: "auth-json", path: filePath });
+}
+
+function localAuthJsonSources(home, env = process.env) {
+  const sources = [];
+  const seen = new Set();
+
+  for (const root of localAuthRoots(home, env)) {
+    let appDirs;
+    try {
+      appDirs = fs.readdirSync(root, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+
+    for (const appDirent of appDirs) {
+      if (!appDirent.isDirectory()) continue;
+      const appDir = path.join(root, appDirent.name);
+      addAuthJsonSource(sources, seen, path.join(appDir, "auth.json"));
+
+      const profilesDir = path.join(appDir, "profiles");
+      let profileDirs;
+      try {
+        profileDirs = fs.readdirSync(profilesDir, { withFileTypes: true });
+      } catch {
+        continue;
+      }
+
+      for (const profileDirent of profileDirs) {
+        if (!profileDirent.isDirectory()) continue;
+        addAuthJsonSource(sources, seen, path.join(profilesDir, profileDirent.name, "auth.json"));
+      }
+    }
+  }
+
+  return sources;
+}
+
+function explicitTokenFileSources(home, env = process.env) {
+  const paths = [];
+  if (typeof env.CCDX_GITHUB_TOKEN_PATH === "string" && env.CCDX_GITHUB_TOKEN_PATH.trim()) {
+    paths.push(env.CCDX_GITHUB_TOKEN_PATH.trim());
+  }
+  paths.push(...splitPathList(env.CCDX_GITHUB_TOKEN_PATHS));
+
+  const seen = new Set();
+  return paths
+    .map((filePath) => expandHome(filePath, home))
+    .filter((filePath) => {
+      if (seen.has(filePath)) return false;
+      seen.add(filePath);
+      return true;
+    })
+    .map((filePath) => ({
+      type: "token-file",
+      name: "configured token file",
+      path: filePath,
+    }));
+}
+
+function looksLikeCopilotAuthJson(json) {
+  if (!json || typeof json !== "object") return false;
+  if (json.ghcAuth || json.gitHubTokens || json.githubToken || json.githubCopilot || json.copilot) return true;
+  return typeof json.access_token === "string" && Boolean(json.copilotAccess || json.copilotToken || json.copilot_token);
+}
+
+function readSmallJson(filePath) {
+  const stat = fs.statSync(filePath);
+  if (!stat.isFile() || stat.size > MAX_AUTH_JSON_BYTES) return null;
+  return JSON.parse(fs.readFileSync(filePath, "utf8"));
+}
+
+export function githubTokenSources({
+  home = os.homedir(),
+  env = process.env,
+} = {}) {
+  if (isTokenDiscoveryDisabled(env)) return [];
+  const sources = [];
+  if (typeof env.CCDX_GITHUB_TOKEN === "string" && env.CCDX_GITHUB_TOKEN.trim()) {
+    sources.push({ type: "env", name: "CCDX_GITHUB_TOKEN", token: env.CCDX_GITHUB_TOKEN.trim() });
+  }
+  sources.push(...explicitTokenFileSources(home, env));
+  sources.push(...localAuthJsonSources(home, env));
+  return sources;
+}
+
+export function sourceDescription(source) {
+  if (!source) return "unknown source";
+  if (source.type === "env") return source.name;
+  if (source.type === "token-file") return `${source.name} (${source.path})`;
+  if (source.type === "auth-json") return `local auth file (${source.path})`;
+  return source.path || source.name || "unknown source";
+}
+
+export function extractGithubTokenFromAuthJson(json) {
+  const candidates = [
+    json?.ghcAuth?.gitHubTokens?.access_token,
+    json?.ghcAuth?.gitHubTokens?.accessToken,
+    json?.ghcAuth?.githubToken,
+    json?.gitHubTokens?.access_token,
+    json?.gitHubTokens?.accessToken,
+    json?.githubToken,
+    json?.access_token,
+    json?.accessToken,
+  ];
+  return candidates.find((value) => typeof value === "string" && value.trim())?.trim() || "";
+}
+
+export function readGithubTokenSource(source) {
+  if (source?.type === "env") return source.token || "";
+  if (source?.type === "token-file") return fs.readFileSync(source.path, "utf8").trim();
+  if (source?.type === "auth-json") {
+    const json = readSmallJson(source.path);
+    if (!looksLikeCopilotAuthJson(json)) return "";
+    return extractGithubTokenFromAuthJson(json);
+  }
+  return "";
+}
+
+function readSavedGithubToken(home = os.homedir()) {
+  const filePath = githubTokenPath(home);
+  if (!fs.existsSync(filePath)) return "";
+  return fs.readFileSync(filePath, "utf8").trim();
+}
+
+export async function validateGithubToken(token, {
+  fetchImpl = fetch,
+  signal,
+} = {}) {
+  if (typeof token !== "string" || !token.trim()) {
+    return { ok: false, reason: "empty_token" };
+  }
+
+  const headers = { Authorization: `token ${token.trim()}`, Accept: "application/json" };
+  let userResp;
+  try {
+    userResp = await fetchImpl(`${GITHUB_API}/user`, { headers, signal });
+  } catch (e) {
+    return { ok: false, transient: true, reason: "github_user_request_failed", error: e };
+  }
+
+  if (!userResp.ok) {
+    return {
+      ok: false,
+      status: userResp.status,
+      reason: userResp.status === 401 || userResp.status === 403 ? "github_token_invalid" : "github_user_failed",
+    };
+  }
+
+  let userData = {};
+  try {
+    userData = await userResp.json();
+  } catch {}
+  const login = typeof userData.login === "string" ? userData.login : "";
+
+  let copilotResp;
+  try {
+    copilotResp = await fetchImpl(COPILOT_TOKEN_URL, { headers, signal });
+  } catch (e) {
+    return { ok: false, transient: true, reason: "copilot_token_request_failed", login, error: e };
+  }
+
+  if (!copilotResp.ok) {
+    return {
+      ok: false,
+      status: copilotResp.status,
+      reason: copilotResp.status === 401 || copilotResp.status === 403 ? "copilot_access_denied" : "copilot_token_failed",
+      login,
+    };
+  }
+
+  let copilotTokenData = {};
+  try {
+    copilotTokenData = await copilotResp.json();
+  } catch (e) {
+    return { ok: false, reason: "copilot_token_parse_failed", login, error: e };
+  }
+
+  if (!copilotTokenData.token) {
+    return { ok: false, reason: "copilot_token_missing", login };
+  }
+
+  return { ok: true, login, copilotTokenData };
+}
+
+export async function discoverGithubToken({
+  home = os.homedir(),
+  env = process.env,
+  fetchImpl = fetch,
+  signal,
+  excludeTokens = [],
+} = {}) {
+  const excluded = new Set(excludeTokens);
+  const seen = new Set(excluded);
+  const failures = [];
+
+  for (const source of githubTokenSources({ home, env })) {
+    let token = "";
+    try {
+      token = readGithubTokenSource(source).trim();
+    } catch (e) {
+      failures.push({ source, reason: "read_failed", error: e });
+      continue;
+    }
+
+    if (!token || seen.has(token)) continue;
+    seen.add(token);
+
+    const validation = await validateGithubToken(token, { fetchImpl, signal });
+    if (validation.ok) return { ok: true, token, source, validation };
+    failures.push({ source, validation });
+  }
+
+  return { ok: false, failures };
+}
+
+export async function importDiscoveredGithubToken({
+  home = os.homedir(),
+  env = process.env,
+  fetchImpl = fetch,
+  signal,
+  excludeTokens = [],
+  log = console.log,
+  lock = true,
+  validateSavedToken = false,
+} = {}) {
+  const run = async () => {
+    const excluded = new Set(excludeTokens);
+    const savedToken = readSavedGithubToken(home);
+    if (savedToken && !excluded.has(savedToken)) {
+      if (!validateSavedToken) {
+        return { ok: true, token: savedToken, source: { type: "saved-token" }, imported: false };
+      }
+      const validation = await validateGithubToken(savedToken, { fetchImpl, signal });
+      if (validation.ok) {
+        return { ok: true, token: savedToken, source: { type: "saved-token" }, validation, imported: false };
+      }
+    }
+
+    const discovered = await discoverGithubToken({ home, env, fetchImpl, signal, excludeTokens });
+    if (!discovered.ok) return null;
+    writeToken(discovered.token, home);
+    const login = discovered.validation.login ? ` for ${discovered.validation.login}` : "";
+    log(status("ok", `Imported GitHub token from ${sourceDescription(discovered.source)}${login}`));
+    return { ...discovered, imported: true };
+  };
+
+  if (!lock) return run();
+  return withFileLock(githubTokenLockPath(home), run, tokenLockOptions(env));
+}
+
 // On macOS, copy the user code and open the verification page. Fail quietly.
 function openAndCopy(userCode, verificationUri) {
   if (process.platform !== "darwin") return;
@@ -50,59 +355,86 @@ function openAndCopy(userCode, verificationUri) {
   } catch {}
 }
 
-export async function ensureAuth() {
-  const GITHUB_TOKEN_PATH = githubTokenPath();
+export async function ensureAuth({
+  home = os.homedir(),
+  env = process.env,
+  fetchImpl = fetch,
+  signal,
+  log = console.log,
+  openAndCopyFn = openAndCopy,
+} = {}) {
+  const GITHUB_TOKEN_PATH = githubTokenPath(home);
   if (fs.existsSync(GITHUB_TOKEN_PATH)) {
-    console.log(status("ok", "GitHub token found"));
-    return;
+    const existing = fs.readFileSync(GITHUB_TOKEN_PATH, "utf8").trim();
+    if (existing) {
+      log(status("ok", "GitHub token found"));
+      return;
+    }
+    log(status("warn", "GitHub token file is empty"));
   }
-  console.log(status("wait", "No GitHub token found. Starting device login..."));
-
-  // Request a device code.
-  const codeResp = await fetch("https://github.com/login/device/code", {
-    method: "POST",
-    headers: { "Content-Type": "application/json", Accept: "application/json" },
-    body: JSON.stringify({ client_id: CLIENT_ID, scope: SCOPE }),
-  });
-  if (!codeResp.ok) throw new Error(`device code request failed: ${codeResp.status}`);
-  const { device_code, user_code, verification_uri, interval } = await codeResp.json();
-
-  // Prompt the user.
-  console.log(`\n${status("info", `Open ${verification_uri}`)}\n${status("info", `Enter code: ${user_code}`)}\n`);
-  openAndCopy(user_code, verification_uri);
-
-  // Poll until GitHub completes the device flow.
-  let waitMs = (interval || 5) * 1000;
-  while (true) {
-    await sleep(waitMs);
-    const pollResp = await fetch("https://github.com/login/oauth/access_token", {
+
+  await withFileLock(githubTokenLockPath(home), async () => {
+    const savedToken = readSavedGithubToken(home);
+    if (savedToken) {
+      log(status("ok", "GitHub token found"));
+      return;
+    }
+
+    const imported = await importDiscoveredGithubToken({ home, env, fetchImpl, signal, log, lock: false });
+    if (imported) return;
+
+    log(status("wait", "No usable GitHub token found. Starting device login..."));
+
+    // Request a device code while holding the auth lock so concurrent starts do not
+    // trigger multiple browser/device-flow sessions for the same local token.
+    const codeResp = await fetchImpl("https://github.com/login/device/code", {
       method: "POST",
       headers: { "Content-Type": "application/json", Accept: "application/json" },
-      body: JSON.stringify({
-        client_id: CLIENT_ID,
-        device_code,
-        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-      }),
+      body: JSON.stringify({ client_id: CLIENT_ID, scope: SCOPE }),
+      signal,
     });
-    if (!pollResp.ok) {
-      // Treat transient network/server errors as pending and retry.
-      continue;
-    }
-    const data = await pollResp.json();
-    const r = interpretPoll(data);
-    if (r.state === "done") {
-      writeToken(r.token);
-      console.log(status("ok", "Login successful"));
-      return;
+    if (!codeResp.ok) throw new Error(`device code request failed: ${codeResp.status}`);
+    const { device_code, user_code, verification_uri, interval } = await codeResp.json();
+
+    // Prompt the user.
+    log(`\n${status("info", `Open ${verification_uri}`)}\n${status("info", `Enter code: ${user_code}`)}\n`);
+    openAndCopyFn(user_code, verification_uri);
+
+    // Poll until GitHub completes the device flow.
+    let waitMs = (interval || 5) * 1000;
+    while (true) {
+      await sleep(waitMs);
+      const pollResp = await fetchImpl("https://github.com/login/oauth/access_token", {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Accept: "application/json" },
+        body: JSON.stringify({
+          client_id: CLIENT_ID,
+          device_code,
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        }),
+        signal,
+      });
+      if (!pollResp.ok) {
+        // Treat transient network/server errors as pending and retry.
+        continue;
+      }
+      const data = await pollResp.json();
+      const r = interpretPoll(data);
+      if (r.state === "done") {
+        writeToken(r.token, home);
+        log(status("ok", "Login successful"));
+        return;
+      }
+      if (r.state === "slow") { waitMs += 5000; continue; }
+      if (r.state === "fail") throw new Error(`Login failed: ${r.error}`);
+      // wait: continue polling.
     }
-    if (r.state === "slow") { waitMs += 5000; continue; }
-    if (r.state === "fail") throw new Error(`Login failed: ${r.error}`);
-    // wait: continue polling.
-  }
+  }, tokenLockOptions(env));
 }
 
-function writeToken(token) {
-  const GITHUB_TOKEN_PATH = githubTokenPath();
+export function writeToken(token, home = os.homedir()) {
+  const GITHUB_TOKEN_PATH = githubTokenPath(home);
   fs.mkdirSync(path.dirname(GITHUB_TOKEN_PATH), { recursive: true });
   fs.writeFileSync(GITHUB_TOKEN_PATH, token, { mode: 0o600 });
+  fs.chmodSync(GITHUB_TOKEN_PATH, 0o600);
 }

package/src/copilot.mjs

@@ -1,7 +1,8 @@
 import fs from "node:fs";
+import os from "node:os";
 import { randomUUID } from "node:crypto";
 import { status } from "./status.mjs";
-import { githubReauthMessage, githubTokenPath } from "./auth.mjs";
+import { githubReauthMessage, githubTokenPath, importDiscoveredGithubToken } from "./auth.mjs";
 
 export const DEFAULT_API_BASE = "https://api.githubcopilot.com";
 let apiBase = DEFAULT_API_BASE;
@@ -245,9 +246,10 @@ export async function refreshVSCodeVersion() {
 
 let copilotToken = null;
 let copilotTokenExpiry = 0;
+let copilotTokenRefresh = null;
 
-function getGithubToken() {
-  const GITHUB_TOKEN_PATH = githubTokenPath();
+function getGithubToken({ home = os.homedir() } = {}) {
+  const GITHUB_TOKEN_PATH = githubTokenPath(home);
   if (!fs.existsSync(GITHUB_TOKEN_PATH)) {
     throw new Error("GitHub token not found. Run codex-copilot-dx again to log in.");
   }
@@ -256,20 +258,14 @@ function getGithubToken() {
   return token;
 }
 
-export async function getCopilotToken({ signal } = {}) {
-  if (copilotToken && Date.now() < copilotTokenExpiry - 60000) return copilotToken;
-  const ghToken = getGithubToken();
-  const resp = await fetch(`${GITHUB_API}/copilot_internal/v2/token`, {
+function requestCopilotToken(ghToken, { fetchImpl = fetch, signal } = {}) {
+  return fetchImpl(`${GITHUB_API}/copilot_internal/v2/token`, {
     headers: { Authorization: `token ${ghToken}`, Accept: "application/json" },
     signal,
   });
-  if (!resp.ok) {
-    if (resp.status === 401 || resp.status === 403) {
-      throw new Error(githubReauthMessage(`Failed to get Copilot token: ${resp.status}. The saved GitHub token may be expired, revoked, or missing Copilot access.`));
-    }
-    throw new Error(`Failed to get Copilot token: ${resp.status}`);
-  }
-  const data = await resp.json();
+}
+
+function cacheCopilotTokenData(data) {
   if (!data.token) throw new Error("Copilot token response missing token field");
   copilotToken = data.token;
   apiBase = parseApiBase(data);
@@ -280,6 +276,55 @@ export async function getCopilotToken({ signal } = {}) {
   return copilotToken;
 }
 
+async function refreshCopilotToken({
+  signal,
+  home = os.homedir(),
+  env = process.env,
+  fetchImpl = fetch,
+} = {}) {
+  const ghToken = getGithubToken({ home });
+  const resp = await requestCopilotToken(ghToken, { fetchImpl, signal });
+  if (!resp.ok) {
+    if (resp.status === 401 || resp.status === 403) {
+      const imported = await importDiscoveredGithubToken({
+        home,
+        env,
+        fetchImpl,
+        signal,
+        excludeTokens: [ghToken],
+        validateSavedToken: true,
+      });
+      if (imported?.validation?.copilotTokenData?.token) {
+        return cacheCopilotTokenData(imported.validation.copilotTokenData);
+      }
+      throw new Error(githubReauthMessage(`Failed to get Copilot token: ${resp.status}. The saved GitHub token may be expired, revoked, or missing Copilot access.`));
+    }
+    throw new Error(`Failed to get Copilot token: ${resp.status}`);
+  }
+  const data = await resp.json();
+  return cacheCopilotTokenData(data);
+}
+
+export async function getCopilotToken(options = {}) {
+  if (copilotToken && Date.now() < copilotTokenExpiry - 60000) return copilotToken;
+  const home = options.home || os.homedir();
+  const refreshKey = githubTokenPath(home);
+  if (copilotTokenRefresh?.key === refreshKey) return copilotTokenRefresh.promise;
+
+  const promise = refreshCopilotToken(options).finally(() => {
+    if (copilotTokenRefresh?.promise === promise) copilotTokenRefresh = null;
+  });
+  copilotTokenRefresh = { key: refreshKey, promise };
+  return promise;
+}
+
+export function resetCopilotTokenForTests() {
+  copilotToken = null;
+  copilotTokenExpiry = 0;
+  copilotTokenRefresh = null;
+  apiBase = DEFAULT_API_BASE;
+}
+
 // chatReq is already converted by the adapter. The caller parses the raw Response.
 export async function chatCompletions(chatReq, { signal } = {}) {
   const token = await getCopilotToken({ signal });

package/src/lock.mjs

@@ -0,0 +1,60 @@
+import fs from "node:fs";
+import path from "node:path";
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function maybeRemoveStaleLock(lockPath, staleMs, nowMs) {
+  if (!Number.isFinite(staleMs) || staleMs <= 0) return false;
+  try {
+    const stat = fs.statSync(lockPath);
+    if (nowMs - stat.mtimeMs <= staleMs) return false;
+    fs.unlinkSync(lockPath);
+    return true;
+  } catch (e) {
+    if (e?.code === "ENOENT") return true;
+    return false;
+  }
+}
+
+export async function withFileLock(lockPath, fn, {
+  timeoutMs = 5000,
+  staleMs = 15 * 60 * 1000,
+  pollMs = 50,
+  now = Date.now,
+} = {}) {
+  fs.mkdirSync(path.dirname(lockPath), { recursive: true });
+  const started = now();
+  let fd = null;
+
+  while (fd === null) {
+    try {
+      fd = fs.openSync(lockPath, "wx", 0o600);
+      fs.writeFileSync(fd, JSON.stringify({ pid: process.pid, created_at: new Date().toISOString() }));
+      break;
+    } catch (e) {
+      if (e?.code !== "EEXIST") throw e;
+      const nowMs = now();
+      if (maybeRemoveStaleLock(lockPath, staleMs, nowMs)) continue;
+      if (nowMs - started >= timeoutMs) {
+        throw new Error(`Timed out waiting for lock: ${lockPath}`);
+      }
+      await sleep(Math.min(pollMs, Math.max(1, timeoutMs - (nowMs - started))));
+    }
+  }
+
+  try {
+    return await fn();
+  } finally {
+    try {
+      if (fd !== null) fs.closeSync(fd);
+    } finally {
+      try {
+        fs.unlinkSync(lockPath);
+      } catch (e) {
+        if (e?.code !== "ENOENT") throw e;
+      }
+    }
+  }
+}

package/src/running-adapter.mjs

@@ -0,0 +1,48 @@
+export const ADAPTER_HEALTH_PATH = "/_ccdx/health";
+
+export function adapterHealthPayload() {
+  return {
+    ok: true,
+    name: "codex-copilot-dx",
+    pid: process.pid,
+  };
+}
+
+export function adapterProbeHost(host = "127.0.0.1") {
+  const normalized = String(host || "127.0.0.1").toLowerCase();
+  if (normalized === "0.0.0.0" || normalized === "::" || normalized === "[::]") return "127.0.0.1";
+  return host || "127.0.0.1";
+}
+
+export function adapterBaseUrl(host = "127.0.0.1", port = 2026) {
+  const probeHost = String(adapterProbeHost(host));
+  const urlHost = probeHost.includes(":") && !probeHost.startsWith("[") ? `[${probeHost}]` : probeHost;
+  return `http://${urlHost}:${port}`;
+}
+
+export async function checkRunningAdapter({
+  host = "127.0.0.1",
+  port = 2026,
+  fetchImpl = fetch,
+  timeoutMs = 500,
+} = {}) {
+  const baseUrl = adapterBaseUrl(host, port);
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+  try {
+    const resp = await fetchImpl(`${baseUrl}${ADAPTER_HEALTH_PATH}`, {
+      headers: { Accept: "application/json" },
+      signal: ctrl.signal,
+    });
+    if (!resp.ok) return { ok: false, baseUrl, status: resp.status };
+    const data = await resp.json();
+    if (data?.name !== "codex-copilot-dx" || data?.ok !== true) {
+      return { ok: false, baseUrl, status: resp.status, data };
+    }
+    return { ok: true, baseUrl, data };
+  } catch (e) {
+    return { ok: false, baseUrl, error: e };
+  } finally {
+    clearTimeout(timer);
+  }
+}