codex-copilot-dx 0.4.23 → 0.4.25

package/src/auth.mjs

@@ -2,6 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
 import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
 import { status } from "./status.mjs";
 import { withFileLock } from "./lock.mjs";
 
@@ -22,6 +23,10 @@ export function githubTokenLockPath(home = os.homedir()) {
   return `${githubTokenPath(home)}.lock`;
 }
 
+export function githubTokenMetadataPath(home = os.homedir()) {
+  return `${githubTokenPath(home)}.account.json`;
+}
+
 export function githubReauthMessage(reason, home = os.homedir()) {
   const tokenPath = githubTokenPath(home);
   return `${reason}
@@ -210,6 +215,73 @@ function readSavedGithubToken(home = os.homedir()) {
   return fs.readFileSync(filePath, "utf8").trim();
 }
 
+function normalizeGithubIdentity(identity) {
+  if (!identity || typeof identity !== "object") return null;
+  const login = typeof identity.login === "string" ? identity.login.trim() : "";
+  const id = identity.id === undefined || identity.id === null ? "" : String(identity.id).trim();
+  if (!login && !id) return null;
+  return { login, id };
+}
+
+function tokenFingerprint(token) {
+  return createHash("sha256").update(String(token || "")).digest("hex").slice(0, 24);
+}
+
+export function readGithubTokenMetadata(home = os.homedir(), token = null) {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(githubTokenMetadataPath(home), "utf8"));
+    if (token && parsed.token_fingerprint !== tokenFingerprint(token)) return null;
+    const identity = normalizeGithubIdentity(parsed);
+    return identity ? { ...identity, token_fingerprint: parsed.token_fingerprint || "" } : null;
+  } catch {
+    return null;
+  }
+}
+
+function githubIdentityMatches(identity, expected) {
+  const actual = normalizeGithubIdentity(identity);
+  const wanted = normalizeGithubIdentity(expected);
+  if (!wanted) return true;
+  if (!actual) return false;
+  if (wanted.id && actual.id) return wanted.id === actual.id;
+  return Boolean(wanted.login && actual.login && wanted.login.toLowerCase() === actual.login.toLowerCase());
+}
+
+function expectedGithubIdentity(home, env, token) {
+  const configuredLogin = String(env.CCDX_GITHUB_LOGIN || "").trim();
+  if (configuredLogin) return { login: configuredLogin };
+  return token ? readGithubTokenMetadata(home, token) : null;
+}
+
+export async function fetchGithubIdentity(token, { fetchImpl = fetch, signal } = {}) {
+  if (typeof token !== "string" || !token.trim()) return { ok: false, reason: "empty_token" };
+  try {
+    const resp = await fetchImpl(`${GITHUB_API}/user`, {
+      headers: { Authorization: `token ${token.trim()}`, Accept: "application/json" },
+      signal,
+    });
+    if (!resp.ok) return { ok: false, status: resp.status, reason: "github_user_failed" };
+    const data = await resp.json();
+    const identity = normalizeGithubIdentity(data);
+    return identity ? { ok: true, ...identity } : { ok: false, reason: "github_identity_missing" };
+  } catch (error) {
+    return { ok: false, transient: true, reason: "github_user_request_failed", error };
+  }
+}
+
+export async function ensureGithubTokenMetadata(token, {
+  home = os.homedir(),
+  fetchImpl = fetch,
+  signal,
+} = {}) {
+  const existing = readGithubTokenMetadata(home, token);
+  if (existing) return existing;
+  const identity = await fetchGithubIdentity(token, { fetchImpl, signal });
+  if (!identity.ok) return null;
+  writeGithubTokenMetadata(identity, home, token);
+  return normalizeGithubIdentity(identity);
+}
+
 export async function validateGithubToken(token, {
   fetchImpl = fetch,
   signal,
@@ -239,6 +311,7 @@ export async function validateGithubToken(token, {
     userData = await userResp.json();
   } catch {}
   const login = typeof userData.login === "string" ? userData.login : "";
+  const id = userData.id === undefined || userData.id === null ? "" : String(userData.id);
 
   let copilotResp;
   try {
@@ -267,7 +340,7 @@ export async function validateGithubToken(token, {
     return { ok: false, reason: "copilot_token_missing", login };
   }
 
-  return { ok: true, login, copilotTokenData };
+  return { ok: true, login, id, copilotTokenData };
 }
 
 export async function discoverGithubToken({
@@ -276,10 +349,13 @@ export async function discoverGithubToken({
   fetchImpl = fetch,
   signal,
   excludeTokens = [],
+  expectedIdentity,
+  strictExpectedIdentity = false,
 } = {}) {
   const excluded = new Set(excludeTokens);
   const seen = new Set(excluded);
   const failures = [];
+  const candidates = [];
 
   for (const source of githubTokenSources({ home, env })) {
     let token = "";
@@ -294,10 +370,40 @@ export async function discoverGithubToken({
     seen.add(token);
 
     const validation = await validateGithubToken(token, { fetchImpl, signal });
-    if (validation.ok) return { ok: true, token, source, validation };
+    if (validation.ok) {
+      const candidate = { ok: true, token, source, validation };
+      const explicitSource = source.type === "env" || source.type === "token-file";
+      if (expectedIdentity && (strictExpectedIdentity || !explicitSource)) {
+        if (githubIdentityMatches(validation, expectedIdentity)) return candidate;
+        failures.push({ source, validation, reason: "github_account_mismatch" });
+        continue;
+      }
+      if (explicitSource) return candidate;
+      candidates.push(candidate);
+      continue;
+    }
     failures.push({ source, validation });
   }
 
+  if (candidates.length) {
+    const identities = new Set(candidates.map(({ validation, token }) => {
+      if (validation.id) return `id:${validation.id}`;
+      if (validation.login) return `login:${validation.login.toLowerCase()}`;
+      return `token:${token}`;
+    }));
+    if (identities.size === 1) return candidates[0];
+    return {
+      ok: false,
+      ambiguous: true,
+      candidates: candidates.map(({ source, validation }) => ({
+        source,
+        login: validation.login,
+        id: validation.id,
+      })),
+      failures,
+    };
+  }
+
   return { ok: false, failures };
 }
 
@@ -314,19 +420,34 @@ export async function importDiscoveredGithubToken({
   const run = async () => {
     const excluded = new Set(excludeTokens);
     const savedToken = readSavedGithubToken(home);
+    const expectedIdentity = expectedGithubIdentity(home, env, savedToken);
+    const strictExpectedIdentity = Boolean(String(env.CCDX_GITHUB_LOGIN || "").trim());
     if (savedToken && !excluded.has(savedToken)) {
       if (!validateSavedToken) {
         return { ok: true, token: savedToken, source: { type: "saved-token" }, imported: false };
       }
       const validation = await validateGithubToken(savedToken, { fetchImpl, signal });
-      if (validation.ok) {
+      if (validation.ok && githubIdentityMatches(validation, expectedIdentity)) {
+        writeGithubTokenMetadata(validation, home, savedToken);
         return { ok: true, token: savedToken, source: { type: "saved-token" }, validation, imported: false };
       }
     }
 
-    const discovered = await discoverGithubToken({ home, env, fetchImpl, signal, excludeTokens });
+    const discovered = await discoverGithubToken({
+      home,
+      env,
+      fetchImpl,
+      signal,
+      excludeTokens,
+      expectedIdentity,
+      strictExpectedIdentity,
+    });
+    if (discovered.ambiguous) {
+      const logins = [...new Set(discovered.candidates.map((candidate) => candidate.login || candidate.id || "unknown"))];
+      throw new Error(`Multiple GitHub Copilot accounts were found (${logins.join(", ")}). Set CCDX_GITHUB_LOGIN or CCDX_GITHUB_TOKEN_PATH to select one explicitly.`);
+    }
     if (!discovered.ok) return null;
-    writeToken(discovered.token, home);
+    writeToken(discovered.token, home, discovered.validation);
     const login = discovered.validation.login ? ` for ${discovered.validation.login}` : "";
     log(status("ok", `Imported GitHub token from ${sourceDescription(discovered.source)}${login}`));
     return { ...discovered, imported: true };
@@ -421,7 +542,8 @@ export async function ensureAuth({
       const data = await pollResp.json();
       const r = interpretPoll(data);
       if (r.state === "done") {
-        writeToken(r.token, home);
+        const identity = await fetchGithubIdentity(r.token, { fetchImpl, signal });
+        writeToken(r.token, home, identity.ok ? identity : null);
         log(status("ok", "Login successful"));
         return;
       }
@@ -432,9 +554,28 @@ export async function ensureAuth({
   }, tokenLockOptions(env));
 }
 
-export function writeToken(token, home = os.homedir()) {
+export function writeGithubTokenMetadata(identity, home = os.homedir(), token = "") {
+  const normalized = normalizeGithubIdentity(identity);
+  if (!normalized) return false;
+  const filePath = githubTokenMetadataPath(home);
+  fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
+  fs.writeFileSync(filePath, `${JSON.stringify({
+    ...normalized,
+    token_fingerprint: tokenFingerprint(token),
+    updated_at: new Date().toISOString(),
+  }, null, 2)}\n`, { mode: 0o600 });
+  fs.chmodSync(filePath, 0o600);
+  return true;
+}
+
+export function writeToken(token, home = os.homedir(), identity = null) {
   const GITHUB_TOKEN_PATH = githubTokenPath(home);
   fs.mkdirSync(path.dirname(GITHUB_TOKEN_PATH), { recursive: true });
   fs.writeFileSync(GITHUB_TOKEN_PATH, token, { mode: 0o600 });
   fs.chmodSync(GITHUB_TOKEN_PATH, 0o600);
+  if (normalizeGithubIdentity(identity)) {
+    writeGithubTokenMetadata(identity, home, token);
+  } else {
+    try { fs.unlinkSync(githubTokenMetadataPath(home)); } catch (e) { if (e?.code !== "ENOENT") throw e; }
+  }
 }

package/src/copilot.mjs

@@ -3,24 +3,28 @@ import os from "node:os";
 import { randomUUID } from "node:crypto";
 import { status } from "./status.mjs";
 import { debugLog } from "./log.mjs";
-import { githubReauthMessage, githubTokenPath, importDiscoveredGithubToken } from "./auth.mjs";
+import { ensureGithubTokenMetadata, githubReauthMessage, githubTokenPath, importDiscoveredGithubToken } from "./auth.mjs";
 
 export const DEFAULT_API_BASE = "https://api.githubcopilot.com";
 let apiBase = DEFAULT_API_BASE;
 
 // Cache of model id -> supported_endpoints, populated from listModels(). Used to
 // route requests to /responses vs /chat/completions based on real model metadata.
-const modelEndpointCache = new Map();
+let modelEndpointCache = new Map();
 
 export function cacheModelEndpoints(models) {
   const data = Array.isArray(models) ? models : models?.data;
-  if (!Array.isArray(data)) return;
+  if (!Array.isArray(data)) return false;
+  const next = new Map();
   for (const model of data) {
     const id = String(model?.id || "").trim();
     if (id && Array.isArray(model?.supported_endpoints)) {
-      modelEndpointCache.set(id, model.supported_endpoints);
+      next.set(id, [...model.supported_endpoints]);
     }
   }
+  if (!next.size) return false;
+  modelEndpointCache = next;
+  return true;
 }
 
 // Returns the cached supported_endpoints for a model id, or null if unknown.
@@ -463,6 +467,7 @@ async function refreshCopilotToken({
     throw new Error(`Failed to get Copilot token: ${resp.status}`);
   }
   const data = await resp.json();
+  await ensureGithubTokenMetadata(ghToken, { home, fetchImpl, signal });
   return cacheCopilotTokenData(data);
 }
 

package/src/doctor.mjs

@@ -2,9 +2,11 @@ import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
 import net from "node:net";
-import { githubTokenPath } from "./auth.mjs";
+import { githubTokenPath, readGithubTokenMetadata, validateGithubToken } from "./auth.mjs";
 import { claudeDesktopPaths } from "./claude-desktop-config.mjs";
 import { status } from "./status.mjs";
+import { buildHeaders, DEFAULT_API_BASE, FALLBACK_VSCODE_VERSION } from "./copilot.mjs";
+import { checkRunningAdapter } from "./running-adapter.mjs";
 
 function localGatewayBaseUrl(host, port) {
   const safeHost = String(host || "127.0.0.1");
@@ -55,7 +57,60 @@ export function inspectGitHubToken({ home = os.homedir() } = {}) {
   if (!token.text.trim()) {
     return [{ kind: "err", message: `GitHub token file is empty at ${displayPath(home, filePath)}` }];
   }
-  return [{ kind: "ok", message: "GitHub token found" }];
+  const metadata = readGithubTokenMetadata(home, token.text.trim());
+  const account = metadata?.login ? ` for ${metadata.login}` : "";
+  return [{ kind: "ok", message: `GitHub token found${account}` }];
+}
+
+export async function inspectGitHubTokenOnline({
+  home = os.homedir(),
+  fetchImpl = fetch,
+  timeoutMs = 10000,
+} = {}) {
+  const token = readText(githubTokenPath(home));
+  if (!token.ok || !token.text.trim()) {
+    return [{ kind: "warn", message: "Online Copilot check skipped because the GitHub token is missing" }];
+  }
+
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const validation = await validateGithubToken(token.text.trim(), {
+      fetchImpl,
+      signal: controller.signal,
+    });
+    if (!validation.ok) {
+      const statusText = validation.status ? ` (HTTP ${validation.status})` : "";
+      return [{ kind: validation.transient ? "warn" : "err", message: `GitHub Copilot authentication failed: ${validation.reason}${statusText}` }];
+    }
+
+    const tokenData = validation.copilotTokenData;
+    const apiBase = tokenData.endpoints?.api || DEFAULT_API_BASE;
+    const headers = buildHeaders({
+      token: tokenData.token,
+      version: FALLBACK_VSCODE_VERSION,
+      initiator: "user",
+      vision: false,
+    });
+    const modelResp = await fetchImpl(`${apiBase}/models`, { headers, signal: controller.signal });
+    if (!modelResp.ok) {
+      return [
+        { kind: "ok", message: `GitHub Copilot access verified for ${validation.login || "current account"}` },
+        { kind: "err", message: `Copilot models endpoint returned HTTP ${modelResp.status}` },
+      ];
+    }
+    const models = await modelResp.json();
+    const data = Array.isArray(models) ? models : models?.data;
+    return [
+      { kind: "ok", message: `GitHub Copilot access verified for ${validation.login || "current account"}` },
+      { kind: "ok", message: `Copilot models endpoint returned ${Array.isArray(data) ? data.length : 0} models` },
+    ];
+  } catch (e) {
+    const reason = e?.name === "AbortError" ? `timed out after ${timeoutMs}ms` : e.message;
+    return [{ kind: "warn", message: `Online Copilot check failed: ${reason}` }];
+  } finally {
+    clearTimeout(timer);
+  }
 }
 
 export function inspectCodexConfig({ home = os.homedir(), port = 2026 } = {}) {
@@ -180,6 +235,10 @@ export async function collectDoctorChecks({
   port = 2026,
   checkAdapter = true,
   checkAdapterListeningFn = checkAdapterListening,
+  checkRunningAdapterFn = checkRunningAdapter,
+  online = false,
+  fetchImpl = fetch,
+  onlineTimeoutMs = 10000,
 } = {}) {
   const checks = [
     ...inspectGitHubToken({ home }),
@@ -188,11 +247,27 @@ export async function collectDoctorChecks({
     ...inspectClaudeAppConfig({ home, platform, env, host, port }),
   ];
 
+  if (online) {
+    checks.push(...await inspectGitHubTokenOnline({ home, fetchImpl, timeoutMs: onlineTimeoutMs }));
+  }
+
   if (checkAdapter) {
-    const listening = await checkAdapterListeningFn({ host, port });
-    checks.push(listening
-      ? { kind: "ok", message: `Adapter is listening on ${localGatewayBaseUrl(host, port)}` }
-      : { kind: "warn", message: `Adapter is not listening on ${localGatewayBaseUrl(host, port)}` });
+    let running;
+    try {
+      running = await checkRunningAdapterFn({ host, port, fetchImpl });
+    } catch {
+      running = null;
+    }
+    if (running?.ok) {
+      checks.push({ kind: "ok", message: `Adapter ${running.data.version} is listening on ${running.baseUrl}` });
+    } else if (running?.incompatible) {
+      checks.push({ kind: "warn", message: `Adapter ${running.data?.version || "legacy"} is running at ${running.baseUrl}, but it is incompatible with this CLI` });
+    } else {
+      const listening = await checkAdapterListeningFn({ host, port });
+      checks.push(listening
+        ? { kind: "warn", message: `A service is listening on ${localGatewayBaseUrl(host, port)}, but it is not a compatible codex-copilot-dx adapter` }
+        : { kind: "warn", message: `Adapter is not listening on ${localGatewayBaseUrl(host, port)}` });
+    }
   }
 
   return checks;
@@ -200,7 +275,7 @@ export async function collectDoctorChecks({
 
 export async function runDoctor(options = {}) {
   const log = options.log || console.log;
-  log("codex-copilot-dx doctor");
+  log(`codex-copilot-dx doctor${options.online ? " --online" : ""}`);
   const checks = await collectDoctorChecks(options);
   for (const check of checks) log(status(check.kind, check.message));
   return checks;

package/src/model-cache.mjs

@@ -0,0 +1,45 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const DEFAULT_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+
+export function modelCachePath(home = os.homedir()) {
+  return path.join(home, ".local", "share", "codex-copilot-dx", "models.json");
+}
+
+function modelData(models) {
+  const data = Array.isArray(models) ? models : models?.data;
+  return Array.isArray(data) ? data : null;
+}
+
+export function loadModelCache({
+  home = os.homedir(),
+  maxAgeMs = DEFAULT_MAX_AGE_MS,
+  now = Date.now,
+} = {}) {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(modelCachePath(home), "utf8"));
+    const savedAt = Date.parse(parsed.saved_at);
+    if (!Number.isFinite(savedAt) || now() - savedAt > maxAgeMs) return null;
+    if (!modelData(parsed.models)) return null;
+    return parsed.models;
+  } catch {
+    return null;
+  }
+}
+
+export function saveModelCache(models, { home = os.homedir() } = {}) {
+  if (!modelData(models)) return false;
+  const filePath = modelCachePath(home);
+  const tempPath = `${filePath}.${process.pid}.tmp`;
+  fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
+  try {
+    fs.writeFileSync(tempPath, `${JSON.stringify({ saved_at: new Date().toISOString(), models })}\n`, { mode: 0o600 });
+    fs.renameSync(tempPath, filePath);
+    fs.chmodSync(filePath, 0o600);
+    return true;
+  } finally {
+    try { fs.unlinkSync(tempPath); } catch (e) { if (e?.code !== "ENOENT") throw e; }
+  }
+}

package/src/running-adapter.mjs

@@ -1,10 +1,19 @@
+import { randomUUID } from "node:crypto";
+import { localPackageVersion } from "./version.mjs";
+
 export const ADAPTER_HEALTH_PATH = "/_ccdx/health";
+export const ADAPTER_PROTOCOL_VERSION = 2;
+export const ADAPTER_VERSION = localPackageVersion();
+const ADAPTER_INSTANCE_ID = randomUUID();
 
 export function adapterHealthPayload() {
   return {
     ok: true,
     name: "codex-copilot-dx",
     pid: process.pid,
+    version: ADAPTER_VERSION,
+    protocol_version: ADAPTER_PROTOCOL_VERSION,
+    instance_id: ADAPTER_INSTANCE_ID,
   };
 }
 
@@ -25,6 +34,8 @@ export async function checkRunningAdapter({
   port = 2026,
   fetchImpl = fetch,
   timeoutMs = 500,
+  expectedVersion = ADAPTER_VERSION,
+  expectedProtocolVersion = ADAPTER_PROTOCOL_VERSION,
 } = {}) {
   const baseUrl = adapterBaseUrl(host, port);
   const ctrl = new AbortController();
@@ -39,6 +50,17 @@ export async function checkRunningAdapter({
     if (data?.name !== "codex-copilot-dx" || data?.ok !== true) {
       return { ok: false, baseUrl, status: resp.status, data };
     }
+    if (data.version !== expectedVersion || data.protocol_version !== expectedProtocolVersion) {
+      return {
+        ok: false,
+        incompatible: true,
+        baseUrl,
+        status: resp.status,
+        data,
+        expectedVersion,
+        expectedProtocolVersion,
+      };
+    }
     return { ok: true, baseUrl, data };
   } catch (e) {
     return { ok: false, baseUrl, error: e };