codex-copilot-dx 0.4.23 → 0.4.26

package/src/atomic-file.mjs

@@ -0,0 +1,63 @@
+import fs from "node:fs";
+import path from "node:path";
+import { randomUUID } from "node:crypto";
+
+function existingMode(filePath, fallback) {
+  try {
+    return fs.statSync(filePath).mode & 0o777;
+  } catch (e) {
+    if (e?.code === "ENOENT") return fallback;
+    throw e;
+  }
+}
+
+function syncDirectory(directory) {
+  if (process.platform === "win32") return;
+  let fd;
+  try {
+    fd = fs.openSync(directory, "r");
+    fs.fsyncSync(fd);
+  } catch (e) {
+    if (!["EINVAL", "ENOTSUP", "EBADF"].includes(e?.code)) throw e;
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+  }
+}
+
+export function atomicWriteFileSync(filePath, data, { mode = 0o600 } = {}) {
+  const directory = path.dirname(filePath);
+  const finalMode = existingMode(filePath, mode);
+  const tempPath = path.join(directory, `.${path.basename(filePath)}.${process.pid}.${randomUUID()}.tmp`);
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+
+  let fd;
+  try {
+    fd = fs.openSync(tempPath, "wx", finalMode);
+    fs.writeFileSync(fd, data);
+    fs.fsyncSync(fd);
+    fs.closeSync(fd);
+    fd = undefined;
+    fs.renameSync(tempPath, filePath);
+    fs.chmodSync(filePath, finalMode);
+    syncDirectory(directory);
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+    try {
+      fs.unlinkSync(tempPath);
+    } catch (e) {
+      if (e?.code !== "ENOENT") throw e;
+    }
+  }
+}
+
+export function atomicWriteFileIfChangedSync(filePath, data, options = {}) {
+  try {
+    const current = fs.readFileSync(filePath);
+    const next = Buffer.isBuffer(data) ? data : Buffer.from(data);
+    if (current.equals(next)) return false;
+  } catch (e) {
+    if (e?.code !== "ENOENT") throw e;
+  }
+  atomicWriteFileSync(filePath, data, options);
+  return true;
+}

package/src/auth.mjs

@@ -2,6 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
 import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
 import { status } from "./status.mjs";
 import { withFileLock } from "./lock.mjs";
 
@@ -22,6 +23,10 @@ export function githubTokenLockPath(home = os.homedir()) {
   return `${githubTokenPath(home)}.lock`;
 }
 
+export function githubTokenMetadataPath(home = os.homedir()) {
+  return `${githubTokenPath(home)}.account.json`;
+}
+
 export function githubReauthMessage(reason, home = os.homedir()) {
   const tokenPath = githubTokenPath(home);
   return `${reason}
@@ -210,6 +215,73 @@ function readSavedGithubToken(home = os.homedir()) {
   return fs.readFileSync(filePath, "utf8").trim();
 }
 
+function normalizeGithubIdentity(identity) {
+  if (!identity || typeof identity !== "object") return null;
+  const login = typeof identity.login === "string" ? identity.login.trim() : "";
+  const id = identity.id === undefined || identity.id === null ? "" : String(identity.id).trim();
+  if (!login && !id) return null;
+  return { login, id };
+}
+
+function tokenFingerprint(token) {
+  return createHash("sha256").update(String(token || "")).digest("hex").slice(0, 24);
+}
+
+export function readGithubTokenMetadata(home = os.homedir(), token = null) {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(githubTokenMetadataPath(home), "utf8"));
+    if (token && parsed.token_fingerprint !== tokenFingerprint(token)) return null;
+    const identity = normalizeGithubIdentity(parsed);
+    return identity ? { ...identity, token_fingerprint: parsed.token_fingerprint || "" } : null;
+  } catch {
+    return null;
+  }
+}
+
+function githubIdentityMatches(identity, expected) {
+  const actual = normalizeGithubIdentity(identity);
+  const wanted = normalizeGithubIdentity(expected);
+  if (!wanted) return true;
+  if (!actual) return false;
+  if (wanted.id && actual.id) return wanted.id === actual.id;
+  return Boolean(wanted.login && actual.login && wanted.login.toLowerCase() === actual.login.toLowerCase());
+}
+
+function expectedGithubIdentity(home, env, token) {
+  const configuredLogin = String(env.CCDX_GITHUB_LOGIN || "").trim();
+  if (configuredLogin) return { login: configuredLogin };
+  return token ? readGithubTokenMetadata(home, token) : null;
+}
+
+export async function fetchGithubIdentity(token, { fetchImpl = fetch, signal } = {}) {
+  if (typeof token !== "string" || !token.trim()) return { ok: false, reason: "empty_token" };
+  try {
+    const resp = await fetchImpl(`${GITHUB_API}/user`, {
+      headers: { Authorization: `token ${token.trim()}`, Accept: "application/json" },
+      signal,
+    });
+    if (!resp.ok) return { ok: false, status: resp.status, reason: "github_user_failed" };
+    const data = await resp.json();
+    const identity = normalizeGithubIdentity(data);
+    return identity ? { ok: true, ...identity } : { ok: false, reason: "github_identity_missing" };
+  } catch (error) {
+    return { ok: false, transient: true, reason: "github_user_request_failed", error };
+  }
+}
+
+export async function ensureGithubTokenMetadata(token, {
+  home = os.homedir(),
+  fetchImpl = fetch,
+  signal,
+} = {}) {
+  const existing = readGithubTokenMetadata(home, token);
+  if (existing) return existing;
+  const identity = await fetchGithubIdentity(token, { fetchImpl, signal });
+  if (!identity.ok) return null;
+  writeGithubTokenMetadata(identity, home, token);
+  return normalizeGithubIdentity(identity);
+}
+
 export async function validateGithubToken(token, {
   fetchImpl = fetch,
   signal,
@@ -239,6 +311,7 @@ export async function validateGithubToken(token, {
     userData = await userResp.json();
   } catch {}
   const login = typeof userData.login === "string" ? userData.login : "";
+  const id = userData.id === undefined || userData.id === null ? "" : String(userData.id);
 
   let copilotResp;
   try {
@@ -267,7 +340,7 @@ export async function validateGithubToken(token, {
     return { ok: false, reason: "copilot_token_missing", login };
   }
 
-  return { ok: true, login, copilotTokenData };
+  return { ok: true, login, id, copilotTokenData };
 }
 
 export async function discoverGithubToken({
@@ -276,10 +349,13 @@ export async function discoverGithubToken({
   fetchImpl = fetch,
   signal,
   excludeTokens = [],
+  expectedIdentity,
+  strictExpectedIdentity = false,
 } = {}) {
   const excluded = new Set(excludeTokens);
   const seen = new Set(excluded);
   const failures = [];
+  const candidates = [];
 
   for (const source of githubTokenSources({ home, env })) {
     let token = "";
@@ -294,10 +370,40 @@ export async function discoverGithubToken({
     seen.add(token);
 
     const validation = await validateGithubToken(token, { fetchImpl, signal });
-    if (validation.ok) return { ok: true, token, source, validation };
+    if (validation.ok) {
+      const candidate = { ok: true, token, source, validation };
+      const explicitSource = source.type === "env" || source.type === "token-file";
+      if (expectedIdentity && (strictExpectedIdentity || !explicitSource)) {
+        if (githubIdentityMatches(validation, expectedIdentity)) return candidate;
+        failures.push({ source, validation, reason: "github_account_mismatch" });
+        continue;
+      }
+      if (explicitSource) return candidate;
+      candidates.push(candidate);
+      continue;
+    }
     failures.push({ source, validation });
   }
 
+  if (candidates.length) {
+    const identities = new Set(candidates.map(({ validation, token }) => {
+      if (validation.id) return `id:${validation.id}`;
+      if (validation.login) return `login:${validation.login.toLowerCase()}`;
+      return `token:${token}`;
+    }));
+    if (identities.size === 1) return candidates[0];
+    return {
+      ok: false,
+      ambiguous: true,
+      candidates: candidates.map(({ source, validation }) => ({
+        source,
+        login: validation.login,
+        id: validation.id,
+      })),
+      failures,
+    };
+  }
+
   return { ok: false, failures };
 }
 
@@ -314,19 +420,34 @@ export async function importDiscoveredGithubToken({
   const run = async () => {
     const excluded = new Set(excludeTokens);
     const savedToken = readSavedGithubToken(home);
+    const expectedIdentity = expectedGithubIdentity(home, env, savedToken);
+    const strictExpectedIdentity = Boolean(String(env.CCDX_GITHUB_LOGIN || "").trim());
     if (savedToken && !excluded.has(savedToken)) {
       if (!validateSavedToken) {
         return { ok: true, token: savedToken, source: { type: "saved-token" }, imported: false };
       }
       const validation = await validateGithubToken(savedToken, { fetchImpl, signal });
-      if (validation.ok) {
+      if (validation.ok && githubIdentityMatches(validation, expectedIdentity)) {
+        writeGithubTokenMetadata(validation, home, savedToken);
         return { ok: true, token: savedToken, source: { type: "saved-token" }, validation, imported: false };
       }
     }
 
-    const discovered = await discoverGithubToken({ home, env, fetchImpl, signal, excludeTokens });
+    const discovered = await discoverGithubToken({
+      home,
+      env,
+      fetchImpl,
+      signal,
+      excludeTokens,
+      expectedIdentity,
+      strictExpectedIdentity,
+    });
+    if (discovered.ambiguous) {
+      const logins = [...new Set(discovered.candidates.map((candidate) => candidate.login || candidate.id || "unknown"))];
+      throw new Error(`Multiple GitHub Copilot accounts were found (${logins.join(", ")}). Set CCDX_GITHUB_LOGIN or CCDX_GITHUB_TOKEN_PATH to select one explicitly.`);
+    }
     if (!discovered.ok) return null;
-    writeToken(discovered.token, home);
+    writeToken(discovered.token, home, discovered.validation);
     const login = discovered.validation.login ? ` for ${discovered.validation.login}` : "";
     log(status("ok", `Imported GitHub token from ${sourceDescription(discovered.source)}${login}`));
     return { ...discovered, imported: true };
@@ -421,7 +542,8 @@ export async function ensureAuth({
       const data = await pollResp.json();
       const r = interpretPoll(data);
       if (r.state === "done") {
-        writeToken(r.token, home);
+        const identity = await fetchGithubIdentity(r.token, { fetchImpl, signal });
+        writeToken(r.token, home, identity.ok ? identity : null);
         log(status("ok", "Login successful"));
         return;
       }
@@ -432,9 +554,28 @@ export async function ensureAuth({
   }, tokenLockOptions(env));
 }
 
-export function writeToken(token, home = os.homedir()) {
+export function writeGithubTokenMetadata(identity, home = os.homedir(), token = "") {
+  const normalized = normalizeGithubIdentity(identity);
+  if (!normalized) return false;
+  const filePath = githubTokenMetadataPath(home);
+  fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
+  fs.writeFileSync(filePath, `${JSON.stringify({
+    ...normalized,
+    token_fingerprint: tokenFingerprint(token),
+    updated_at: new Date().toISOString(),
+  }, null, 2)}\n`, { mode: 0o600 });
+  fs.chmodSync(filePath, 0o600);
+  return true;
+}
+
+export function writeToken(token, home = os.homedir(), identity = null) {
   const GITHUB_TOKEN_PATH = githubTokenPath(home);
   fs.mkdirSync(path.dirname(GITHUB_TOKEN_PATH), { recursive: true });
   fs.writeFileSync(GITHUB_TOKEN_PATH, token, { mode: 0o600 });
   fs.chmodSync(GITHUB_TOKEN_PATH, 0o600);
+  if (normalizeGithubIdentity(identity)) {
+    writeGithubTokenMetadata(identity, home, token);
+  } else {
+    try { fs.unlinkSync(githubTokenMetadataPath(home)); } catch (e) { if (e?.code !== "ENOENT") throw e; }
+  }
 }

package/src/claude-config.mjs

@@ -2,6 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
 import { status } from "./status.mjs";
+import { atomicWriteFileIfChangedSync } from "./atomic-file.mjs";
 
 const SETTINGS_PATH = path.join(os.homedir(), ".claude", "settings.json");
 
@@ -23,20 +24,19 @@ export function computeUpdatedSettings(settings, port) {
 }
 
 // Point Claude Code at the adapter by updating ~/.claude/settings.json.
-export function ensureClaudeConfig(port = 2026) {
+export function ensureClaudeConfig(port = 2026, { filePath = SETTINGS_PATH } = {}) {
   const target = `http://127.0.0.1:${port}`;
 
-  if (!fs.existsSync(SETTINGS_PATH)) {
-    fs.mkdirSync(path.dirname(SETTINGS_PATH), { recursive: true });
+  if (!fs.existsSync(filePath)) {
     const { json } = computeUpdatedSettings({}, port);
-    fs.writeFileSync(SETTINGS_PATH, JSON.stringify(json, null, 2) + "\n");
+    atomicWriteFileIfChangedSync(filePath, JSON.stringify(json, null, 2) + "\n");
     console.log(status("ok", `Created ~/.claude/settings.json for Claude Code at ${target}`));
     return;
   }
 
   let raw, settings;
   try {
-    raw = fs.readFileSync(SETTINGS_PATH, "utf-8");
+    raw = fs.readFileSync(filePath, "utf-8");
     settings = JSON.parse(raw);
   } catch (e) {
     console.log(status("warn", `Could not parse ~/.claude/settings.json: ${e.message}`));
@@ -50,7 +50,7 @@ export function ensureClaudeConfig(port = 2026) {
     return;
   }
 
-  fs.writeFileSync(`${SETTINGS_PATH}.bak`, raw);
-  fs.writeFileSync(SETTINGS_PATH, JSON.stringify(json, null, 2) + "\n");
+  atomicWriteFileIfChangedSync(`${filePath}.bak`, raw);
+  atomicWriteFileIfChangedSync(filePath, JSON.stringify(json, null, 2) + "\n");
   console.log(status("ok", `Configured Claude Code ANTHROPIC_BASE_URL="${target}" and backed up settings.json.bak`));
 }

package/src/claude-desktop-config.mjs

@@ -4,6 +4,7 @@ import os from "node:os";
 import { randomUUID } from "node:crypto";
 import { claudeDesktopModelIds } from "./models.mjs";
 import { status } from "./status.mjs";
+import { atomicWriteFileIfChangedSync, atomicWriteFileSync } from "./atomic-file.mjs";
 
 const CONFIG_FILE = "claude_desktop_config.json";
 const CONFIG_LIBRARY_DIR = "configLibrary";
@@ -127,8 +128,7 @@ function readJsonFile(filePath, fallback = {}) {
 }
 
 function writeJsonFile(filePath, data) {
-  fs.mkdirSync(path.dirname(filePath), { recursive: true });
-  fs.writeFileSync(filePath, JSON.stringify(data, null, 2) + "\n", { mode: 0o600 });
+  return atomicWriteFileIfChangedSync(filePath, JSON.stringify(data, null, 2) + "\n", { mode: 0o600 });
 }
 
 function snapshotFiles(files) {
@@ -148,8 +148,7 @@ function restoreSnapshots(snapshots) {
       fs.rmSync(snapshot.filePath, { force: true });
       continue;
     }
-    fs.mkdirSync(path.dirname(snapshot.filePath), { recursive: true });
-    fs.writeFileSync(snapshot.filePath, snapshot.data, { mode: 0o600 });
+    atomicWriteFileSync(snapshot.filePath, snapshot.data, { mode: 0o600 });
   }
 }
 

package/src/cli-options.mjs

@@ -0,0 +1,69 @@
+const HELP_COMMANDS = new Set(["help", "--help", "-h"]);
+const VERSION_COMMANDS = new Set(["version", "--version", "-v"]);
+
+function unexpectedArgs(args) {
+  throw new Error(`Unexpected argument${args.length === 1 ? "" : "s"}: ${args.join(" ")}`);
+}
+
+export function parseCliArgs(args = []) {
+  const [command, ...rest] = args;
+  if (!command) return { command: "start", configureClaudeDesktop: false, online: false };
+  if (HELP_COMMANDS.has(command)) {
+    if (rest.length) unexpectedArgs(rest);
+    return { command: "help", configureClaudeDesktop: false, online: false };
+  }
+  if (VERSION_COMMANDS.has(command)) {
+    if (rest.length) unexpectedArgs(rest);
+    return { command: "version", configureClaudeDesktop: false, online: false };
+  }
+  if (command === "usage") {
+    if (rest.length) unexpectedArgs(rest);
+    return { command: "usage", configureClaudeDesktop: false, online: false };
+  }
+  if (command === "doctor" || command === "--doctor") {
+    const invalid = rest.filter((arg) => arg !== "--online");
+    if (invalid.length) unexpectedArgs(invalid);
+    if (rest.filter((arg) => arg === "--online").length > 1) unexpectedArgs(["--online"]);
+    return { command: "doctor", configureClaudeDesktop: false, online: rest.includes("--online") };
+  }
+  if (command === "--configure-claude-desktop") {
+    if (rest.length) unexpectedArgs(rest);
+    return { command: "start", configureClaudeDesktop: true, online: false };
+  }
+  throw new Error(`Unknown command or option: ${command}`);
+}
+
+function integerEnv(env, name, fallback, { min, max = Number.MAX_SAFE_INTEGER }) {
+  const raw = env[name];
+  if (raw === undefined || raw === null || String(raw).trim() === "") return fallback;
+  const text = String(raw).trim();
+  if (!/^\d+$/.test(text)) throw new Error(`${name} must be an integer between ${min} and ${max}`);
+  const value = Number(text);
+  if (!Number.isSafeInteger(value) || value < min || value > max) {
+    throw new Error(`${name} must be an integer between ${min} and ${max}`);
+  }
+  return value;
+}
+
+export function parseRuntimeOptions(env = process.env) {
+  return {
+    adapterPort: integerEnv(env, "ADAPTER_PORT", 2026, { min: 1, max: 65535 }),
+    adapterHost: String(env.ADAPTER_HOST || "127.0.0.1").trim() || "127.0.0.1",
+    modelRefreshTimeoutMs: integerEnv(env, "CCDX_MODEL_REFRESH_TIMEOUT_MS", 5000, { min: 1 }),
+    existingAdapterTimeoutMs: integerEnv(env, "CCDX_EXISTING_ADAPTER_TIMEOUT_MS", 500, { min: 1 }),
+    modelRefreshIntervalMs: integerEnv(env, "CCDX_MODEL_REFRESH_INTERVAL_MS", 30 * 60 * 1000, { min: 0 }),
+    upstreamTimeoutMs: integerEnv(env, "CCDX_UPSTREAM_TIMEOUT_MS", 120000, { min: 1 }),
+    streamHandshakeTimeoutMs: integerEnv(env, "CCDX_STREAM_HANDSHAKE_TIMEOUT_MS", 120000, { min: 1 }),
+    streamIdleTimeoutMs: integerEnv(env, "CCDX_STREAM_IDLE_TIMEOUT_MS", 120000, { min: 1 }),
+    shutdownTimeoutMs: integerEnv(env, "CCDX_SHUTDOWN_TIMEOUT_MS", 5000, { min: 1 }),
+  };
+}
+
+export function cliHelp() {
+  return `Usage:
+  codex-copilot-dx [--configure-claude-desktop]
+  codex-copilot-dx doctor [--online]
+  codex-copilot-dx usage
+  codex-copilot-dx --version
+  codex-copilot-dx --help`;
+}

package/src/config.mjs

@@ -2,6 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
 import { status } from "./status.mjs";
+import { atomicWriteFileIfChangedSync } from "./atomic-file.mjs";
 
 const CONFIG_PATH = path.join(os.homedir(), ".codex", "config.toml");
 
@@ -74,20 +75,23 @@ OPENAI_API_KEY = "dummy"
 `;
 }
 
-export function ensureCodexConfig(adapterPort = 2026) {
+export function ensureCodexConfig(adapterPort = 2026, { filePath = CONFIG_PATH } = {}) {
   const baseUrl = `http://127.0.0.1:${adapterPort}/v1`;
 
-  if (!fs.existsSync(CONFIG_PATH)) {
+  if (!fs.existsSync(filePath)) {
     // Codex config does not exist yet; create the local proxy defaults.
-    fs.mkdirSync(path.dirname(CONFIG_PATH), { recursive: true });
-    fs.writeFileSync(CONFIG_PATH, initialCodexConfig(adapterPort));
+    atomicWriteFileIfChangedSync(filePath, initialCodexConfig(adapterPort));
     console.log(status("ok", "Created ~/.codex/config.toml"));
     return;
   }
 
-  let content = fs.readFileSync(CONFIG_PATH, "utf-8");
+  const content = fs.readFileSync(filePath, "utf-8");
   const updated = computeUpdatedCodexConfig(content, adapterPort);
 
-  fs.writeFileSync(CONFIG_PATH, updated.content);
+  if (!updated.changed) {
+    console.log(status("ok", `Codex already points to ${baseUrl}`));
+    return;
+  }
+  atomicWriteFileIfChangedSync(filePath, updated.content);
   console.log(status("ok", `Configured Codex base URL: ${baseUrl}`));
 }