codex-copilot-dx 0.4.27 → 0.4.29

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Dale Xiao
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -12,12 +12,12 @@ A single in-process adapter (port `2026`) exposes both APIs over your Copilot su
 
 Supports both HTTP SSE streaming and non-streaming.
 
-Codex Auto-review requests use the hidden `codex-auto-review` model ID. The adapter maps it to Copilot's `gpt-5.4-mini` Responses model by default and logs both model IDs when the mapping is used.
+Codex Auto-review requests use the hidden `codex-auto-review` model ID. The adapter maps it to Copilot's `gpt-5.5` Responses model by default and logs both model IDs when the mapping is used.
 
 ## Prerequisites
 
 - GitHub Copilot subscription (Individual, Business, or Enterprise)
-- Node.js 18.17+
+- Node.js 22.15+ (required for built-in Zstandard request decompression)
 - [Codex Desktop](https://openai.com/codex), [Claude Code](https://claude.com/claude-code), and/or Claude App installed
 
 ## Usage
@@ -100,21 +100,23 @@ Environment variables:
 | `ADAPTER_HOST` | `127.0.0.1` | Host for the adapter; only loopback hosts are allowed by default |
 | `ADAPTER_PORT` | `2026` | Port for the adapter |
 | `CCDX_ALLOW_LAN` | unset | Set to `1` to allow non-loopback `ADAPTER_HOST` values such as `0.0.0.0`; exposes your Copilot-backed adapter beyond this machine |
-| `CCDX_MAX_BODY_BYTES` | `134217728` | Maximum compressed/raw request body size |
-| `CCDX_MAX_DECODED_BODY_BYTES` | `268435456` | Maximum decoded request body size after decompression |
+| `CCDX_MAX_BODY_BYTES` | `67108864` | Maximum compressed/raw request body size |
+| `CCDX_MAX_DECODED_BODY_BYTES` | `134217728` | Maximum decoded request body size after decompression |
+| `CCDX_MAX_SSE_BUFFER_BYTES` | `8388608` | Maximum buffered bytes for one unterminated upstream SSE line/event |
 | `CCDX_UPSTREAM_TIMEOUT_MS` | `120000` | Timeout for non-streaming upstream Copilot requests |
 | `CCDX_STREAM_HANDSHAKE_TIMEOUT_MS` | `120000` | Timeout while waiting for upstream streaming response headers |
 | `CCDX_STREAM_IDLE_TIMEOUT_MS` | `120000` | Maximum idle time between upstream streaming body chunks |
 | `CCDX_UPSTREAM_RETRIES` | `2` | Retries for transient Copilot upstream network errors; capped at `5` |
 | `CCDX_UPSTREAM_RETRY_DELAY_MS` | `300` | Initial upstream retry backoff in milliseconds; capped at `5000` |
-| `CCDX_AUTO_REVIEW_MODEL` | `gpt-5.4-mini` | Copilot Responses model used for Codex Auto-review requests |
+| `CCDX_AUTO_REVIEW_MODEL` | `gpt-5.5` | Copilot Responses model used for Codex Auto-review requests |
 | `CCDX_LOG_PATH` | unset | Mirror terminal logs to a file; set to `1` for `~/.local/share/codex-copilot-dx/debug.log` |
 | `CCDX_LOG_LEVEL` | `info` | Set to `debug` to include upstream request attempts, status codes, retry causes, and timings |
 | `CCDX_LOG_MAX_BYTES` | `16777216` | Rotate the debug log at this size, retaining one `.1` backup; set to `0` to disable rotation |
 | `CCDX_IMG_MAX_DIM` | `2048` | Max long edge in pixels for image downscaling |
 | `CCDX_IMG_QUALITY` | `85` | WebP quality used when re-encoding images |
 | `CCDX_IMG_MIN_BYTES` | `100000` | Images smaller than this are left untouched |
-| `CCDX_IMG_CONCURRENCY` | `4` | Concurrent image optimization tasks; values above `12` are capped at `12` |
+| `CCDX_IMG_CONCURRENCY` | `2` | Global concurrent image optimization tasks; values above `12` are capped at `12` |
+| `CCDX_IMG_MAX_INPUT_PIXELS` | `40000000` | Maximum decoded pixels accepted by `sharp` for one image |
 | `CCDX_DISABLE_IMG_OPT` | unset | Set to `1` to disable image optimization |
 | `CCDX_CONFIGURE_CLAUDE_DESKTOP` | unset | Set to `1` to write the Claude App 3P gateway profile during startup |
 | `CCDX_CLAUDE_DESKTOP_API_KEY` | generated for opt-in setup | Bearer key written into the Claude App profile and recognized by the adapter for model discovery |
@@ -151,7 +153,7 @@ codex-copilot-dx usage
 
 Long computer-use sessions can accumulate screenshots inside the conversation history. Each screenshot is shipped on later turns, and GitHub Copilot's `/responses` endpoint can reject oversized requests with `413 Payload Too Large`.
 
-The adapter automatically downsamples embedded screenshots to long-edge <= 2048 px and re-encodes them as WebP before forwarding `/v1/responses`.
+The adapter automatically downsamples embedded screenshots to long-edge <= 2048 px and re-encodes them as WebP before forwarding `/v1/responses`. It keeps an existing in-bounds WebP unchanged, never replaces an image with a larger encoding, and applies one global concurrency limit across direct and tool-output images.
 
 Newer ChatGPT/Codex clients can advertise an `image_gen` namespace that already exists upstream. The adapter removes that exact conflicting client tool before forwarding and retries once only when Copilot explicitly reports an image namespace collision. Image inputs and screenshot optimization remain enabled.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-copilot-dx",
-  "version": "0.4.27",
+  "version": "0.4.29",
   "description": "Use Codex Desktop, Claude Code, and Claude App with GitHub Copilot",
   "type": "module",
   "bin": {
@@ -25,15 +25,24 @@
     "responses-api"
   ],
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dalexiao/codex-copilot-dx.git"
+  },
+  "homepage": "https://github.com/dalexiao/codex-copilot-dx#readme",
+  "bugs": {
+    "url": "https://github.com/dalexiao/codex-copilot-dx/issues"
+  },
   "engines": {
-    "node": ">=18.17"
+    "node": ">=22.15.0"
   },
   "scripts": {
     "test": "node --test",
     "test:smoke": "node scripts/offline-smoke.mjs",
     "test:e2e": "bash test/e2e.sh",
     "pack:check": "npm pack --dry-run --json",
-    "verify": "npm test && npm run test:smoke && npm run pack:check"
+    "verify": "npm test && npm run test:smoke && npm run pack:check",
+    "prepublishOnly": "npm run verify"
   },
   "dependencies": {
     "gpt-tokenizer": "^3.4.0",

package/src/adapter.mjs

@@ -69,6 +69,7 @@ function isResponsesOnlyModel(model) {
 const DEFAULT_UPSTREAM_TIMEOUT_MS = 120 * 1000;
 const DEFAULT_STREAM_HANDSHAKE_TIMEOUT_MS = 120 * 1000;
 const DEFAULT_STREAM_IDLE_TIMEOUT_MS = 120 * 1000;
+const DEFAULT_MAX_SSE_BUFFER_BYTES = 8 * 1024 * 1024;
 
 function positiveInt(value, fallback) {
   const n = Number.parseInt(value, 10);
@@ -78,6 +79,7 @@ function positiveInt(value, fallback) {
 const UPSTREAM_TIMEOUT_MS = positiveInt(process.env.CCDX_UPSTREAM_TIMEOUT_MS, DEFAULT_UPSTREAM_TIMEOUT_MS);
 const STREAM_HANDSHAKE_TIMEOUT_MS = positiveInt(process.env.CCDX_STREAM_HANDSHAKE_TIMEOUT_MS, DEFAULT_STREAM_HANDSHAKE_TIMEOUT_MS);
 const STREAM_IDLE_TIMEOUT_MS = positiveInt(process.env.CCDX_STREAM_IDLE_TIMEOUT_MS, DEFAULT_STREAM_IDLE_TIMEOUT_MS);
+const MAX_SSE_BUFFER_BYTES = positiveInt(process.env.CCDX_MAX_SSE_BUFFER_BYTES, DEFAULT_MAX_SSE_BUFFER_BYTES);
 
 export function requestPath(reqUrl) {
   return new URL(reqUrl || "/", "http://localhost").pathname;
@@ -324,6 +326,9 @@ function readSseEvents(buffer, onData) {
     const match = buffer.match(/\r?\n\r?\n/);
     if (!match) return buffer;
     const chunk = buffer.slice(0, match.index);
+    if (Buffer.byteLength(chunk) > MAX_SSE_BUFFER_BYTES) {
+      throw httpError(`Upstream SSE buffer exceeds ${MAX_SSE_BUFFER_BYTES} bytes`, 502);
+    }
     buffer = buffer.slice(match.index + match[0].length);
     const data = chunk
       .split(/\r?\n/)
@@ -334,6 +339,22 @@ function readSseEvents(buffer, onData) {
   }
 }
 
+function streamErrorData(protocol, error, abort) {
+  const code = abort?.reason || "upstream_stream_error";
+  const message = `${code}: ${error?.message || "Upstream stream failed"}`;
+  if (protocol === "anthropic") {
+    return { type: "error", error: { type: "api_error", message } };
+  }
+  return { type: "error", code, message, param: null };
+}
+
+async function endStreamWithError(res, protocol, error, abort) {
+  if (res.destroyed || res.writableEnded) return;
+  const data = streamErrorData(protocol, error, abort);
+  await writeOrDrain(res, `event: error\ndata: ${JSON.stringify(data)}\n\n`).catch(() => false);
+  if (!res.destroyed && !res.writableEnded) res.end();
+}
+
 async function proxyCopilotResponses(reqContext, req, res, upstream = copilotResponses, options = {}) {
   const opened = await openCopilotResponse(reqContext, upstream, options);
   const { resp, errorText } = opened;
@@ -358,6 +379,9 @@ async function proxyCopilotResponses(reqContext, req, res, upstream = copilotRes
         const { done, value } = await reader.read();
         if (done) {
           buffer += decoder.decode();
+          if (Buffer.byteLength(buffer) > MAX_SSE_BUFFER_BYTES) {
+            throw httpError(`Upstream SSE buffer exceeds ${MAX_SSE_BUFFER_BYTES} bytes`, 502);
+          }
           readSseEvents(buffer, (data) => storeCompletedResponseFromSse(reqContext, data));
           res.end();
           return;
@@ -365,8 +389,14 @@ async function proxyCopilotResponses(reqContext, req, res, upstream = copilotRes
         options.abort?.setTimeout(options.streamIdleTimeoutMs, "stream_idle_timeout");
         buffer += decoder.decode(value, { stream: true });
         buffer = readSseEvents(buffer, (data) => storeCompletedResponseFromSse(reqContext, data));
+        if (Buffer.byteLength(buffer) > MAX_SSE_BUFFER_BYTES) {
+          throw httpError(`Upstream SSE buffer exceeds ${MAX_SSE_BUFFER_BYTES} bytes`, 502);
+        }
         if (!await writeOrDrain(res, value)) return;
       }
+    } catch (e) {
+      logRequestFailure("Responses", e, options.abort);
+      await endStreamWithError(res, "responses", e, options.abort);
     } finally {
       await reader.cancel().catch(() => {});
       reader.releaseLock();
@@ -508,11 +538,11 @@ export async function forwardToChat(chatReq, emitEvent, onDone, onError, options
     }, { signal: options.signal });
   } catch (e) {
     const statusCode = isAbortLikeError(e) ? abortErrorStatusCode(options.abort?.reason) : 502;
-    onError(statusCode, e.message);
+    await onError(statusCode, e.message);
     return;
   }
   if (!resp.ok) {
-    onError(resp.status, await resp.text());
+    await onError(resp.status, await resp.text());
     return;
   }
   options.abort?.setTimeout(options.streamIdleTimeoutMs, "stream_idle_timeout");
@@ -655,7 +685,8 @@ export async function forwardToChat(chatReq, emitEvent, onDone, onError, options
       }
     }
   } catch (e) {
-    onError(500, e?.message || "upstream stream error");
+    const statusCode = isAbortLikeError(e) ? abortErrorStatusCode(options.abort?.reason) : 502;
+    await onError(statusCode, e?.message || "upstream stream error");
     return;
   }
   await emitCompleted();
@@ -723,7 +754,14 @@ export function createAdapterHandler(options = {}) {
                   rememberResponseHistory(prepared, data.response);
                   recordResponsesUsage({ surface: prepared.surface, mode: "stream", model, response: data.response, event: data });
                 }
-              }, () => { if (!res.writableEnded) res.end(); }, (status, errMsg) => { if (!res.headersSent) res.writeHead(status || 500); res.end(errMsg); }, {
+              }, () => { if (!res.writableEnded) res.end(); }, async (statusCode, errMsg) => {
+                if (!res.headersSent) {
+                  res.writeHead(statusCode || 500, { "Content-Type": "text/plain; charset=utf-8" });
+                  res.end(errMsg);
+                  return;
+                }
+                await endStreamWithError(res, "responses", new Error(errMsg), abort);
+              }, {
                 signal: abort.signal,
                 abort,
                 streamIdleTimeoutMs,
@@ -855,18 +893,24 @@ export function createAdapterHandler(options = {}) {
             res.writeHead(200, { "Content-Type": "text/event-stream", "Cache-Control": "no-cache", Connection: "keep-alive" });
             let messageId;
             let usage;
-            await streamAnthropicFromLines(
-              webStreamLines(upstream, {
-                onChunk: () => abort.setTimeout(streamIdleTimeoutMs, "stream_idle_timeout"),
-              }),
-              async (event, data) => {
-                if (event === "message_start") messageId = data.message?.id;
-                if (event === "message_delta") usage = data.usage;
-                await writeOrDrain(res, `event: ${event}\ndata: ${JSON.stringify(data)}\n\n`);
-              },
-              requestedModel,
-              { forceModel: forceRequestedModel },
-            );
+            try {
+              await streamAnthropicFromLines(
+                webStreamLines(upstream, {
+                  onChunk: () => abort.setTimeout(streamIdleTimeoutMs, "stream_idle_timeout"),
+                }),
+                async (event, data) => {
+                  if (event === "message_start") messageId = data.message?.id;
+                  if (event === "message_delta") usage = data.usage;
+                  await writeOrDrain(res, `event: ${event}\ndata: ${JSON.stringify(data)}\n\n`);
+                },
+                requestedModel,
+                { forceModel: forceRequestedModel },
+              );
+            } catch (e) {
+              logRequestFailure("Messages", e, abort);
+              await endStreamWithError(res, "anthropic", e, abort);
+              return;
+            }
             recordAnthropicUsage({ surface: "messages", mode: "stream", model: requestedModel, responseId: messageId, usage });
             if (!res.writableEnded) res.end();
           } else {

package/src/http-transport.mjs

@@ -2,8 +2,8 @@ import { promisify } from "node:util";
 import * as zlib from "node:zlib";
 import { status } from "./status.mjs";
 
-const DEFAULT_MAX_BODY_BYTES = 128 * 1024 * 1024;
-const DEFAULT_MAX_DECODED_BODY_BYTES = 256 * 1024 * 1024;
+const DEFAULT_MAX_BODY_BYTES = 64 * 1024 * 1024;
+const DEFAULT_MAX_DECODED_BODY_BYTES = 128 * 1024 * 1024;
 const gunzipAsync = promisify(zlib.gunzip);
 const inflateAsync = promisify(zlib.inflate);
 const brotliDecompressAsync = promisify(zlib.brotliDecompress);
@@ -27,8 +27,12 @@ function payloadTooLarge(kind, maxBytes) {
   return httpError(`${kind} request body exceeds ${maxBytes} bytes`, 413);
 }
 
+function requestContentLength(req) {
+  return Number.parseInt(req.headers?.["content-length"] || "", 10);
+}
+
 async function readRequestBuffer(req, maxBytes) {
-  const contentLength = Number.parseInt(req.headers?.["content-length"] || "", 10);
+  const contentLength = requestContentLength(req);
   if (Number.isFinite(contentLength) && contentLength > maxBytes) {
     throw payloadTooLarge("Raw", maxBytes);
   }
@@ -44,6 +48,35 @@ async function readRequestBuffer(req, maxBytes) {
   return Buffer.concat(chunks);
 }
 
+async function readIdentityText(req, maxBodyBytes, maxDecodedBodyBytes) {
+  const contentLength = requestContentLength(req);
+  if (Number.isFinite(contentLength) && contentLength > maxBodyBytes) {
+    throw payloadTooLarge("Raw", maxBodyBytes);
+  }
+  if (Number.isFinite(contentLength) && contentLength > maxDecodedBodyBytes) {
+    throw payloadTooLarge("Decoded", maxDecodedBodyBytes);
+  }
+
+  const decoder = new TextDecoder();
+  let text = "";
+  let total = 0;
+  for await (const chunk of req) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    total += buffer.length;
+    if (total > maxBodyBytes) throw payloadTooLarge("Raw", maxBodyBytes);
+    if (total > maxDecodedBodyBytes) throw payloadTooLarge("Decoded", maxDecodedBodyBytes);
+    text += decoder.decode(buffer, { stream: true });
+  }
+  return text + decoder.decode();
+}
+
+function contentEncodings(contentEncoding) {
+  return String(contentEncoding || "identity")
+    .split(",")
+    .map((value) => value.trim().toLowerCase())
+    .filter(Boolean);
+}
+
 async function decompressBody(decompress, buffer, maxBytes) {
   try {
     return await decompress(buffer, { maxOutputLength: maxBytes });
@@ -56,10 +89,7 @@ async function decompressBody(decompress, buffer, maxBytes) {
 }
 
 async function decodeRequestBuffer(buffer, contentEncoding, maxBytes) {
-  const encodings = String(contentEncoding || "identity")
-    .split(",")
-    .map((value) => value.trim().toLowerCase())
-    .filter(Boolean);
+  const encodings = contentEncodings(contentEncoding);
 
   let decoded = buffer;
   for (const encoding of encodings.reverse()) {
@@ -86,6 +116,10 @@ export async function readJsonBody(req, {
   maxBodyBytes = MAX_BODY_BYTES,
   maxDecodedBodyBytes = MAX_DECODED_BODY_BYTES,
 } = {}) {
+  const encodings = contentEncodings(req.headers?.["content-encoding"]);
+  if (encodings.every((encoding) => encoding === "identity")) {
+    return JSON.parse(await readIdentityText(req, maxBodyBytes, maxDecodedBodyBytes));
+  }
   const buffer = await readRequestBuffer(req, maxBodyBytes);
   const decoded = await decodeRequestBuffer(buffer, req.headers?.["content-encoding"], maxDecodedBodyBytes);
   return JSON.parse(decoded.toString("utf8"));
@@ -93,7 +127,11 @@ export async function readJsonBody(req, {
 
 export function sendJsonError(res, err, fallbackStatus = 400) {
   if (res.destroyed || res.writableEnded) return;
-  if (!res.headersSent) res.writeHead(err?.statusCode || fallbackStatus, { "Content-Type": "application/json" });
+  if (res.headersSent) {
+    res.end();
+    return;
+  }
+  res.writeHead(err?.statusCode || fallbackStatus, { "Content-Type": "application/json" });
   res.end(JSON.stringify({ error: err?.message || "Request failed" }));
 }
 

package/src/image-optimization.mjs

@@ -1,14 +1,26 @@
 import { status } from "./status.mjs";
 
-const IMG_MAX_DIM = Number.parseInt(process.env.CCDX_IMG_MAX_DIM || "2048", 10);
-const IMG_QUALITY = Number.parseInt(process.env.CCDX_IMG_QUALITY || "85", 10);
-const IMG_MIN_BYTES = Number.parseInt(process.env.CCDX_IMG_MIN_BYTES || "100000", 10);
-const DEFAULT_IMG_CONCURRENCY = 4;
+const DEFAULT_IMG_CONCURRENCY = 2;
 const IMG_MAX_CONCURRENCY = 12;
+const DEFAULT_IMG_MAX_INPUT_PIXELS = 40 * 1000 * 1000;
+const IMG_MAX_DIM = positiveInt(process.env.CCDX_IMG_MAX_DIM, 2048);
+const IMG_QUALITY = positiveInt(process.env.CCDX_IMG_QUALITY, 85, 100);
+const IMG_MIN_BYTES = nonNegativeInt(process.env.CCDX_IMG_MIN_BYTES, 100000);
+const IMG_MAX_INPUT_PIXELS = positiveInt(process.env.CCDX_IMG_MAX_INPUT_PIXELS, DEFAULT_IMG_MAX_INPUT_PIXELS);
 const IMG_OPT_DISABLED = process.env.CCDX_DISABLE_IMG_OPT === "1";
 const IMG_CONCURRENCY = parseImageConcurrency(process.env.CCDX_IMG_CONCURRENCY);
 let sharpImport = null;
 
+function positiveInt(value, fallback, max = Number.MAX_SAFE_INTEGER) {
+  const n = Number.parseInt(value, 10);
+  return Number.isFinite(n) && n > 0 ? Math.min(n, max) : fallback;
+}
+
+function nonNegativeInt(value, fallback) {
+  const n = Number.parseInt(value, 10);
+  return Number.isFinite(n) && n >= 0 ? n : fallback;
+}
+
 export function parseImageConcurrency(value) {
   const n = Number.parseInt(value, 10);
   return Number.isFinite(n) && n > 0 ? Math.min(n, IMG_MAX_CONCURRENCY) : DEFAULT_IMG_CONCURRENCY;
@@ -31,11 +43,20 @@ export async function optimizeImageDataUrl(dataUrl) {
 
   try {
     const resize = await sharp();
-    const out = await resize(raw, { failOn: "none" })
+    const image = resize(raw, { failOn: "none", limitInputPixels: IMG_MAX_INPUT_PIXELS });
+    const metadata = await image.metadata();
+    if (mime === "image/webp"
+      && metadata.width <= IMG_MAX_DIM
+      && metadata.height <= IMG_MAX_DIM
+      && (!metadata.orientation || metadata.orientation === 1)) {
+      return dataUrl;
+    }
+    const out = await image
       .rotate()
       .resize(IMG_MAX_DIM, IMG_MAX_DIM, { fit: "inside", withoutEnlargement: true })
       .webp({ quality: IMG_QUALITY, effort: 4 })
       .toBuffer();
+    if (out.length >= raw.length) return dataUrl;
     const ratio = ((out.length / raw.length) * 100).toFixed(1);
     console.log(status("info", `image ${(raw.length / 1024).toFixed(0)}KB ${mime} -> ${(out.length / 1024).toFixed(0)}KB webp (${ratio}%)`));
     return `data:image/webp;base64,${out.toString("base64")}`;
@@ -57,16 +78,16 @@ export async function runWithConcurrency(taskFns, concurrency) {
   }));
 }
 
-function visitImageParts(parts, tasks) {
+function visitImageParts(parts, tasks, optimizeImage) {
   if (!Array.isArray(parts)) return;
   for (const part of parts) {
     if (!part) continue;
     if (part.type === "input_image" && typeof part.image_url === "string") {
-      tasks.push(async () => { part.image_url = await optimizeImageDataUrl(part.image_url); });
+      tasks.push(async () => { part.image_url = await optimizeImage(part.image_url); });
     } else if (part.type === "image" && part.source?.type === "base64" && part.source?.data) {
       tasks.push(async () => {
         const dataUrl = `data:${part.source.media_type || "image/png"};base64,${part.source.data}`;
-        const optimized = await optimizeImageDataUrl(dataUrl);
+        const optimized = await optimizeImage(dataUrl);
         const match = /^data:([^;]+);base64,(.+)$/.exec(optimized);
         if (match) {
           part.source.media_type = match[1];
@@ -77,32 +98,31 @@ function visitImageParts(parts, tasks) {
   }
 }
 
-export async function optimizeImagesInBody(reqBody) {
+export async function optimizeImagesInBody(reqBody, {
+  concurrency = IMG_CONCURRENCY,
+  optimizeImage = optimizeImageDataUrl,
+} = {}) {
   if (IMG_OPT_DISABLED || !Array.isArray(reqBody.input)) return reqBody;
   const tasks = [];
+  const finalize = [];
 
   for (const item of reqBody.input) {
     if (!item) continue;
     if (item.type === "message" && Array.isArray(item.content)) {
-      visitImageParts(item.content, tasks);
+      visitImageParts(item.content, tasks, optimizeImage);
     }
     if (item.type === "function_call_output") {
       if (Array.isArray(item.output)) {
-        visitImageParts(item.output, tasks);
+        visitImageParts(item.output, tasks, optimizeImage);
       } else if (typeof item.output === "string") {
         const trimmed = item.output.trim();
         if (trimmed.startsWith("[")) {
           try {
             const parsed = JSON.parse(trimmed);
             if (Array.isArray(parsed)) {
-              const localTasks = [];
-              visitImageParts(parsed, localTasks);
-              if (localTasks.length) {
-                tasks.push(async () => {
-                  await runWithConcurrency(localTasks, IMG_CONCURRENCY);
-                  item.output = JSON.stringify(parsed);
-                });
-              }
+              const taskCount = tasks.length;
+              visitImageParts(parsed, tasks, optimizeImage);
+              if (tasks.length > taskCount) finalize.push(() => { item.output = JSON.stringify(parsed); });
             }
           } catch {
             // Leave non-JSON tool output untouched.
@@ -112,7 +132,8 @@ export async function optimizeImagesInBody(reqBody) {
     }
   }
 
-  if (tasks.length) await runWithConcurrency(tasks, IMG_CONCURRENCY);
+  if (tasks.length) await runWithConcurrency(tasks, concurrency);
+  for (const apply of finalize) apply();
   return reqBody;
 }
 

package/src/lock.mjs

@@ -1,15 +1,52 @@
 import fs from "node:fs";
 import path from "node:path";
+import { randomUUID } from "node:crypto";
 
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
+function readLockSnapshot(lockPath) {
+  const stat = fs.statSync(lockPath);
+  let record = {};
+  try {
+    record = JSON.parse(fs.readFileSync(lockPath, "utf8"));
+  } catch {}
+  return {
+    dev: stat.dev,
+    ino: stat.ino,
+    mtimeMs: stat.mtimeMs,
+    size: stat.size,
+    pid: Number(record.pid),
+    owner: typeof record.owner === "string" ? record.owner : "",
+  };
+}
+
+function processIsAlive(pid) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e?.code === "EPERM";
+  }
+}
+
+function sameLock(left, right) {
+  return left.dev === right.dev
+    && left.ino === right.ino
+    && left.mtimeMs === right.mtimeMs
+    && left.size === right.size
+    && left.owner === right.owner;
+}
+
 function maybeRemoveStaleLock(lockPath, staleMs, nowMs) {
   if (!Number.isFinite(staleMs) || staleMs <= 0) return false;
   try {
-    const stat = fs.statSync(lockPath);
-    if (nowMs - stat.mtimeMs <= staleMs) return false;
+    const first = readLockSnapshot(lockPath);
+    if (nowMs - first.mtimeMs <= staleMs || processIsAlive(first.pid)) return false;
+    const current = readLockSnapshot(lockPath);
+    if (!sameLock(first, current)) return false;
     fs.unlinkSync(lockPath);
     return true;
   } catch (e) {
@@ -26,12 +63,20 @@ export async function withFileLock(lockPath, fn, {
 } = {}) {
   fs.mkdirSync(path.dirname(lockPath), { recursive: true });
   const started = now();
+  const owner = randomUUID();
   let fd = null;
 
   while (fd === null) {
     try {
-      fd = fs.openSync(lockPath, "wx", 0o600);
-      fs.writeFileSync(fd, JSON.stringify({ pid: process.pid, created_at: new Date().toISOString() }));
+      const candidateFd = fs.openSync(lockPath, "wx", 0o600);
+      try {
+        fs.writeFileSync(candidateFd, JSON.stringify({ pid: process.pid, owner, created_at: new Date().toISOString() }));
+        fd = candidateFd;
+      } catch (e) {
+        fs.closeSync(candidateFd);
+        try { fs.unlinkSync(lockPath); } catch {}
+        throw e;
+      }
       break;
     } catch (e) {
       if (e?.code !== "EEXIST") throw e;
@@ -50,11 +95,19 @@ export async function withFileLock(lockPath, fn, {
     try {
       if (fd !== null) fs.closeSync(fd);
     } finally {
+      let currentOwner = "";
       try {
-        fs.unlinkSync(lockPath);
+        currentOwner = readLockSnapshot(lockPath).owner;
       } catch (e) {
         if (e?.code !== "ENOENT") throw e;
       }
+      if (currentOwner === owner) {
+        try {
+          fs.unlinkSync(lockPath);
+        } catch (e) {
+          if (e?.code !== "ENOENT") throw e;
+        }
+      }
     }
   }
 }

package/src/models.mjs

@@ -61,7 +61,7 @@ const DEFAULT_CLAUDE_MODEL_ALIAS_DEFS = [
 ];
 
 export const CODEX_AUTO_REVIEW_MODEL = "codex-auto-review";
-export const DEFAULT_CODEX_AUTO_REVIEW_MODEL = "gpt-5.4-mini";
+export const DEFAULT_CODEX_AUTO_REVIEW_MODEL = "gpt-5.5";
 
 function cleanList(value) {
   return String(value || "")

package/src/stream.mjs

@@ -1,6 +1,21 @@
 // Yield fetch Response body lines while preserving SSE semantics for callers.
 // Strip CRLF tails and release the reader if iteration stops early.
-export async function* webStreamLines(response, { onChunk } = {}) {
+const DEFAULT_MAX_SSE_BUFFER_BYTES = 8 * 1024 * 1024;
+
+function positiveInt(value, fallback) {
+  const n = Number.parseInt(value, 10);
+  return Number.isFinite(n) && n > 0 ? n : fallback;
+}
+
+const MAX_SSE_BUFFER_BYTES = positiveInt(process.env.CCDX_MAX_SSE_BUFFER_BYTES, DEFAULT_MAX_SSE_BUFFER_BYTES);
+
+function assertSseBufferLimit(buffer, maxBufferBytes) {
+  if (Buffer.byteLength(buffer) > maxBufferBytes) {
+    throw new Error(`Upstream SSE buffer exceeds ${maxBufferBytes} bytes`);
+  }
+}
+
+export async function* webStreamLines(response, { onChunk, maxBufferBytes = MAX_SSE_BUFFER_BYTES } = {}) {
   const reader = response.body.getReader();
   const decoder = new TextDecoder();
   let buf = "";
@@ -12,9 +27,14 @@ export async function* webStreamLines(response, { onChunk } = {}) {
       buf += decoder.decode(value, { stream: true });
       const lines = buf.split("\n");
       buf = lines.pop();
-      for (const line of lines) yield line.replace(/\r$/, "");
+      assertSseBufferLimit(buf, maxBufferBytes);
+      for (const line of lines) {
+        assertSseBufferLimit(line, maxBufferBytes);
+        yield line.replace(/\r$/, "");
+      }
     }
     buf += decoder.decode();
+    assertSseBufferLimit(buf, maxBufferBytes);
     if (buf.length > 0) yield buf.replace(/\r$/, "");
   } finally {
     await reader.cancel().catch(() => {});