codex-copilot-dx 0.4.34 → 0.4.36

package/src/anthropic-handler.mjs

@@ -0,0 +1,128 @@
+import {
+  anthropicToChat,
+  chatToAnthropic,
+  countTokens,
+  streamAnthropicFromLines,
+} from "./anthropic.mjs";
+import {
+  createRequestAbort,
+  logRequestFailure,
+  readJsonBody,
+  sendJsonError,
+  sendUpstreamError,
+  writeOrDrain,
+} from "./http-transport.mjs";
+import { resolveAnthropicModel } from "./models.mjs";
+import { status } from "./status.mjs";
+import { webStreamLines } from "./stream.mjs";
+import { endStreamWithError } from "./stream-errors.mjs";
+import { recordAnthropicUsage } from "./usage.mjs";
+
+export function createAnthropicCountTokensHandler(options) {
+  const { acquireRequest } = options;
+
+  return async function handleAnthropicCountTokens(req, res) {
+    const abort = createRequestAbort(req, res);
+    let releaseRequest = () => {};
+    try {
+      releaseRequest = await acquireRequest(req, { signal: abort.signal });
+      const parsed = await readJsonBody(req);
+      const result = await countTokens(parsed);
+      releaseRequest();
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify(result));
+    } catch (error) {
+      sendJsonError(res, error);
+    } finally {
+      releaseRequest();
+      abort.cleanup();
+    }
+  };
+}
+
+export function createAnthropicMessagesHandler(options) {
+  const {
+    acquireRequest,
+    chatCompletionsFn,
+    environment,
+    modelOptions,
+    streamHandshakeTimeoutMs,
+    streamIdleTimeoutMs,
+    upstreamTimeoutMs,
+  } = options;
+
+  return async function handleAnthropicMessages(req, res) {
+    const abort = createRequestAbort(req, res);
+    let releaseRequest = () => {};
+    try {
+      releaseRequest = await acquireRequest(req, { signal: abort.signal });
+      const parsed = await readJsonBody(req);
+      abort.setTimeout(
+        parsed.stream ? streamHandshakeTimeoutMs : upstreamTimeoutMs,
+        parsed.stream ? "stream_handshake_timeout" : "upstream_timeout",
+      );
+      const { requestedModel, upstreamModel } = resolveAnthropicModel(parsed.model || "unknown", environment, modelOptions());
+      const modelNote = upstreamModel === requestedModel ? requestedModel : `${requestedModel} -> ${upstreamModel}`;
+      console.log(status("info", `messages model=${modelNote} stream=${!!parsed.stream}`));
+      const chatReq = anthropicToChat(parsed, { upstreamModel });
+      const forceRequestedModel = upstreamModel !== requestedModel;
+      if (parsed.stream) {
+        const upstream = await chatCompletionsFn({ ...chatReq, stream: true }, { signal: abort.signal });
+        releaseRequest();
+        if (!upstream.ok) {
+          if (!res.headersSent) res.writeHead(upstream.status);
+          res.end(await upstream.text());
+          return;
+        }
+        abort.setTimeout(streamIdleTimeoutMs, "stream_idle_timeout");
+        res.writeHead(200, { "Content-Type": "text/event-stream", "Cache-Control": "no-cache", Connection: "keep-alive" });
+        let messageId;
+        let usage;
+        try {
+          await streamAnthropicFromLines(
+            webStreamLines(upstream, {
+              onChunk: () => abort.setTimeout(streamIdleTimeoutMs, "stream_idle_timeout"),
+            }),
+            async (event, data) => {
+              if (event === "message_start") messageId = data.message?.id;
+              if (event === "message_delta") usage = data.usage;
+              await writeOrDrain(res, `event: ${event}\ndata: ${JSON.stringify(data)}\n\n`);
+            },
+            requestedModel,
+            { forceModel: forceRequestedModel },
+          );
+        } catch (error) {
+          logRequestFailure("Messages", error, abort);
+          await endStreamWithError(res, "anthropic", error, abort);
+          return;
+        }
+        recordAnthropicUsage({ surface: "messages", mode: "stream", model: requestedModel, responseId: messageId, usage });
+        if (!res.writableEnded) res.end();
+      } else {
+        const upstream = await chatCompletionsFn({ ...chatReq, stream: false }, { signal: abort.signal });
+        releaseRequest();
+        const data = await upstream.text();
+        if (!upstream.ok) {
+          sendUpstreamError(res, upstream, data);
+          return;
+        }
+        const anthropicMessage = chatToAnthropic(JSON.parse(data), requestedModel, { forceModel: forceRequestedModel });
+        recordAnthropicUsage({
+          surface: "messages",
+          mode: "json",
+          model: anthropicMessage.model,
+          responseId: anthropicMessage.id,
+          usage: anthropicMessage.usage,
+        });
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(anthropicMessage));
+      }
+    } catch (error) {
+      logRequestFailure("Messages", error, abort);
+      sendJsonError(res, error, 502);
+    } finally {
+      releaseRequest();
+      abort.cleanup();
+    }
+  };
+}

package/src/anthropic.mjs

@@ -2,13 +2,13 @@ import { randomUUID } from "node:crypto";
 
 let tokenizerModulePromise = null;
 
-async function tokenEncoder() {
+async function tokenCounter() {
   tokenizerModulePromise ||= import("gpt-tokenizer");
-  return (await tokenizerModulePromise).encode;
+  return (await tokenizerModulePromise).countTokens;
 }
 
 // Anthropic Messages API to OpenAI chat/completions translation.
-// Pure functions only; network calls stay in adapter.mjs and copilot.mjs.
+// Pure functions only; network calls stay in the protocol handler and copilot.mjs.
 
 export function mapStopReason(finishReason) {
   switch (finishReason) {
@@ -282,6 +282,6 @@ export async function countTokens(body) {
   }
 
   const text = parts.join("\n");
-  const encode = await tokenEncoder();
-  return { input_tokens: encode(text).length };
+  const count = await tokenCounter();
+  return { input_tokens: count(text) };
 }

package/src/auth.mjs

@@ -2,7 +2,12 @@ import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
 import { spawn } from "node:child_process";
-import { createHash } from "node:crypto";
+import {
+  githubIdentityMatchesExpected,
+  githubTokenFingerprint,
+  normalizeGithubIdentity,
+} from "./github-identity.mjs";
+import { parsePositiveInteger, RUNTIME_DEFAULTS } from "./runtime-config.mjs";
 import { status } from "./status.mjs";
 import { withFileLock } from "./lock.mjs";
 
@@ -12,8 +17,6 @@ const GITHUB_API = "https://api.github.com";
 const COPILOT_TOKEN_URL = `${GITHUB_API}/copilot_internal/v2/token`;
 const DISABLE_TOKEN_DISCOVERY_VALUES = new Set(["1", "true", "yes"]);
 const MAX_AUTH_JSON_BYTES = 1024 * 1024;
-const DEFAULT_TOKEN_LOCK_TIMEOUT_MS = 10 * 60 * 1000;
-const DEFAULT_TOKEN_LOCK_STALE_MS = 15 * 60 * 1000;
 
 export function githubTokenPath(home = os.homedir()) {
   return path.join(home, ".local", "share", "copilot-api", "github_token");
@@ -58,15 +61,10 @@ function isTokenDiscoveryDisabled(env = process.env) {
   return DISABLE_TOKEN_DISCOVERY_VALUES.has(String(env.CCDX_DISABLE_TOKEN_DISCOVERY || "").toLowerCase());
 }
 
-function positiveInt(value, fallback) {
-  const n = Number.parseInt(value, 10);
-  return Number.isFinite(n) && n > 0 ? n : fallback;
-}
-
 function tokenLockOptions(env = process.env) {
   return {
-    timeoutMs: positiveInt(env.CCDX_TOKEN_LOCK_TIMEOUT_MS, DEFAULT_TOKEN_LOCK_TIMEOUT_MS),
-    staleMs: positiveInt(env.CCDX_TOKEN_LOCK_STALE_MS, DEFAULT_TOKEN_LOCK_STALE_MS),
+    timeoutMs: parsePositiveInteger(env.CCDX_TOKEN_LOCK_TIMEOUT_MS, RUNTIME_DEFAULTS.tokenLockTimeoutMs),
+    staleMs: parsePositiveInteger(env.CCDX_TOKEN_LOCK_STALE_MS, RUNTIME_DEFAULTS.tokenLockStaleMs),
   };
 }
 
@@ -215,22 +213,10 @@ function readSavedGithubToken(home = os.homedir()) {
   return fs.readFileSync(filePath, "utf8").trim();
 }
 
-function normalizeGithubIdentity(identity) {
-  if (!identity || typeof identity !== "object") return null;
-  const login = typeof identity.login === "string" ? identity.login.trim() : "";
-  const id = identity.id === undefined || identity.id === null ? "" : String(identity.id).trim();
-  if (!login && !id) return null;
-  return { login, id };
-}
-
-function tokenFingerprint(token) {
-  return createHash("sha256").update(String(token || "")).digest("hex").slice(0, 24);
-}
-
 export function readGithubTokenMetadata(home = os.homedir(), token = null) {
   try {
     const parsed = JSON.parse(fs.readFileSync(githubTokenMetadataPath(home), "utf8"));
-    if (token && parsed.token_fingerprint !== tokenFingerprint(token)) return null;
+    if (token && parsed.token_fingerprint !== githubTokenFingerprint(token)) return null;
     const identity = normalizeGithubIdentity(parsed);
     return identity ? { ...identity, token_fingerprint: parsed.token_fingerprint || "" } : null;
   } catch {
@@ -238,15 +224,6 @@ export function readGithubTokenMetadata(home = os.homedir(), token = null) {
   }
 }
 
-function githubIdentityMatches(identity, expected) {
-  const actual = normalizeGithubIdentity(identity);
-  const wanted = normalizeGithubIdentity(expected);
-  if (!wanted) return true;
-  if (!actual) return false;
-  if (wanted.id && actual.id) return wanted.id === actual.id;
-  return Boolean(wanted.login && actual.login && wanted.login.toLowerCase() === actual.login.toLowerCase());
-}
-
 function expectedGithubIdentity(home, env, token) {
   const configuredLogin = String(env.CCDX_GITHUB_LOGIN || "").trim();
   if (configuredLogin) return { login: configuredLogin };
@@ -374,7 +351,7 @@ export async function discoverGithubToken({
       const candidate = { ok: true, token, source, validation };
       const explicitSource = source.type === "env" || source.type === "token-file";
       if (expectedIdentity && (strictExpectedIdentity || !explicitSource)) {
-        if (githubIdentityMatches(validation, expectedIdentity)) return candidate;
+        if (githubIdentityMatchesExpected(validation, expectedIdentity)) return candidate;
         failures.push({ source, validation, reason: "github_account_mismatch" });
         continue;
       }
@@ -427,7 +404,7 @@ export async function importDiscoveredGithubToken({
         return { ok: true, token: savedToken, source: { type: "saved-token" }, imported: false };
       }
       const validation = await validateGithubToken(savedToken, { fetchImpl, signal });
-      if (validation.ok && githubIdentityMatches(validation, expectedIdentity)) {
+      if (validation.ok && githubIdentityMatchesExpected(validation, expectedIdentity)) {
         writeGithubTokenMetadata(validation, home, savedToken);
         return { ok: true, token: savedToken, source: { type: "saved-token" }, validation, imported: false };
       }
@@ -561,7 +538,7 @@ export function writeGithubTokenMetadata(identity, home = os.homedir(), token =
   fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
   fs.writeFileSync(filePath, `${JSON.stringify({
     ...normalized,
-    token_fingerprint: tokenFingerprint(token),
+    token_fingerprint: githubTokenFingerprint(token),
     updated_at: new Date().toISOString(),
   }, null, 2)}\n`, { mode: 0o600 });
   fs.chmodSync(filePath, 0o600);

package/src/claude-config.mjs

@@ -3,12 +3,13 @@ import path from "node:path";
 import os from "node:os";
 import { status } from "./status.mjs";
 import { atomicWriteFileIfChangedSync } from "./atomic-file.mjs";
+import { adapterBaseUrl } from "./running-adapter.mjs";
 
 const SETTINGS_PATH = path.join(os.homedir(), ".claude", "settings.json");
 
 // Return an updated settings object without mutating the input.
-export function computeUpdatedSettings(settings, port) {
-  const target = `http://127.0.0.1:${port}`;
+export function computeUpdatedSettings(settings, port, host = "127.0.0.1") {
+  const target = adapterBaseUrl(host, port);
   const current = settings?.env?.ANTHROPIC_BASE_URL;
   const currentToken = settings?.env?.ANTHROPIC_AUTH_TOKEN;
   const changed = current !== target || currentToken !== "dummy";
@@ -24,11 +25,11 @@ export function computeUpdatedSettings(settings, port) {
 }
 
 // Point Claude Code at the adapter by updating ~/.claude/settings.json.
-export function ensureClaudeConfig(port = 2026, { filePath = SETTINGS_PATH } = {}) {
-  const target = `http://127.0.0.1:${port}`;
+export function ensureClaudeConfig(port = 2026, { filePath = SETTINGS_PATH, host = "127.0.0.1" } = {}) {
+  const target = adapterBaseUrl(host, port);
 
   if (!fs.existsSync(filePath)) {
-    const { json } = computeUpdatedSettings({}, port);
+    const { json } = computeUpdatedSettings({}, port, host);
     atomicWriteFileIfChangedSync(filePath, JSON.stringify(json, null, 2) + "\n");
     console.log(status("ok", `Created ~/.claude/settings.json for Claude Code at ${target}`));
     return;
@@ -44,7 +45,7 @@ export function ensureClaudeConfig(port = 2026, { filePath = SETTINGS_PATH } = {
     return;
   }
 
-  const { json, changed } = computeUpdatedSettings(settings, port);
+  const { json, changed } = computeUpdatedSettings(settings, port, host);
   if (!changed) {
     console.log(status("ok", `Claude Code already points to ${target}`));
     return;

package/src/config.mjs

@@ -3,6 +3,7 @@ import path from "node:path";
 import os from "node:os";
 import { status } from "./status.mjs";
 import { atomicWriteFileIfChangedSync } from "./atomic-file.mjs";
+import { adapterBaseUrl } from "./running-adapter.mjs";
 
 const CONFIG_PATH = path.join(os.homedir(), ".codex", "config.toml");
 
@@ -33,9 +34,9 @@ function setTomlKey(lines, sectionName, key, value) {
   return true;
 }
 
-export function computeUpdatedCodexConfig(content, adapterPort = 2026) {
-  const baseUrl = `http://127.0.0.1:${adapterPort}/v1`;
-  const anthropicBaseUrl = `http://127.0.0.1:${adapterPort}`;
+export function computeUpdatedCodexConfig(content, adapterPort = 2026, adapterHost = "127.0.0.1") {
+  const anthropicBaseUrl = adapterBaseUrl(adapterHost, adapterPort);
+  const baseUrl = `${anthropicBaseUrl}/v1`;
   const hadTrailingNewline = content.endsWith("\n");
   const lines = content.split("\n");
   if (hadTrailingNewline) lines.pop();
@@ -59,9 +60,9 @@ export function computeUpdatedCodexConfig(content, adapterPort = 2026) {
   return { content: lines.join("\n") + (hadTrailingNewline ? "\n" : ""), changed };
 }
 
-function initialCodexConfig(adapterPort) {
-  const baseUrl = `http://127.0.0.1:${adapterPort}/v1`;
-  const anthropicBaseUrl = `http://127.0.0.1:${adapterPort}`;
+function initialCodexConfig(adapterPort, adapterHost) {
+  const anthropicBaseUrl = adapterBaseUrl(adapterHost, adapterPort);
+  const baseUrl = `${anthropicBaseUrl}/v1`;
   return `openai_base_url = "${baseUrl}"
 
 [shell_environment_policy]
@@ -75,18 +76,18 @@ OPENAI_API_KEY = "dummy"
 `;
 }
 
-export function ensureCodexConfig(adapterPort = 2026, { filePath = CONFIG_PATH } = {}) {
-  const baseUrl = `http://127.0.0.1:${adapterPort}/v1`;
+export function ensureCodexConfig(adapterPort = 2026, { filePath = CONFIG_PATH, host = "127.0.0.1" } = {}) {
+  const baseUrl = `${adapterBaseUrl(host, adapterPort)}/v1`;
 
   if (!fs.existsSync(filePath)) {
     // Codex config does not exist yet; create the local proxy defaults.
-    atomicWriteFileIfChangedSync(filePath, initialCodexConfig(adapterPort));
+    atomicWriteFileIfChangedSync(filePath, initialCodexConfig(adapterPort, host));
     console.log(status("ok", "Created ~/.codex/config.toml"));
     return;
   }
 
   const content = fs.readFileSync(filePath, "utf-8");
-  const updated = computeUpdatedCodexConfig(content, adapterPort);
+  const updated = computeUpdatedCodexConfig(content, adapterPort, host);
 
   if (!updated.changed) {
     console.log(status("ok", `Codex already points to ${baseUrl}`));

package/src/copilot.mjs

@@ -1,6 +1,6 @@
 import fs from "node:fs";
 import os from "node:os";
-import { createHash, randomUUID } from "node:crypto";
+import { randomUUID } from "node:crypto";
 import { status } from "./status.mjs";
 import { debugLog } from "./log.mjs";
 import {
@@ -11,6 +11,12 @@ import {
   readGithubTokenMetadata,
   writeGithubTokenMetadata,
 } from "./auth.mjs";
+import {
+  githubIdentitiesEqual,
+  githubIdentityLabel,
+  githubTokenFingerprint,
+  normalizeGithubIdentity,
+} from "./github-identity.mjs";
 import { prepareResponsesPayload } from "./image-optimization.mjs";
 
 export {
@@ -95,6 +101,12 @@ const RETRYABLE_UPSTREAM_ERROR_CODES = new Set([
   "EAI_AGAIN",
   "ENOTFOUND",
 ]);
+const RETRYABLE_POST_CONNECT_ERROR_CODES = new Set([
+  "UND_ERR_CONNECT_TIMEOUT",
+  "ECONNREFUSED",
+  "EAI_AGAIN",
+  "ENOTFOUND",
+]);
 const RETRYABLE_UPSTREAM_STATUSES = new Set([408, 502, 503, 504]);
 
 function upstreamTarget(url) {
@@ -146,9 +158,15 @@ function requestMethod(init = {}) {
   return String(init.method || "GET").toUpperCase();
 }
 
-export function isRetryableUpstreamError(err, { signal } = {}) {
+export function isRetryableUpstreamError(err, { signal, method = "GET" } = {}) {
   if (isAbortError(err, signal)) return false;
-  return RETRYABLE_UPSTREAM_ERROR_CODES.has(upstreamErrorCode(err));
+  const code = upstreamErrorCode(err);
+  if (!["GET", "HEAD", "OPTIONS"].includes(String(method || "GET").toUpperCase())) {
+    const syscall = err?.cause?.syscall || err?.syscall || "";
+    return RETRYABLE_POST_CONNECT_ERROR_CODES.has(code)
+      || (syscall === "connect" && ["ETIMEDOUT", "ECONNRESET"].includes(code));
+  }
+  return RETRYABLE_UPSTREAM_ERROR_CODES.has(code);
 }
 
 export function isRetryableUpstreamStatus(status, method = "GET") {
@@ -197,7 +215,7 @@ export async function fetchCopilotUpstream(
       return resp;
     } catch (e) {
       debugLog(`upstream ${method} ${target} error=${describeUpstreamError(e)} attempt=${attempt + 1}/${retryCount + 1} attempt_ms=${Date.now() - attemptStart} total_ms=${Date.now() - totalStart}`);
-      if (attempt >= retryCount || !isRetryableUpstreamError(e, { signal })) throw e;
+      if (attempt >= retryCount || !isRetryableUpstreamError(e, { signal, method })) throw e;
       const delay = upstreamRetryDelay(attempt, baseDelay);
       console.warn(status("warn", `upstream ${target} ${describeUpstreamError(e)}; retry ${attempt + 1}/${retryCount} in ${delay}ms`));
       await sleep(delay, { signal });
@@ -280,6 +298,21 @@ let copilotTokenGithubIdentity = null;
 let copilotTokenRefreshRetryAt = 0;
 const modelListFlights = new Map();
 
+export function copilotRuntimeStatus(now = Date.now()) {
+  let upstreamHost = "unknown";
+  try { upstreamHost = new URL(apiBase).hostname; } catch {}
+  return {
+    token_cached: Boolean(copilotToken),
+    token_expires_in_ms: copilotToken ? Math.max(0, copilotTokenExpiry - now) : null,
+    token_refresh_in_flight: Boolean(copilotTokenRefresh),
+    token_refresh_backoff_ms: Math.max(0, copilotTokenRefreshRetryAt - now),
+    account_bound: Boolean(copilotTokenGithubIdentity),
+    upstream_host: upstreamHost,
+    model_endpoint_cache_entries: modelEndpointCache.size,
+    model_list_flights: modelListFlights.size,
+  };
+}
+
 function getGithubToken({ home = os.homedir() } = {}) {
   const GITHUB_TOKEN_PATH = githubTokenPath(home);
   if (!fs.existsSync(GITHUB_TOKEN_PATH)) {
@@ -297,30 +330,6 @@ function requestCopilotToken(ghToken, { fetchImpl = fetch, signal } = {}) {
   });
 }
 
-function githubTokenFingerprint(token) {
-  return createHash("sha256").update(String(token || "")).digest("hex").slice(0, 24);
-}
-
-function normalizeGithubIdentity(identity) {
-  if (!identity || typeof identity !== "object") return null;
-  const login = typeof identity.login === "string" ? identity.login.trim() : "";
-  const id = identity.id === undefined || identity.id === null ? "" : String(identity.id).trim();
-  return login || id ? { login, id } : null;
-}
-
-function githubIdentitiesMatch(first, second) {
-  const a = normalizeGithubIdentity(first);
-  const b = normalizeGithubIdentity(second);
-  if (!a || !b) return false;
-  if (a.id && b.id) return a.id === b.id;
-  return Boolean(a.login && b.login && a.login.toLowerCase() === b.login.toLowerCase());
-}
-
-function githubIdentityLabel(identity) {
-  const normalized = normalizeGithubIdentity(identity);
-  return normalized?.login || normalized?.id || "unknown";
-}
-
 function cacheCopilotTokenData(data, {
   sourceKey,
   githubToken,
@@ -332,7 +341,7 @@ function cacheCopilotTokenData(data, {
   const identity = normalizeGithubIdentity(githubIdentity);
   const tokenChanged = Boolean(copilotTokenGithubFingerprint && fingerprint !== copilotTokenGithubFingerprint);
   if (!allowAccountSwitch && copilotTokenGithubIdentity && identity
-    && !githubIdentitiesMatch(copilotTokenGithubIdentity, identity)) {
+    && !githubIdentitiesEqual(copilotTokenGithubIdentity, identity)) {
     throw new Error(`Refusing to switch GitHub Copilot account from ${githubIdentityLabel(copilotTokenGithubIdentity)} to ${githubIdentityLabel(identity)} while the adapter is running. Restart codex-copilot-dx to switch accounts intentionally.`);
   }
   if (!allowAccountSwitch && copilotTokenGithubIdentity && tokenChanged && !identity) {

package/src/doctor.mjs

@@ -6,7 +6,8 @@ import { githubTokenPath, readGithubTokenMetadata, validateGithubToken } from ".
 import { claudeDesktopPaths } from "./claude-desktop-config.mjs";
 import { status } from "./status.mjs";
 import { buildHeaders, DEFAULT_API_BASE, FALLBACK_VSCODE_VERSION } from "./copilot.mjs";
-import { checkRunningAdapter } from "./running-adapter.mjs";
+import { adapterBaseUrl, checkRunningAdapter } from "./running-adapter.mjs";
+import { CODEX_AUTO_REVIEW_MODEL } from "./models.mjs";
 
 function localGatewayBaseUrl(host, port) {
   const safeHost = String(host || "127.0.0.1");
@@ -146,6 +147,15 @@ export async function inspectAdapterCompatibility({
     return checks;
   }
 
+  await runCompatibilityCheck(checks, "Codex Auto-review", async () => {
+    const text = await compatibilityRequest(fetchImpl, `${baseUrl}/v1/responses`, {
+      model: CODEX_AUTO_REVIEW_MODEL,
+      stream: false,
+      input: "Reply with OK only.",
+    }, timeoutMs);
+    parseResponseObject(text);
+  });
+
   const firstResponse = await runCompatibilityCheck(checks, `Native Responses (${responsesModel})`, async () => {
     const text = await compatibilityRequest(fetchImpl, `${baseUrl}/v1/responses`, {
       model: responsesModel,
@@ -259,10 +269,10 @@ export async function inspectGitHubTokenOnline({
   }
 }
 
-export function inspectCodexConfig({ home = os.homedir(), port = 2026 } = {}) {
+export function inspectCodexConfig({ home = os.homedir(), host = "127.0.0.1", port = 2026 } = {}) {
   const filePath = path.join(home, ".codex", "config.toml");
-  const expectedBaseUrl = `http://127.0.0.1:${port}/v1`;
-  const expectedAnthropicBaseUrl = `http://127.0.0.1:${port}`;
+  const expectedAnthropicBaseUrl = adapterBaseUrl(host, port);
+  const expectedBaseUrl = `${expectedAnthropicBaseUrl}/v1`;
   const config = readText(filePath);
   if (!config.ok) {
     return [{ kind: "warn", message: `Codex config not found at ${displayPath(home, filePath)}` }];
@@ -285,9 +295,9 @@ export function inspectCodexConfig({ home = os.homedir(), port = 2026 } = {}) {
   return checks;
 }
 
-export function inspectClaudeCodeConfig({ home = os.homedir(), port = 2026 } = {}) {
+export function inspectClaudeCodeConfig({ home = os.homedir(), host = "127.0.0.1", port = 2026 } = {}) {
   const filePath = path.join(home, ".claude", "settings.json");
-  const expectedBaseUrl = `http://127.0.0.1:${port}`;
+  const expectedBaseUrl = adapterBaseUrl(host, port);
   const settings = readJson(filePath);
   if (!settings.ok) {
     const reason = settings.parseError ? `could not parse: ${settings.error.message}` : `not found at ${displayPath(home, filePath)}`;
@@ -391,8 +401,8 @@ export async function collectDoctorChecks({
 } = {}) {
   const checks = [
     ...inspectGitHubToken({ home }),
-    ...inspectCodexConfig({ home, port }),
-    ...inspectClaudeCodeConfig({ home, port }),
+    ...inspectCodexConfig({ home, host, port }),
+    ...inspectClaudeCodeConfig({ home, host, port }),
     ...inspectClaudeAppConfig({ home, platform, env, host, port }),
   ];
 

package/src/github-identity.mjs

@@ -0,0 +1,30 @@
+import { createHash } from "node:crypto";
+
+export function normalizeGithubIdentity(identity) {
+  if (!identity || typeof identity !== "object") return null;
+  const login = typeof identity.login === "string" ? identity.login.trim() : "";
+  const id = identity.id === undefined || identity.id === null ? "" : String(identity.id).trim();
+  return login || id ? { login, id } : null;
+}
+
+export function githubTokenFingerprint(token) {
+  return createHash("sha256").update(String(token || "")).digest("hex").slice(0, 24);
+}
+
+export function githubIdentitiesEqual(first, second) {
+  const a = normalizeGithubIdentity(first);
+  const b = normalizeGithubIdentity(second);
+  if (!a || !b) return false;
+  if (a.id && b.id) return a.id === b.id;
+  return Boolean(a.login && b.login && a.login.toLowerCase() === b.login.toLowerCase());
+}
+
+export function githubIdentityMatchesExpected(identity, expected) {
+  if (!normalizeGithubIdentity(expected)) return true;
+  return githubIdentitiesEqual(identity, expected);
+}
+
+export function githubIdentityLabel(identity) {
+  const normalized = normalizeGithubIdentity(identity);
+  return normalized?.login || normalized?.id || "unknown";
+}