codex-copilot-dx 0.6.14 → 0.6.18

package/src/copilot-responses-policy.mjs

@@ -0,0 +1,78 @@
+function cloneJson(value) {
+  return value === undefined ? undefined : structuredClone(value);
+}
+
+export function isEncryptedContentVerificationError(statusCode, text) {
+  if (statusCode < 400 || !text) return false;
+  const lower = String(text).toLowerCase();
+  const reasoningFailure = lower.includes("encrypted content")
+    && lower.includes("could not be verified")
+    && (lower.includes("could not be decrypted") || lower.includes("could not be parsed"));
+  const functionOutputFailure = lower.includes("encrypted function output content")
+    && lower.includes("could not be decrypted or decoded");
+  const missingEncryptedContent = statusCode < 500
+    && /missing required parameter:\s*(['"]?)input\[\d+\](?:\.[a-z0-9_]+|\[\d+\])*\.encrypted_content\1(?=\.?(?:\s|$|["},\]]))/.test(lower);
+  return reasoningFailure || functionOutputFailure || missingEncryptedContent;
+}
+
+export function isImageNamespaceCollisionError(statusCode, text) {
+  if (statusCode < 400 || !text) return false;
+  const lower = String(text).toLowerCase();
+  return lower.includes("namespace")
+    && lower.includes("image_gen")
+    && lower.includes("collid");
+}
+
+export function isCopilotImageNamespaceTool(tool, { collisionFallback = false } = {}) {
+  if (!tool || typeof tool !== "object") return false;
+  const type = String(tool.type || "").toLowerCase();
+  if (["image_gen", "image_generation"].includes(type)) return true;
+  if (!collisionFallback) return false;
+  const name = String(tool.name || tool.function?.name || "").toLowerCase();
+  const namespace = String(tool.namespace || "").toLowerCase();
+  if (["image_gen", "image_generation"].includes(name)) return true;
+  if (namespace === "image_gen" || namespace === "image_generation") return true;
+  return [type, name, namespace].some((value) => value.startsWith("image_gen"));
+}
+
+function toolName(tool) {
+  return String(tool?.name || tool?.function?.name || "").trim();
+}
+
+// Copilot currently rejects the public image-generation tool. Keep this
+// provider-owned policy paired with tool_choice so request invariants survive
+// the removal. Revalidate against Copilot before deleting or broadening it.
+// Reference: https://github.com/Menci/Floway/blob/ac2bbb04352033a7d9d74574a9d465d40395ef06/packages/provider-copilot/src/interceptors/openai-responses/strip-image-generation.ts
+export function applyCopilotResponsesRequestPolicies(body, options = {}) {
+  if (!Array.isArray(body?.tools)) return false;
+  const removedNames = new Set();
+  const filtered = body.tools.filter((tool) => {
+    const removed = isCopilotImageNamespaceTool(tool, options);
+    if (removed) {
+      const name = toolName(tool);
+      if (name) removedNames.add(name);
+    }
+    return !removed;
+  });
+  if (filtered.length === body.tools.length) return false;
+  if (filtered.length) body.tools = filtered;
+  else delete body.tools;
+
+  const choiceName = toolName(body.tool_choice);
+  const choiceTargetsRemovedTool = choiceName
+    && removedNames.has(choiceName)
+    && !filtered.some((tool) => toolName(tool) === choiceName);
+  if (isCopilotImageNamespaceTool(body.tool_choice, options)
+    || choiceTargetsRemovedTool
+    || (body.tool_choice === "required" && !body.tools)) {
+    delete body.tool_choice;
+  }
+  return true;
+}
+
+export function sanitizeImageNamespaceCollisionRequest(reqContext) {
+  if (!Array.isArray(reqContext?.body?.tools)) return null;
+  const body = cloneJson(reqContext.body);
+  if (!applyCopilotResponsesRequestPolicies(body, { collisionFallback: true })) return null;
+  return { ...reqContext, body };
+}

package/src/copilot.mjs

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import { status } from "./status.mjs";
 import { debugLog } from "./log.mjs";
 import { createCopilotClientRuntime } from "./copilot-client.mjs";
+import { discardBoundedResponseBody } from "./http-transport.mjs";
 
 export {
   optimizeImageDataUrl,
@@ -156,7 +157,7 @@ export async function fetchCopilotUpstream(
       const resp = await fetchImpl(url, init);
       debugLog(`upstream ${method} ${target} status=${resp.status} attempt=${attempt + 1}/${retryCount + 1} attempt_ms=${Date.now() - attemptStart} total_ms=${Date.now() - totalStart}`);
       if (attempt < retryCount && isRetryableUpstreamStatus(resp.status, method)) {
-        await resp.arrayBuffer?.().catch(() => {});
+        await discardBoundedResponseBody(resp);
         const delay = upstreamRetryDelay(attempt, baseDelay);
         console.warn(status("warn", `upstream ${target} returned ${resp.status}; retry ${attempt + 1}/${retryCount} in ${delay}ms`));
         await sleep(delay, { signal });

package/src/http-transport.mjs

@@ -17,12 +17,103 @@ const MAX_INFLIGHT_BODY_BYTES = HTTP_RUNTIME_CONFIG.maxInflightBodyBytes;
 const MAX_QUEUED_REQUESTS = HTTP_RUNTIME_CONFIG.maxQueuedRequests;
 const REQUEST_QUEUE_TIMEOUT_MS = HTTP_RUNTIME_CONFIG.requestQueueTimeoutMs;
 
+export const MAX_UPSTREAM_ERROR_BODY_BYTES = 1024 * 1024;
+export const MAX_UPSTREAM_MODEL_CATALOG_BYTES = 8 * 1024 * 1024;
+export const MAX_UPSTREAM_RETRY_DRAIN_BYTES = 64 * 1024;
+
 export function httpError(message, statusCode) {
   const err = new Error(message);
   err.statusCode = statusCode;
   return err;
 }
 
+function upstreamBodyTooLarge(label, maxBytes) {
+  const error = httpError(`${label} exceeds ${maxBytes} bytes`, 502);
+  error.code = "ccdx_upstream_response_too_large";
+  error.jsonBody = {
+    error: {
+      message: error.message,
+      type: "upstream_error",
+      code: error.code,
+    },
+  };
+  return error;
+}
+
+function unreadableUpstreamBody(label) {
+  const error = httpError(`${label} is not a readable web stream`, 502);
+  error.code = "ccdx_upstream_response_unreadable";
+  error.jsonBody = {
+    error: {
+      message: error.message,
+      type: "upstream_error",
+      code: error.code,
+    },
+  };
+  return error;
+}
+
+async function cancelResponseBody(response) {
+  try { await response?.body?.cancel?.(); } catch {}
+}
+
+function responseContentLength(response) {
+  const raw = response?.headers?.get?.("content-length")
+    ?? response?.headers?.["content-length"]
+    ?? response?.headers?.["Content-Length"];
+  const parsed = Number.parseInt(raw || "", 10);
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : null;
+}
+
+export async function readBoundedResponseBuffer(response, {
+  maxBytes,
+  label = "Upstream response body",
+} = {}) {
+  const limit = Number.isFinite(maxBytes) && maxBytes >= 0 ? Math.floor(maxBytes) : 0;
+  if (responseContentLength(response) > limit) {
+    await cancelResponseBody(response);
+    throw upstreamBodyTooLarge(label, limit);
+  }
+  if (!response?.body) {
+    if ((responseContentLength(response) || 0) > 0) throw unreadableUpstreamBody(label);
+    return Buffer.alloc(0);
+  }
+  const reader = response?.body?.getReader?.();
+  if (!reader) throw unreadableUpstreamBody(label);
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      const chunk = Buffer.from(value);
+      total += chunk.length;
+      if (total > limit) {
+        await reader.cancel().catch(() => {});
+        throw upstreamBodyTooLarge(label, limit);
+      }
+      chunks.push(chunk);
+    }
+    return Buffer.concat(chunks, total);
+  } finally {
+    reader.releaseLock();
+  }
+}
+
+export async function readBoundedResponseText(response, options) {
+  return new TextDecoder().decode(await readBoundedResponseBuffer(response, options));
+}
+
+export async function discardBoundedResponseBody(response, maxBytes = MAX_UPSTREAM_RETRY_DRAIN_BYTES) {
+  try {
+    await readBoundedResponseBuffer(response, { maxBytes, label: "Upstream retry response body" });
+    return true;
+  } catch {
+    await cancelResponseBody(response);
+    return false;
+  }
+}
+
 function payloadTooLarge(kind, maxBytes) {
   return httpError(`${kind} request body exceeds ${maxBytes} bytes`, 413);
 }

package/src/lock.mjs

@@ -32,23 +32,171 @@ function processIsAlive(pid) {
   }
 }
 
+function readStaleLockSnapshot(lockPath, io) {
+  const before = io.lstatSync(lockPath);
+  if (!before.isFile() || before.isSymbolicLink()) return { safe: false };
+
+  const noFollow = io.constants?.O_NOFOLLOW || 0;
+  let fd;
+  try {
+    fd = io.openSync(lockPath, io.constants.O_RDONLY | noFollow);
+    const opened = io.fstatSync(fd);
+    if (!opened.isFile()
+      || opened.dev !== before.dev
+      || opened.ino !== before.ino
+      || opened.size !== before.size) {
+      return { safe: false };
+    }
+    const text = io.readFileSync(fd, "utf8");
+    const after = io.fstatSync(fd);
+    if (after.dev !== opened.dev
+      || after.ino !== opened.ino
+      || after.size !== opened.size
+      || after.mtimeMs !== opened.mtimeMs
+      || after.ctimeMs !== opened.ctimeMs) {
+      return { safe: false };
+    }
+    let record = {};
+    try {
+      record = JSON.parse(text);
+    } catch {}
+    return {
+      safe: true,
+      dev: after.dev,
+      ino: after.ino,
+      mtimeMs: after.mtimeMs,
+      size: after.size,
+      text,
+      pid: Number(record?.pid),
+      owner: typeof record?.owner === "string" ? record.owner : "",
+    };
+  } finally {
+    if (fd !== undefined) io.closeSync(fd);
+  }
+}
+
 function sameLock(left, right) {
   return left.dev === right.dev
     && left.ino === right.ino
     && left.mtimeMs === right.mtimeMs
     && left.size === right.size
-    && left.owner === right.owner;
+    && left.owner === right.owner
+    && left.text === right.text;
 }
 
-function maybeRemoveStaleLock(lockPath, staleMs, nowMs) {
-  if (!Number.isFinite(staleMs) || staleMs <= 0) return false;
+function lockPathExists(lockPath, io) {
+  try {
+    io.lstatSync(lockPath);
+    return true;
+  } catch (error) {
+    if (error?.code === "ENOENT") return false;
+    throw error;
+  }
+}
+
+function writeLockRecord(lockPath, record, io) {
+  const fd = io.openSync(lockPath, "wx", 0o600);
+  try {
+    io.writeFileSync(fd, JSON.stringify(record));
+  } catch (error) {
+    io.closeSync(fd);
+    try { io.unlinkSync(lockPath); } catch {}
+    throw error;
+  }
+  return fd;
+}
+
+function removeOwnedLock(lockPath, owner, io) {
+  try {
+    const snapshot = readStaleLockSnapshot(lockPath, io);
+    if (snapshot.safe && snapshot.owner === owner) io.unlinkSync(lockPath);
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw error;
+  }
+}
+
+function reclaimGuardPath(lockPath) {
+  return `${lockPath}.reclaim`;
+}
+
+function acquireReclaimGuard(lockPath, io) {
+  const guardPath = reclaimGuardPath(lockPath);
+  const owner = randomUUID();
+  let fd;
+  try {
+    fd = writeLockRecord(guardPath, {
+      pid: process.pid,
+      owner,
+      created_at: new Date().toISOString(),
+    }, io);
+    io.closeSync(fd);
+    return { guardPath, owner };
+  } catch (error) {
+    if (fd !== undefined) try { io.closeSync(fd); } catch {}
+    if (error?.code === "EEXIST") return null;
+    throw error;
+  }
+}
+
+function maybeRemoveAbandonedGuard(guardPath, staleMs, nowMs, io, processAlive) {
   try {
-    const first = readLockSnapshot(lockPath);
-    if (nowMs - first.mtimeMs <= staleMs || processIsAlive(first.pid)) return false;
-    const current = readLockSnapshot(lockPath);
-    if (!sameLock(first, current)) return false;
-    fs.unlinkSync(lockPath);
+    const snapshot = readStaleLockSnapshot(guardPath, io);
+    if (!snapshot.safe || nowMs - snapshot.mtimeMs <= staleMs || processAlive(snapshot.pid)) return false;
+    const quarantinePath = `${guardPath}.stale-${randomUUID()}`;
+    io.renameSync(guardPath, quarantinePath);
+    const moved = readStaleLockSnapshot(quarantinePath, io);
+    if (!moved.safe || !sameLock(snapshot, moved)) {
+      restoreQuarantinedLock(guardPath, quarantinePath, io);
+      return false;
+    }
+    io.unlinkSync(quarantinePath);
     return true;
+  } catch (error) {
+    return error?.code === "ENOENT";
+  }
+}
+
+function restoreQuarantinedLock(lockPath, quarantinePath, io) {
+  try {
+    io.linkSync(quarantinePath, lockPath);
+  } catch {
+    return;
+  }
+  try {
+    io.unlinkSync(quarantinePath);
+  } catch {}
+}
+
+function maybeRemoveStaleLock(lockPath, staleMs, nowMs, io, processAlive) {
+  if (!Number.isFinite(staleMs) || staleMs <= 0) return false;
+  try {
+    const first = readStaleLockSnapshot(lockPath, io);
+    if (!first.safe || nowMs - first.mtimeMs <= staleMs || processAlive(first.pid)) return false;
+    const guard = acquireReclaimGuard(lockPath, io);
+    if (!guard) return false;
+    try {
+      const current = readStaleLockSnapshot(lockPath, io);
+      if (!sameLock(first, current)
+        || nowMs - current.mtimeMs <= staleMs
+        || processAlive(current.pid)) {
+        return false;
+      }
+      const quarantinePath = `${lockPath}.stale-${randomUUID()}`;
+      try {
+        io.renameSync(lockPath, quarantinePath);
+      } catch (e) {
+        return e?.code === "ENOENT";
+      }
+      const moved = readStaleLockSnapshot(quarantinePath, io);
+      if (!moved.safe || !sameLock(current, moved)) {
+        restoreQuarantinedLock(lockPath, quarantinePath, io);
+        return false;
+      }
+      io.unlinkSync(quarantinePath);
+      return true;
+    } finally {
+      removeOwnedLock(guard.guardPath, guard.owner, io);
+    }
   } catch (e) {
     if (e?.code === "ENOENT") return true;
     return false;
@@ -60,28 +208,42 @@ export async function withFileLock(lockPath, fn, {
   staleMs = 15 * 60 * 1000,
   pollMs = 50,
   now = Date.now,
+  fsImpl = fs,
+  processAlive = processIsAlive,
 } = {}) {
   fs.mkdirSync(path.dirname(lockPath), { recursive: true });
   const started = now();
   const owner = randomUUID();
   let fd = null;
+  const guardPath = reclaimGuardPath(lockPath);
 
   while (fd === null) {
+    const beforeAcquire = now();
+    if (lockPathExists(guardPath, fsImpl)) {
+      maybeRemoveAbandonedGuard(guardPath, staleMs, beforeAcquire, fsImpl, processAlive);
+      if (lockPathExists(guardPath, fsImpl)) {
+        if (beforeAcquire - started >= timeoutMs) throw new Error(`Timed out waiting for lock: ${lockPath}`);
+        await sleep(Math.min(pollMs, Math.max(1, timeoutMs - (beforeAcquire - started))));
+        continue;
+      }
+    }
     try {
-      const candidateFd = fs.openSync(lockPath, "wx", 0o600);
-      try {
-        fs.writeFileSync(candidateFd, JSON.stringify({ pid: process.pid, owner, created_at: new Date().toISOString() }));
-        fd = candidateFd;
-      } catch (e) {
-        fs.closeSync(candidateFd);
-        try { fs.unlinkSync(lockPath); } catch {}
-        throw e;
+      fd = writeLockRecord(lockPath, {
+        pid: process.pid,
+        owner,
+        created_at: new Date().toISOString(),
+      }, fs);
+      if (lockPathExists(guardPath, fsImpl)) {
+        fs.closeSync(fd);
+        fd = null;
+        removeOwnedLock(lockPath, owner, fs);
+        continue;
       }
       break;
     } catch (e) {
       if (e?.code !== "EEXIST") throw e;
       const nowMs = now();
-      if (maybeRemoveStaleLock(lockPath, staleMs, nowMs)) continue;
+      if (maybeRemoveStaleLock(lockPath, staleMs, nowMs, fsImpl, processAlive)) continue;
       if (nowMs - started >= timeoutMs) {
         throw new Error(`Timed out waiting for lock: ${lockPath}`);
       }

package/src/model-cache.mjs

@@ -2,7 +2,8 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
-const DEFAULT_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+export const MODEL_CACHE_SOFT_TTL_MS = 2 * 60 * 60 * 1000;
+export const MODEL_CACHE_HARD_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 const MODEL_CACHE_PROFILES = new Set(["codex", "claude"]);
 
 export function modelCachePath(home = os.homedir(), profile = "codex") {
@@ -23,40 +24,69 @@ export function isValidModelList(models) {
   return modelData(models) !== null;
 }
 
-export function loadModelCache({
+function normalizedTtl(value, fallback) {
+  return Number.isFinite(value) && value >= 0 ? value : fallback;
+}
+
+export function loadModelCacheEntry({
   home = os.homedir(),
   profile = "codex",
   credentialFingerprint = "",
-  maxAgeMs = DEFAULT_MAX_AGE_MS,
+  softTtlMs = MODEL_CACHE_SOFT_TTL_MS,
+  hardTtlMs,
+  maxAgeMs,
   now = Date.now,
 } = {}) {
   try {
     const parsed = JSON.parse(fs.readFileSync(modelCachePath(home, profile), "utf8"));
     const savedAt = Date.parse(parsed.saved_at);
-    if (!Number.isFinite(savedAt) || now() - savedAt > maxAgeMs) return null;
+    if (!Number.isFinite(savedAt)) return null;
     const expectedFingerprint = String(credentialFingerprint || "").trim();
     if (expectedFingerprint && parsed.credential_fingerprint !== expectedFingerprint) return null;
     if (!isValidModelList(parsed.models)) return null;
-    return parsed.models;
+    const resolvedHardTtlMs = normalizedTtl(
+      hardTtlMs,
+      normalizedTtl(maxAgeMs, MODEL_CACHE_HARD_TTL_MS),
+    );
+    const resolvedSoftTtlMs = Math.min(
+      normalizedTtl(softTtlMs, MODEL_CACHE_SOFT_TTL_MS),
+      resolvedHardTtlMs,
+    );
+    const ageMs = Math.max(0, now() - savedAt);
+    if (ageMs > resolvedHardTtlMs) return null;
+    return {
+      models: parsed.models,
+      savedAtMs: savedAt,
+      ageMs,
+      state: ageMs > resolvedSoftTtlMs ? "stale" : "fresh",
+    };
   } catch {
     return null;
   }
 }
 
+export function loadModelCache(options = {}) {
+  return loadModelCacheEntry(options)?.models || null;
+}
+
 export function saveModelCache(models, {
   home = os.homedir(),
   profile = "codex",
   credentialFingerprint = "",
+  isCurrent = () => true,
+  now = Date.now,
 } = {}) {
   if (!isValidModelList(models)) return false;
+  if (typeof isCurrent === "function" && !isCurrent()) return false;
   const filePath = modelCachePath(home, profile);
   const tempPath = `${filePath}.${process.pid}.tmp`;
-  const payload = { saved_at: new Date().toISOString(), models };
+  const payload = { saved_at: new Date(now()).toISOString(), models };
   const fingerprint = String(credentialFingerprint || "").trim();
   if (fingerprint) payload.credential_fingerprint = fingerprint;
   fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
   try {
     fs.writeFileSync(tempPath, `${JSON.stringify(payload)}\n`, { mode: 0o600 });
+    if (typeof isCurrent === "function" && !isCurrent()) return false;
     fs.renameSync(tempPath, filePath);
     fs.chmodSync(filePath, 0o600);
     return true;

package/src/models.mjs

@@ -117,6 +117,23 @@ export function modelIsResponsesOnly(model) {
   return hasResponses && !endpoints.includes("/chat/completions");
 }
 
+export function resolveCopilotPriorityTierModel(model, serviceTier, models) {
+  const baseModel = String(model || "").trim();
+  if (baseModel !== "gpt-5.6-sol" || serviceTier !== "priority") return null;
+  const fastModelId = "gpt-5.6-sol-fast";
+  const fastModel = copilotModelData(models)
+    .find((entry) => String(entry?.id || "").trim() === fastModelId);
+  const vendor = String(fastModel?.vendor || fastModel?.owned_by || "").trim().toLowerCase();
+  const policy = String(fastModel?.policy?.state || "").trim().toLowerCase();
+  if (vendor !== "openai"
+    || policy !== "enabled"
+    || fastModel?.model_picker_enabled !== true
+    || !modelIsResponsesOnly(fastModel)) {
+    return null;
+  }
+  return fastModelId;
+}
+
 function copilotModelData(models) {
   const data = Array.isArray(models) ? models : models?.data;
   return Array.isArray(data) ? data : [];

package/src/observability.mjs

@@ -116,11 +116,23 @@ function modelRegistryStatus(modelRegistry) {
   const modelData = Array.isArray(modelRegistry?.models)
     ? modelRegistry.models
     : modelRegistry?.models?.data;
-  return {
+  const result = {
     source: String(modelRegistry?.source || "built-in"),
     models: Array.isArray(modelData) ? modelData.length : 0,
     claude_models: Array.isArray(modelRegistry?.modelDefs) ? modelRegistry.modelDefs.length : 0,
   };
+  if (typeof modelRegistry?.cacheState === "string") {
+    const savedAtMs = Number(modelRegistry.cacheSavedAtMs);
+    result.cache_state = modelRegistry.cacheState;
+    result.cache_age_ms = Number.isFinite(savedAtMs) ? Math.max(0, Date.now() - savedAtMs) : null;
+    result.refresh_in_flight = modelRegistry.refreshInFlight === true;
+    result.generation = finiteRuntimeNumber(modelRegistry.generation);
+    result.last_error = typeof modelRegistry.lastError === "string" ? modelRegistry.lastError : null;
+    result.last_error_at_ms = Number.isFinite(modelRegistry.lastErrorAtMs)
+      ? modelRegistry.lastErrorAtMs
+      : null;
+  }
+  return result;
 }
 
 function finiteRuntimeNumber(value, fallback = 0) {