codex-copilot-dx 0.6.15 → 0.6.18

package/README.md

@@ -143,7 +143,8 @@ integrity, isolated Claude profile, and live relay routing without changing file
 ccdx pms status
 ```
 
-`ccdx pm-studio status` and `ccdx pm-studio setup` are equivalent long-form aliases.
+`ccdx pm-studio status`, `ccdx pm-studio setup`, and `ccdx pm-studio restore`
+are equivalent long-form aliases.
 
 `ccdx pms setup` performs local preflight, structural verification, backup,
 staging, integrity, signing, and replacement work. It does not access a PM
@@ -183,37 +184,47 @@ require reinstalling PM Studio. Setup prints the verified backup and
 manifest paths plus the version-matched restore procedure. Never restore a
 backup over a different PM Studio version or build.
 
-To restore, first quit PM Studio and its updater. Use the exact verified backup
-path printed by setup as `BACKUP_APP`, then confirm that both the installed App
-and backup still report the same version/build printed by setup:
+To restore the original local bundle, first quit PM Studio and its updater,
+then run:
 
 ```bash
-BACKUP_APP="<verified-backup-path-from-ccdx-pms-setup>"
-/usr/bin/plutil -extract CFBundleShortVersionString raw -o - "/Applications/PM Studio.app/Contents/Info.plist"
-/usr/bin/plutil -extract CFBundleVersion raw -o - "/Applications/PM Studio.app/Contents/Info.plist"
-/usr/bin/plutil -extract CFBundleShortVersionString raw -o - "$BACKUP_APP/Contents/Info.plist"
-/usr/bin/plutil -extract CFBundleVersion raw -o - "$BACKUP_APP/Contents/Info.plist"
+ccdx pms restore
 ```
 
-Only when all four values match each other and the version/build recorded in the
-source-bound manifest, move the patched App aside, restore the complete local
-bundle, and verify it before launch:
+The explicit command authorizes the local App replacement and does not show an
+additional confirmation prompt. Restore neither needs the Claude profile nor
+starts the adapter, Device Flow, Codex, or PM Studio. It selects the unique
+source-bound backup itself, verifies the installed patch record and the exact
+clean backup, stages and verifies the complete bundle, confirms that the
+installed App did not change during staging, and then performs an atomic
+replacement. It never restores a missing, ambiguous, drifted, or
+version/build-mismatched record. The original local signature is inspected and
+reported, but is not an admission gate: the exact source-bound content recorded
+when setup created the backup is authoritative. The verified backup and manifest
+remain available after a successful restore. Repeating restore on the same
+recorded clean App is safe and does not replace it again.
+
+If automatic restore reports that the replacement state cannot be verified, do
+not launch PM Studio. Keep the recovery path printed by the command and reinstall
+PM Studio. The following manual procedure is only an exceptional recovery path;
+use the exact backup and manifest paths printed by setup or restore, and first
+confirm that the installed App and backup still match the manifest version/build:
 
 ```bash
+BACKUP_APP="<exact-verified-backup-path>"
 RECOVERY_DIR="$(/usr/bin/mktemp -d '/Applications/CCDX-PM-Studio-recovery.XXXXXX')"
 PATCHED_APP="$RECOVERY_DIR/PM Studio.app"
 mv "/Applications/PM Studio.app" "$PATCHED_APP"
 /usr/bin/ditto --rsrc --extattr --acl "$BACKUP_APP" "/Applications/PM Studio.app"
-/usr/bin/codesign --verify --deep --strict --verbose=2 "/Applications/PM Studio.app"
 ccdx pms status
 ```
 
 The App-patch row from `ccdx pms status` must classify the restored bundle as
 the recorded clean local content rather than integrity drift. If the version
-check, copy, or either verification path fails,
+check, copy, or content verification fails,
 do not launch the restored App. Keep the moved patched bundle at `$PATCHED_APP`
 and reinstall PM Studio instead of applying a version-mismatched
-backup. CCDX never runs these restore commands or `sudo` automatically.
+backup. CCDX never uses `sudo` automatically.
 
 To change the model used by Codex Auto-review, run:
 

package/bin/cli.mjs

@@ -143,6 +143,11 @@ if (CLI.command === "pms") {
       });
       process.exit(result.ok ? 0 : 1);
     }
+    if (CLI.action === "restore") {
+      const { runPmStudioRestore } = await import("../src/pm-studio-setup.mjs");
+      await runPmStudioRestore({ commandName: CLI_NAME });
+      process.exit(0);
+    }
     const { runPmStudioSetup } = await import("../src/pm-studio-setup.mjs");
     await runPmStudioSetup({ commandName: CLI_NAME });
     process.exit(0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-copilot-dx",
-  "version": "0.6.15",
+  "version": "0.6.18",
   "description": "Use Codex Desktop, Claude Code, and Claude App with GitHub Copilot",
   "author": "Dale Xiao",
   "type": "module",

package/src/adapter.mjs

@@ -155,6 +155,7 @@ export function createAdapterHandler(options = {}) {
     chatCompletionsFn: codexChatCompletionsFn,
     getCachedModelEndpointsFn,
     imagePressure,
+    modelRegistry: codexModelRegistry,
     now: options.now,
     openAIModelEnv,
     responsesPayloadOptions: options.responsesPayloadOptions,
@@ -168,6 +169,7 @@ export function createAdapterHandler(options = {}) {
     acquireRequest,
     autoReviewModelResolver: options.autoReviewModelResolver,
     imagePressure,
+    modelRegistry: codexModelRegistry,
     now: options.now,
     openAIModelEnv,
     requestBodyTimeoutMs,
@@ -294,6 +296,9 @@ export function createAdapterHandler(options = {}) {
     res.writeHead(404, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ error: "Not found" }));
   };
+  const dispatchRequest = typeof options.dispatchRequestForTests === "function"
+    ? options.dispatchRequestForTests
+    : dispatch;
 
   return (req, res) => {
     const requestId = createRequestId();
@@ -326,10 +331,28 @@ export function createAdapterHandler(options = {}) {
     const finishRequest = ({ statusCode = 0, aborted = false } = {}) => {
       if (requestFinished) return;
       requestFinished = true;
-      complete({ statusCode, aborted });
-      streamPerformance?.finish({ failed: aborted || statusCode >= 400 });
+      try { complete({ statusCode, aborted }); } catch {}
+      try { streamPerformance?.finish({ failed: aborted || statusCode >= 400 }); } catch {}
       try { finishTerminalActivity(); } catch {}
     };
+    const containUnexpectedError = (error) => {
+      try { finishRequest({ statusCode: res.statusCode >= 400 ? res.statusCode : 500 }); } catch {}
+      const safeCause = error instanceof Error ? error : new Error("Unexpected adapter failure");
+      try { logRequestFailure("Adapter", safeCause); } catch {}
+      try {
+        const safeError = httpError("Internal adapter error", 500);
+        safeError.jsonBody = {
+          error: {
+            message: safeError.message,
+            type: "server_error",
+            code: "ccdx_internal_error",
+          },
+        };
+        sendJsonError(res, safeError, 500);
+      } catch {
+        try { res.destroy?.(); } catch {}
+      }
+    };
     if (trackRequest && typeof res.once === "function") {
       res.once("finish", () => finishRequest({ statusCode: res.statusCode }));
       res.once("close", () => finishRequest({
@@ -344,17 +367,15 @@ export function createAdapterHandler(options = {}) {
         pathname,
         showRequestId: options.showRequestId === true,
         streamPerformance,
-      }, () => dispatch(req, res, pathname));
+      }, () => dispatchRequest(req, res, pathname));
       if (result && typeof result.then === "function") {
         return result.catch((error) => {
-          finishRequest({ statusCode: res.statusCode >= 400 ? res.statusCode : 500 });
-          throw error;
+          containUnexpectedError(error);
         });
       }
       return result;
     } catch (error) {
-      finishRequest({ statusCode: res.statusCode >= 400 ? res.statusCode : 500 });
-      throw error;
+      containUnexpectedError(error);
     }
   };
 }

package/src/anthropic-handler.mjs

@@ -7,7 +7,9 @@ import {
 import {
   createRequestAbort,
   logRequestFailure,
+  MAX_UPSTREAM_ERROR_BODY_BYTES,
   readJsonBody,
+  readBoundedResponseText,
   sendJsonError,
   sendUpstreamError,
   writeOrDrain,
@@ -21,6 +23,7 @@ import { safeUpstreamResponseHeaders } from "./upstream-headers.mjs";
 import { recordAnthropicUsage } from "./usage.mjs";
 
 const PROMPT_TOO_LONG_MESSAGE = "prompt is too long: your prompt is too long. Please reduce the number of messages or use a model with a larger context window.";
+const DOWNSTREAM_CLOSED = Symbol("downstream-closed");
 
 function contextWindowErrorBody(text) {
   let error;
@@ -112,7 +115,10 @@ export function createAnthropicMessagesHandler(options) {
         const upstream = await chatCompletionsFn(withChatStreamUsage(chatReq), { signal: abort.signal });
         releaseRequest();
         if (!upstream.ok) {
-          sendAnthropicUpstreamError(res, upstream, await upstream.text());
+          sendAnthropicUpstreamError(res, upstream, await readBoundedResponseText(upstream, {
+            maxBytes: MAX_UPSTREAM_ERROR_BODY_BYTES,
+            label: "Copilot Chat error body",
+          }));
           return;
         }
         await requireUpstreamEventStream(upstream);
@@ -132,12 +138,15 @@ export function createAnthropicMessagesHandler(options) {
             async (event, data) => {
               if (event === "message_start") messageId = data.message?.id;
               if (event === "message_delta") usage = data.usage;
-              await writeOrDrain(res, `event: ${event}\ndata: ${JSON.stringify(data)}\n\n`);
+              if (!await writeOrDrain(res, `event: ${event}\ndata: ${JSON.stringify(data)}\n\n`)) {
+                throw DOWNSTREAM_CLOSED;
+              }
             },
             requestedModel,
             { forceModel: forceRequestedModel },
           );
         } catch (error) {
+          if (error === DOWNSTREAM_CLOSED) return;
           logRequestFailure("Messages", error, abort);
           await endStreamWithError(res, "anthropic", error, abort);
           return;
@@ -147,7 +156,12 @@ export function createAnthropicMessagesHandler(options) {
       } else {
         const upstream = await chatCompletionsFn({ ...chatReq, stream: false }, { signal: abort.signal });
         releaseRequest();
-        const data = await upstream.text();
+        const data = upstream.ok
+          ? await upstream.text()
+          : await readBoundedResponseText(upstream, {
+            maxBytes: MAX_UPSTREAM_ERROR_BODY_BYTES,
+            label: "Copilot Chat error body",
+          });
         if (!upstream.ok) {
           sendAnthropicUpstreamError(res, upstream, data);
           return;

package/src/anthropic.mjs

@@ -163,6 +163,10 @@ export function anthropicToChat(body, options = {}) {
 
 function uid() { return randomUUID().replace(/-/g, ""); }
 
+function nonNegativeTokenCount(value) {
+  return Number.isFinite(value) ? Math.max(0, value) : 0;
+}
+
 function invalidToolArguments(toolName) {
   const name = String(toolName || "unknown").slice(0, 100);
   return invalidUpstreamStream(
@@ -198,10 +202,11 @@ export function chatToAnthropic(openaiResp, model, options = {}) {
   }
 
   const u = openaiResp.usage || {};
-  const cached = u.prompt_tokens_details?.cached_tokens ?? 0;
+  const prompt = nonNegativeTokenCount(u.prompt_tokens);
+  const cached = Math.min(prompt, nonNegativeTokenCount(u.prompt_tokens_details?.cached_tokens));
   const usage = {
-    input_tokens: (u.prompt_tokens ?? 0) - cached,
-    output_tokens: u.completion_tokens ?? 0,
+    input_tokens: prompt - cached,
+    output_tokens: nonNegativeTokenCount(u.completion_tokens),
   };
   if (cached > 0) usage.cache_read_input_tokens = cached;
 
@@ -281,7 +286,7 @@ export async function streamAnthropicFromLines(lineIterator, emit, model, option
     if (upstreamError) throw upstreamError;
     if (!options.forceModel && parsed.model) actualModel = parsed.model;
     if (parsed.usage?.completion_tokens != null) {
-      outputTokens = parsed.usage.completion_tokens;
+      outputTokens = nonNegativeTokenCount(parsed.usage.completion_tokens);
       markOutputTokens(outputTokens);
     }
     const choice = parsed.choices?.[0];

package/src/atomic-file.mjs

@@ -24,9 +24,12 @@ function syncDirectory(directory) {
   }
 }
 
-export function atomicWriteFileSync(filePath, data, { mode = 0o600 } = {}) {
+export function atomicWriteFileSync(filePath, data, {
+  mode = 0o600,
+  preserveMode = true,
+} = {}) {
   const directory = path.dirname(filePath);
-  const finalMode = existingMode(filePath, mode);
+  const finalMode = preserveMode ? existingMode(filePath, mode) : mode;
   const tempPath = path.join(directory, `.${path.basename(filePath)}.${process.pid}.${randomUUID()}.tmp`);
   fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
 
@@ -50,6 +53,77 @@ export function atomicWriteFileSync(filePath, data, { mode = 0o600 } = {}) {
   }
 }
 
+function fileSnapshot(filePath) {
+  try {
+    return {
+      exists: true,
+      data: fs.readFileSync(filePath),
+      mode: fs.statSync(filePath).mode & 0o777,
+    };
+  } catch (error) {
+    if (error?.code === "ENOENT") return { exists: false, data: null, mode: 0o600 };
+    throw error;
+  }
+}
+
+function removeFile(filePath, unlinkFile) {
+  try {
+    unlinkFile(filePath);
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw error;
+  }
+}
+
+function writeExactMode(filePath, data, mode, writeFile) {
+  writeFile(filePath, data, { mode, preserveMode: false });
+  fs.chmodSync(filePath, mode);
+}
+
+function restoreFile(filePath, snapshot, { writeFile, unlinkFile }) {
+  if (snapshot.exists) {
+    writeExactMode(filePath, snapshot.data, snapshot.mode, writeFile);
+    return;
+  }
+  removeFile(filePath, unlinkFile);
+}
+
+// Commit a primary file first and its metadata/activation marker last. A null
+// secondary value removes stale metadata as the final transaction step.
+export function atomicWriteFilePairSync(
+  primaryPath,
+  primaryData,
+  secondaryPath,
+  secondaryData,
+  {
+    mode = 0o600,
+    writeFile = atomicWriteFileSync,
+    unlinkFile = fs.unlinkSync,
+  } = {},
+) {
+  const primarySnapshot = fileSnapshot(primaryPath);
+  const secondarySnapshot = fileSnapshot(secondaryPath);
+
+  try {
+    writeExactMode(primaryPath, primaryData, mode, writeFile);
+    if (secondaryData === null) removeFile(secondaryPath, unlinkFile);
+    else writeExactMode(secondaryPath, secondaryData, mode, writeFile);
+  } catch (error) {
+    let rollbackError;
+    try {
+      restoreFile(primaryPath, primarySnapshot, { writeFile, unlinkFile });
+    } catch (cause) {
+      rollbackError = cause;
+    }
+    try {
+      restoreFile(secondaryPath, secondarySnapshot, { writeFile, unlinkFile });
+    } catch (cause) {
+      rollbackError ||= cause;
+    }
+    if (rollbackError) error.rollbackError = rollbackError;
+    throw error;
+  }
+}
+
 export function atomicWriteFileIfChangedSync(filePath, data, options = {}) {
   try {
     const current = fs.readFileSync(filePath);

package/src/auth-profile.mjs

@@ -1,7 +1,7 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { atomicWriteFileSync } from "./atomic-file.mjs";
+import { atomicWriteFilePairSync, atomicWriteFileSync } from "./atomic-file.mjs";
 import {
   githubTokenLockPath,
   githubTokenMetadataPath,
@@ -131,27 +131,11 @@ export function withAuthProfileLock(profile, fn, {
   return withFileLock(lockPath, fn, { ...lockOptions(env), ...options });
 }
 
-function writeSecret(filePath, data, writeFile) {
-  writeFile(filePath, data, { mode: 0o600 });
-  fs.chmodSync(filePath, 0o600);
-}
-
-function restoreSnapshot(filePath, snapshot, writeFile) {
-  if (snapshot.exists) {
-    writeSecret(filePath, snapshot.data, writeFile);
-    return;
-  }
-  try {
-    fs.unlinkSync(filePath);
-  } catch (error) {
-    if (error?.code !== "ENOENT") throw error;
-  }
-}
-
 export function writeClaudeAuthProfile(token, identity, {
   home = os.homedir(),
   now = () => new Date(),
   writeFile = atomicWriteFileSync,
+  unlinkFile = fs.unlinkSync,
 } = {}) {
   const cleanToken = String(token || "").trim();
   const normalizedIdentity = normalizeGithubIdentity(identity);
@@ -163,8 +147,6 @@ export function writeClaudeAuthProfile(token, identity, {
   fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
   fs.chmodSync(directory, 0o700);
 
-  const previousToken = readOptionalFile(paths.tokenPath);
-  const previousMetadata = readOptionalFile(paths.metadataPath);
   const timestamp = now();
   const updatedAt = timestamp instanceof Date ? timestamp.toISOString() : new Date(timestamp).toISOString();
   const metadata = `${JSON.stringify({
@@ -174,20 +156,15 @@ export function writeClaudeAuthProfile(token, identity, {
     updated_at: updatedAt,
   }, null, 2)}\n`;
 
-  try {
-    writeSecret(paths.tokenPath, cleanToken, writeFile);
-    // Commit the activation marker last. Readers never observe a configured
-    // Claude profile unless the token and its fingerprint agree.
-    writeSecret(paths.metadataPath, metadata, writeFile);
-  } catch (error) {
-    try {
-      restoreSnapshot(paths.tokenPath, previousToken, writeFile);
-      restoreSnapshot(paths.metadataPath, previousMetadata, writeFile);
-    } catch (rollbackError) {
-      error.rollbackError = rollbackError;
-    }
-    throw error;
-  }
+  // Commit the activation marker last. Readers never observe a configured
+  // Claude profile unless the token and its fingerprint agree.
+  atomicWriteFilePairSync(
+    paths.tokenPath,
+    cleanToken,
+    paths.metadataPath,
+    metadata,
+    { mode: 0o600, writeFile, unlinkFile },
+  );
 
   return {
     profile: AUTH_PROFILE_CLAUDE,