codex-copilot-dx 0.6.15 → 0.6.18

package/src/auth.mjs

@@ -2,6 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
 import { spawn } from "node:child_process";
+import { atomicWriteFilePairSync, atomicWriteFileSync } from "./atomic-file.mjs";
 import {
   githubIdentityMatchesExpected,
   githubTokenFingerprint,
@@ -15,6 +16,11 @@ const CLIENT_ID = "Iv1.b507a08c87ecfe98"; // Public GitHub Copilot client ID.
 const SCOPE = "read:user";
 const GITHUB_API = "https://api.github.com";
 const COPILOT_TOKEN_URL = `${GITHUB_API}/copilot_internal/v2/token`;
+const ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
+const DEFAULT_DEVICE_INTERVAL_SECONDS = 5;
+const DEFAULT_DEVICE_EXPIRES_SECONDS = 900;
+const DEFAULT_DEVICE_CODE_TIMEOUT_MS = 30 * 1000;
+const MAX_DEVICE_FLOW_JSON_BYTES = 64 * 1024;
 const DISABLE_TOKEN_DISCOVERY_VALUES = new Set(["1", "true", "yes"]);
 const MAX_AUTH_JSON_BYTES = 1024 * 1024;
 
@@ -48,7 +54,196 @@ export function interpretPoll(data) {
   }
 }
 
-function sleep(ms) { return new Promise((r) => setTimeout(r, ms)); }
+function abortError(signal) {
+  if (signal?.reason instanceof Error) return signal.reason;
+  const error = new Error("The operation was aborted");
+  error.name = "AbortError";
+  return error;
+}
+
+function sleep(ms, { signal } = {}) {
+  if (signal?.aborted) return Promise.reject(abortError(signal));
+  return new Promise((resolve, reject) => {
+    const cleanup = () => signal?.removeEventListener("abort", onAbort);
+    const onAbort = () => {
+      clearTimeout(timer);
+      cleanup();
+      reject(abortError(signal));
+    };
+    const timer = setTimeout(() => {
+      cleanup();
+      resolve();
+    }, ms);
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+
+function awaitWithSignal(operation, signal) {
+  if (signal?.aborted) return Promise.reject(abortError(signal));
+  return new Promise((resolve, reject) => {
+    const cleanup = () => signal?.removeEventListener("abort", onAbort);
+    const finish = (callback, value) => {
+      cleanup();
+      callback(value);
+    };
+    const onAbort = () => finish(reject, abortError(signal));
+    signal?.addEventListener("abort", onAbort, { once: true });
+    Promise.resolve()
+      .then(operation)
+      .then((value) => finish(resolve, value), (error) => finish(reject, error));
+  });
+}
+
+async function discardBoundedResponseBody(response) {
+  const transport = await import("./http-transport.mjs");
+  return transport.discardBoundedResponseBody(response);
+}
+
+async function readDeviceFlowJson(response, signal, label) {
+  if (typeof response?.body?.getReader === "function") {
+    const transport = await import("./http-transport.mjs");
+    const text = await awaitWithSignal(() => transport.readBoundedResponseText(response, {
+      maxBytes: MAX_DEVICE_FLOW_JSON_BYTES,
+      label,
+    }), signal);
+    return JSON.parse(text);
+  }
+  return awaitWithSignal(() => response.json(), signal);
+}
+
+function cancelResponseBody(response) {
+  try { Promise.resolve(response?.body?.cancel?.()).catch(() => {}); } catch {}
+}
+
+function deviceCodeTimeoutError(timeoutMs) {
+  const error = new Error(`Device code request timed out after ${timeoutMs}ms`);
+  error.code = "CCDX_DEVICE_CODE_TIMEOUT";
+  return error;
+}
+
+export async function requestGithubDeviceCode({
+  fetchImpl = fetch,
+  signal,
+  timeoutMs = DEFAULT_DEVICE_CODE_TIMEOUT_MS,
+} = {}) {
+  const parsedTimeout = Number(timeoutMs);
+  const deadlineMs = Number.isFinite(parsedTimeout) && parsedTimeout > 0
+    ? parsedTimeout
+    : DEFAULT_DEVICE_CODE_TIMEOUT_MS;
+  const controller = new AbortController();
+  let response;
+  const onCallerAbort = () => controller.abort(signal.reason);
+  signal?.addEventListener("abort", onCallerAbort, { once: true });
+  if (signal?.aborted) onCallerAbort();
+  const timer = setTimeout(() => controller.abort(deviceCodeTimeoutError(deadlineMs)), deadlineMs);
+  try {
+    response = await awaitWithSignal(() => fetchImpl("https://github.com/login/device/code", {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Accept: "application/json" },
+      body: JSON.stringify({ client_id: CLIENT_ID, scope: SCOPE }),
+      signal: controller.signal,
+    }), controller.signal);
+    if (!response.ok) {
+      await awaitWithSignal(() => discardBoundedResponseBody(response), controller.signal);
+      return { response, data: null, jsonError: null };
+    }
+    try {
+      const data = await readDeviceFlowJson(response, controller.signal, "Device code response");
+      return { response, data, jsonError: null };
+    } catch (error) {
+      if (controller.signal.aborted) throw error;
+      return { response, data: null, jsonError: error };
+    }
+  } catch (error) {
+    cancelResponseBody(response);
+    if (signal?.aborted) throw abortError(signal);
+    if (controller.signal.aborted) throw abortError(controller.signal);
+    throw error;
+  } finally {
+    clearTimeout(timer);
+    signal?.removeEventListener("abort", onCallerAbort);
+  }
+}
+
+export async function pollGithubDeviceFlow({
+  deviceCode,
+  interval,
+  expiresIn,
+  fetchImpl = fetch,
+  signal,
+  sleepImpl = sleep,
+  now = Date.now,
+} = {}) {
+  const parsedInterval = Number(interval);
+  const parsedExpires = Number(expiresIn);
+  let waitMs = (Number.isFinite(parsedInterval) && parsedInterval > 0
+    ? parsedInterval
+    : DEFAULT_DEVICE_INTERVAL_SECONDS) * 1000;
+  const expiresMs = (Number.isFinite(parsedExpires) && parsedExpires > 0
+    ? parsedExpires
+    : DEFAULT_DEVICE_EXPIRES_SECONDS) * 1000;
+  const deadline = now() + expiresMs;
+
+  while (true) {
+    const remainingMs = deadline - now();
+    if (remainingMs <= 0) return { state: "expired" };
+    await sleepImpl(Math.min(waitMs, remainingMs), { signal });
+    if (signal?.aborted) throw abortError(signal);
+    if (now() >= deadline) return { state: "expired" };
+
+    const pollController = new AbortController();
+    let deadlineExpired = false;
+    const onCallerAbort = () => pollController.abort(signal.reason);
+    signal?.addEventListener("abort", onCallerAbort, { once: true });
+    if (signal?.aborted) onCallerAbort();
+    const deadlineTimer = setTimeout(() => {
+      deadlineExpired = true;
+      pollController.abort();
+    }, Math.max(1, deadline - now()));
+    let result;
+    let pollResponse;
+    try {
+      pollResponse = await fetchImpl(ACCESS_TOKEN_URL, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Accept: "application/json" },
+        body: JSON.stringify({
+          client_id: CLIENT_ID,
+          device_code: deviceCode,
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        }),
+        signal: pollController.signal,
+      });
+      if (now() >= deadline) {
+        await awaitWithSignal(() => discardBoundedResponseBody(pollResponse), pollController.signal);
+        return { state: "expired" };
+      }
+      if (!pollResponse.ok) {
+        await awaitWithSignal(() => discardBoundedResponseBody(pollResponse), pollController.signal);
+        if (now() >= deadline) return { state: "expired" };
+        continue;
+      }
+      result = interpretPoll(await readDeviceFlowJson(
+        pollResponse,
+        pollController.signal,
+        "Device Flow poll response",
+      ));
+      if (now() >= deadline) return { state: "expired" };
+    } catch (error) {
+      cancelResponseBody(pollResponse);
+      if (signal?.aborted) throw abortError(signal);
+      if (deadlineExpired || now() >= deadline) return { state: "expired" };
+      throw error;
+    } finally {
+      clearTimeout(deadlineTimer);
+      signal?.removeEventListener("abort", onCallerAbort);
+    }
+    if (result.state === "slow") {
+      waitMs += 5000;
+      continue;
+    }
+    if (result.state !== "wait") return result;
+  }
+}
 
 function expandHome(filePath, home = os.homedir()) {
   if (!filePath) return "";
@@ -465,6 +660,9 @@ export async function ensureAuth({
   signal,
   log = console.log,
   openAndCopyFn = openAndCopy,
+  deviceCodeTimeoutMs = DEFAULT_DEVICE_CODE_TIMEOUT_MS,
+  sleepImpl = sleep,
+  now = Date.now,
 } = {}) {
   const GITHUB_TOKEN_PATH = githubTokenPath(home);
   if (fs.existsSync(GITHUB_TOKEN_PATH)) {
@@ -490,74 +688,89 @@ export async function ensureAuth({
 
     // Request a device code while holding the auth lock so concurrent starts do not
     // trigger multiple browser/device-flow sessions for the same local token.
-    const codeResp = await fetchImpl("https://github.com/login/device/code", {
-      method: "POST",
-      headers: { "Content-Type": "application/json", Accept: "application/json" },
-      body: JSON.stringify({ client_id: CLIENT_ID, scope: SCOPE }),
+    const codeResult = await requestGithubDeviceCode({
+      fetchImpl,
       signal,
+      timeoutMs: deviceCodeTimeoutMs,
     });
-    if (!codeResp.ok) throw new Error(`device code request failed: ${codeResp.status}`);
-    const { device_code, user_code, verification_uri, interval } = await codeResp.json();
+    const codeResp = codeResult.response;
+    if (!codeResp.ok) {
+      throw new Error(`device code request failed: ${codeResp.status}`);
+    }
+    if (codeResult.jsonError) throw codeResult.jsonError;
+    const {
+      device_code,
+      user_code,
+      verification_uri,
+      interval,
+      expires_in,
+    } = codeResult.data;
 
     // Prompt the user.
     log(`\n${status("info", `Open ${verification_uri}`)}\n${status("info", `Enter code: ${user_code}`)}\n`);
     openAndCopyFn(user_code, verification_uri);
 
-    // Poll until GitHub completes the device flow.
-    let waitMs = (interval || 5) * 1000;
-    while (true) {
-      await sleep(waitMs);
-      const pollResp = await fetchImpl("https://github.com/login/oauth/access_token", {
-        method: "POST",
-        headers: { "Content-Type": "application/json", Accept: "application/json" },
-        body: JSON.stringify({
-          client_id: CLIENT_ID,
-          device_code,
-          grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-        }),
-        signal,
-      });
-      if (!pollResp.ok) {
-        // Treat transient network/server errors as pending and retry.
-        continue;
-      }
-      const data = await pollResp.json();
-      const r = interpretPoll(data);
-      if (r.state === "done") {
-        const identity = await fetchGithubIdentity(r.token, { fetchImpl, signal });
-        writeToken(r.token, home, identity.ok ? identity : null);
-        log(status("ok", "Login successful"));
-        return;
-      }
-      if (r.state === "slow") { waitMs += 5000; continue; }
-      if (r.state === "fail") throw new Error(`Login failed: ${r.error}`);
-      // wait: continue polling.
+    const result = await pollGithubDeviceFlow({
+      deviceCode: device_code,
+      interval,
+      expiresIn: expires_in,
+      fetchImpl,
+      signal,
+      sleepImpl,
+      now,
+    });
+    if (result.state === "done") {
+      const identity = await fetchGithubIdentity(result.token, { fetchImpl, signal });
+      writeToken(result.token, home, identity.ok ? identity : null);
+      log(status("ok", "Login successful"));
+      return;
     }
+    if (result.state === "expired") throw new Error("Login failed: device code expired");
+    throw new Error(`Login failed: ${result.error}`);
   }, tokenLockOptions(env));
 }
 
-export function writeGithubTokenMetadata(identity, home = os.homedir(), token = "") {
+function githubTokenMetadataData(identity, token, now = () => new Date()) {
   const normalized = normalizeGithubIdentity(identity);
-  if (!normalized) return false;
-  const filePath = githubTokenMetadataPath(home);
-  fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
-  fs.writeFileSync(filePath, `${JSON.stringify({
+  if (!normalized) return null;
+  const timestamp = now();
+  const updatedAt = timestamp instanceof Date ? timestamp.toISOString() : new Date(timestamp).toISOString();
+  return `${JSON.stringify({
     ...normalized,
     token_fingerprint: githubTokenFingerprint(token),
-    updated_at: new Date().toISOString(),
-  }, null, 2)}\n`, { mode: 0o600 });
+    updated_at: updatedAt,
+  }, null, 2)}\n`;
+}
+
+export function writeGithubTokenMetadata(identity, home = os.homedir(), token = "", {
+  now = () => new Date(),
+  writeFile = atomicWriteFileSync,
+} = {}) {
+  const metadata = githubTokenMetadataData(identity, token, now);
+  if (metadata === null) return false;
+  const filePath = githubTokenMetadataPath(home);
+  const directory = path.dirname(filePath);
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  fs.chmodSync(directory, 0o700);
+  writeFile(filePath, metadata, { mode: 0o600, preserveMode: false });
   fs.chmodSync(filePath, 0o600);
   return true;
 }
 
-export function writeToken(token, home = os.homedir(), identity = null) {
+export function writeToken(token, home = os.homedir(), identity = null, {
+  now = () => new Date(),
+  writeFile = atomicWriteFileSync,
+  unlinkFile = fs.unlinkSync,
+} = {}) {
   const GITHUB_TOKEN_PATH = githubTokenPath(home);
-  fs.mkdirSync(path.dirname(GITHUB_TOKEN_PATH), { recursive: true });
-  fs.writeFileSync(GITHUB_TOKEN_PATH, token, { mode: 0o600 });
-  fs.chmodSync(GITHUB_TOKEN_PATH, 0o600);
-  if (normalizeGithubIdentity(identity)) {
-    writeGithubTokenMetadata(identity, home, token);
-  } else {
-    try { fs.unlinkSync(githubTokenMetadataPath(home)); } catch (e) { if (e?.code !== "ENOENT") throw e; }
-  }
+  const directory = path.dirname(GITHUB_TOKEN_PATH);
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  fs.chmodSync(directory, 0o700);
+  atomicWriteFilePairSync(
+    GITHUB_TOKEN_PATH,
+    token,
+    githubTokenMetadataPath(home),
+    githubTokenMetadataData(identity, token, now),
+    { mode: 0o600, writeFile, unlinkFile },
+  );
 }

package/src/cli-auth.mjs

@@ -3,7 +3,8 @@ import { spawn } from "node:child_process";
 import {
   discoverGithubToken,
   fetchGithubIdentity,
-  interpretPoll,
+  pollGithubDeviceFlow,
+  requestGithubDeviceCode,
   sourceDescription,
   validateGithubToken,
 } from "./auth.mjs";
@@ -31,37 +32,6 @@ import {
   terminalCell,
 } from "./cli-table.mjs";
 
-const CLIENT_ID = "Iv1.b507a08c87ecfe98";
-const SCOPE = "read:user";
-const DEVICE_CODE_URL = "https://github.com/login/device/code";
-const ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
-const DEFAULT_DEVICE_INTERVAL_SECONDS = 5;
-const DEFAULT_DEVICE_EXPIRES_SECONDS = 900;
-
-function abortError(signal) {
-  if (signal?.reason instanceof Error) return signal.reason;
-  const error = new Error("The operation was aborted");
-  error.name = "AbortError";
-  return error;
-}
-
-function sleep(ms, { signal } = {}) {
-  if (signal?.aborted) return Promise.reject(abortError(signal));
-  return new Promise((resolve, reject) => {
-    const cleanup = () => signal?.removeEventListener("abort", onAbort);
-    const onAbort = () => {
-      clearTimeout(timer);
-      cleanup();
-      reject(abortError(signal));
-    };
-    const timer = setTimeout(() => {
-      cleanup();
-      resolve();
-    }, ms);
-    signal?.addEventListener("abort", onAbort, { once: true });
-  });
-}
-
 function openAndCopy(userCode, verificationUri) {
   if (process.platform !== "darwin") return;
   try {
@@ -80,13 +50,12 @@ function responseDetail(value) {
   return String(value || "").replace(/\s+/g, " ").trim().slice(0, 240);
 }
 
-async function jsonResponse(response, label) {
-  if (!response.ok) throw new Error(`${label} failed with HTTP ${response.status}`);
-  try {
-    return await response.json();
-  } catch {
-    throw new Error(`${label} returned invalid JSON`);
+async function jsonResponse({ response, data, jsonError }, label) {
+  if (!response.ok) {
+    throw new Error(`${label} failed with HTTP ${response.status}`);
   }
+  if (jsonError) throw new Error(`${label} returned invalid JSON`);
+  return data;
 }
 
 export async function requestDeviceFlowToken({
@@ -94,16 +63,16 @@ export async function requestDeviceFlowToken({
   signal,
   log = console.log,
   openAndCopyFn = openAndCopy,
-  sleepImpl = sleep,
+  deviceCodeTimeoutMs,
+  sleepImpl,
   now = Date.now,
 } = {}) {
-  const codeResponse = await fetchImpl(DEVICE_CODE_URL, {
-    method: "POST",
-    headers: { "Content-Type": "application/json", Accept: "application/json" },
-    body: JSON.stringify({ client_id: CLIENT_ID, scope: SCOPE }),
+  const codeResult = await requestGithubDeviceCode({
+    fetchImpl,
     signal,
+    timeoutMs: deviceCodeTimeoutMs,
   });
-  const code = await jsonResponse(codeResponse, "Device code request");
+  const code = await jsonResponse(codeResult, "Device code request");
   if (!code.device_code || !code.user_code || !code.verification_uri) {
     throw new Error("Device code response is missing required fields");
   }
@@ -111,32 +80,18 @@ export async function requestDeviceFlowToken({
   log(`\n${status("info", `Open ${code.verification_uri}`)}\n${status("info", `Enter Claude account code: ${code.user_code}`)}\n`);
   openAndCopyFn(code.user_code, code.verification_uri);
 
-  let waitMs = (Number(code.interval) || DEFAULT_DEVICE_INTERVAL_SECONDS) * 1000;
-  const expiresMs = (Number(code.expires_in) || DEFAULT_DEVICE_EXPIRES_SECONDS) * 1000;
-  const deadline = now() + expiresMs;
-
-  while (now() < deadline) {
-    await sleepImpl(waitMs, { signal });
-    const pollResponse = await fetchImpl(ACCESS_TOKEN_URL, {
-      method: "POST",
-      headers: { "Content-Type": "application/json", Accept: "application/json" },
-      body: JSON.stringify({
-        client_id: CLIENT_ID,
-        device_code: code.device_code,
-        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-      }),
-      signal,
-    });
-    if (!pollResponse.ok) continue;
-    const result = interpretPoll(await pollResponse.json());
-    if (result.state === "done") return result.token;
-    if (result.state === "slow") {
-      waitMs += 5000;
-      continue;
-    }
-    if (result.state === "fail") throw new Error(`Claude login failed: ${result.error}`);
-  }
-  throw new Error("Claude login failed: device code expired");
+  const result = await pollGithubDeviceFlow({
+    deviceCode: code.device_code,
+    interval: code.interval,
+    expiresIn: code.expires_in,
+    fetchImpl,
+    signal,
+    sleepImpl,
+    now,
+  });
+  if (result.state === "done") return result.token;
+  if (result.state === "expired") throw new Error("Claude login failed: device code expired");
+  throw new Error(`Claude login failed: ${result.error}`);
 }
 
 async function codexIdentity({ home, fetchImpl, signal }) {
@@ -249,7 +204,8 @@ export async function authorizeClaudeProfile({
   signal,
   log = console.log,
   openAndCopyFn = openAndCopy,
-  sleepImpl = sleep,
+  deviceCodeTimeoutMs,
+  sleepImpl,
   now = Date.now,
   saveModelCacheFn = saveModelCache,
 } = {}) {
@@ -302,6 +258,7 @@ export async function authorizeClaudeProfile({
         signal,
         log,
         openAndCopyFn,
+        deviceCodeTimeoutMs,
         sleepImpl,
         now,
       });

package/src/cli-options.mjs

@@ -18,6 +18,7 @@ const HELP_TOPICS = new Set([
   "pms",
   "pms setup",
   "pms status",
+  "pms restore",
   "usage",
   "auto-review-model",
   "update",
@@ -154,9 +155,9 @@ export function parseCliArgs(args = []) {
   }
   if (PM_COMMANDS.has(command)) {
     const [action, ...pmsArgs] = rest;
-    if (!action) throw new Error("Missing pms action: expected setup or status");
-    if (!new Set(["setup", "status"]).has(action)) throw new Error(`Unknown pms action: ${action}`);
-    if (action === "setup") {
+    if (!action) throw new Error("Missing pms action: expected setup, status, or restore");
+    if (!new Set(["setup", "status", "restore"]).has(action)) throw new Error(`Unknown pms action: ${action}`);
+    if (action === "setup" || action === "restore") {
       if (pmsArgs.length) unexpectedArgs(pmsArgs);
       return baseCommand("pms", { action });
     }
@@ -292,9 +293,10 @@ function topicHelp(name, topic) {
     doctor: `Usage:\n  ${name} doctor [--online] [--compat] [--profile codex|claude|all]\n\nChecks local credentials, client configuration, PM Studio state, and the adapter. --online validates account entitlement; --compat sends minimal inference requests and consumes a small amount of Copilot usage.`,
     status: `Usage:\n  ${name} status\n\nShows bounded runtime, routing, performance, cache, queue, and PM relay metrics from a running adapter.`,
     models: `Usage:\n  ${name} models [--profile codex|claude] [--format table|plain]\n\nPerforms a fresh, read-only Copilot model-directory lookup for one saved profile. Interactive terminals use a table by default.`,
-    pms: `Usage:\n  ${name} pms status [--format table|plain]\n  ${name} pms setup\n  ${name} pm-studio status [--format table|plain]\n  ${name} pm-studio setup\n\nInspects or installs the fail-closed PM Studio split-origin patch. setup modifies the installed app only after exact or semantic compatibility and source checks pass.`,
+    pms: `Usage:\n  ${name} pms status [--format table|plain]\n  ${name} pms setup\n  ${name} pms restore\n  ${name} pm-studio status [--format table|plain]\n  ${name} pm-studio setup\n  ${name} pm-studio restore\n\nInspects, installs, or restores the fail-closed PM Studio split-origin patch. setup and restore modify the installed app only after source-bound compatibility and backup checks pass.`,
     "pms setup": `Usage:\n  ${name} pms setup\n\nBacks up, patches, verifies, and ad-hoc signs an exact or structurally compatible PM Studio bundle. Unverifiable versions and drift are never modified.`,
     "pms status": `Usage:\n  ${name} pms status [--format table|plain]\n\nRead-only inspection of the installed PM Studio version, patch integrity, Claude profile, and relay availability. Interactive terminals use a table by default.`,
+    "pms restore": `Usage:\n  ${name} pms restore\n\nRestores the installed PM Studio bundle from its exact source-bound verified backup. The explicit command authorizes the change; no confirmation prompt is shown. Missing, ambiguous, version-mismatched, or drifted records are never restored.`,
     usage: `Usage:\n  ${name} usage [--format table|plain]\n\nSummarizes local token usage metadata without reading prompt or completion content. Interactive terminals use a table by default.`,
     "auto-review-model": `Usage:\n  ${name} auto-review-model\n\nInteractively selects an enabled Responses model for Codex Auto-review.`,
     update: `Usage:\n  ${name} update [npm|github]\n\nUpdates the global package from the configured npm registry or GitHub main. With no source, an interactive terminal prompts for one.`,
@@ -316,6 +318,7 @@ export function cliHelp(commandName = "ccdx", topic = "") {
   ${name} models [--profile codex|claude] [--format table|plain]
   ${name} pms status [--format table|plain]
   ${name} pms setup
+  ${name} pms restore
   ${name} usage [--format table|plain]
   ${name} auto-review-model
   ${name} update [npm|github]
@@ -328,7 +331,7 @@ Commands:
   doctor             Diagnose local config; optional live and inference checks
   status             Show runtime routing, performance, queue, and cache health
   models             Query a saved account's live Copilot model catalog
-  pms, pm-studio     Inspect or install the PM Studio patch
+  pms, pm-studio     Inspect, install, or restore the PM Studio patch
   usage              Summarize locally recorded token usage
   auto-review-model  Select the Codex Auto-review Responses model
   update             Update the global package from npm or GitHub

package/src/copilot-client.mjs

@@ -1,4 +1,5 @@
 import { createCopilotTokenSession } from "./copilot-token-session.mjs";
+import { MAX_UPSTREAM_MODEL_CATALOG_BYTES, readBoundedResponseText } from "./http-transport.mjs";
 import { prepareResponsesPayload, summarizeReqBody } from "./image-optimization.mjs";
 import { debugLog } from "./log.mjs";
 import { enforceResponsesPayloadByteBudget } from "./responses-byte-budget.mjs";
@@ -117,7 +118,10 @@ export function createCopilotClientRuntime({
       headers,
       signal,
     }, { fetchImpl, ...retryOptions });
-    const body = await response.text();
+    const body = await readBoundedResponseText(response, {
+      maxBytes: MAX_UPSTREAM_MODEL_CATALOG_BYTES,
+      label: "Copilot model catalog",
+    });
     if (response.ok) {
       try { cacheModelEndpoints(JSON.parse(body)); } catch {}
     }

package/src/copilot-responses-compat.mjs

@@ -4,7 +4,11 @@ import {
   isImageNamespaceCollisionError,
   sanitizeImageNamespaceCollisionRequest,
 } from "./copilot-responses-policy.mjs";
-import { httpError } from "./http-transport.mjs";
+import {
+  httpError,
+  MAX_UPSTREAM_ERROR_BODY_BYTES,
+  readBoundedResponseText,
+} from "./http-transport.mjs";
 import {
   finalizeEncryptedHistoryRebase,
   sanitizeEncryptedReasoningRequest,
@@ -48,7 +52,10 @@ export async function openCopilotResponse(reqContext, upstream = copilotResponse
       return { resp, reqContext };
     }
 
-    const errorText = await resp.text();
+    const errorText = await readBoundedResponseText(resp, {
+      maxBytes: MAX_UPSTREAM_ERROR_BODY_BYTES,
+      label: "Copilot Responses error body",
+    });
     options.assertPrepareActive?.();
     let retryPolicy = null;
     let retryContext = null;

package/src/copilot.mjs

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import { status } from "./status.mjs";
 import { debugLog } from "./log.mjs";
 import { createCopilotClientRuntime } from "./copilot-client.mjs";
+import { discardBoundedResponseBody } from "./http-transport.mjs";
 
 export {
   optimizeImageDataUrl,
@@ -156,7 +157,7 @@ export async function fetchCopilotUpstream(
       const resp = await fetchImpl(url, init);
       debugLog(`upstream ${method} ${target} status=${resp.status} attempt=${attempt + 1}/${retryCount + 1} attempt_ms=${Date.now() - attemptStart} total_ms=${Date.now() - totalStart}`);
       if (attempt < retryCount && isRetryableUpstreamStatus(resp.status, method)) {
-        await resp.arrayBuffer?.().catch(() => {});
+        await discardBoundedResponseBody(resp);
         const delay = upstreamRetryDelay(attempt, baseDelay);
         console.warn(status("warn", `upstream ${target} returned ${resp.status}; retry ${attempt + 1}/${retryCount} in ${delay}ms`));
         await sleep(delay, { signal });