codex-copilot-dx 0.6.15 → 0.6.19

package/src/cli-error.mjs

@@ -0,0 +1,44 @@
+import { terminalCell } from "./cli-table.mjs";
+import { status } from "./status.mjs";
+
+const MAX_MESSAGE_CHARACTERS = 1024;
+const MAX_DETAIL_CHARACTERS = 512;
+const MAX_DETAILS = 16;
+
+function redactSensitiveValues(value) {
+  return value
+    .replace(/\b(authorization\s*[:=]\s*)(?:bearer\s+)?[^\s,;]+/gi, "$1[REDACTED]")
+    .replace(/\bbearer\s+[^\s,;]+/gi, "Bearer [REDACTED]")
+    .replace(/\b((?:api[-_ ]?key|access[-_ ]?token|refresh[-_ ]?token|password|secret)\s*[:=]\s*)[^\s,;]+/gi, "$1[REDACTED]")
+    .replace(/\b(?:github_pat_[A-Za-z0-9_]{8,}|gh[pousr]_[A-Za-z0-9_]{8,}|sk-[A-Za-z0-9_-]{8,})\b/g, "[REDACTED]");
+}
+
+function boundedTerminalText(value, fallback, maxCharacters) {
+  try {
+    return redactSensitiveValues(terminalCell(value, { fallback })).slice(0, maxCharacters);
+  } catch {
+    return fallback;
+  }
+}
+
+export function formatCliError(error) {
+  const message = boundedTerminalText(error?.message, "Command failed", MAX_MESSAGE_CHARACTERS);
+  let details;
+  try {
+    details = error?.details;
+  } catch {
+    details = undefined;
+  }
+  const values = details === undefined
+    ? []
+    : Array.isArray(details) ? details : [details];
+  const visible = values.slice(0, MAX_DETAILS);
+  const lines = [status("err", message)];
+  for (const detail of visible) {
+    lines.push(status("info", boundedTerminalText(detail, "Detail unavailable", MAX_DETAIL_CHARACTERS)));
+  }
+  if (values.length > visible.length) {
+    lines.push(status("info", `${values.length - visible.length} additional detail(s) omitted`));
+  }
+  return lines.join("\n");
+}

package/src/cli-options.mjs

@@ -18,6 +18,7 @@ const HELP_TOPICS = new Set([
   "pms",
   "pms setup",
   "pms status",
+  "pms restore",
   "usage",
   "auto-review-model",
   "update",
@@ -154,9 +155,9 @@ export function parseCliArgs(args = []) {
   }
   if (PM_COMMANDS.has(command)) {
     const [action, ...pmsArgs] = rest;
-    if (!action) throw new Error("Missing pms action: expected setup or status");
-    if (!new Set(["setup", "status"]).has(action)) throw new Error(`Unknown pms action: ${action}`);
-    if (action === "setup") {
+    if (!action) throw new Error("Missing pms action: expected setup, status, or restore");
+    if (!new Set(["setup", "status", "restore"]).has(action)) throw new Error(`Unknown pms action: ${action}`);
+    if (action === "setup" || action === "restore") {
       if (pmsArgs.length) unexpectedArgs(pmsArgs);
       return baseCommand("pms", { action });
     }
@@ -292,9 +293,10 @@ function topicHelp(name, topic) {
     doctor: `Usage:\n  ${name} doctor [--online] [--compat] [--profile codex|claude|all]\n\nChecks local credentials, client configuration, PM Studio state, and the adapter. --online validates account entitlement; --compat sends minimal inference requests and consumes a small amount of Copilot usage.`,
     status: `Usage:\n  ${name} status\n\nShows bounded runtime, routing, performance, cache, queue, and PM relay metrics from a running adapter.`,
     models: `Usage:\n  ${name} models [--profile codex|claude] [--format table|plain]\n\nPerforms a fresh, read-only Copilot model-directory lookup for one saved profile. Interactive terminals use a table by default.`,
-    pms: `Usage:\n  ${name} pms status [--format table|plain]\n  ${name} pms setup\n  ${name} pm-studio status [--format table|plain]\n  ${name} pm-studio setup\n\nInspects or installs the fail-closed PM Studio split-origin patch. setup modifies the installed app only after exact or semantic compatibility and source checks pass.`,
+    pms: `Usage:\n  ${name} pms status [--format table|plain]\n  ${name} pms setup\n  ${name} pms restore\n  ${name} pm-studio status [--format table|plain]\n  ${name} pm-studio setup\n  ${name} pm-studio restore\n\nInspects, installs, or restores the fail-closed PM Studio split-origin patch. setup and restore modify the installed app only after source-bound compatibility and backup checks pass.`,
     "pms setup": `Usage:\n  ${name} pms setup\n\nBacks up, patches, verifies, and ad-hoc signs an exact or structurally compatible PM Studio bundle. Unverifiable versions and drift are never modified.`,
     "pms status": `Usage:\n  ${name} pms status [--format table|plain]\n\nRead-only inspection of the installed PM Studio version, patch integrity, Claude profile, and relay availability. Interactive terminals use a table by default.`,
+    "pms restore": `Usage:\n  ${name} pms restore\n\nRestores the installed PM Studio bundle from its exact source-bound verified backup. The explicit command authorizes the change; no confirmation prompt is shown. Missing, ambiguous, version-mismatched, or drifted records are never restored.`,
     usage: `Usage:\n  ${name} usage [--format table|plain]\n\nSummarizes local token usage metadata without reading prompt or completion content. Interactive terminals use a table by default.`,
     "auto-review-model": `Usage:\n  ${name} auto-review-model\n\nInteractively selects an enabled Responses model for Codex Auto-review.`,
     update: `Usage:\n  ${name} update [npm|github]\n\nUpdates the global package from the configured npm registry or GitHub main. With no source, an interactive terminal prompts for one.`,
@@ -316,6 +318,7 @@ export function cliHelp(commandName = "ccdx", topic = "") {
   ${name} models [--profile codex|claude] [--format table|plain]
   ${name} pms status [--format table|plain]
   ${name} pms setup
+  ${name} pms restore
   ${name} usage [--format table|plain]
   ${name} auto-review-model
   ${name} update [npm|github]
@@ -328,7 +331,7 @@ Commands:
   doctor             Diagnose local config; optional live and inference checks
   status             Show runtime routing, performance, queue, and cache health
   models             Query a saved account's live Copilot model catalog
-  pms, pm-studio     Inspect or install the PM Studio patch
+  pms, pm-studio     Inspect, install, or restore the PM Studio patch
   usage              Summarize locally recorded token usage
   auto-review-model  Select the Codex Auto-review Responses model
   update             Update the global package from npm or GitHub

package/src/copilot-client.mjs

@@ -1,4 +1,5 @@
 import { createCopilotTokenSession } from "./copilot-token-session.mjs";
+import { MAX_UPSTREAM_MODEL_CATALOG_BYTES, readBoundedResponseText } from "./http-transport.mjs";
 import { prepareResponsesPayload, summarizeReqBody } from "./image-optimization.mjs";
 import { debugLog } from "./log.mjs";
 import { enforceResponsesPayloadByteBudget } from "./responses-byte-budget.mjs";
@@ -117,7 +118,10 @@ export function createCopilotClientRuntime({
       headers,
       signal,
     }, { fetchImpl, ...retryOptions });
-    const body = await response.text();
+    const body = await readBoundedResponseText(response, {
+      maxBytes: MAX_UPSTREAM_MODEL_CATALOG_BYTES,
+      label: "Copilot model catalog",
+    });
     if (response.ok) {
       try { cacheModelEndpoints(JSON.parse(body)); } catch {}
     }

package/src/copilot-responses-compat.mjs

@@ -4,7 +4,11 @@ import {
   isImageNamespaceCollisionError,
   sanitizeImageNamespaceCollisionRequest,
 } from "./copilot-responses-policy.mjs";
-import { httpError } from "./http-transport.mjs";
+import {
+  httpError,
+  MAX_UPSTREAM_ERROR_BODY_BYTES,
+  readBoundedResponseText,
+} from "./http-transport.mjs";
 import {
   finalizeEncryptedHistoryRebase,
   sanitizeEncryptedReasoningRequest,
@@ -48,7 +52,10 @@ export async function openCopilotResponse(reqContext, upstream = copilotResponse
       return { resp, reqContext };
     }
 
-    const errorText = await resp.text();
+    const errorText = await readBoundedResponseText(resp, {
+      maxBytes: MAX_UPSTREAM_ERROR_BODY_BYTES,
+      label: "Copilot Responses error body",
+    });
     options.assertPrepareActive?.();
     let retryPolicy = null;
     let retryContext = null;

package/src/copilot.mjs

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import { status } from "./status.mjs";
 import { debugLog } from "./log.mjs";
 import { createCopilotClientRuntime } from "./copilot-client.mjs";
+import { discardBoundedResponseBody } from "./http-transport.mjs";
 
 export {
   optimizeImageDataUrl,
@@ -156,7 +157,7 @@ export async function fetchCopilotUpstream(
       const resp = await fetchImpl(url, init);
       debugLog(`upstream ${method} ${target} status=${resp.status} attempt=${attempt + 1}/${retryCount + 1} attempt_ms=${Date.now() - attemptStart} total_ms=${Date.now() - totalStart}`);
       if (attempt < retryCount && isRetryableUpstreamStatus(resp.status, method)) {
-        await resp.arrayBuffer?.().catch(() => {});
+        await discardBoundedResponseBody(resp);
         const delay = upstreamRetryDelay(attempt, baseDelay);
         console.warn(status("warn", `upstream ${target} returned ${resp.status}; retry ${attempt + 1}/${retryCount} in ${delay}ms`));
         await sleep(delay, { signal });

package/src/http-transport.mjs

@@ -17,12 +17,150 @@ const MAX_INFLIGHT_BODY_BYTES = HTTP_RUNTIME_CONFIG.maxInflightBodyBytes;
 const MAX_QUEUED_REQUESTS = HTTP_RUNTIME_CONFIG.maxQueuedRequests;
 const REQUEST_QUEUE_TIMEOUT_MS = HTTP_RUNTIME_CONFIG.requestQueueTimeoutMs;
 
+export const MAX_UPSTREAM_ERROR_BODY_BYTES = 1024 * 1024;
+export const MAX_UPSTREAM_MODEL_CATALOG_BYTES = 8 * 1024 * 1024;
+export const MAX_UPSTREAM_RETRY_DRAIN_BYTES = 64 * 1024;
+export const MAX_UPSTREAM_CHAT_SUCCESS_BODY_BYTES = HTTP_RUNTIME_CONFIG.maxUpstreamChatResponseBytes;
+export const MAX_UPSTREAM_RESPONSES_SUCCESS_BODY_BYTES = HTTP_RUNTIME_CONFIG.maxUpstreamResponsesResponseBytes;
+
 export function httpError(message, statusCode) {
   const err = new Error(message);
   err.statusCode = statusCode;
   return err;
 }
 
+function upstreamBodyTooLarge(label, maxBytes) {
+  const error = httpError(`${label} exceeds ${maxBytes} bytes`, 502);
+  error.code = "ccdx_upstream_response_too_large";
+  error.jsonBody = {
+    error: {
+      message: error.message,
+      type: "upstream_error",
+      code: error.code,
+    },
+  };
+  return error;
+}
+
+function unreadableUpstreamBody(label) {
+  const error = httpError(`${label} is not a readable web stream`, 502);
+  error.code = "ccdx_upstream_response_unreadable";
+  error.jsonBody = {
+    error: {
+      message: error.message,
+      type: "upstream_error",
+      code: error.code,
+    },
+  };
+  return error;
+}
+
+async function cancelResponseBody(response) {
+  try { await response?.body?.cancel?.(); } catch {}
+}
+
+function responseAbortError(signal) {
+  if (signal?.reason instanceof Error) return signal.reason;
+  const error = new Error("The operation was aborted");
+  error.name = "AbortError";
+  return error;
+}
+
+function readResponseChunk(reader, signal) {
+  if (!signal) return reader.read();
+  if (signal.aborted) return Promise.reject(responseAbortError(signal));
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const finish = (callback, value) => {
+      if (settled) return;
+      settled = true;
+      signal.removeEventListener("abort", onAbort);
+      callback(value);
+    };
+    const onAbort = () => {
+      const error = responseAbortError(signal);
+      try { Promise.resolve(reader.cancel(error)).catch(() => {}); } catch {}
+      finish(reject, error);
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    reader.read().then(
+      (value) => finish(resolve, value),
+      (error) => finish(reject, error),
+    );
+  });
+}
+
+function responseContentLength(response) {
+  const raw = response?.headers?.get?.("content-length")
+    ?? response?.headers?.["content-length"]
+    ?? response?.headers?.["Content-Length"];
+  const parsed = Number.parseInt(raw || "", 10);
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : null;
+}
+
+export async function readBoundedResponseBuffer(response, {
+  maxBytes,
+  label = "Upstream response body",
+  signal,
+} = {}) {
+  const limit = Number.isFinite(maxBytes) && maxBytes >= 0 ? Math.floor(maxBytes) : 0;
+  if (signal?.aborted) {
+    cancelResponseBody(response);
+    throw responseAbortError(signal);
+  }
+  if (responseContentLength(response) > limit) {
+    await cancelResponseBody(response);
+    throw upstreamBodyTooLarge(label, limit);
+  }
+  if (!response?.body) {
+    if (typeof response?.text === "function") {
+      const buffer = Buffer.from(await response.text());
+      if (buffer.length > limit) throw upstreamBodyTooLarge(label, limit);
+      return buffer;
+    }
+    if ((responseContentLength(response) || 0) > 0) throw unreadableUpstreamBody(label);
+    return Buffer.alloc(0);
+  }
+  const reader = response?.body?.getReader?.();
+  if (!reader) throw unreadableUpstreamBody(label);
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      const { done, value } = await readResponseChunk(reader, signal);
+      if (done) break;
+      const chunk = Buffer.from(value);
+      total += chunk.length;
+      if (total > limit) {
+        await reader.cancel().catch(() => {});
+        throw upstreamBodyTooLarge(label, limit);
+      }
+      chunks.push(chunk);
+    }
+    return Buffer.concat(chunks, total);
+  } finally {
+    try {
+      reader.releaseLock();
+    } catch (error) {
+      if (!signal?.aborted) throw error;
+    }
+  }
+}
+
+export async function readBoundedResponseText(response, options) {
+  return new TextDecoder().decode(await readBoundedResponseBuffer(response, options));
+}
+
+export async function discardBoundedResponseBody(response, maxBytes = MAX_UPSTREAM_RETRY_DRAIN_BYTES) {
+  try {
+    await readBoundedResponseBuffer(response, { maxBytes, label: "Upstream retry response body" });
+    return true;
+  } catch {
+    await cancelResponseBody(response);
+    return false;
+  }
+}
+
 function payloadTooLarge(kind, maxBytes) {
   return httpError(`${kind} request body exceeds ${maxBytes} bytes`, 413);
 }

package/src/lock.mjs

@@ -32,23 +32,191 @@ function processIsAlive(pid) {
   }
 }
 
+function readStaleLockSnapshot(lockPath, io) {
+  const before = io.lstatSync(lockPath);
+  if (!before.isFile() || before.isSymbolicLink()) return { safe: false };
+
+  const noFollow = io.constants?.O_NOFOLLOW || 0;
+  let fd;
+  try {
+    fd = io.openSync(lockPath, io.constants.O_RDONLY | noFollow);
+    const opened = io.fstatSync(fd);
+    if (!opened.isFile()
+      || opened.dev !== before.dev
+      || opened.ino !== before.ino
+      || opened.size !== before.size) {
+      return { safe: false };
+    }
+    const text = io.readFileSync(fd, "utf8");
+    const after = io.fstatSync(fd);
+    if (after.dev !== opened.dev
+      || after.ino !== opened.ino
+      || after.size !== opened.size
+      || after.mtimeMs !== opened.mtimeMs
+      || after.ctimeMs !== opened.ctimeMs) {
+      return { safe: false };
+    }
+    let record = {};
+    try {
+      record = JSON.parse(text);
+    } catch {}
+    return {
+      safe: true,
+      dev: after.dev,
+      ino: after.ino,
+      mtimeMs: after.mtimeMs,
+      size: after.size,
+      text,
+      pid: Number(record?.pid),
+      owner: typeof record?.owner === "string" ? record.owner : "",
+    };
+  } finally {
+    if (fd !== undefined) io.closeSync(fd);
+  }
+}
+
 function sameLock(left, right) {
   return left.dev === right.dev
     && left.ino === right.ino
     && left.mtimeMs === right.mtimeMs
     && left.size === right.size
-    && left.owner === right.owner;
+    && left.owner === right.owner
+    && left.text === right.text;
 }
 
-function maybeRemoveStaleLock(lockPath, staleMs, nowMs) {
-  if (!Number.isFinite(staleMs) || staleMs <= 0) return false;
+function lockPathExists(lockPath, io) {
+  try {
+    io.lstatSync(lockPath);
+    return true;
+  } catch (error) {
+    if (error?.code === "ENOENT") return false;
+    throw error;
+  }
+}
+
+function writeLockRecord(lockPath, record, io) {
+  const fd = io.openSync(lockPath, "wx", 0o600);
+  try {
+    io.writeFileSync(fd, JSON.stringify(record));
+  } catch (error) {
+    io.closeSync(fd);
+    try { io.unlinkSync(lockPath); } catch {}
+    throw error;
+  }
+  return fd;
+}
+
+function removeOwnedLock(lockPath, owner, io) {
+  try {
+    const snapshot = readStaleLockSnapshot(lockPath, io);
+    if (snapshot.safe && snapshot.owner === owner) io.unlinkSync(lockPath);
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw error;
+  }
+}
+
+function reclaimGuardPath(lockPath) {
+  return `${lockPath}.reclaim`;
+}
+
+function acquireReclaimGuard(lockPath, io) {
+  const guardPath = reclaimGuardPath(lockPath);
+  const owner = randomUUID();
+  let fd;
+  try {
+    fd = writeLockRecord(guardPath, {
+      pid: process.pid,
+      owner,
+      created_at: new Date().toISOString(),
+    }, io);
+    io.closeSync(fd);
+    return { guardPath, owner };
+  } catch (error) {
+    if (fd !== undefined) try { io.closeSync(fd); } catch {}
+    if (error?.code === "EEXIST") return null;
+    throw error;
+  }
+}
+
+function maybeRemoveAbandonedGuard(guardPath, staleMs, nowMs, io, processAlive) {
+  try {
+    const snapshot = readStaleLockSnapshot(guardPath, io);
+    if (!snapshot.safe || nowMs - snapshot.mtimeMs <= staleMs || processAlive(snapshot.pid)) return false;
+    const quarantinePath = `${guardPath}.stale-${randomUUID()}`;
+    io.renameSync(guardPath, quarantinePath);
+    const moved = readStaleLockSnapshot(quarantinePath, io);
+    if (!moved.safe || !sameLock(snapshot, moved)) {
+      restoreQuarantinedLock(guardPath, quarantinePath, io);
+      return false;
+    }
+    try {
+      io.unlinkSync(quarantinePath);
+      return true;
+    } catch {
+      return recoverQuarantineUnlinkFailure(guardPath, quarantinePath, snapshot, io);
+    }
+  } catch (error) {
+    return error?.code === "ENOENT";
+  }
+}
+
+function restoreQuarantinedLock(lockPath, quarantinePath, io) {
+  try {
+    io.linkSync(quarantinePath, lockPath);
+  } catch {
+    return;
+  }
   try {
-    const first = readLockSnapshot(lockPath);
-    if (nowMs - first.mtimeMs <= staleMs || processIsAlive(first.pid)) return false;
-    const current = readLockSnapshot(lockPath);
-    if (!sameLock(first, current)) return false;
-    fs.unlinkSync(lockPath);
+    io.unlinkSync(quarantinePath);
+  } catch {}
+}
+
+function recoverQuarantineUnlinkFailure(lockPath, quarantinePath, snapshot, io) {
+  restoreQuarantinedLock(lockPath, quarantinePath, io);
+  try {
+    const restored = readStaleLockSnapshot(lockPath, io);
+    if (!restored.safe || !sameLock(snapshot, restored)) return false;
+    io.unlinkSync(lockPath);
     return true;
+  } catch (error) {
+    return error?.code === "ENOENT";
+  }
+}
+
+function maybeRemoveStaleLock(lockPath, staleMs, nowMs, io, processAlive) {
+  if (!Number.isFinite(staleMs) || staleMs <= 0) return false;
+  try {
+    const first = readStaleLockSnapshot(lockPath, io);
+    if (!first.safe || nowMs - first.mtimeMs <= staleMs || processAlive(first.pid)) return false;
+    const guard = acquireReclaimGuard(lockPath, io);
+    if (!guard) return false;
+    try {
+      const current = readStaleLockSnapshot(lockPath, io);
+      if (!sameLock(first, current)
+        || nowMs - current.mtimeMs <= staleMs
+        || processAlive(current.pid)) {
+        return false;
+      }
+      const quarantinePath = `${lockPath}.stale-${randomUUID()}`;
+      try {
+        io.renameSync(lockPath, quarantinePath);
+      } catch (e) {
+        return e?.code === "ENOENT";
+      }
+      const moved = readStaleLockSnapshot(quarantinePath, io);
+      if (!moved.safe || !sameLock(current, moved)) {
+        restoreQuarantinedLock(lockPath, quarantinePath, io);
+        return false;
+      }
+      try {
+        io.unlinkSync(quarantinePath);
+        return true;
+      } catch {
+        return recoverQuarantineUnlinkFailure(lockPath, quarantinePath, current, io);
+      }
+    } finally {
+      removeOwnedLock(guard.guardPath, guard.owner, io);
+    }
   } catch (e) {
     if (e?.code === "ENOENT") return true;
     return false;
@@ -60,28 +228,42 @@ export async function withFileLock(lockPath, fn, {
   staleMs = 15 * 60 * 1000,
   pollMs = 50,
   now = Date.now,
+  fsImpl = fs,
+  processAlive = processIsAlive,
 } = {}) {
   fs.mkdirSync(path.dirname(lockPath), { recursive: true });
   const started = now();
   const owner = randomUUID();
   let fd = null;
+  const guardPath = reclaimGuardPath(lockPath);
 
   while (fd === null) {
+    const beforeAcquire = now();
+    if (lockPathExists(guardPath, fsImpl)) {
+      maybeRemoveAbandonedGuard(guardPath, staleMs, beforeAcquire, fsImpl, processAlive);
+      if (lockPathExists(guardPath, fsImpl)) {
+        if (beforeAcquire - started >= timeoutMs) throw new Error(`Timed out waiting for lock: ${lockPath}`);
+        await sleep(Math.min(pollMs, Math.max(1, timeoutMs - (beforeAcquire - started))));
+        continue;
+      }
+    }
     try {
-      const candidateFd = fs.openSync(lockPath, "wx", 0o600);
-      try {
-        fs.writeFileSync(candidateFd, JSON.stringify({ pid: process.pid, owner, created_at: new Date().toISOString() }));
-        fd = candidateFd;
-      } catch (e) {
-        fs.closeSync(candidateFd);
-        try { fs.unlinkSync(lockPath); } catch {}
-        throw e;
+      fd = writeLockRecord(lockPath, {
+        pid: process.pid,
+        owner,
+        created_at: new Date().toISOString(),
+      }, fs);
+      if (lockPathExists(guardPath, fsImpl)) {
+        fs.closeSync(fd);
+        fd = null;
+        removeOwnedLock(lockPath, owner, fs);
+        continue;
       }
       break;
     } catch (e) {
       if (e?.code !== "EEXIST") throw e;
       const nowMs = now();
-      if (maybeRemoveStaleLock(lockPath, staleMs, nowMs)) continue;
+      if (maybeRemoveStaleLock(lockPath, staleMs, nowMs, fsImpl, processAlive)) continue;
       if (nowMs - started >= timeoutMs) {
         throw new Error(`Timed out waiting for lock: ${lockPath}`);
       }

package/src/models.mjs

@@ -117,6 +117,23 @@ export function modelIsResponsesOnly(model) {
   return hasResponses && !endpoints.includes("/chat/completions");
 }
 
+export function resolveCopilotPriorityTierModel(model, serviceTier, models) {
+  const baseModel = String(model || "").trim();
+  if (baseModel !== "gpt-5.6-sol" || serviceTier !== "priority") return null;
+  const fastModelId = "gpt-5.6-sol-fast";
+  const fastModel = copilotModelData(models)
+    .find((entry) => String(entry?.id || "").trim() === fastModelId);
+  const vendor = String(fastModel?.vendor || fastModel?.owned_by || "").trim().toLowerCase();
+  const policy = String(fastModel?.policy?.state || "").trim().toLowerCase();
+  if (vendor !== "openai"
+    || policy !== "enabled"
+    || fastModel?.model_picker_enabled !== true
+    || !modelIsResponsesOnly(fastModel)) {
+    return null;
+  }
+  return fastModelId;
+}
+
 function copilotModelData(models) {
   const data = Array.isArray(models) ? models : models?.data;
   return Array.isArray(data) ? data : [];