codex-copilot-dx 0.6.18 → 0.6.20

package/src/copilot.mjs

@@ -33,9 +33,28 @@ export function parseUpstreamRetryDelayMs(value) {
 }
 
 export function parseApiBase(data) {
-  return (data && data.endpoints && typeof data.endpoints.api === "string" && data.endpoints.api)
-    ? data.endpoints.api
-    : DEFAULT_API_BASE;
+  const configured = data?.endpoints?.api;
+  if (typeof configured !== "string" || !configured.trim()) return DEFAULT_API_BASE;
+  let parsed;
+  try {
+    parsed = new URL(configured.trim());
+  } catch {
+    throw Object.assign(new Error("Copilot API endpoint is invalid"), {
+      code: "CCDX_INVALID_COPILOT_API_ENDPOINT",
+    });
+  }
+  if (parsed.protocol !== "https:"
+    || !parsed.hostname
+    || parsed.username
+    || parsed.password
+    || parsed.search
+    || parsed.hash) {
+    throw Object.assign(new Error("Copilot API endpoint is invalid"), {
+      code: "CCDX_INVALID_COPILOT_API_ENDPOINT",
+    });
+  }
+  const pathname = parsed.pathname.replace(/\/+$/, "");
+  return `${parsed.origin}${pathname && pathname !== "/" ? pathname : ""}`;
 }
 
 export function responsesEndpointPath() {

package/src/doctor.mjs

@@ -10,7 +10,7 @@ import {
 } from "./auth-profile.mjs";
 import { claudeDesktopPaths } from "./claude-desktop-config.mjs";
 import { status } from "./status.mjs";
-import { buildHeaders, DEFAULT_API_BASE, FALLBACK_VSCODE_VERSION } from "./copilot.mjs";
+import { buildHeaders, FALLBACK_VSCODE_VERSION, parseApiBase } from "./copilot.mjs";
 import { adapterBaseUrl, checkRunningAdapter } from "./running-adapter.mjs";
 import { CODEX_AUTO_REVIEW_MODEL, isClaudeCopilotModel } from "./models.mjs";
 import { loadModelCache } from "./model-cache.mjs";
@@ -322,7 +322,7 @@ export async function inspectGitHubTokenOnline({
     }
 
     const tokenData = validation.copilotTokenData;
-    const apiBase = tokenData.endpoints?.api || DEFAULT_API_BASE;
+    const apiBase = parseApiBase(tokenData);
     const headers = buildHeaders({
       token: tokenData.token,
       version: FALLBACK_VSCODE_VERSION,

package/src/http-transport.mjs

@@ -20,6 +20,8 @@ const REQUEST_QUEUE_TIMEOUT_MS = HTTP_RUNTIME_CONFIG.requestQueueTimeoutMs;
 export const MAX_UPSTREAM_ERROR_BODY_BYTES = 1024 * 1024;
 export const MAX_UPSTREAM_MODEL_CATALOG_BYTES = 8 * 1024 * 1024;
 export const MAX_UPSTREAM_RETRY_DRAIN_BYTES = 64 * 1024;
+export const MAX_UPSTREAM_CHAT_SUCCESS_BODY_BYTES = HTTP_RUNTIME_CONFIG.maxUpstreamChatResponseBytes;
+export const MAX_UPSTREAM_RESPONSES_SUCCESS_BODY_BYTES = HTTP_RUNTIME_CONFIG.maxUpstreamResponsesResponseBytes;
 
 export function httpError(message, statusCode) {
   const err = new Error(message);
@@ -57,6 +59,37 @@ async function cancelResponseBody(response) {
   try { await response?.body?.cancel?.(); } catch {}
 }
 
+function responseAbortError(signal) {
+  if (signal?.reason instanceof Error) return signal.reason;
+  const error = new Error("The operation was aborted");
+  error.name = "AbortError";
+  return error;
+}
+
+function readResponseChunk(reader, signal) {
+  if (!signal) return reader.read();
+  if (signal.aborted) return Promise.reject(responseAbortError(signal));
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const finish = (callback, value) => {
+      if (settled) return;
+      settled = true;
+      signal.removeEventListener("abort", onAbort);
+      callback(value);
+    };
+    const onAbort = () => {
+      const error = responseAbortError(signal);
+      try { Promise.resolve(reader.cancel(error)).catch(() => {}); } catch {}
+      finish(reject, error);
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    reader.read().then(
+      (value) => finish(resolve, value),
+      (error) => finish(reject, error),
+    );
+  });
+}
+
 function responseContentLength(response) {
   const raw = response?.headers?.get?.("content-length")
     ?? response?.headers?.["content-length"]
@@ -68,13 +101,23 @@ function responseContentLength(response) {
 export async function readBoundedResponseBuffer(response, {
   maxBytes,
   label = "Upstream response body",
+  signal,
 } = {}) {
   const limit = Number.isFinite(maxBytes) && maxBytes >= 0 ? Math.floor(maxBytes) : 0;
+  if (signal?.aborted) {
+    cancelResponseBody(response);
+    throw responseAbortError(signal);
+  }
   if (responseContentLength(response) > limit) {
     await cancelResponseBody(response);
     throw upstreamBodyTooLarge(label, limit);
   }
   if (!response?.body) {
+    if (typeof response?.text === "function") {
+      const buffer = Buffer.from(await response.text());
+      if (buffer.length > limit) throw upstreamBodyTooLarge(label, limit);
+      return buffer;
+    }
     if ((responseContentLength(response) || 0) > 0) throw unreadableUpstreamBody(label);
     return Buffer.alloc(0);
   }
@@ -84,7 +127,7 @@ export async function readBoundedResponseBuffer(response, {
   let total = 0;
   try {
     while (true) {
-      const { done, value } = await reader.read();
+      const { done, value } = await readResponseChunk(reader, signal);
       if (done) break;
       const chunk = Buffer.from(value);
       total += chunk.length;
@@ -96,7 +139,11 @@ export async function readBoundedResponseBuffer(response, {
     }
     return Buffer.concat(chunks, total);
   } finally {
-    reader.releaseLock();
+    try {
+      reader.releaseLock();
+    } catch (error) {
+      if (!signal?.aborted) throw error;
+    }
   }
 }
 
@@ -360,6 +407,9 @@ export function createRequestAdmission({
         continue;
       }
       if (activeBytes + entry.weight > byteLimit) {
+        // Unknown-length requests reserve the whole budget. Once one is waiting,
+        // do not let later arrivals keep extending its wait indefinitely.
+        if (entry.weight === byteLimit) break;
         index += 1;
         continue;
       }
@@ -375,11 +425,13 @@ export function createRequestAdmission({
       return Promise.reject(admissionAbortError(signal));
     }
     const weight = requestAdmissionWeight(req, byteLimit);
-    if (queue.length >= queueLimit && activeBytes + weight > byteLimit) {
+    const blockedByExclusive = queue.some((entry) => !entry.cancelled && entry.weight === byteLimit);
+    const mustWait = blockedByExclusive || activeBytes + weight > byteLimit;
+    if (queue.length >= queueLimit && mustWait) {
       counters.rejected += 1;
       return Promise.reject(httpError(`Request queue is full (${queueLimit} waiting)`, 503));
     }
-    if (activeBytes + weight > byteLimit) counters.queued += 1;
+    if (mustWait) counters.queued += 1;
 
     return new Promise((resolve, reject) => {
       let timer;

package/src/lock.mjs

@@ -149,8 +149,12 @@ function maybeRemoveAbandonedGuard(guardPath, staleMs, nowMs, io, processAlive)
       restoreQuarantinedLock(guardPath, quarantinePath, io);
       return false;
     }
-    io.unlinkSync(quarantinePath);
-    return true;
+    try {
+      io.unlinkSync(quarantinePath);
+      return true;
+    } catch {
+      return recoverQuarantineUnlinkFailure(guardPath, quarantinePath, snapshot, io);
+    }
   } catch (error) {
     return error?.code === "ENOENT";
   }
@@ -167,6 +171,18 @@ function restoreQuarantinedLock(lockPath, quarantinePath, io) {
   } catch {}
 }
 
+function recoverQuarantineUnlinkFailure(lockPath, quarantinePath, snapshot, io) {
+  restoreQuarantinedLock(lockPath, quarantinePath, io);
+  try {
+    const restored = readStaleLockSnapshot(lockPath, io);
+    if (!restored.safe || !sameLock(snapshot, restored)) return false;
+    io.unlinkSync(lockPath);
+    return true;
+  } catch (error) {
+    return error?.code === "ENOENT";
+  }
+}
+
 function maybeRemoveStaleLock(lockPath, staleMs, nowMs, io, processAlive) {
   if (!Number.isFinite(staleMs) || staleMs <= 0) return false;
   try {
@@ -192,8 +208,12 @@ function maybeRemoveStaleLock(lockPath, staleMs, nowMs, io, processAlive) {
         restoreQuarantinedLock(lockPath, quarantinePath, io);
         return false;
       }
-      io.unlinkSync(quarantinePath);
-      return true;
+      try {
+        io.unlinkSync(quarantinePath);
+        return true;
+      } catch {
+        return recoverQuarantineUnlinkFailure(lockPath, quarantinePath, current, io);
+      }
     } finally {
       removeOwnedLock(guard.guardPath, guard.owner, io);
     }

package/src/pm-studio-bundle-content.mjs

@@ -0,0 +1,165 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { sha256Hex } from "./pm-studio-asar.mjs";
+
+const BUNDLE_CONTENT_SCHEME = "ccdx-bundle-content-v2";
+
+function setupError(code, message, details) {
+  const error = new Error(message);
+  error.code = code;
+  if (details !== undefined) error.details = details;
+  return error;
+}
+
+function hashRegularFile(filePath, expected, readBuffer) {
+  const hash = createHash("sha256");
+  const file = fs.openSync(filePath, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0));
+  const buffer = readBuffer || Buffer.allocUnsafe(1024 * 1024);
+  try {
+    const before = fs.fstatSync(file, { bigint: true });
+    if (before.dev !== BigInt(expected.dev)
+      || before.ino !== BigInt(expected.ino)
+      || before.size !== BigInt(expected.size)) {
+      throw setupError("PM_STUDIO_BUNDLE_CHANGED", `PM Studio bundle changed while reading ${filePath}`);
+    }
+    for (;;) {
+      const length = fs.readSync(file, buffer, 0, buffer.length, null);
+      if (length === 0) break;
+      hash.update(buffer.subarray(0, length));
+    }
+    const after = fs.fstatSync(file, { bigint: true });
+    if (before.dev !== after.dev
+      || before.ino !== after.ino
+      || before.size !== after.size
+      || before.mtimeNs !== after.mtimeNs
+      || before.ctimeNs !== after.ctimeNs) {
+      throw setupError("PM_STUDIO_BUNDLE_CHANGED", `PM Studio bundle changed while hashing ${filePath}`);
+    }
+  } finally {
+    fs.closeSync(file);
+  }
+  return hash.digest("hex");
+}
+
+function parseXattrHex(output, root, ignoredXattrs) {
+  const records = [];
+  const ignored = new Set(ignoredXattrs);
+  const seen = new Set();
+  let current = null;
+  const flush = () => {
+    if (!current) return;
+    if (!ignored.has(current.name)) {
+      const key = `${current.path}\0${current.name}`;
+      if (seen.has(key)) throw setupError("PM_STUDIO_XATTR_INVALID", `Duplicate extended attribute ${current.name}`);
+      seen.add(key);
+      const value = Buffer.from(current.hex.join(""), "hex");
+      records.push(["xattr", current.path, current.name, value.length, sha256Hex(value)]);
+    }
+    current = null;
+  };
+
+  for (const line of String(output || "").split(/\r?\n/)) {
+    if (!line) continue;
+    const separator = line.lastIndexOf(": ");
+    if ((line === `${root}:` || line.startsWith(`${root}: `) || line.startsWith(`${root}${path.sep}`))
+      && separator >= root.length && line.endsWith(":")) {
+      flush();
+      const target = line.slice(0, separator);
+      const relative = target === root ? "." : path.relative(root, target).split(path.sep).join("/");
+      if (!relative || relative === ".." || relative.startsWith("../") || path.isAbsolute(relative)) {
+        throw setupError("PM_STUDIO_XATTR_INVALID", `Extended attribute path escapes PM Studio: ${target}`);
+      }
+      current = { path: relative, name: line.slice(separator + 2, -1), hex: [] };
+      continue;
+    }
+    if (!current) throw setupError("PM_STUDIO_XATTR_INVALID", "Could not parse PM Studio extended attributes");
+    const data = line.includes("  |") ? line.slice(0, line.indexOf("  |")) : line;
+    const tokens = data.trim().split(/\s+/);
+    if (!/^[0-9a-f]{8}$/i.test(tokens[0]) || tokens.slice(1).some((token) => !/^[0-9a-f]{2}$/i.test(token))) {
+      throw setupError("PM_STUDIO_XATTR_INVALID", "Could not parse PM Studio extended attribute bytes");
+    }
+    current.hex.push(...tokens.slice(1));
+  }
+  flush();
+  return records.sort((left, right) => Buffer.compare(
+    Buffer.from(`${left[1]}\0${left[2]}`),
+    Buffer.from(`${right[1]}\0${right[2]}`),
+  ));
+}
+
+export function inspectBundleContent(appPath, {
+  xattrOutput = "",
+  ignoredXattrs = [],
+  readBuffer,
+} = {}) {
+  const root = path.resolve(appPath);
+  const rootStat = fs.lstatSync(root);
+  if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) {
+    throw setupError("PM_STUDIO_APP_INVALID", `PM Studio path is not a regular app bundle: ${appPath}`);
+  }
+  const records = [];
+  const normalizedPaths = new Map();
+  let regularFileCount = 0;
+  let regularBytes = 0;
+  let symlinkCount = 0;
+
+  const rememberPath = (relative) => {
+    const normalized = relative.normalize("NFC");
+    const existing = normalizedPaths.get(normalized);
+    if (existing && existing !== relative) {
+      throw setupError("PM_STUDIO_BUNDLE_PATH_COLLISION", `PM Studio contains colliding paths: ${existing} and ${relative}`);
+    }
+    normalizedPaths.set(normalized, relative);
+  };
+  rememberPath(".");
+  records.push(["directory", ".", rootStat.mode & 0o7777]);
+  const visit = (directory) => {
+    const names = fs.readdirSync(directory).sort((left, right) =>
+      Buffer.compare(Buffer.from(left), Buffer.from(right)));
+    for (const name of names) {
+      const fullPath = path.join(directory, name);
+      const stat = fs.lstatSync(fullPath);
+      const relative = path.relative(root, fullPath).split(path.sep).join("/");
+      const mode = stat.mode & 0o7777;
+      rememberPath(relative);
+      if (stat.isDirectory() && !stat.isSymbolicLink()) {
+        records.push(["directory", relative, mode]);
+        visit(fullPath);
+      } else if (stat.isSymbolicLink()) {
+        const target = fs.readlinkSync(fullPath);
+        const resolved = path.resolve(path.dirname(fullPath), target);
+        if (path.isAbsolute(target)
+          || (resolved !== root && !resolved.startsWith(`${root}${path.sep}`))
+          || !fs.existsSync(resolved)) {
+          throw setupError("PM_STUDIO_BUNDLE_SYMLINK_INVALID", `PM Studio contains an unsafe symlink: ${relative}`);
+        }
+        symlinkCount += 1;
+        records.push(["symlink", relative, mode, target]);
+      } else if (stat.isFile()) {
+        if (stat.nlink !== 1) {
+          throw setupError("PM_STUDIO_BUNDLE_HARDLINK_INVALID", `PM Studio contains a hard-linked file: ${relative}`);
+        }
+        regularFileCount += 1;
+        regularBytes += stat.size;
+        records.push(["file", relative, mode, stat.size, hashRegularFile(fullPath, stat, readBuffer)]);
+      } else {
+        throw setupError("PM_STUDIO_BUNDLE_ENTRY_INVALID", `PM Studio contains an unsupported entry: ${relative}`);
+      }
+    }
+  };
+  visit(root);
+
+  const xattrRecords = parseXattrHex(xattrOutput, root, ignoredXattrs);
+  const hash = createHash("sha256");
+  for (const record of [...records, ...xattrRecords]) hash.update(`${JSON.stringify(record)}\n`);
+  return {
+    scheme: BUNDLE_CONTENT_SCHEME,
+    sha256: hash.digest("hex"),
+    entryCount: records.length,
+    regularFileCount,
+    regularBytes,
+    symlinkCount,
+    xattrCount: xattrRecords.length,
+  };
+}

package/src/pm-studio-relay.mjs

@@ -5,6 +5,10 @@ import {
   createRequestAdmission,
   httpError,
   isAbortLikeError,
+  MAX_UPSTREAM_CHAT_SUCCESS_BODY_BYTES,
+  MAX_UPSTREAM_ERROR_BODY_BYTES,
+  MAX_UPSTREAM_MODEL_CATALOG_BYTES,
+  readBoundedResponseBuffer,
   readJsonBody,
   sendJsonError,
   writeOrDrain,
@@ -150,12 +154,12 @@ function catalogData(catalog) {
   return Array.isArray(catalog?.data) ? catalog.data : null;
 }
 
-async function responseSnapshot(response) {
+async function responseSnapshot(response, { maxBytes, label, signal }) {
   return {
     status: response.status,
     ok: response.ok,
     headers: new Headers(response.headers),
-    body: Buffer.from(await response.arrayBuffer()),
+    body: await readBoundedResponseBuffer(response, { maxBytes, label, signal }),
   };
 }
 
@@ -209,7 +213,15 @@ function mergeModelCatalog(snapshot, modelRouter) {
 async function relayUpstreamResponse(response, reqBody, res, abort, streamIdleTimeoutMs) {
   const stream = reqBody?.stream === true;
   if (!stream || !response.ok) {
-    const snapshot = await responseSnapshot(response);
+    const snapshot = await responseSnapshot(response, response.ok ? {
+      maxBytes: MAX_UPSTREAM_CHAT_SUCCESS_BODY_BYTES,
+      label: "PM Studio Claude success body",
+      signal: abort.signal,
+    } : {
+      maxBytes: MAX_UPSTREAM_ERROR_BODY_BYTES,
+      label: "PM Studio Claude error body",
+      signal: abort.signal,
+    });
     sendSnapshot(res, snapshot);
     return;
   }
@@ -345,9 +357,18 @@ export function createPmStudioRelayHandler(options = {}) {
     }
     activeModelRequests += 1;
     try {
-      return await fetchEnterprise(
+      const response = await fetchEnterprise(
         "/models", "GET", inboundHeaders, token, undefined, signal,
-      ).then(responseSnapshot);
+      );
+      return await responseSnapshot(response, response.ok ? {
+        maxBytes: MAX_UPSTREAM_MODEL_CATALOG_BYTES,
+        label: "PM Studio model catalog",
+        signal,
+      } : {
+        maxBytes: MAX_UPSTREAM_ERROR_BODY_BYTES,
+        label: "PM Studio model catalog error body",
+        signal,
+      });
     } finally {
       activeModelRequests -= 1;
     }