codex-copilot-dx 0.8.11 → 0.9.1

package/README.md

@@ -131,6 +131,17 @@ ccdx cache --clean --history
 
 Plain `--clean` clears only completed image transforms; the next matching request may recompute them. Adding `--history` also invalidates all process-local `previous_response_id` chains and can make a task's next continuation fail, so it requires interactive confirmation or `--yes`. Cleanup waits for active cache users to finish and never deletes Codex transcripts, generated image files, provider credentials, image edit handles, model catalogs, or usage/debug logs. A stopped or older adapter must be restarted before runtime cleanup; a saved limit applies on the next start.
 
+### Request-body limits
+
+```bash
+ccdx limits
+ccdx limits --decoded 256
+ccdx limits -256
+ccdx limits --decoded default
+```
+
+`ccdx limits` distinguishes the saved decoded request-body limit from the running adapter's active limit. The default is 128 MiB; the opt-in saved limit accepts 128–512 MiB. Changes take effect only after restarting the adapter, never restart it automatically, and do not clear conversations or caches. `CCDX_MAX_DECODED_BODY_BYTES` overrides the saved setting; unset it before changing the saved limit. The separate 64 MiB raw/compressed-body limit is not changed. Larger decoded requests can use substantially more process memory during JSON parsing and image preparation; raising this limit may enable a large thread to compact, but does not guarantee successful inference or compaction. Return to `default` after temporary use.
+
 ### Terminal animation
 
 Choose the terminal activity animation interactively:
@@ -173,6 +184,8 @@ The provider credential is stored in `~/.config/codex-copilot-dx/image-provider.
 
 The enable command verifies the local MCP handshake and generation-tool directory without generating an image. It reports provider configuration separately from local service readiness; it cannot assert that every running Codex task has refreshed its catalog. Codex normally detects changed skills; restart Codex App once if an open task has not refreshed them. Normal CCDX startup installs or updates this guidance only for an already-enabled provider, without repeating API setup. Without `enable-image`, it installs neither this skill nor the MCP registration. Unchanged guidance is not rewritten. The existing adapter can remain running because provider settings are loaded when the tool is invoked.
 
+For Qwen-style image responses, CCDX accepts canonical PNG, JPEG, or WebP `data:image/...;base64,` output within the existing 32 MiB image limit. Public HTTPS image URLs still use the same pinned-DNS download checks; HTTP, private-network targets, and URLs with embedded credentials remain rejected.
+
 Existing compatible `ccdx_image` registrations are reused without requiring CCDX's comment markers or resetting user timeouts/tool policies. Missing or damaged markers alone do not block startup. Core GPT configuration is committed independently before optional image maintenance: image configuration conflicts, image-only write failures, or Skill maintenance failures warn without aborting the core service. No new image guidance is installed after failed image configuration. With images disabled or their provider configuration invalid/unreadable, normal startup performs no image configuration maintenance, Skill installation, or image-network probe; explicit `disable-image` owns cleanup. Automatic updates/removal are limited to recognizable CCDX defaults and isolated TOML declarations, never everything between two comments. Ambiguous shared-inline or customized registrations are left intact; `disable-image` still disables the CCDX provider and removes its owned guidance. Invalid TOML/UTF-8 in the shared Codex config or a failed essential core configuration write remains an explicit error rather than a silent success.
 
 Direct MCP generations and edits retain their original inline image content and editing ID, and also save the exact image bytes privately under `~/.local/share/codex-copilot-dx/images`. The result includes ready-to-use image Markdown for Codex's final chat reply, so the image appears as a clickable thumbnail instead of only inside a tool result. Files use unique names and are not overwritten or removed on adapter restart. Asking to show the same image again reuses its existing Markdown, not a new generation or edit. If saving fails, CCDX still returns the generated image content, reports the delivery failure, and does not retry the provider or invent a file path. The bundled helper continues saving once at its existing output location, without a second adapter-side copy. Existing enabled users receive updated, unmodified CCDX-owned guidance on the next CCDX startup; no new setup command is needed.

package/bin/cli.mjs

@@ -101,6 +101,24 @@ if (CLI.command === "cache") {
     process.exit(1);
   }
 }
+if (CLI.command === "limits") {
+  try {
+    const probe = parseAdapterProbeOptions(process.env);
+    const { runLimitsCommand } = await import("../src/cli-limits.mjs");
+    await runLimitsCommand({
+      action: CLI.action,
+      limitMib: CLI.limitMib,
+      resetLimit: CLI.resetLimit,
+      host: probe.adapterHost,
+      port: probe.adapterPort,
+      timeoutMs: probe.existingAdapterTimeoutMs,
+    });
+    process.exit(0);
+  } catch (e) {
+    console.error(status("err", e.message));
+    process.exit(1);
+  }
+}
 if (CLI.command === "retired") {
   console.error(status("err", `${CLI.integration} integration was retired in ccdx 0.7.0.`));
   if (CLI.integration === "PM Studio") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-copilot-dx",
-  "version": "0.8.11",
+  "version": "0.9.1",
   "description": "Use Codex App with GitHub Copilot",
   "author": "Dale Xiao",
   "type": "module",

package/src/cli-limits.mjs

@@ -0,0 +1,55 @@
+import os from "node:os";
+import { MIB } from "./cache-limits.mjs";
+import { readAdapterStatus } from "./cli-status.mjs";
+import { loadRuntimeConfig } from "./runtime-config.mjs";
+import { decodedBodyLimitPreference, writeDecodedBodyLimitMib } from "./user-settings.mjs";
+
+function mib(bytes) {
+  const value = Number(bytes);
+  return `${(value / MIB).toFixed(value % MIB === 0 ? 0 : 1)} MiB`;
+}
+
+export async function runLimitsCommand({
+  action = "status",
+  limitMib,
+  resetLimit = false,
+  env = process.env,
+  home = os.homedir(),
+  host = "127.0.0.1",
+  port = 2026,
+  output = process.stdout,
+  fetchImpl = fetch,
+  timeoutMs = 1000,
+} = {}) {
+  if (action === "set") {
+    if (String(env.CCDX_MAX_DECODED_BODY_BYTES || "").trim()) {
+      throw new Error("CCDX_MAX_DECODED_BODY_BYTES overrides saved limits; unset it before using ccdx limits --decoded");
+    }
+    writeDecodedBodyLimitMib(resetLimit ? null : limitMib, { env, home });
+  } else if (action !== "status") {
+    throw new Error(`Unknown limits action: ${action}`);
+  }
+
+  const preference = decodedBodyLimitPreference({ env, home });
+  let runtime;
+  try {
+    runtime = await readAdapterStatus({ host, port, timeoutMs, fetchImpl });
+  } catch {
+    runtime = null;
+  }
+  const activeDecoded = Number(runtime?.data?.limits?.max_decoded_body_bytes);
+  const activeRaw = Number(runtime?.data?.limits?.max_body_bytes);
+  const lines = [
+    "ccdx limits",
+    `Configured decoded request body: ${mib(preference.bytes)} (${preference.source})`,
+    runtime && Number.isFinite(activeDecoded) && activeDecoded > 0
+      ? `Running decoded request body: ${mib(activeDecoded)}`
+      : "Running decoded request body: unavailable",
+    `Raw request body: ${mib(runtime && Number.isFinite(activeRaw) && activeRaw > 0 ? activeRaw : loadRuntimeConfig(env).maxBodyBytes)}${runtime ? " (running)" : " (configured)"}`,
+  ];
+  if (!runtime) lines.push("Running adapter status unavailable; restart ccdx to apply and verify this limit.");
+  else if (activeDecoded !== preference.bytes) lines.push("Restart ccdx to apply the configured decoded-body limit.");
+  if (action === "set") lines.push("Existing conversations and caches were not modified.");
+  output.write(`${lines.join("\n")}\n`);
+  return { preference, runtime };
+}

package/src/cli-options.mjs

@@ -21,6 +21,7 @@ const HELP_TOPICS = new Set([
   "models",
   "usage",
   "cache",
+  "limits",
   "animation",
   "enable-image",
   "disable-image",
@@ -187,6 +188,21 @@ export function parseCliArgs(args = []) {
       yes: Boolean(options["--yes"]),
     });
   }
+  if (command === "limits") {
+    const limitArgs = rest.length === 1 && /^-\d+$/.test(rest[0])
+      ? ["--decoded", rest[0].slice(1)]
+      : rest;
+    const options = parseOptions(limitArgs, new Map([["--decoded", "value"]]));
+    const rawLimit = options["--decoded"];
+    if (rawLimit && rawLimit !== "default" && !/^\d+$/.test(rawLimit)) {
+      throw new Error(`Decoded request-body limit must be an integer MiB value or default: ${rawLimit}`);
+    }
+    return baseCommand("limits", {
+      action: rawLimit ? "set" : "status",
+      limitMib: rawLimit && rawLimit !== "default" ? Number(rawLimit) : undefined,
+      resetLimit: rawLimit === "default",
+    });
+  }
   if (PM_COMMANDS.has(command)) {
     return baseCommand("retired", { integration: "PM Studio" });
   }
@@ -334,6 +350,7 @@ function topicHelp(name, topic) {
     models: `Usage:\n  ${name} models [--format table|plain]\n\nPerforms a fresh, read-only Copilot model-directory lookup for the saved account. Interactive terminals use a table by default.`,
     usage: `Usage:\n  ${name} usage [--format table|plain]\n\nSummarizes local token usage metadata without reading prompt or completion content. Interactive terminals use a table by default.`,
     cache: `Usage:\n  ${name} cache\n  ${name} cache --limit <MiB|default>\n  ${name} cache --clean [--history] [--yes]\n\nShows runtime cache use, saves and applies the shared response-history limit, or clears the rebuildable image-transform cache. --history also clears in-memory response history for all tasks and can make their next continuation fail, so interactive confirmation or --yes is required. Generated image files and saved Codex transcripts are never deleted. Short aliases: -128 sets 128 MiB and -clean equals --clean.`,
+    limits: `Usage:\n  ${name} limits\n  ${name} limits --decoded <MiB|default>\n\nShows configured and running request-body limits, or saves a decoded request-body limit from 128 to 512 MiB. The raw-body limit is unchanged. Restart ccdx to apply a saved change; no conversation or cache is cleared. Short alias: -256 sets 256 MiB.`,
     animation: `Usage:\n  ${name} animation\n\nPreviews all terminal activity animations together and selects the theme used the next time the adapter starts.`,
     "enable-image": `Usage:\n  ${name} enable-image\n\nInteractively configures an HTTPS image API endpoint (base URLs are also accepted) and API key, detects its supported image model and protocol, installs CCDX image guidance, and checks the local image tool for Codex App without generating an image. A blank key preserves the saved key only for the same origin; a new origin requires explicit key entry. Concurrent unrelated config edits are preserved.`,
     "disable-image": `Usage:\n  ${name} disable-image\n\nDisables the local CCDX image tool and removes its stored API credential and unmodified CCDX image guidance.`,
@@ -358,6 +375,7 @@ export function cliHelp(commandName = "ccdx", topic = "") {
   ${name} models [--format table|plain]
   ${name} usage [--format table|plain]
   ${name} cache [--limit <MiB|default> | --clean [--history] [--yes]]
+  ${name} limits [--decoded <MiB|default>]
   ${name} animation
   ${name} enable-image
   ${name} disable-image
@@ -375,6 +393,7 @@ Commands:
   models             Query a saved account's live Copilot model catalog
   usage              Summarize locally recorded token usage
   cache              Inspect, size, or clear bounded runtime caches
+  limits             Inspect or configure the decoded request-body limit
   animation          Select the terminal activity animation
   enable-image       Configure and enable the optional image provider
   disable-image      Disable the image provider and remove its credential

package/src/http-transport.mjs

@@ -1,6 +1,7 @@
 import { promisify } from "node:util";
 import * as zlib from "node:zlib";
 import { loadRuntimeConfig, parsePositiveInteger } from "./runtime-config.mjs";
+import { decodedBodyLimitPreference } from "./user-settings.mjs";
 import { status } from "./status.mjs";
 import { safeUpstreamResponseHeaders } from "./upstream-headers.mjs";
 import { redactDiagnosticText } from "./diagnostic-text.mjs";
@@ -13,7 +14,7 @@ const zstdDecompressAsync = zlib.zstdDecompress ? promisify(zlib.zstdDecompress)
 
 const HTTP_RUNTIME_CONFIG = loadRuntimeConfig();
 const MAX_BODY_BYTES = HTTP_RUNTIME_CONFIG.maxBodyBytes;
-const MAX_DECODED_BODY_BYTES = HTTP_RUNTIME_CONFIG.maxDecodedBodyBytes;
+const MAX_DECODED_BODY_BYTES = decodedBodyLimitPreference().bytes;
 const MAX_INFLIGHT_BODY_BYTES = HTTP_RUNTIME_CONFIG.maxInflightBodyBytes;
 const MAX_QUEUED_REQUESTS = HTTP_RUNTIME_CONFIG.maxQueuedRequests;
 const REQUEST_QUEUE_TIMEOUT_MS = HTTP_RUNTIME_CONFIG.requestQueueTimeoutMs;

package/src/image-provider.mjs

@@ -73,6 +73,29 @@ function checkedImage(config, value) {
   return value;
 }
 
+function decodeGeneratedImageDataUri(value, signal) {
+  if (signal?.aborted) throw providerError("Image generation timed out or was cancelled", "ccdx_image_timeout");
+  const maxEncodedLength = 4 * Math.ceil(IMAGE_MAX_BYTES / 3);
+  if (value.length > maxEncodedLength + 32) {
+    throw providerError("Generated image exceeds the size limit", "ccdx_image_too_large");
+  }
+  const match = /^data:(image\/(?:png|jpeg|webp));base64,/.exec(value);
+  if (!match) throw providerError("Image API returned an unsupported image data URI", "ccdx_image_format_unsupported");
+  const encoded = value.slice(match[0].length);
+  if (!encoded || encoded.length > maxEncodedLength || encoded.length % 4 !== 0
+    || !/^[A-Za-z0-9+/]+={0,2}$/.test(encoded)) {
+    throw providerError("Image API returned invalid image data", "ccdx_image_data_invalid");
+  }
+  const bytes = Buffer.from(encoded, "base64");
+  if (bytes.length > IMAGE_MAX_BYTES) throw providerError("Generated image exceeds the size limit", "ccdx_image_too_large");
+  if (bytes.toString("base64") !== encoded) throw providerError("Image API returned invalid image data", "ccdx_image_data_invalid");
+  if (imageMetadata(bytes).mimeType !== match[1]) {
+    throw providerError("Image API returned image data with a mismatched format", "ccdx_image_format_unsupported");
+  }
+  if (signal?.aborted) throw providerError("Image generation timed out or was cancelled", "ccdx_image_timeout");
+  return bytes;
+}
+
 function generationBody(config, prompt, size, image) {
   if (config.protocol === "qwen-messages") {
     return {
@@ -306,9 +329,9 @@ export async function generateImage(config, {
   if (!source) throw providerError("Image API response did not contain an image");
   let bytes;
   try {
-    bytes = source.type === "base64"
-      ? Buffer.from(source.value, "base64")
-      : await downloadImage(source.value, { signal: requestSignal, maxBytes: IMAGE_MAX_BYTES });
+    if (source.type === "base64") bytes = Buffer.from(source.value, "base64");
+    else if (source.value.startsWith("data:")) bytes = decodeGeneratedImageDataUri(source.value, requestSignal);
+    else bytes = await downloadImage(source.value, { signal: requestSignal, maxBytes: IMAGE_MAX_BYTES });
   } catch (error) {
     if (error?.code?.startsWith?.("ccdx_")) throw error;
     const code = String(error?.cause?.code || error?.code || "").replace(/[^A-Z0-9_-]/gi, "").slice(0, 64);

package/src/observability.mjs

@@ -4,12 +4,14 @@ import { copilotRuntimeStatus } from "./copilot.mjs";
 import { imageOptimizationStats } from "./image-optimization.mjs";
 import { responseHistoryStats } from "./response-history.mjs";
 import { loadRuntimeConfig } from "./runtime-config.mjs";
+import { decodedBodyLimitPreference } from "./user-settings.mjs";
 import { profileRouting } from "./profile-routing.mjs";
 import { usageLoggingStats } from "./usage.mjs";
 import { debugLoggingStats } from "./log.mjs";
 
 export { ADAPTER_STATUS_PATH };
 const OBSERVABILITY_RUNTIME_CONFIG = loadRuntimeConfig();
+const OBSERVABILITY_DECODED_BODY_BYTES = decodedBodyLimitPreference().bytes;
 
 const ROUTE_NAMES = Object.freeze([
   "responses",
@@ -208,7 +210,7 @@ export function runtimeStatusPayload({
     routing: profileRouting(),
     limits: {
       max_body_bytes: OBSERVABILITY_RUNTIME_CONFIG.maxBodyBytes,
-      max_decoded_body_bytes: OBSERVABILITY_RUNTIME_CONFIG.maxDecodedBodyBytes,
+      max_decoded_body_bytes: OBSERVABILITY_DECODED_BODY_BYTES,
       max_sse_buffer_bytes: OBSERVABILITY_RUNTIME_CONFIG.maxSseBufferBytes,
       response_history_max_bytes: history.maxBytes,
       response_history_max_entries: history.maxEntries,

package/src/user-settings.mjs

@@ -3,7 +3,7 @@ import os from "node:os";
 import path from "node:path";
 import { atomicWriteFileIfChangedSync } from "./atomic-file.mjs";
 import { DEFAULT_CODEX_AUTO_REVIEW_MODEL } from "./models.mjs";
-import { loadRuntimeConfig } from "./runtime-config.mjs";
+import { loadRuntimeConfig, RUNTIME_DEFAULTS } from "./runtime-config.mjs";
 import {
   MIB,
   RESPONSE_HISTORY_DEFAULT_MIB,
@@ -19,6 +19,9 @@ import {
 const AUTO_REVIEW_MODEL_KEY = "auto_review_model";
 const TERMINAL_ANIMATION_KEY = "terminal_animation";
 const RESPONSE_HISTORY_MAX_MIB_KEY = "response_history_max_mib";
+const DECODED_BODY_LIMIT_MIB_KEY = "decoded_body_limit_mib";
+export const DECODED_BODY_LIMIT_MIN_MIB = RUNTIME_DEFAULTS.maxDecodedBodyBytes / MIB;
+export const DECODED_BODY_LIMIT_MAX_MIB = 512;
 export { RESPONSE_HISTORY_MAX_MIB, RESPONSE_HISTORY_MIN_MIB };
 
 export function userSettingsPath({ env = process.env, home = os.homedir() } = {}) {
@@ -66,6 +69,17 @@ export function readUserSettings({ env = process.env, home = os.homedir(), stric
         delete parsed[RESPONSE_HISTORY_MAX_MIB_KEY];
       }
     }
+    if (Object.hasOwn(parsed, DECODED_BODY_LIMIT_MIB_KEY)) {
+      const value = parsed[DECODED_BODY_LIMIT_MIB_KEY];
+      if (!Number.isSafeInteger(value)
+        || value < DECODED_BODY_LIMIT_MIN_MIB
+        || value > DECODED_BODY_LIMIT_MAX_MIB) {
+        if (strict) {
+          throw invalidSettings(filePath, `${DECODED_BODY_LIMIT_MIB_KEY} must be an integer from ${DECODED_BODY_LIMIT_MIN_MIB} to ${DECODED_BODY_LIMIT_MAX_MIB}`);
+        }
+        delete parsed[DECODED_BODY_LIMIT_MIB_KEY];
+      }
+    }
     return parsed;
   } catch (error) {
     if (error?.code === "ENOENT") return {};
@@ -114,6 +128,39 @@ export function responseHistoryLimitPreference({ env = process.env, home = os.ho
   return { bytes: RESPONSE_HISTORY_DEFAULT_MIB * MIB, mib: RESPONSE_HISTORY_DEFAULT_MIB, source: "default" };
 }
 
+export function decodedBodyLimitPreference({ env = process.env, home = os.homedir() } = {}) {
+  const environment = String(env.CCDX_MAX_DECODED_BODY_BYTES || "").trim();
+  if (environment) {
+    return { bytes: loadRuntimeConfig(env).maxDecodedBodyBytes, source: "environment" };
+  }
+  const settings = readUserSettings({ env, home });
+  const mib = settings[DECODED_BODY_LIMIT_MIB_KEY];
+  if (Number.isSafeInteger(mib)) return { bytes: mib * MIB, mib, source: "settings" };
+  return { bytes: RUNTIME_DEFAULTS.maxDecodedBodyBytes, mib: DECODED_BODY_LIMIT_MIN_MIB, source: "default" };
+}
+
+export function writeDecodedBodyLimitMib(mib, { env = process.env, home = os.homedir() } = {}) {
+  const filePath = userSettingsPath({ env, home });
+  const settings = readUserSettings({ env, home, strict: true });
+  const next = { ...settings };
+  if (mib === null || mib === undefined || mib === "") {
+    if (!Object.hasOwn(next, DECODED_BODY_LIMIT_MIB_KEY)) {
+      return { changed: false, filePath, ...decodedBodyLimitPreference({ env, home }) };
+    }
+    delete next[DECODED_BODY_LIMIT_MIB_KEY];
+  } else {
+    const parsed = Number(mib);
+    if (!Number.isSafeInteger(parsed)
+      || parsed < DECODED_BODY_LIMIT_MIN_MIB
+      || parsed > DECODED_BODY_LIMIT_MAX_MIB) {
+      throw new Error(`Decoded request-body limit must be an integer from ${DECODED_BODY_LIMIT_MIN_MIB} to ${DECODED_BODY_LIMIT_MAX_MIB} MiB`);
+    }
+    next[DECODED_BODY_LIMIT_MIB_KEY] = parsed;
+  }
+  const changed = atomicWriteFileIfChangedSync(filePath, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 });
+  return { changed, filePath, ...decodedBodyLimitPreference({ env, home }) };
+}
+
 export function writeResponseHistoryLimitMib(mib, { env = process.env, home = os.homedir() } = {}) {
   const filePath = userSettingsPath({ env, home });
   const settings = readUserSettings({ env, home, strict: true });