codex-copilot-dx 0.8.2 → 0.8.3

package/README.md

@@ -151,6 +151,8 @@ The provider credential is stored in `~/.config/codex-copilot-dx/image-provider.
 
 The enable command verifies the local MCP handshake and generation-tool directory without generating an image. It reports provider configuration separately from local service readiness; it cannot assert that every running Codex task has refreshed its catalog. Codex normally detects changed skills; restart Codex App once if an open task has not refreshed them. Normal CCDX startup installs or updates this guidance only for an already-enabled provider, without repeating API setup. Without `enable-image`, it installs neither this skill nor the MCP registration. Unchanged guidance is not rewritten. The existing adapter can remain running because provider settings are loaded when the tool is invoked.
 
+Existing compatible `ccdx_image` registrations are reused without requiring CCDX's comment markers or resetting user timeouts/tool policies. Missing or damaged markers alone do not block startup. Core GPT configuration is committed independently before optional image maintenance: image configuration conflicts, image-only write failures, or Skill maintenance failures warn without aborting the core service. No new image guidance is installed after failed image configuration. With images disabled or their provider configuration invalid/unreadable, normal startup performs no image configuration maintenance, Skill installation, or image-network probe; explicit `disable-image` owns cleanup. Automatic updates/removal are limited to recognizable CCDX defaults and isolated TOML declarations, never everything between two comments. Ambiguous shared-inline or customized registrations are left intact; `disable-image` still disables the CCDX provider and removes its owned guidance. Invalid TOML/UTF-8 in the shared Codex config or a failed essential core configuration write remains an explicit error rather than a silent success.
+
 Direct MCP generations and edits retain their original inline image content and editing ID, and also save the exact image bytes privately under `~/.local/share/codex-copilot-dx/images`. The result includes ready-to-use image Markdown for Codex's final chat reply, so the image appears as a clickable thumbnail instead of only inside a tool result. Files use unique names and are not overwritten or removed on adapter restart. Asking to show the same image again reuses its existing Markdown, not a new generation or edit. If saving fails, CCDX still returns the generated image content, reports the delivery failure, and does not retry the provider or invent a file path. The bundled helper continues saving once at its existing output location, without a second adapter-side copy. Existing enabled users receive updated, unmodified CCDX-owned guidance on the next CCDX startup; no new setup command is needed.
 
 Inspect or disable the optional provider with:

package/bin/cli.mjs

@@ -229,8 +229,8 @@ async function reuseRunningAdapterIfAvailable() {
 
 async function configureCodexClient() {
   const imageProviderEnabled = Boolean(readImageProviderConfig());
-  ensureCodexConfig(ADAPTER_PORT, { host: ADAPTER_HOST, imageProviderEnabled });
-  if (imageProviderEnabled) {
+  const { imageMcpSkipped } = ensureCodexConfig(ADAPTER_PORT, { host: ADAPTER_HOST, imageProviderEnabled });
+  if (imageProviderEnabled && !imageMcpSkipped) {
     try {
       const { syncEnabledImageSkill } = await import("../src/cli-image.mjs");
       syncEnabledImageSkill({ adapterPort: ADAPTER_PORT, adapterHost: ADAPTER_HOST });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-copilot-dx",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "description": "Use Codex App with GitHub Copilot",
   "author": "Dale Xiao",
   "type": "module",

package/src/config.mjs

@@ -4,6 +4,7 @@ import os from "node:os";
 import { status } from "./status.mjs";
 import { atomicWriteFileIfChangedSync } from "./atomic-file.mjs";
 import { adapterBaseUrl } from "./running-adapter.mjs";
+import { isLoopbackHost } from "./security.mjs";
 import { codexTomlStatements, configValue, parseCodexToml, validateManagedConfigEdit } from "./config-toml.mjs";
 
 const CONFIG_PATH = path.join(os.homedir(), ".codex", "config.toml");
@@ -12,6 +13,10 @@ const MODEL_AUTO_COMPACT_TOKEN_LIMIT = 900_000;
 const IMAGE_MCP_START = "# ccdx:image-mcp:start";
 const IMAGE_MCP_END = "# ccdx:image-mcp:end";
 const IMAGE_MCP_SECTION = "mcp_servers.ccdx_image";
+const IMAGE_MCP_KEYS = ["enabled", "tool_timeout_sec", "url"];
+
+// Only optional image-configuration conflicts may degrade to core-only startup.
+export class ImageMcpConfigError extends Error {}
 const STARTUP_MANAGED_PATHS = [
   "openai_base_url",
   "model_context_window",
@@ -92,41 +97,98 @@ function imageMcpHost(adapterHost) {
   return host;
 }
 
-function removeManagedImageMcp(lines) {
-  const comments = codexTomlStatements(lines.join("\n")).filter((item) => item.kind === "comment");
-  const starts = comments.filter((item) => lines[item.line] === IMAGE_MCP_START).map((item) => item.line);
-  const ends = comments.filter((item) => lines[item.line] === IMAGE_MCP_END).map((item) => item.line);
-  let start = starts[0] ?? -1;
-  const end = ends[0] ?? -1;
-  if (start === -1 && end === -1) return false;
-  if (starts.length !== 1 || ends.length !== 1 || end < start) {
-    throw new Error("Invalid managed CCDX image MCP block in Codex config");
-  }
-  lines.splice(start, end - start + 1);
-  while (start > 0 && start >= lines.length && lines[start - 1].trim() === "") {
-    lines.splice(start - 1, 1);
-    start -= 1;
-  }
-  while (start < lines.length && lines[start].trim() === "" && start > 0 && lines[start - 1].trim() === "") {
-    lines.splice(start, 1);
-  }
-  return true;
+function imageMcpUrl(value) {
+  if (typeof value !== "string" || /[\s\x00-\x1f\x7f]/.test(value)) return null;
+  try {
+    const url = new URL(value);
+    return url.protocol === "http:" && url.pathname === "/mcp/image"
+      && !url.username && !url.password && !url.search && !url.hash ? url : null;
+  } catch { return null; }
+}
+
+function isImageDeclaration(item) {
+  return ["table", "value"].includes(item.kind)
+    && sameKeys(item.keys.slice(0, IMAGE_MANAGED_PATH.length), IMAGE_MANAGED_PATH);
+}
+
+function imageMcpMarkers(content, statements) {
+  return statements.filter((item) => item.kind === "comment"
+    && [IMAGE_MCP_START, IMAGE_MCP_END].includes(item.source.trim())
+    && !content.slice(content.lastIndexOf("\n", item.start - 1) + 1, item.start).trim());
 }
 
-function hasUnmanagedImageMcp(lines) {
-  return configValue(parseCodexToml(lines.join("\n")), IMAGE_MANAGED_PATH) !== undefined;
+function knownImageMcp(section, expectedUrl, previousBaseUrl, statements, markers) {
+  if (!section || Object.keys(section).sort().join(",") !== IMAGE_MCP_KEYS.join(",")
+    || section.enabled !== true || section.tool_timeout_sec !== 210n) return false;
+  const url = imageMcpUrl(section.url);
+  if (!url) return false;
+  if (url.href === new URL(expectedUrl).href) return true;
+  // The core and image URLs were configured together. This survives comment
+  // stripping and allows an adapter address change without guessing a new owner.
+  try {
+    const previous = new URL(previousBaseUrl);
+    if (previous.protocol === "http:" && previous.pathname === "/v1"
+      && !previous.username && !previous.password && !previous.search && !previous.hash
+      && previous.origin === url.origin
+      && (isLoopbackHost(url.hostname) || url.hostname === new URL(expectedUrl).hostname)) return true;
+  } catch {}
+  // Legacy markers are an additional ownership hint, never deletion boundaries.
+  const starts = markers.filter((item) => item.source.trim() === IMAGE_MCP_START);
+  const ends = markers.filter((item) => item.source.trim() === IMAGE_MCP_END);
+  if (starts.length !== 1 || ends.length !== 1 || starts[0].start >= ends[0].start
+    || !(isLoopbackHost(url.hostname) || url.hostname === new URL(expectedUrl).hostname)) return false;
+  const declarations = statements.filter((item) => ["table", "value"].includes(item.kind));
+  return declarations.some(isImageDeclaration)
+    && declarations.filter(isImageDeclaration).every((item) => item.start > starts[0].start && item.end < ends[0].start)
+    && declarations.filter((item) => item.start > starts[0].start && item.start < ends[0].start).every(isImageDeclaration);
 }
 
-function ensureImageMcp(lines, enabled, adapterPort, adapterHost) {
+function removeImageMcpDeclarations(content, statements, markers) {
+  const declarations = statements.filter(isImageDeclaration);
+  // A shared inline parent is not a surgical edit target. Reuse it unchanged or
+  // leave it for the user; never serialize away sibling settings or credentials.
+  if (!declarations.length) return null;
+  const ranges = [...declarations, ...markers].map((item) => {
+    const start = content.lastIndexOf("\n", item.start - 1) + 1;
+    const newline = content.indexOf("\n", item.end);
+    return [start, newline < 0 ? content.length : newline + 1];
+  }).sort((left, right) => right[0] - left[0]);
+  for (const [start, end] of ranges) content = content.slice(0, start) + content.slice(end);
+  return content;
+}
+
+function ensureImageMcp(lines, enabled, adapterPort, adapterHost, previousBaseUrl) {
   const previous = lines.join("\n");
-  removeManagedImageMcp(lines);
+  const config = parseCodexToml(previous);
+  const section = configValue(config, IMAGE_MANAGED_PATH);
+  const url = `${adapterBaseUrl(imageMcpHost(adapterHost), adapterPort)}/mcp/image`;
+  if (section !== undefined) {
+    // Reuse compatible registrations without rewriting comments, formatting,
+    // user tool policies, or timeouts. An explicit disabled flag is preserved.
+    if (enabled && imageMcpUrl(section?.url)?.href === new URL(url).href
+      && [undefined, true].includes(section?.enabled)) return false;
+    const statements = codexTomlStatements(previous);
+    const markers = imageMcpMarkers(previous, statements);
+    if (!knownImageMcp(section, url, previousBaseUrl, statements, markers)) {
+      if (!enabled) return false;
+      throw new ImageMcpConfigError(`Codex config already defines [${IMAGE_MCP_SECTION}] outside the CCDX-managed block; its settings were preserved`);
+    }
+    const removed = removeImageMcpDeclarations(previous, statements, markers);
+    if (removed === null) {
+      if (!enabled) return false;
+      throw new ImageMcpConfigError(`Cannot safely update [${IMAGE_MCP_SECTION}] inside a shared inline table; its settings were preserved`);
+    }
+    lines.splice(0, lines.length, ...removed.split("\n"));
+    while (lines.length && !lines.at(-1).trim()) lines.pop();
+  }
   if (enabled) {
-    if (hasUnmanagedImageMcp(lines)) {
-      throw new Error(`Codex config already defines [${IMAGE_MCP_SECTION}] outside the CCDX-managed block`);
+    const parent = config.mcp_servers;
+    if (parent !== undefined && (typeof parent !== "object" || parent === null || Array.isArray(parent)
+      || codexTomlStatements(previous).some((item) => item.kind === "value" && sameKeys(item.keys, ["mcp_servers"])))) {
+      throw new ImageMcpConfigError("Cannot append the image MCP to an inline or non-table mcp_servers setting; its settings were preserved");
     }
     while (lines.length && lines.at(-1).trim() === "") lines.pop();
     if (lines.length) lines.push("");
-    const url = `${adapterBaseUrl(imageMcpHost(adapterHost), adapterPort)}/mcp/image`;
     lines.push(
       IMAGE_MCP_START,
       `[${IMAGE_MCP_SECTION}]`,
@@ -149,7 +211,6 @@ export function computeUpdatedCodexConfig(
   const baseUrl = `${adapterBaseUrl(adapterHost, adapterPort)}/v1`;
   const hadTrailingNewline = content.endsWith("\n");
   const lines = content.split("\n");
-  if (hadTrailingNewline) lines.pop();
 
   let changed = false;
   const openaiLine = `openai_base_url = "${baseUrl}"`;
@@ -166,10 +227,11 @@ export function computeUpdatedCodexConfig(
   changed = setTomlKey(lines, "shell_environment_policy.set", "OPENAI_API_KEY", "dummy") || changed;
   changed = ensureContextManagementDefault(lines) || changed;
   if (typeof imageProviderEnabled === "boolean") {
-    changed = ensureImageMcp(lines, imageProviderEnabled, adapterPort, adapterHost) || changed;
+    changed = ensureImageMcp(lines, imageProviderEnabled, adapterPort, adapterHost, config.openai_base_url) || changed;
   }
 
-  const updated = lines.join("\n") + (hadTrailingNewline ? "\n" : "");
+  const joined = lines.join("\n");
+  const updated = joined + (hadTrailingNewline && !joined.endsWith("\n") ? "\n" : "");
   validateManagedConfigEdit(config, updated, typeof imageProviderEnabled === "boolean"
     ? [...STARTUP_MANAGED_PATHS, IMAGE_MANAGED_PATH] : STARTUP_MANAGED_PATHS);
   return { content: updated, changed };
@@ -196,20 +258,26 @@ context_management = true
     : base;
 }
 
-export function computeImageMcpCodexConfig(
+function computeImageConfig(
   content,
   { enabled, adapterPort = 2026, adapterHost = "127.0.0.1" } = {},
+  previousBaseUrl,
 ) {
   const config = parseCodexToml(content);
   const hadTrailingNewline = content.endsWith("\n");
   const lines = content.split("\n");
-  if (hadTrailingNewline) lines.pop();
-  const changed = ensureImageMcp(lines, Boolean(enabled), adapterPort, adapterHost);
-  const updated = lines.join("\n") + (hadTrailingNewline || lines.length ? "\n" : "");
+  const changed = ensureImageMcp(lines, Boolean(enabled), adapterPort, adapterHost, previousBaseUrl ?? config.openai_base_url);
+  if (!changed) return { content, changed: false };
+  const joined = lines.join("\n");
+  const updated = joined + ((hadTrailingNewline || lines.length) && !joined.endsWith("\n") ? "\n" : "");
   validateManagedConfigEdit(config, updated, [IMAGE_MANAGED_PATH]);
   return { content: updated, changed };
 }
 
+export function computeImageMcpCodexConfig(content, options = {}) {
+  return computeImageConfig(content, options);
+}
+
 export function ensureCodexConfig(adapterPort = 2026, {
   filePath = CONFIG_PATH,
   host = "127.0.0.1",
@@ -217,26 +285,41 @@ export function ensureCodexConfig(adapterPort = 2026, {
 } = {}) {
   const baseUrl = `${adapterBaseUrl(host, adapterPort)}/v1`;
 
-  if (!fs.existsSync(filePath)) {
-    // Codex config does not exist yet; create the local proxy defaults.
-    atomicWriteFileIfChangedSync(filePath, initialCodexConfig(adapterPort, host, { imageProviderEnabled }));
-    console.log(status("ok", "Created ~/.codex/config.toml"));
-    return;
-  }
-
   let content;
   try {
     content = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(fs.readFileSync(filePath));
   } catch (error) {
-    if (error?.code !== "ERR_ENCODING_INVALID_ENCODED_DATA") throw error;
-    throw new Error("Codex configuration is not valid UTF-8 TOML; no configuration changes were written");
+    if (error?.code === "ERR_ENCODING_INVALID_ENCODED_DATA") {
+      throw new Error("Codex configuration is not valid UTF-8 TOML; no configuration changes were written");
+    }
+    if (error?.code !== "ENOENT") throw error;
   }
-  const updated = computeUpdatedCodexConfig(content, adapterPort, host, { imageProviderEnabled });
-
-  if (!updated.changed) {
+  // Commit essential configuration independently. Image-only parse/edit/write
+  // failures must not roll it back or close an otherwise usable GPT adapter.
+  const core = content === undefined
+    ? { content: initialCodexConfig(adapterPort, host), changed: true }
+    : computeUpdatedCodexConfig(content, adapterPort, host);
+  if (!core.changed) {
     console.log(status("ok", `Codex already points to ${baseUrl}`));
-    return;
+  } else {
+    atomicWriteFileIfChangedSync(filePath, core.content);
+    console.log(status("ok", content === undefined ? "Created ~/.codex/config.toml" : `Configured Codex base URL: ${baseUrl}`));
+  }
+  // Disabled means no image maintenance, including no implicit removal of old
+  // or user-owned entries. Explicit disable-image owns the cleanup operation.
+  if (!imageProviderEnabled) return { imageMcpSkipped: false };
+  try {
+    const previousBaseUrl = content === undefined ? undefined : parseCodexToml(content).openai_base_url;
+    const image = computeImageConfig(core.content, { enabled: true, adapterPort, adapterHost: host }, previousBaseUrl);
+    if (image.changed) {
+      if (fs.readFileSync(filePath, "utf8") !== core.content) {
+        throw new ImageMcpConfigError("Codex config changed during image setup; the newer configuration was preserved");
+      }
+      atomicWriteFileIfChangedSync(filePath, image.content);
+    }
+    return { imageMcpSkipped: false };
+  } catch (error) {
+    console.warn(status("warn", `Image MCP setup was skipped: ${error.message}. Core proxy startup will continue.`));
+    return { imageMcpSkipped: true };
   }
-  atomicWriteFileIfChangedSync(filePath, updated.content);
-  console.log(status("ok", `Configured Codex base URL: ${baseUrl}`));
 }