codex-copilot-dx 0.8.2 → 0.8.4

package/README.md

@@ -28,6 +28,8 @@ Codex App requests a versioned, capability-rich model catalog that is different
 
 CCDX exposes the GPT-6 Standard path and removes its unverified speed-tier metadata. It leaves the bundled reasoning-effort options unchanged, including Ultra when supplied by the installed catalog. GPT-5.6 Sol Fast follows the separate rule above. Versioned model discovery matches the bundled catalog to the client's `client_version`, caches it by application binary identity, and reloads it after an App update. If a matching usable catalog cannot be loaded, the versioned models request returns `503`; an unversioned request returns the Copilot-style list.
 
+`/v1/models` still attempts live discovery first. With a usable in-process catalog, it limits that upstream wait to 1.5 seconds (or a shorter configured upstream timeout) before falling back to last-known-good data. Without a catalog it retains the regular upstream timeout. Received HTTP `401`/`403` responses remain errors, not cached successes; fallback does not grant inference access. This does not change the explicitly live `ccdx models` command.
+
 ## Prerequisites
 
 - A GitHub account with Copilot access to the desired models
@@ -78,6 +80,8 @@ Normal startup and reuse of an existing adapter check `~/.codex/config.toml` onc
 
 The two token limits are fixed defaults, not detected model capabilities. Existing custom values are retained. Writes target the listed keys with format-preserving edits and atomic replacement; this is not a general TOML formatter. Quoted keys, quoted table headers, and explicit dotted shell-environment declarations are recognized; inline shell-environment tables are left intact. Startup and image configuration commands validate UTF-8/TOML and verify that unrelated settings retain their values before writing. An unsafe edit leaves the original file unchanged. Use `ccdx doctor config` to inspect parsed values and preview what this writer would do with the current file. No actual change means no file rewrite.
 
+Interactive image setup rereads the shared config after prompts and network validation, so unrelated changes made during setup are preserved. It checks the snapshot again before committing and rejects conflicting image declarations. Identical configuration bytes are not replaced; private file permissions may still be corrected. These checks reduce lost-update risks but are not a filesystem-wide transaction with other applications that do not share a lock.
+
 ## Version 0.7.0 migration
 
 CCDX 0.7.0 retires the former Claude App, Claude Code, Anthropic Messages API, isolated Claude account, and PM Studio patch integrations. Their setup, status, restore, profile, and routing commands are no longer supported.
@@ -147,10 +151,14 @@ ccdx enable-image
 
 The command accepts an HTTPS base URL or a full `/images/generations` endpoint, then asks for an API key without echoing the key. A bare origin such as `https://api.example` expands to `/v1/images/generations`; `https://api.example/v1` expands to the same endpoint. Custom base paths are retained, and existing full endpoints remain unchanged. CCDX uses GET for the corresponding `/models` catalog and POST for image requests; there is no endpoint-search or automatic fallback. It asks for a numeric model selection only when multiple image models are available, then detects either the standard OpenAI Images request format or the supported `input.messages` format for the selected model only. Its single validation request omits the prompt and does not generate an image.
 
+An empty key answer retains the saved key only when the normalized endpoint has the same origin (scheme, host, and port). Changing origins requires explicitly entering a key before any provider request; the old key is never automatically sent to a new origin.
+
 The provider credential is stored in `~/.config/codex-copilot-dx/image-provider.json`, or under `XDG_CONFIG_HOME`, with mode `0600`. The API key is never written to `~/.codex/config.toml`; that file receives only a marked local MCP entry pointing to the running CCDX adapter with a 210-second tool timeout. Only after enabling, CCDX installs `ccdx-image` guidance under `~/.codex/skills`, with a self-contained Node helper. The concise `SKILL.md` keeps operation selection, safety, and final-image delivery rules; editing details and helper instructions live in references read only for those operations. Codex uses the MCP tool directly, including through deferred tool search; an already-open task without that tool can use the helper to call the same local service and display the saved image. Neither route requires Python, an OpenAI SDK, or copying credentials. Built-in skills and unrelated tools are not modified.
 
 The enable command verifies the local MCP handshake and generation-tool directory without generating an image. It reports provider configuration separately from local service readiness; it cannot assert that every running Codex task has refreshed its catalog. Codex normally detects changed skills; restart Codex App once if an open task has not refreshed them. Normal CCDX startup installs or updates this guidance only for an already-enabled provider, without repeating API setup. Without `enable-image`, it installs neither this skill nor the MCP registration. Unchanged guidance is not rewritten. The existing adapter can remain running because provider settings are loaded when the tool is invoked.
 
+Existing compatible `ccdx_image` registrations are reused without requiring CCDX's comment markers or resetting user timeouts/tool policies. Missing or damaged markers alone do not block startup. Core GPT configuration is committed independently before optional image maintenance: image configuration conflicts, image-only write failures, or Skill maintenance failures warn without aborting the core service. No new image guidance is installed after failed image configuration. With images disabled or their provider configuration invalid/unreadable, normal startup performs no image configuration maintenance, Skill installation, or image-network probe; explicit `disable-image` owns cleanup. Automatic updates/removal are limited to recognizable CCDX defaults and isolated TOML declarations, never everything between two comments. Ambiguous shared-inline or customized registrations are left intact; `disable-image` still disables the CCDX provider and removes its owned guidance. Invalid TOML/UTF-8 in the shared Codex config or a failed essential core configuration write remains an explicit error rather than a silent success.
+
 Direct MCP generations and edits retain their original inline image content and editing ID, and also save the exact image bytes privately under `~/.local/share/codex-copilot-dx/images`. The result includes ready-to-use image Markdown for Codex's final chat reply, so the image appears as a clickable thumbnail instead of only inside a tool result. Files use unique names and are not overwritten or removed on adapter restart. Asking to show the same image again reuses its existing Markdown, not a new generation or edit. If saving fails, CCDX still returns the generated image content, reports the delivery failure, and does not retry the provider or invent a file path. The bundled helper continues saving once at its existing output location, without a second adapter-side copy. Existing enabled users receive updated, unmodified CCDX-owned guidance on the next CCDX startup; no new setup command is needed.
 
 Inspect or disable the optional provider with:
@@ -235,7 +243,9 @@ For the complete machine-readable status payload:
 curl -s http://127.0.0.1:2026/_ccdx/status | jq
 ```
 
-The status endpoint is restricted to the socket's real loopback address even when LAN binding is explicitly enabled. It reports fixed-size request counters, bounded TTFT/TPOT histograms, admission pressure, memory use, response-history size, image queue/cache and adaptive-history state, model-cache counts, token expiry state, and the ten most recent upstream `response.failed` diagnostics retained by the running process. Failure diagnostics include the event type, model, error code/message, response/request IDs when supplied upstream, and retry outcome; long opaque encrypted values are redacted. They are cleared when the adapter restarts. The endpoint never includes prompts, completions, tool arguments, image content, account names, or token values.
+The status endpoint is restricted to the socket's real loopback address even when LAN binding is explicitly enabled. It reports fixed-size request counters, bounded TTFT/TPOT histograms, admission pressure, memory use, response-history size, image queue/cache and adaptive-history state, model-cache counts, token expiry state, and the ten most recent upstream `response.failed` diagnostics retained by the running process. Failure diagnostics include the event type, model, error code/message, response/request IDs when supplied upstream, and retry outcome. Common credential forms, long opaque encrypted values, and explicitly labelled input/prompt/tool-content echoes are redacted. They are cleared when the adapter restarts. No request/response bodies, credential fields, or account profiles are copied into status. Arbitrary upstream prose cannot be guaranteed free of sensitive content; review diagnostics before sharing them.
+
+`image_mcp` has its own HTTP route counter. After the image handler has been used, `image_generation` separately reports active, succeeded, failed, busy, cancelled, and chat-file delivery-failure counts, including tool errors returned with HTTP 200. A delivery failure can accompany a successful generation; it never causes another generation. Before handler initialization this field is `null`, meaning not observed, not necessarily disabled. Status never initializes that handler, reads its provider credential, installs guidance, or probes the provider. Input-image optimization metrics remain separate. `logging` reports pending records/bytes, queue caps, overflow drops, and write failures for usage and enabled debug-file logging.
 
 `stream_performance.by_route` also reports `request_ttft_ms`, measured from adapter entry to the first observed output delta, including local preparation. The existing `ttft_ms` continues to start at upstream dispatch. Neither timestamp means the client has drained or displayed the output. `preparation_ms` contains bounded histograms for admission (including history reservations), body reading/decompression/JSON parsing, history materialization/compact preparation, image optimization, and request serialization. Each sample measures one operation, including failed operations; retries can add samples. These are diagnostic intervals rather than a complete breakdown of request time: body reading includes internal decoded-body admission waits; authentication, routing, and other preparation are not individually timed. Non-streaming requests contribute preparation samples without inventing a first-token measurement.
 
@@ -267,7 +277,7 @@ Recovery first tries compatible local credentials and starts Device Flow only wh
 - The GitHub OAuth credential is stored locally at `~/.local/share/copilot-api/github_token`. Short-lived Copilot service tokens remain in process memory and are refreshed as needed.
 - The optional image API credential is stored separately with mode `0600` only after `ccdx enable-image`; it is never placed in Codex configuration or diagnostic output.
 - Runtime status and usage records retain metadata rather than request/response content. Diagnostic logging records status and error messages; it is not a general redaction layer for arbitrary error text. See Debug logging before sharing logs.
-- Request and response bodies are bounded. Queues, history, image work, SSE parsing, retries, and shutdown all have explicit resource or time limits.
+- Request/response bodies, request-admission queues, retained history, image work, SSE buffers, log queues, retries, and shutdown have explicit limits. These component limits are not a single process-wide memory ceiling; completed image files are persistent user artifacts, not an automatically evicted cache.
 
 ## Configuration
 
@@ -331,9 +341,11 @@ ccdx usage
 
 The summary covers the current log and its single rotated backup, not an unbounded lifetime history. It reports recorded responses and per-model input, cache-read, output, and total token metadata.
 
+Usage writes are asynchronous and batched under the existing cross-process rotation lock. Pending and in-flight records share a 4096-record / 4 MiB ceiling. If either ceiling is reached, new excess records are dropped with a warning and a status counter; inference does not wait or retry. Normal records and per-record rotation boundaries are unchanged. The bounded shutdown flush remains 1.5 seconds; disk failures and shutdown deadlines can prevent persistence, so usage is diagnostic rather than a billing ledger.
+
 ## Debug logging
 
-Set `CCDX_LOG_PATH=1` to mirror terminal logs to `~/.local/share/codex-copilot-dx/debug.log`, or provide a custom path. Add `CCDX_LOG_LEVEL=debug` for upstream attempts, retry causes, status codes, and timings. The adapter does not deliberately dump request/response bodies or authorization headers. The log mirror writes console text verbatim, including diagnostic/error messages that can originate in external components, so review logs before sharing them. `ccdx doctor config` bypasses file logging entirely.
+Set `CCDX_LOG_PATH=1` to mirror terminal logs to `~/.local/share/codex-copilot-dx/debug.log`, or provide a custom path. Add `CCDX_LOG_LEVEL=debug` for upstream attempts, retry causes, status codes, and timings. The adapter does not deliberately dump request/response bodies or authorization headers. File diagnostics redact common credential forms and labelled content echoes, but this cannot identify every secret in arbitrary external prose; review logs before sharing them. File writes are asynchronous and batched with a 4096-record / 2 MiB pending-and-in-flight ceiling. Overflow drops excess file records with one warning and a status counter; terminal output continues. CLI exit paths flush for at most 1.5 seconds. `ccdx doctor config` bypasses file logging entirely.
 
 ## Large histories and images
 
@@ -357,6 +369,8 @@ Changing the model or transport of a continuation can require removing incompati
 
 After the stream handshake succeeds, stream liveness uses the idle timeout rather than the expired handshake deadline. Eligible HTTP-200 failure recovery acquires a bounded preparation budget and history admission before rebuilding its payload, then releases those reservations when the retry opens upstream or fails. Normal streams still release preparation admission after their response headers arrive.
 
+Downstream backpressure waits also observe cancellation and the stream deadline. A client that stops reading cannot retain the pending stream indefinitely after timeout; CCDX closes that connection without retrying its request. Final error-frame delivery has a separate one-second maximum drain wait.
+
 Successful streaming responses are accepted only when the upstream body is SSE and reaches its protocol terminal event. Unexpected EOF becomes a protocol-native stream error, and repeated blank tool-argument deltas are stopped per tool call. Allowlisted rate-limit, retry, model, trace, and upstream request-ID metadata are forwarded; cookies, authorization, body-length, and encoding headers are not.
 
 CCDX keeps each native Responses message on its first upstream ID when Copilot changes that ID during streaming. Message deltas, completion events, and cached history stay consistent, addressing this cause of duplicate live messages in Codex App. Tool identities, reasoning/encrypted content, message phases, and speed-tier routing are unchanged by this ID normalization. Stable events retain their original SSE bytes; changed events are rewritten with bounded, backpressured streaming.

package/bin/cli.mjs

@@ -229,8 +229,8 @@ async function reuseRunningAdapterIfAvailable() {
 
 async function configureCodexClient() {
   const imageProviderEnabled = Boolean(readImageProviderConfig());
-  ensureCodexConfig(ADAPTER_PORT, { host: ADAPTER_HOST, imageProviderEnabled });
-  if (imageProviderEnabled) {
+  const { imageMcpSkipped } = ensureCodexConfig(ADAPTER_PORT, { host: ADAPTER_HOST, imageProviderEnabled });
+  if (imageProviderEnabled && !imageMcpSkipped) {
     try {
       const { syncEnabledImageSkill } = await import("../src/cli-image.mjs");
       syncEnabledImageSkill({ adapterPort: ADAPTER_PORT, adapterHost: ADAPTER_HOST });
@@ -248,6 +248,7 @@ if (CLI.command === "doctor") {
     online: CLI.online,
     compat: CLI.compat,
   });
+  await LOGGING.cleanup();
   process.exit(checks.some((check) => check.kind === "err") ? 1 : 0);
 }
 
@@ -270,7 +271,10 @@ async function printUpdateNotice() {
 try {
   assertSafeAdapterHost(ADAPTER_HOST, process.env);
   void runInBackground(printUpdateNotice);
-  if (await reuseRunningAdapterIfAvailable()) process.exit(0);
+  if (await reuseRunningAdapterIfAvailable()) {
+    await LOGGING.cleanup();
+    process.exit(0);
+  }
 
   // Ensure GitHub login, using device flow if no token exists.
   await ensureAuth();
@@ -347,7 +351,7 @@ try {
       exitCode = 1;
       console.error(status("err", `Shutdown failed: ${e.message}`));
     } finally {
-      LOGGING.cleanup();
+      await LOGGING.cleanup();
       process.exit(exitCode);
     }
   };
@@ -357,6 +361,6 @@ try {
   console.error(status("err", e.message));
   await closeHttpServer(activeServer, { timeoutMs: RUNTIME.shutdownTimeoutMs }).catch(() => {});
   await flushUsageWrites();
-  LOGGING.cleanup();
+  await LOGGING.cleanup();
   process.exit(1);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-copilot-dx",
-  "version": "0.8.2",
+  "version": "0.8.4",
   "description": "Use Codex App with GitHub Copilot",
   "author": "Dale Xiao",
   "type": "module",

package/src/adapter.mjs

@@ -213,6 +213,7 @@ export function createAdapterHandler(options = {}) {
         admission: acquireRequest,
         imagePressure,
         responseFailures,
+        imageGeneration: imageMcpHandler?.stats?.(),
         modelRegistry: codexModelRegistry,
         codexClient,
         codexModelRegistry,
@@ -237,7 +238,12 @@ export function createAdapterHandler(options = {}) {
     if (req.method === "GET" && pathname === "/v1/models") {
       const clientVersion = modelClientVersion(req.url);
       const abort = createRequestAbort(req, res);
-      abort.setTimeout(upstreamTimeoutMs);
+      // Keep live discovery and explicit auth failures authoritative, but do
+      // not make a usable cached picker wait the full inference timeout.
+      const modelTimeoutMs = isValidModelList(codexModelRegistry?.models)
+        ? Math.min(upstreamTimeoutMs, parsePositiveInteger(options.cachedModelsTimeoutMs, 1500))
+        : upstreamTimeoutMs;
+      abort.setTimeout(modelTimeoutMs);
       listModelsFn({ signal: abort.signal })
         .then(async ({ status, body }) => {
           abort.clearTimeout();

package/src/cli-image.mjs

@@ -3,7 +3,7 @@ import os from "node:os";
 import path from "node:path";
 import readline from "node:readline";
 import { createInterface } from "node:readline/promises";
-import { atomicWriteFilePairSync } from "./atomic-file.mjs";
+import { atomicWriteFileIfChangedSync, atomicWriteFilePairSync } from "./atomic-file.mjs";
 import { terminalCell } from "./cli-table.mjs";
 import { computeImageMcpCodexConfig } from "./config.mjs";
 import { probeImageTool } from "./image-readiness.mjs";
@@ -11,6 +11,7 @@ import { updateImageSkill } from "./image-skill.mjs";
 import {
   imageProviderConfigPath,
   inspectImageProvider,
+  normalizeImageEndpoint,
   readImageProviderConfig,
   validateImageProviderConfig,
 } from "./image-provider-config.mjs";
@@ -110,12 +111,15 @@ function enableImageProvider({ providerConfig, providerPath, codexPath, codexCon
   const normalized = validateImageProviderConfig(providerConfig, { filePath: providerPath });
   const skill = updateImageSkill({ enabled: true, codexPath, adapterPort, adapterHost });
   try {
+    if (fileContent(codexPath) !== codexContent) {
+      throw new Error("Codex configuration changed during image setup; retry to preserve the newer settings");
+    }
     atomicWriteFilePairSync(
       codexPath,
       codex.content,
       providerPath,
       `${JSON.stringify(normalized, null, 2)}\n`,
-      { mode: 0o600 },
+      { mode: 0o600, writeFile: atomicWriteFileIfChangedSync },
     );
   } catch (error) {
     skill.rollback();
@@ -134,7 +138,12 @@ function disableImageProvider({ providerPath, codexPath, codexContent, adapterPo
   const skill = updateImageSkill({ enabled: false, codexPath, adapterPort, adapterHost });
   try {
     if (fs.existsSync(codexPath)) {
-      atomicWriteFilePairSync(codexPath, codex.content, providerPath, null, { mode: 0o600 });
+      if (fileContent(codexPath) !== codexContent) {
+        throw new Error("Codex configuration changed during image cleanup; retry to preserve the newer settings");
+      }
+      atomicWriteFilePairSync(codexPath, codex.content, providerPath, null, {
+        mode: 0o600, writeFile: atomicWriteFileIfChangedSync,
+      });
     } else if (providerExists) {
       fs.unlinkSync(providerPath);
     }
@@ -203,10 +212,11 @@ export async function runImageCommand({
   output.write(`${commandName} enable-image\n`);
   output.write("Enter an HTTPS base URL (for example, https://api.example/v1) or a full /images/generations endpoint.\n");
   const endpointAnswer = String(await ask(`API base URL or endpoint${current ? ` [${current.endpoint}]` : ""}: `) || "").trim();
-  const endpoint = endpointAnswer || current?.endpoint;
-  if (!endpoint) throw new Error("Image API base URL or endpoint is required");
-  const keyAnswer = String(await askSecret(`API key${current ? " [Enter to keep current]" : ""}: `) || "").trim();
-  const apiKey = keyAnswer || current?.api_key;
+  if (!endpointAnswer && !current?.endpoint) throw new Error("Image API base URL or endpoint is required");
+  const endpoint = normalizeImageEndpoint(endpointAnswer || current.endpoint);
+  const sameOrigin = current && new URL(endpoint).origin === new URL(current.endpoint).origin;
+  const keyAnswer = String(await askSecret(`API key${sameOrigin ? " [Enter to keep current]" : current ? " [new origin; enter a key]" : ""}: `) || "").trim();
+  const apiKey = keyAnswer || (sameOrigin ? current.api_key : undefined);
   if (!apiKey) throw new Error("Image API key is required");
 
   output.write("Checking image API...\n");
@@ -227,7 +237,9 @@ export async function runImageCommand({
     },
     providerPath,
     codexPath,
-    codexContent,
+    // Prompts and provider validation may take minutes. Merge into the latest
+    // shared file rather than replacing edits made while we were waiting.
+    codexContent: fileContent(codexPath),
     adapterPort,
     adapterHost,
   });

package/src/cli-options.mjs

@@ -302,7 +302,7 @@ function topicHelp(name, topic) {
     models: `Usage:\n  ${name} models [--format table|plain]\n\nPerforms a fresh, read-only Copilot model-directory lookup for the saved account. Interactive terminals use a table by default.`,
     usage: `Usage:\n  ${name} usage [--format table|plain]\n\nSummarizes local token usage metadata without reading prompt or completion content. Interactive terminals use a table by default.`,
     animation: `Usage:\n  ${name} animation\n\nPreviews all terminal activity animations together and selects the theme used the next time the adapter starts.`,
-    "enable-image": `Usage:\n  ${name} enable-image\n\nInteractively configures an HTTPS image API endpoint (base URLs are also accepted) and API key, detects its supported image model and protocol, installs CCDX image guidance, and checks the local image tool for Codex App without generating an image.`,
+    "enable-image": `Usage:\n  ${name} enable-image\n\nInteractively configures an HTTPS image API endpoint (base URLs are also accepted) and API key, detects its supported image model and protocol, installs CCDX image guidance, and checks the local image tool for Codex App without generating an image. A blank key preserves the saved key only for the same origin; a new origin requires explicit key entry. Concurrent unrelated config edits are preserved.`,
     "disable-image": `Usage:\n  ${name} disable-image\n\nDisables the local CCDX image tool and removes its stored API credential and unmodified CCDX image guidance.`,
     "image-status": `Usage:\n  ${name} image-status\n\nShows provider configuration and probes local image-tool readiness without generating an image or exposing its API key.`,
     "auto-review-model": `Usage:\n  ${name} auto-review-model\n\nInteractively selects an advertised Responses model for Codex Auto-review.`,

package/src/cli-status.mjs

@@ -158,6 +158,17 @@ export function formatAdapterStatus({ baseUrl, data }, { commandName = "ccdx", c
   if (imageHistory && typeof imageHistory === "object") {
     lines.push(status("info", `Visual history: ${count(imageHistory.active_recovery_trees)} recovery trees, ${count(imageHistory.adapted_requests)} adapted requests, ${count(imageHistory.historical_images_omitted)} older images omitted, ${count(imageHistory.timeouts_recorded)} timeouts`));
   }
+  if (data.image_generation) {
+    const generation = data.image_generation;
+    lines.push(status("info", `Image generation: ${count(generation.active)} active, ${count(generation.succeeded)} succeeded, ${count(generation.failed)} failed (${count(generation.busy)} busy), ${count(generation.cancelled)} cancelled, ${count(generation.delivery_failures)} delivery failures`));
+  }
+  if (data.logging) {
+    for (const [name, logging] of Object.entries(data.logging)) {
+      if (logging?.enabled === false) continue;
+      lines.push(status(logging.dropped_records || logging.write_failures ? "warn" : "info",
+        `${name === "usage" ? "Usage" : "Debug"} logging: ${count(logging.pending_records)} pending (${mebibytes(logging.pending_bytes)}), ${count(logging.dropped_records)} dropped, ${count(logging.write_failures)} write failures`));
+    }
+  }
   if (responseFailures && typeof responseFailures === "object") {
     lines.push(status("info", `Response failures: ${count(responseFailures.total)} observed, ${count(responseFailures.retried)} compatibility retries`));
     for (const failure of Array.isArray(responseFailures.recent) ? responseFailures.recent.slice(-3).reverse() : []) {

package/src/config.mjs

@@ -4,6 +4,7 @@ import os from "node:os";
 import { status } from "./status.mjs";
 import { atomicWriteFileIfChangedSync } from "./atomic-file.mjs";
 import { adapterBaseUrl } from "./running-adapter.mjs";
+import { isLoopbackHost } from "./security.mjs";
 import { codexTomlStatements, configValue, parseCodexToml, validateManagedConfigEdit } from "./config-toml.mjs";
 
 const CONFIG_PATH = path.join(os.homedir(), ".codex", "config.toml");
@@ -12,6 +13,10 @@ const MODEL_AUTO_COMPACT_TOKEN_LIMIT = 900_000;
 const IMAGE_MCP_START = "# ccdx:image-mcp:start";
 const IMAGE_MCP_END = "# ccdx:image-mcp:end";
 const IMAGE_MCP_SECTION = "mcp_servers.ccdx_image";
+const IMAGE_MCP_KEYS = ["enabled", "tool_timeout_sec", "url"];
+
+// Only optional image-configuration conflicts may degrade to core-only startup.
+export class ImageMcpConfigError extends Error {}
 const STARTUP_MANAGED_PATHS = [
   "openai_base_url",
   "model_context_window",
@@ -92,41 +97,98 @@ function imageMcpHost(adapterHost) {
   return host;
 }
 
-function removeManagedImageMcp(lines) {
-  const comments = codexTomlStatements(lines.join("\n")).filter((item) => item.kind === "comment");
-  const starts = comments.filter((item) => lines[item.line] === IMAGE_MCP_START).map((item) => item.line);
-  const ends = comments.filter((item) => lines[item.line] === IMAGE_MCP_END).map((item) => item.line);
-  let start = starts[0] ?? -1;
-  const end = ends[0] ?? -1;
-  if (start === -1 && end === -1) return false;
-  if (starts.length !== 1 || ends.length !== 1 || end < start) {
-    throw new Error("Invalid managed CCDX image MCP block in Codex config");
-  }
-  lines.splice(start, end - start + 1);
-  while (start > 0 && start >= lines.length && lines[start - 1].trim() === "") {
-    lines.splice(start - 1, 1);
-    start -= 1;
-  }
-  while (start < lines.length && lines[start].trim() === "" && start > 0 && lines[start - 1].trim() === "") {
-    lines.splice(start, 1);
-  }
-  return true;
+function imageMcpUrl(value) {
+  if (typeof value !== "string" || /[\s\x00-\x1f\x7f]/.test(value)) return null;
+  try {
+    const url = new URL(value);
+    return url.protocol === "http:" && url.pathname === "/mcp/image"
+      && !url.username && !url.password && !url.search && !url.hash ? url : null;
+  } catch { return null; }
+}
+
+function isImageDeclaration(item) {
+  return ["table", "value"].includes(item.kind)
+    && sameKeys(item.keys.slice(0, IMAGE_MANAGED_PATH.length), IMAGE_MANAGED_PATH);
+}
+
+function imageMcpMarkers(content, statements) {
+  return statements.filter((item) => item.kind === "comment"
+    && [IMAGE_MCP_START, IMAGE_MCP_END].includes(item.source.trim())
+    && !content.slice(content.lastIndexOf("\n", item.start - 1) + 1, item.start).trim());
 }
 
-function hasUnmanagedImageMcp(lines) {
-  return configValue(parseCodexToml(lines.join("\n")), IMAGE_MANAGED_PATH) !== undefined;
+function knownImageMcp(section, expectedUrl, previousBaseUrl, statements, markers) {
+  if (!section || Object.keys(section).sort().join(",") !== IMAGE_MCP_KEYS.join(",")
+    || section.enabled !== true || section.tool_timeout_sec !== 210n) return false;
+  const url = imageMcpUrl(section.url);
+  if (!url) return false;
+  if (url.href === new URL(expectedUrl).href) return true;
+  // The core and image URLs were configured together. This survives comment
+  // stripping and allows an adapter address change without guessing a new owner.
+  try {
+    const previous = new URL(previousBaseUrl);
+    if (previous.protocol === "http:" && previous.pathname === "/v1"
+      && !previous.username && !previous.password && !previous.search && !previous.hash
+      && previous.origin === url.origin
+      && (isLoopbackHost(url.hostname) || url.hostname === new URL(expectedUrl).hostname)) return true;
+  } catch {}
+  // Legacy markers are an additional ownership hint, never deletion boundaries.
+  const starts = markers.filter((item) => item.source.trim() === IMAGE_MCP_START);
+  const ends = markers.filter((item) => item.source.trim() === IMAGE_MCP_END);
+  if (starts.length !== 1 || ends.length !== 1 || starts[0].start >= ends[0].start
+    || !(isLoopbackHost(url.hostname) || url.hostname === new URL(expectedUrl).hostname)) return false;
+  const declarations = statements.filter((item) => ["table", "value"].includes(item.kind));
+  return declarations.some(isImageDeclaration)
+    && declarations.filter(isImageDeclaration).every((item) => item.start > starts[0].start && item.end < ends[0].start)
+    && declarations.filter((item) => item.start > starts[0].start && item.start < ends[0].start).every(isImageDeclaration);
 }
 
-function ensureImageMcp(lines, enabled, adapterPort, adapterHost) {
+function removeImageMcpDeclarations(content, statements, markers) {
+  const declarations = statements.filter(isImageDeclaration);
+  // A shared inline parent is not a surgical edit target. Reuse it unchanged or
+  // leave it for the user; never serialize away sibling settings or credentials.
+  if (!declarations.length) return null;
+  const ranges = [...declarations, ...markers].map((item) => {
+    const start = content.lastIndexOf("\n", item.start - 1) + 1;
+    const newline = content.indexOf("\n", item.end);
+    return [start, newline < 0 ? content.length : newline + 1];
+  }).sort((left, right) => right[0] - left[0]);
+  for (const [start, end] of ranges) content = content.slice(0, start) + content.slice(end);
+  return content;
+}
+
+function ensureImageMcp(lines, enabled, adapterPort, adapterHost, previousBaseUrl) {
   const previous = lines.join("\n");
-  removeManagedImageMcp(lines);
+  const config = parseCodexToml(previous);
+  const section = configValue(config, IMAGE_MANAGED_PATH);
+  const url = `${adapterBaseUrl(imageMcpHost(adapterHost), adapterPort)}/mcp/image`;
+  if (section !== undefined) {
+    // Reuse compatible registrations without rewriting comments, formatting,
+    // user tool policies, or timeouts. An explicit disabled flag is preserved.
+    if (enabled && imageMcpUrl(section?.url)?.href === new URL(url).href
+      && [undefined, true].includes(section?.enabled)) return false;
+    const statements = codexTomlStatements(previous);
+    const markers = imageMcpMarkers(previous, statements);
+    if (!knownImageMcp(section, url, previousBaseUrl, statements, markers)) {
+      if (!enabled) return false;
+      throw new ImageMcpConfigError(`Codex config already defines [${IMAGE_MCP_SECTION}] outside the CCDX-managed block; its settings were preserved`);
+    }
+    const removed = removeImageMcpDeclarations(previous, statements, markers);
+    if (removed === null) {
+      if (!enabled) return false;
+      throw new ImageMcpConfigError(`Cannot safely update [${IMAGE_MCP_SECTION}] inside a shared inline table; its settings were preserved`);
+    }
+    lines.splice(0, lines.length, ...removed.split("\n"));
+    while (lines.length && !lines.at(-1).trim()) lines.pop();
+  }
   if (enabled) {
-    if (hasUnmanagedImageMcp(lines)) {
-      throw new Error(`Codex config already defines [${IMAGE_MCP_SECTION}] outside the CCDX-managed block`);
+    const parent = config.mcp_servers;
+    if (parent !== undefined && (typeof parent !== "object" || parent === null || Array.isArray(parent)
+      || codexTomlStatements(previous).some((item) => item.kind === "value" && sameKeys(item.keys, ["mcp_servers"])))) {
+      throw new ImageMcpConfigError("Cannot append the image MCP to an inline or non-table mcp_servers setting; its settings were preserved");
     }
     while (lines.length && lines.at(-1).trim() === "") lines.pop();
     if (lines.length) lines.push("");
-    const url = `${adapterBaseUrl(imageMcpHost(adapterHost), adapterPort)}/mcp/image`;
     lines.push(
       IMAGE_MCP_START,
       `[${IMAGE_MCP_SECTION}]`,
@@ -149,7 +211,6 @@ export function computeUpdatedCodexConfig(
   const baseUrl = `${adapterBaseUrl(adapterHost, adapterPort)}/v1`;
   const hadTrailingNewline = content.endsWith("\n");
   const lines = content.split("\n");
-  if (hadTrailingNewline) lines.pop();
 
   let changed = false;
   const openaiLine = `openai_base_url = "${baseUrl}"`;
@@ -166,10 +227,11 @@ export function computeUpdatedCodexConfig(
   changed = setTomlKey(lines, "shell_environment_policy.set", "OPENAI_API_KEY", "dummy") || changed;
   changed = ensureContextManagementDefault(lines) || changed;
   if (typeof imageProviderEnabled === "boolean") {
-    changed = ensureImageMcp(lines, imageProviderEnabled, adapterPort, adapterHost) || changed;
+    changed = ensureImageMcp(lines, imageProviderEnabled, adapterPort, adapterHost, config.openai_base_url) || changed;
   }
 
-  const updated = lines.join("\n") + (hadTrailingNewline ? "\n" : "");
+  const joined = lines.join("\n");
+  const updated = joined + (hadTrailingNewline && !joined.endsWith("\n") ? "\n" : "");
   validateManagedConfigEdit(config, updated, typeof imageProviderEnabled === "boolean"
     ? [...STARTUP_MANAGED_PATHS, IMAGE_MANAGED_PATH] : STARTUP_MANAGED_PATHS);
   return { content: updated, changed };
@@ -196,20 +258,26 @@ context_management = true
     : base;
 }
 
-export function computeImageMcpCodexConfig(
+function computeImageConfig(
   content,
   { enabled, adapterPort = 2026, adapterHost = "127.0.0.1" } = {},
+  previousBaseUrl,
 ) {
   const config = parseCodexToml(content);
   const hadTrailingNewline = content.endsWith("\n");
   const lines = content.split("\n");
-  if (hadTrailingNewline) lines.pop();
-  const changed = ensureImageMcp(lines, Boolean(enabled), adapterPort, adapterHost);
-  const updated = lines.join("\n") + (hadTrailingNewline || lines.length ? "\n" : "");
+  const changed = ensureImageMcp(lines, Boolean(enabled), adapterPort, adapterHost, previousBaseUrl ?? config.openai_base_url);
+  if (!changed) return { content, changed: false };
+  const joined = lines.join("\n");
+  const updated = joined + ((hadTrailingNewline || lines.length) && !joined.endsWith("\n") ? "\n" : "");
   validateManagedConfigEdit(config, updated, [IMAGE_MANAGED_PATH]);
   return { content: updated, changed };
 }
 
+export function computeImageMcpCodexConfig(content, options = {}) {
+  return computeImageConfig(content, options);
+}
+
 export function ensureCodexConfig(adapterPort = 2026, {
   filePath = CONFIG_PATH,
   host = "127.0.0.1",
@@ -217,26 +285,41 @@ export function ensureCodexConfig(adapterPort = 2026, {
 } = {}) {
   const baseUrl = `${adapterBaseUrl(host, adapterPort)}/v1`;
 
-  if (!fs.existsSync(filePath)) {
-    // Codex config does not exist yet; create the local proxy defaults.
-    atomicWriteFileIfChangedSync(filePath, initialCodexConfig(adapterPort, host, { imageProviderEnabled }));
-    console.log(status("ok", "Created ~/.codex/config.toml"));
-    return;
-  }
-
   let content;
   try {
     content = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(fs.readFileSync(filePath));
   } catch (error) {
-    if (error?.code !== "ERR_ENCODING_INVALID_ENCODED_DATA") throw error;
-    throw new Error("Codex configuration is not valid UTF-8 TOML; no configuration changes were written");
+    if (error?.code === "ERR_ENCODING_INVALID_ENCODED_DATA") {
+      throw new Error("Codex configuration is not valid UTF-8 TOML; no configuration changes were written");
+    }
+    if (error?.code !== "ENOENT") throw error;
   }
-  const updated = computeUpdatedCodexConfig(content, adapterPort, host, { imageProviderEnabled });
-
-  if (!updated.changed) {
+  // Commit essential configuration independently. Image-only parse/edit/write
+  // failures must not roll it back or close an otherwise usable GPT adapter.
+  const core = content === undefined
+    ? { content: initialCodexConfig(adapterPort, host), changed: true }
+    : computeUpdatedCodexConfig(content, adapterPort, host);
+  if (!core.changed) {
     console.log(status("ok", `Codex already points to ${baseUrl}`));
-    return;
+  } else {
+    atomicWriteFileIfChangedSync(filePath, core.content);
+    console.log(status("ok", content === undefined ? "Created ~/.codex/config.toml" : `Configured Codex base URL: ${baseUrl}`));
+  }
+  // Disabled means no image maintenance, including no implicit removal of old
+  // or user-owned entries. Explicit disable-image owns the cleanup operation.
+  if (!imageProviderEnabled) return { imageMcpSkipped: false };
+  try {
+    const previousBaseUrl = content === undefined ? undefined : parseCodexToml(content).openai_base_url;
+    const image = computeImageConfig(core.content, { enabled: true, adapterPort, adapterHost: host }, previousBaseUrl);
+    if (image.changed) {
+      if (fs.readFileSync(filePath, "utf8") !== core.content) {
+        throw new ImageMcpConfigError("Codex config changed during image setup; the newer configuration was preserved");
+      }
+      atomicWriteFileIfChangedSync(filePath, image.content);
+    }
+    return { imageMcpSkipped: false };
+  } catch (error) {
+    console.warn(status("warn", `Image MCP setup was skipped: ${error.message}. Core proxy startup will continue.`));
+    return { imageMcpSkipped: true };
   }
-  atomicWriteFileIfChangedSync(filePath, updated.content);
-  console.log(status("ok", `Configured Codex base URL: ${baseUrl}`));
 }

package/src/diagnostic-text.mjs

@@ -0,0 +1,11 @@
+// Diagnostics are not a copy of the upstream payload. Keep useful error text,
+// but remove common credential forms and explicitly labelled content echoes.
+export function redactDiagnosticText(value) {
+  return String(value ?? "")
+    .replace(/\bBearer\s+[^\s,;"'<>]+/gi, "Bearer [redacted]")
+    .replace(/\b(?:github_pat_|gh[pousr]_|sk-|copilot_)[A-Za-z0-9._-]+/gi, "[redacted]")
+    .replace(/((?:api[_-]?key|access[_-]?token|refresh[_-]?token|authorization|cookie)["']?\s*[:=]\s*)(?:"[^"\n]*"|'[^'\n]*'|[^\s,;]+)/gi, "$1[redacted]")
+    .replace(/((?:prompt|input|completion|tool_arguments|arguments|content)["']?\s*[:=]\s*)[^\n]+/gi, "$1[redacted]")
+    .replace(/(encrypted(?: function output)? content\s+)[A-Za-z0-9+/_=-]{24,}/gi, "$1[redacted]")
+    .replace(/\b[A-Za-z0-9+/_=-]{96,}\b/g, "[redacted]");
+}

package/src/file-rotation.mjs

@@ -28,3 +28,37 @@ export function rotateFileIfNeededSync(filePath, incomingBytes, maxBytes) {
   fs.renameSync(filePath, backupPath);
   return true;
 }
+
+// Callers serialize writers (usage also holds its cross-process file lock).
+// Group adjacent lines without changing the existing per-record rotation rule.
+export async function appendRotatingLines(filePath, lines, maxBytes) {
+  let size = 0;
+  try {
+    const stat = await fs.promises.stat(filePath);
+    if (!stat.isFile()) throw new Error("Log destination is not a regular file");
+    size = stat.size;
+  }
+  catch (error) { if (error?.code !== "ENOENT") throw error; }
+  let group = [];
+  let bytes = 0;
+  const flush = async () => {
+    if (!group.length) return;
+    await fs.promises.appendFile(filePath, group.join(""), { encoding: "utf8", mode: 0o600 });
+    group = [];
+    bytes = 0;
+  };
+  for (const line of lines) {
+    const length = Buffer.byteLength(line);
+    if (maxBytes > 0 && size > 0 && size + length > maxBytes) {
+      await flush();
+      await fs.promises.rm(rotatedFilePath(filePath), { force: true });
+      await fs.promises.rename(filePath, rotatedFilePath(filePath));
+      size = 0;
+    }
+    group.push(line);
+    size += length;
+    bytes += length;
+    if (bytes >= 256 * 1024) await flush();
+  }
+  await flush();
+}

package/src/http-transport.mjs

@@ -3,6 +3,7 @@ import * as zlib from "node:zlib";
 import { loadRuntimeConfig, parsePositiveInteger } from "./runtime-config.mjs";
 import { status } from "./status.mjs";
 import { safeUpstreamResponseHeaders } from "./upstream-headers.mjs";
+import { redactDiagnosticText } from "./diagnostic-text.mjs";
 
 const COMPRESSED_BODY_WEIGHT_MULTIPLIER = 4;
 const gunzipAsync = promisify(zlib.gunzip);
@@ -730,21 +731,29 @@ export function sendUpstreamError(res, response, text) {
   res.end(text || JSON.stringify({ error: "Upstream request failed" }));
 }
 
-export function writeOrDrain(res, chunk) {
+export function writeOrDrain(res, chunk, { signal } = {}) {
   if (res.destroyed || res.writableEnded) return Promise.resolve(false);
+  if (signal?.aborted) {
+    res.destroy?.();
+    return Promise.resolve(false);
+  }
   if (res.write(chunk)) return Promise.resolve(true);
   return new Promise((resolve, reject) => {
     const cleanup = () => {
       res.off("drain", onDrain);
       res.off("error", onError);
       res.off("close", onClose);
+      signal?.removeEventListener("abort", onAbort);
     };
     const onDrain = () => { cleanup(); resolve(true); };
     const onClose = () => { cleanup(); resolve(false); };
     const onError = (err) => { cleanup(); reject(err); };
+    const onAbort = () => { cleanup(); res.destroy?.(); resolve(false); };
     res.once("drain", onDrain);
     res.once("close", onClose);
     res.once("error", onError);
+    signal?.addEventListener("abort", onAbort, { once: true });
+    if (signal?.aborted) onAbort();
   });
 }
 
@@ -800,7 +809,7 @@ export function createRequestAbort(req, res) {
 
 export function logRequestFailure(label, err, abort) {
   if (!isAbortLikeError(err)) {
-    console.error(status("err", `${label} request failed: ${err.message}`));
+    console.error(status("err", `${label} request failed: ${redactDiagnosticText(err.message)}`));
     return;
   }
 

package/src/image-mcp.mjs

@@ -138,7 +138,8 @@ export function createImageMcpHandler({
   imageDirectory = path.join(os.homedir(), ".local", "share", "codex-copilot-dx", "images"),
 } = {}) {
   let active = 0;
-  return async function imageMcpHandler(req, res) {
+  const metrics = { total: 0, succeeded: 0, failed: 0, busy: 0, cancelled: 0, delivery_failures: 0 };
+  const handler = async function imageMcpHandler(req, res) {
     if (!isLoopbackAddress(req.socket?.remoteAddress) && !sameHostSocket(req.socket)) {
       writeJson(res, 403, jsonRpcError(null, -32001, "Image MCP is available only on this device"));
       return;
@@ -207,18 +208,23 @@ export function createImageMcpHandler({
       writeJson(res, 200, jsonRpcError(request.id, -32602, "Unknown image tool"));
       return;
     }
+    metrics.total += 1;
     const config = configLoader();
     if (!config) {
+      metrics.failed += 1;
       imageReferences.clear();
       reply({ content: [{ type: "text", text: "Image generation is disabled. Run ccdx enable-image first." }], isError: true });
       return;
     }
     const editing = request.params.name === EDIT_TOOL_NAME;
     if (editing && !supportsImageEditing(config)) {
+      metrics.failed += 1;
       reply({ content: [{ type: "text", text: "The configured image provider does not support CCDX editing. No edit was submitted." }], isError: true });
       return;
     }
     if (active >= maxConcurrent) {
+      metrics.busy += 1;
+      metrics.failed += 1;
       reply({ content: [{ type: "text", text: "Image generation is busy. Try again after the current request finishes." }], isError: true });
       return;
     }
@@ -234,6 +240,7 @@ export function createImageMcpHandler({
       const parameters = { prompt: args.prompt, size: args.size ?? source?.size ?? "1024x1024" };
       if (source) parameters.image = source.image;
       const image = await generateImageFn(config, parameters, { signal: abort.signal });
+      abort.signal.throwIfAborted();
       let imageId = null;
       if (supportsImageEditing(config)) {
         try { imageId = imageReferences.remember(config, { ...image, size: parameters.size }); } catch {}
@@ -250,9 +257,12 @@ export function createImageMcpHandler({
           saved = await saveChatImage(image, imageDirectory, abort.signal);
           delivery = `\nInclude this image Markdown in your final chat reply to show its thumbnail:\n${saved.markdown}\nTo display this same image again, reuse this Markdown; do not call generate_image or edit_image.`;
         } catch {
+          if (abort.signal.aborted) throw abort.signal.reason;
+          metrics.delivery_failures += 1;
           delivery = "\nThe image was generated, but its chat-preview file could not be saved. Image content is still returned. Do not claim it was displayed, invent a file path, or generate/edit again to retry delivery.";
         }
       }
+      abort.signal.throwIfAborted();
       reply({
         // Codex prioritizes structuredContent over image blocks. Keep IDs in metadata/text.
         ...(imageId || saved ? { _meta: { ...(imageId ? { "ccdx/image_id": imageId } : {}), ...(saved ? { "ccdx/image_path": saved.filePath } : {}) } } : {}),
@@ -261,7 +271,10 @@ export function createImageMcpHandler({
           { type: "text", text: `${editing ? "Edited" : "Generated"} ${image.width || ""}${image.width && image.height ? "×" : ""}${image.height || image.size} image with ${image.model}.${note}${delivery}` },
         ],
       });
+      metrics.succeeded += 1;
     } catch (error) {
+      if (abort.signal.aborted) metrics.cancelled += 1;
+      else metrics.failed += 1;
       if (!res.destroyed && !res.writableEnded) {
         reply({ content: [{ type: "text", text: safeToolError(error, config.api_key) }], isError: true });
       }
@@ -271,4 +284,7 @@ export function createImageMcpHandler({
       res.off?.("close", cancel);
     }
   };
+  // Status never reads credentials, loads image guidance, or probes a provider.
+  handler.stats = () => ({ ...metrics, active, max_concurrent: maxConcurrent });
+  return handler;
 }

package/src/image-provider.mjs

@@ -179,11 +179,16 @@ function publicAddress(address) {
   const family = net.isIP(address);
   if (family === 4) return ipv4Public(address);
   if (family !== 6) return false;
-  const lower = address.toLowerCase();
+  let lower;
+  try { lower = new URL(`https://[${address}]/`).hostname.slice(1, -1); }
+  catch { return false; }
   if (lower === "::" || lower === "::1" || lower.startsWith("fc") || lower.startsWith("fd")
     || /^fe[89ab]/.test(lower) || lower.startsWith("ff") || lower.startsWith("2001:db8:")) return false;
-  const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(lower);
-  return mapped ? ipv4Public(mapped[1]) : true;
+  const mapped = /^::ffff:([a-f0-9]{1,4}):([a-f0-9]{1,4})$/.exec(lower);
+  if (!mapped) return true;
+  const high = Number.parseInt(mapped[1], 16);
+  const low = Number.parseInt(mapped[2], 16);
+  return ipv4Public([high >> 8, high & 255, low >> 8, low & 255].join("."));
 }
 
 export async function downloadPublicImage(urlValue, {
@@ -217,7 +222,8 @@ export async function downloadPublicImage(urlValue, {
     if (signal?.aborted) { onAbort(); return; }
     signal?.addEventListener("abort", onAbort, { once: true });
     // DNS and transfer share one deadline; a late lookup cannot start a cancelled download.
-    Promise.resolve().then(() => settled ? undefined : lookup(url.hostname, { all: true, verbatim: true })).then((addresses) => {
+    const hostname = url.hostname.replace(/^\[|\]$/g, "");
+    Promise.resolve().then(() => settled ? undefined : lookup(hostname, { all: true, verbatim: true })).then((addresses) => {
       if (settled) return;
       if (!Array.isArray(addresses) || !addresses.length || addresses.some(({ address }) => !publicAddress(address))) {
         finish(providerError("Image API returned a non-public image URL", "ccdx_image_url_unsafe"));

package/src/log.mjs

@@ -3,10 +3,17 @@ import os from "node:os";
 import path from "node:path";
 import { format } from "node:util";
 import { status } from "./status.mjs";
-import { parseByteLimit, rotateFileIfNeededSync } from "./file-rotation.mjs";
+import { appendRotatingLines, parseByteLimit } from "./file-rotation.mjs";
+import { redactDiagnosticText } from "./diagnostic-text.mjs";
 
 let globalInstall = null;
 const DEFAULT_LOG_MAX_BYTES = 16 * 1024 * 1024;
+const LOG_QUEUE_MAX_BYTES = 2 * 1024 * 1024;
+const LOG_QUEUE_MAX_RECORDS = 4096;
+
+export function debugLoggingStats() {
+  return globalInstall?.stats() || { enabled: false };
+}
 
 export function normalizeLogLevel(value) {
   return String(value || "info").trim().toLowerCase() === "debug" ? "debug" : "info";
@@ -35,7 +42,7 @@ export function debugLogMaxBytes(env = process.env) {
 
 function renderLogPayload(args) {
   const stamp = new Date().toISOString();
-  const text = format(...args);
+  const text = redactDiagnosticText(format(...args));
   return `${text.split(/\r?\n/).map((line) => `${stamp} ${line}`).join("\n")}\n`;
 }
 
@@ -43,12 +50,13 @@ export function configureLogging({
   env = process.env,
   consoleObj = console,
   home = os.homedir(),
+  appendLines = appendRotatingLines,
 } = {}) {
   const level = normalizeLogLevel(env.CCDX_LOG_LEVEL);
   const filePath = resolveLogPath(env.CCDX_LOG_PATH, { home });
   if (!filePath) return { level, filePath: null, cleanup: () => {} };
   if (consoleObj === console && globalInstall) {
-    return { level, filePath: globalInstall.filePath, cleanup: globalInstall.cleanup };
+    return { level, ...globalInstall };
   }
 
   fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
@@ -59,16 +67,52 @@ export function configureLogging({
     typeof consoleObj[method] === "function" ? consoleObj[method].bind(consoleObj) : () => {},
   ]));
   let writeFailed = false;
+  const pending = [];
+  let drain = null;
+  let pendingBytes = 0;
+  let pendingRecords = 0;
+  let droppedRecords = 0;
+  let writeFailures = 0;
+  const stats = () => ({ enabled: true, pending_bytes: pendingBytes, pending_records: pendingRecords,
+    dropped_records: droppedRecords, write_failures: writeFailures,
+    max_bytes: LOG_QUEUE_MAX_BYTES, max_records: LOG_QUEUE_MAX_RECORDS });
+
+  function scheduleDrain() {
+    if (drain) return;
+    drain = Promise.resolve().then(async () => {
+      while (pending.length) {
+        const batch = pending.splice(0);
+        try {
+          await appendLines(filePath, batch.map(({ payload }) => payload), debugLogMaxBytes(env));
+        } catch (error) {
+          writeFailures += 1;
+          if (!writeFailed) originals.error(`codex-copilot-dx log write failed: ${redactDiagnosticText(error.message)}`);
+          writeFailed = true;
+        } finally {
+          pendingRecords -= batch.length;
+          pendingBytes -= batch.reduce((sum, entry) => sum + entry.bytes, 0);
+        }
+      }
+    }).finally(() => { drain = null; if (pending.length) scheduleDrain(); });
+  }
 
   function append(args) {
     try {
       const payload = renderLogPayload(args);
-      rotateFileIfNeededSync(filePath, Buffer.byteLength(payload), debugLogMaxBytes(env));
-      fs.appendFileSync(filePath, payload, { encoding: "utf8", mode: 0o600 });
+      const bytes = Buffer.byteLength(payload);
+      if (pendingRecords >= LOG_QUEUE_MAX_RECORDS || pendingBytes + bytes > LOG_QUEUE_MAX_BYTES) {
+        droppedRecords += 1;
+        if (droppedRecords === 1) originals.error("codex-copilot-dx log queue is full; excess file records are dropped, terminal output is unchanged (see ccdx status)");
+        return;
+      }
+      pending.push({ payload, bytes });
+      pendingRecords += 1;
+      pendingBytes += bytes;
+      scheduleDrain();
     } catch (e) {
       if (writeFailed) return;
       writeFailed = true;
-      originals.error(`codex-copilot-dx log write failed: ${e.message}`);
+      originals.error(`codex-copilot-dx log write failed: ${redactDiagnosticText(e.message)}`);
     }
   }
 
@@ -79,13 +123,23 @@ export function configureLogging({
     };
   }
 
+  const flush = async ({ timeoutMs = 1500 } = {}) => {
+    let timer;
+    const completed = await Promise.race([
+      (async () => { while (drain) await drain; return true; })(),
+      new Promise((resolve) => { timer = setTimeout(() => resolve(false), timeoutMs); }),
+    ]);
+    clearTimeout(timer);
+    if (!completed) originals.error(`codex-copilot-dx log flush timed out after ${timeoutMs}ms`);
+  };
   const cleanup = () => {
     for (const method of methods) consoleObj[method] = originals[method];
     if (consoleObj === console && globalInstall?.cleanup === cleanup) globalInstall = null;
+    return flush();
   };
 
-  if (consoleObj === console) globalInstall = { filePath, cleanup };
-  return { level, filePath, cleanup };
+  if (consoleObj === console) globalInstall = { filePath, cleanup, flush, stats };
+  return { level, filePath, cleanup, flush, stats };
 }
 
 export function debugLog(message, env = process.env) {

package/src/observability.mjs

@@ -5,6 +5,8 @@ import { imageOptimizationStats } from "./image-optimization.mjs";
 import { responseHistoryStats } from "./response-history.mjs";
 import { loadRuntimeConfig } from "./runtime-config.mjs";
 import { profileRouting } from "./profile-routing.mjs";
+import { usageLoggingStats } from "./usage.mjs";
+import { debugLoggingStats } from "./log.mjs";
 
 export { ADAPTER_STATUS_PATH };
 const OBSERVABILITY_RUNTIME_CONFIG = loadRuntimeConfig();
@@ -13,6 +15,7 @@ const ROUTE_NAMES = Object.freeze([
   "responses",
   "responses_compact",
   "models",
+  "image_mcp",
   "not_found",
 ]);
 
@@ -94,6 +97,7 @@ export function classifyAdapterRoute(method, pathname) {
   if (method === "POST" && pathname === "/v1/responses") return "responses";
   if (method === "POST" && pathname === "/v1/responses/compact") return "responses_compact";
   if (method === "GET" && pathname === "/v1/models") return "models";
+  if (pathname === "/mcp/image") return "image_mcp";
   return "not_found";
 }
 
@@ -155,6 +159,7 @@ export function runtimeStatusPayload({
   admission,
   imagePressure,
   responseFailures,
+  imageGeneration,
   modelRegistry,
   codexClient,
   codexModelRegistry,
@@ -177,6 +182,8 @@ export function runtimeStatusPayload({
     admission: admission?.diagnostics?.() || admission?.stats?.() || null,
     response_history: responseHistoryStats(),
     image_optimization: imageOptimizationStats(),
+    image_generation: imageGeneration || null,
+    logging: { usage: usageLoggingStats(), debug: debugLoggingStats() },
     image_history_pressure: imagePressure?.snapshot?.() || null,
     response_failures: responseFailures?.snapshot?.() || null,
     copilot: codexRuntime,

package/src/response-failures.mjs

@@ -1,17 +1,16 @@
 import { terminalCell } from "./cli-table.mjs";
+import { redactDiagnosticText } from "./diagnostic-text.mjs";
 
 const DEFAULT_RECENT_FAILURES = 10;
 
 function safeIdentifier(value, fallback = "unknown") {
-  const text = terminalCell(value, { fallback });
+  const text = redactDiagnosticText(terminalCell(value, { fallback }));
   return text.slice(0, 200);
 }
 
 function safeFailureMessage(value) {
   let text = terminalCell(value, { fallback: "Response failed without an error message" });
-  text = text
-    .replace(/(encrypted(?: function output)? content\s+)[A-Za-z0-9+/_=-]{24,}/gi, "$1[redacted]")
-    .replace(/\b[A-Za-z0-9+/_=-]{96,}\b/g, "[redacted]");
+  text = redactDiagnosticText(text);
   return text.slice(0, 500);
 }
 

package/src/responses-handler.mjs

@@ -319,7 +319,7 @@ export function createResponsesHandler(options) {
               "Cache-Control": "no-cache",
               Connection: "keep-alive",
             });
-            const written = await writeOrDrain(res, `event: ${event}\ndata: ${JSON.stringify(data)}\n\n`);
+            const written = await writeOrDrain(res, `event: ${event}\ndata: ${JSON.stringify(data)}\n\n`, { signal: abort.signal });
             if (!written) return false;
             if (event === "response.completed") {
               rememberResponseHistory(prepared, data.response);

package/src/responses-proxy.mjs

@@ -403,13 +403,13 @@ async function proxyStreamingResponses(opened, res, upstream, options) {
       const body = prelude.length === 1 ? prelude[0] : Buffer.concat(prelude, preludeBytes);
       prelude.length = 0;
       preludeBytes = 0;
-      return writeOrDrain(res, body);
+      return writeOrDrain(res, body, { signal: options.signal });
     };
     const forwardFrame = async (frame) => {
       if (!frame) return true;
       if (!holdPrelude) {
         writeHeaders();
-        return writeOrDrain(res, frame);
+        return writeOrDrain(res, frame, { signal: options.signal });
       }
       prelude.push(frame);
       preludeBytes += frame.byteLength;

package/src/stream-errors.mjs

@@ -11,6 +11,10 @@ export async function endStreamWithError(res, error, abort) {
   markStreamFailure();
   if (res.destroyed || res.writableEnded) return;
   const data = streamErrorData(error, abort);
-  await writeOrDrain(res, `event: error\ndata: ${JSON.stringify(data)}\n\n`).catch(() => false);
+  // Allow a final error frame after an upstream timeout, but never wait forever
+  // for a client that has stopped reading (including protocol-error paths).
+  await writeOrDrain(res, `event: error\ndata: ${JSON.stringify(data)}\n\n`, {
+    signal: AbortSignal.timeout(1000),
+  }).catch(() => false);
   if (!res.destroyed && !res.writableEnded) res.end();
 }

package/src/usage.mjs

@@ -3,7 +3,7 @@ import os from "node:os";
 import path from "node:path";
 import readline from "node:readline";
 import { cliOutputFormat, cliOutputWidth, formatResponsiveCliTable, terminalCell } from "./cli-table.mjs";
-import { parseByteLimit, rotateFileIfNeededSync, rotatedFilePath } from "./file-rotation.mjs";
+import { appendRotatingLines, parseByteLimit, rotatedFilePath } from "./file-rotation.mjs";
 import { withFileLock } from "./lock.mjs";
 
 const DEFAULT_USAGE_PATH = path.join(os.homedir(), ".local", "share", "codex-copilot-dx", "usage.jsonl");
@@ -15,6 +15,17 @@ const USAGE_FLUSH_TIMEOUT_MS = 1_500;
 
 const pendingWrites = [];
 let writeDrain = null;
+const USAGE_QUEUE_MAX_RECORDS = 4096;
+const USAGE_QUEUE_MAX_BYTES = 4 * 1024 * 1024;
+let pendingRecords = 0;
+let pendingBytes = 0;
+let droppedRecords = 0;
+let writeFailures = 0;
+
+export function usageLoggingStats() {
+  return { pending_records: pendingRecords, pending_bytes: pendingBytes, dropped_records: droppedRecords,
+    write_failures: writeFailures, max_records: USAGE_QUEUE_MAX_RECORDS, max_bytes: USAGE_QUEUE_MAX_BYTES };
+}
 
 export function usageLogPath() {
   return process.env.CCDX_USAGE_PATH || DEFAULT_USAGE_PATH;
@@ -114,10 +125,7 @@ async function writeUsageBatch(batch) {
   await fs.promises.mkdir(path.dirname(filePath), { recursive: true });
   await withFileLock(`${path.resolve(filePath)}.lock`, async () => {
     batch.push(...takePendingWrites(filePath, maxBytes));
-    for (const { line } of batch) {
-      rotateFileIfNeededSync(filePath, Buffer.byteLength(line), maxBytes);
-      await fs.promises.appendFile(filePath, line, { encoding: "utf8", mode: 0o600 });
-    }
+    await appendRotatingLines(filePath, batch.map(({ line }) => line), maxBytes);
   }, {
     timeoutMs: USAGE_WRITE_LOCK_TIMEOUT_MS,
     staleMs: USAGE_WRITE_LOCK_STALE_MS,
@@ -134,10 +142,15 @@ function scheduleUsageWriteDrain() {
       try {
         await writeUsageBatch(batch);
       } catch (error) {
+        writeFailures += 1;
         batch.push(...takePendingWrites(first.filePath, first.maxBytes));
         console.error(`codex-copilot-dx usage log write failed: ${error.message}`);
       } finally {
-        for (const entry of batch) entry.resolve();
+        for (const entry of batch) {
+          pendingRecords -= 1;
+          pendingBytes -= entry.bytes;
+          entry.resolve();
+        }
       }
     }
   }).finally(() => {
@@ -150,8 +163,16 @@ export function recordUsage(record) {
   if (!record || process.env.CCDX_DISABLE_USAGE === "1") return Promise.resolve();
   const filePath = usageLogPath();
   const line = `${JSON.stringify(record)}\n`;
+  const bytes = Buffer.byteLength(line);
+  if (pendingRecords >= USAGE_QUEUE_MAX_RECORDS || pendingBytes + bytes > USAGE_QUEUE_MAX_BYTES) {
+    droppedRecords += 1;
+    if (droppedRecords === 1) console.error("codex-copilot-dx usage queue is full; excess usage records are dropped, inference is unaffected (see ccdx status)");
+    return Promise.resolve();
+  }
+  pendingRecords += 1;
+  pendingBytes += bytes;
   const completed = new Promise((resolve) => {
-    pendingWrites.push({ filePath, line, maxBytes: usageLogMaxBytes(), resolve });
+    pendingWrites.push({ filePath, line, bytes, maxBytes: usageLogMaxBytes(), resolve });
   });
   scheduleUsageWriteDrain();
   return completed;