codex-copilot-dx 0.8.6 → 0.8.8

package/src/dashboard/ui.js

@@ -0,0 +1,347 @@
+const element = (id) => document.getElementById(id);
+const text = (id, value) => { element(id).textContent = value; };
+const finite = (value) => value !== null && value !== undefined && Number.isFinite(Number(value));
+const number = (value) => finite(value) ? Math.max(0, Math.round(Number(value))).toLocaleString() : "—";
+const mib = (value) => finite(value) ? `${(Number(value) / 1048576).toFixed(1)} MiB` : "—";
+
+function duration(value) {
+  if (!finite(value)) return "—";
+  const seconds = Math.max(0, Math.round(Number(value) / 1000));
+  const days = Math.floor(seconds / 86400);
+  const hours = Math.floor((seconds % 86400) / 3600);
+  const minutes = Math.floor((seconds % 3600) / 60);
+  return days ? `${days}d ${hours}h` : hours ? `${hours}h ${minutes}m` : `${minutes}m`;
+}
+
+function renderFailures(recent) {
+  const list = element("failures");
+  list.replaceChildren();
+  const failures = Array.isArray(recent) ? recent.slice(-5).reverse() : [];
+  if (!failures.length) {
+    const item = document.createElement("li");
+    item.className = "empty";
+    item.textContent = "No response.failed events recorded.";
+    list.append(item);
+    return;
+  }
+  for (const failure of failures) {
+    const item = document.createElement("li");
+    const title = document.createElement("strong");
+    const detail = document.createElement("span");
+    title.textContent = `${String(failure.model || "unknown_model").slice(0, 80)} / ${String(failure.code || "unknown_error").slice(0, 80)}`;
+    detail.textContent = `${String(failure.message || "No message").slice(0, 240)}${failure.retried ? " / retried" : ""}`;
+    item.append(title, detail);
+    list.append(item);
+  }
+}
+
+function render(data) {
+  text("version", `v${data.version || "?"}`);
+  text("uptime", `pid ${number(data.pid)} / uptime ${duration(data.uptime_ms)}`);
+
+  const copilot = data.copilot || {};
+  text("copilot", copilot.account_bound ? "BOUND" : "UNCONFIRMED");
+  text("token", copilot.token_cached ? `service token / TTL ${duration(copilot.token_expires_in_ms)}` : "service token not cached");
+
+  const models = data.models || {};
+  text("models", number(models.models));
+  text("model-source", `source ${String(models.source || "unknown").slice(0, 80)} / live: ccdx models`);
+
+  const requests = data.requests || {};
+  text("requests", number(requests.total));
+  text("request-errors", `4xx ${number(requests.status_4xx)} / 5xx ${number(requests.status_5xx)} / active ${number(requests.active)}`);
+
+  const outcomes = data.stream_performance?.by_route?.responses?.terminal_outcomes?.totals || {};
+  for (const key of ["completed", "incomplete", "failed", "cancelled"]) text(key, number(outcomes[key]));
+
+  const history = data.response_history || {};
+  const limit = Number(history.maxBytes || data.limits?.response_history_max_bytes || 0);
+  const used = Number(history.bytes || 0);
+  text("history", `${mib(used)} / ${mib(limit)}`);
+  text("history-detail", `entries ${number(history.entries)} / trees ${number(history.tree_count)} / misses ${number(history.lookup_misses)} (evicted ${number(history.evicted_lookup_misses)})`);
+  element("history-meter").value = limit > 0 ? Math.min(100, Math.max(0, used / limit * 100)) : 0;
+
+  const image = data.image_generation;
+  text("image", image ? `${number(image.succeeded)} succeeded` : "NOT INITIALIZED");
+  text("image-detail", image
+    ? `active ${number(image.active)} / failed ${number(image.failed)} / delivery failures ${number(image.delivery_failures)}`
+    : "Setup state unknown / ccdx image-status");
+
+  renderFailures(data.response_failures?.recent);
+  text("updated", `Snapshot ${new Date().toLocaleTimeString()}`);
+}
+
+async function refresh() {
+  const button = element("refresh");
+  button.disabled = true;
+  text("connection", "READING");
+  element("connection").className = "badge neutral";
+  try {
+    const response = await fetch("/_ccdx/status", {
+      cache: "no-store",
+      headers: { Accept: "application/json" },
+      signal: AbortSignal.timeout(5000),
+    });
+    if (!response.ok) throw new Error(`HTTP ${response.status}`);
+    const data = await response.json();
+    if (data?.ok !== true || data?.name !== "codex-copilot-dx") throw new Error("Unexpected status response");
+    render(data);
+    text("connection", "LOCAL OK");
+    element("connection").className = "badge good";
+  } catch {
+    text("connection", "UNAVAILABLE");
+    element("connection").className = "badge bad";
+    text("updated", "Status unavailable / check ccdx, then refresh");
+  } finally {
+    button.disabled = false;
+  }
+}
+
+element("refresh").addEventListener("click", refresh);
+refresh();
+
+const animationRows = new Map();
+let animationTimelines = [];
+let savedAnimation = "";
+let selectedAnimation = "";
+let previewDisabledByEnvironment = false;
+let previewVisible = false;
+let previewTimer = null;
+let previewStarted = 0;
+const reducedMotion = window.matchMedia("(prefers-reduced-motion: reduce)");
+
+function renderAnsiFrame(target, frame) {
+  const fragments = String(frame).split(/\u001b\[([0-9;]+)m/);
+  const content = document.createDocumentFragment();
+  let color = "";
+  for (let index = 0; index < fragments.length; index += 2) {
+    if (fragments[index]) {
+      const span = document.createElement("span");
+      span.className = color;
+      span.textContent = fragments[index];
+      content.append(span);
+    }
+    const code = fragments[index + 1];
+    color = code === "97" ? "ansi-white"
+      : /^38;5;(159|123|87|51|45|39|33)$/.test(code || "") ? `ansi-${code.slice(5)}` : "";
+  }
+  target.replaceChildren(content);
+}
+
+function renderAnimationFrames(elapsed) {
+  for (const timeline of animationTimelines) {
+    const position = timeline.id === selectedAnimation ? elapsed % timeline.duration : 0;
+    const frameIndex = timeline.frames.findIndex(({ until }) => position < until);
+    if (frameIndex === timeline.lastFrame) continue;
+    timeline.lastFrame = frameIndex;
+    renderAnsiFrame(timeline.target, frameIndex < 0 ? `[${" ".repeat(20)}]` : timeline.frames[frameIndex].ansi);
+  }
+}
+
+function stopAnimationPreview() {
+  if (previewTimer !== null) clearTimeout(previewTimer);
+  previewTimer = null;
+}
+
+function tickAnimationPreview() {
+  previewTimer = null;
+  if (!previewVisible || document.visibilityState !== "visible" || reducedMotion.matches || previewDisabledByEnvironment) return;
+  renderAnimationFrames(performance.now() - previewStarted);
+  previewTimer = setTimeout(tickAnimationPreview, 32);
+}
+
+function syncAnimationPreview() {
+  stopAnimationPreview();
+  if (!previewVisible || document.visibilityState !== "visible" || reducedMotion.matches || previewDisabledByEnvironment) {
+    for (const timeline of animationTimelines) timeline.lastFrame = -2;
+    renderAnimationFrames(0);
+    return;
+  }
+  previewStarted = performance.now();
+  tickAnimationPreview();
+}
+
+new IntersectionObserver(([entry]) => {
+  previewVisible = entry.isIntersecting;
+  syncAnimationPreview();
+}).observe(element("animation-options"));
+document.addEventListener("visibilitychange", syncAnimationPreview);
+reducedMotion.addEventListener("change", syncAnimationPreview);
+
+function buildAnimationOptions(data) {
+  const container = element("animation-options");
+  container.replaceChildren();
+  animationRows.clear();
+  animationTimelines = [];
+  savedAnimation = data.theme;
+  selectedAnimation = data.theme;
+  previewDisabledByEnvironment = data.disabled_by_environment === true;
+  for (const [index, theme] of data.themes.entries()) {
+    const option = document.createElement("button");
+    option.type = "button";
+    option.className = "theme-option";
+    option.setAttribute("aria-pressed", String(theme.id === data.theme));
+    option.addEventListener("click", () => {
+      selectedAnimation = theme.id;
+      for (const [id, row] of animationRows) row.setAttribute("aria-pressed", String(id === theme.id));
+      element("save-animation").disabled = selectedAnimation === savedAnimation;
+      syncAnimationPreview();
+    });
+    const name = document.createElement("span");
+    name.className = "theme-name";
+    name.textContent = `${String(index + 1).padStart(2, "0")} ${theme.label}`;
+    if (theme.default) {
+      const marker = document.createElement("small");
+      marker.textContent = "DEFAULT";
+      name.append(marker);
+    }
+    const preview = document.createElement("span");
+    preview.className = "theme-preview";
+    preview.setAttribute("aria-hidden", "true");
+    option.append(name, preview);
+    container.append(option);
+    animationRows.set(theme.id, option);
+    let until = 0;
+    const frames = theme.frames.map((frame) => {
+      until += frame.delay_ms;
+      return { ansi: frame.ansi, until };
+    });
+    animationTimelines.push({ id: theme.id, target: preview, frames, duration: until + theme.loop_pause_ms, lastFrame: -2 });
+  }
+  element("save-animation").disabled = true;
+  syncAnimationPreview();
+}
+
+function animationNote(data) {
+  return data.disabled_by_environment
+    ? "Disabled by CCDX_TERMINAL_ANIMATION; saved choice applies after override removal and next start."
+    : "Saved choice applies on next ccdx start.";
+}
+
+async function loadAnimation() {
+  text("animation-state", "READING");
+  try {
+    const response = await fetch("/_ccdx/ui/animation", { cache: "no-store", headers: { "X-CCDX-Dashboard": "1" }, signal: AbortSignal.timeout(8000) });
+    const data = await response.json();
+    if (!response.ok) throw new Error(data.error || `HTTP ${response.status}`);
+    buildAnimationOptions(data);
+    text("animation-state", `CURRENT ${data.theme.toUpperCase()}`);
+    text("animation-note", animationNote(data));
+  } catch (error) {
+    text("animation-state", "UNAVAILABLE");
+    text("animation-note", String(error.message || error).slice(0, 180));
+  }
+}
+
+async function saveAnimation() {
+  const button = element("save-animation");
+  if (!selectedAnimation || selectedAnimation === savedAnimation) return;
+  button.disabled = true;
+  text("animation-note", "Saving…");
+  try {
+    const response = await fetch("/_ccdx/ui/animation", {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "X-CCDX-Dashboard": "1" },
+      body: JSON.stringify({ theme: selectedAnimation }),
+      signal: AbortSignal.timeout(8000),
+    });
+    const data = await response.json();
+    if (!response.ok) throw new Error(data.error || `HTTP ${response.status}`);
+    savedAnimation = data.theme;
+    text("animation-state", `CURRENT ${data.theme.toUpperCase()}`);
+    text("animation-note", animationNote(data));
+  } catch (error) {
+    text("animation-note", `Not saved / ${String(error.message || error).slice(0, 150)}`);
+  } finally {
+    button.disabled = selectedAnimation === savedAnimation;
+  }
+}
+
+function emptyTable(bodyId, columns, message) {
+  const body = element(bodyId);
+  body.replaceChildren();
+  const row = document.createElement("tr");
+  const cell = document.createElement("td");
+  cell.colSpan = columns;
+  cell.textContent = message;
+  row.append(cell);
+  body.append(row);
+}
+
+function tableRow(values, { total = false } = {}) {
+  const row = document.createElement("tr");
+  if (total) row.className = "total-row";
+  for (const value of values) {
+    const cell = document.createElement("td");
+    cell.textContent = value;
+    row.append(cell);
+  }
+  return row;
+}
+
+async function loadModels() {
+  const button = element("refresh-models");
+  button.disabled = true;
+  text("models-state", "CHECKING LIVE");
+  text("models-note", "Querying GitHub Copilot…");
+  emptyTable("live-models-body", 4, "Loading…");
+  try {
+    const response = await fetch("/_ccdx/ui/models/live", { cache: "no-store", headers: { "X-CCDX-Dashboard": "1" }, signal: AbortSignal.timeout(15000) });
+    const data = await response.json();
+    if (!response.ok || data.source !== "live") throw new Error(data.error || `HTTP ${response.status}`);
+    const body = element("live-models-body");
+    body.replaceChildren();
+    for (const model of data.models) {
+      body.append(tableRow([model.id, model.vendor, model.endpoints.join(" / "), model.preview ? "preview" : "—"]));
+    }
+    if (!data.models.length) emptyTable("live-models-body", 4, "No selectable GPT models advertised.");
+    text("models-state", "LIVE SNAPSHOT");
+    text("models-note", `${number(data.selectable)} selectable / ${number(data.advertised)} advertised / ${data.upstream_host} / ${new Date(data.checked_at).toLocaleTimeString()}`);
+  } catch (error) {
+    text("models-state", "LIVE LOOKUP FAILED");
+    text("models-note", String(error.message || error).slice(0, 240));
+    emptyTable("live-models-body", 4, "No live catalog available.");
+  } finally {
+    button.disabled = false;
+  }
+}
+
+function usageValues(row) {
+  return [row.model, number(row.requests), number(row.input_tokens), number(row.cache_read_tokens), number(row.output_tokens), number(row.total_tokens)];
+}
+
+async function loadUsage() {
+  const button = element("refresh-usage");
+  button.disabled = true;
+  text("usage-state", "READING LOG");
+  text("usage-note", "Aggregating local usage metadata…");
+  emptyTable("usage-body", 6, "Loading…");
+  try {
+    const response = await fetch("/_ccdx/ui/usage", { cache: "no-store", headers: { "X-CCDX-Dashboard": "1" }, signal: AbortSignal.timeout(15000) });
+    const data = await response.json();
+    if (!response.ok || data.source !== "local_usage_log") throw new Error(data.error || `HTTP ${response.status}`);
+    const body = element("usage-body");
+    body.replaceChildren();
+    if (data.total.requests > 0) {
+      body.append(tableRow(usageValues(data.total), { total: true }));
+      for (const row of data.rows) body.append(tableRow(usageValues(row)));
+    } else {
+      emptyTable("usage-body", 6, "No usage records.");
+    }
+    text("usage-state", "LOCAL LOG");
+    text("usage-note", `${number(data.total.requests)} records / ${number(data.rows.length)} of ${number(data.model_count)} models shown`);
+  } catch (error) {
+    text("usage-state", "LOG UNAVAILABLE");
+    text("usage-note", String(error.message || error).slice(0, 180));
+    emptyTable("usage-body", 6, "No usage summary available.");
+  } finally {
+    button.disabled = false;
+  }
+}
+
+element("save-animation").addEventListener("click", saveAnimation);
+element("refresh-models").addEventListener("click", loadModels);
+element("refresh-usage").addEventListener("click", loadUsage);
+loadAnimation();
+loadModels();
+loadUsage();

package/src/dashboard-api.mjs

@@ -0,0 +1,204 @@
+import os from "node:os";
+import { fetchLiveCopilotModels } from "./cli-models.mjs";
+import { createRequestAbort, readJsonBody } from "./http-transport.mjs";
+import { isLoopbackAddress, isLoopbackHostHeader } from "./observability.mjs";
+import {
+  DEFAULT_TERMINAL_ANIMATION_THEME,
+  getTerminalAnimationFrameDelay,
+  isTerminalAnimationTheme,
+  renderTerminalAnimationFrame,
+  TERMINAL_ANIMATION_THEMES,
+} from "./terminal-animation.mjs";
+import { summarizeUsageLogs } from "./usage.mjs";
+import { readUserSettings, terminalAnimationPreference, writeTerminalAnimationTheme } from "./user-settings.mjs";
+
+const ANIMATION_PATH = "/_ccdx/ui/animation";
+const MODELS_PATH = "/_ccdx/ui/models/live";
+const USAGE_PATH = "/_ccdx/ui/usage";
+const DISABLED_ANIMATION = /^(0|false|no|off)$/i;
+
+function sendJson(res, statusCode, value) {
+  res.writeHead(statusCode, {
+    "Content-Type": "application/json; charset=utf-8",
+    "Cache-Control": "no-store",
+    "X-Content-Type-Options": "nosniff",
+  });
+  res.end(JSON.stringify(value));
+}
+
+function safeText(value, length = 160) {
+  return String(value ?? "").replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").trim().slice(0, length);
+}
+
+function liveModelError(error) {
+  const message = String(error?.message || error || "");
+  const status = /\bHTTP (\d{3})\b/.exec(message)?.[1];
+  if (status) return `Live model lookup failed (HTTP ${status}). Run ccdx models for details.`;
+  if (/timed out/i.test(message)) return "Live model lookup timed out. Retry or run ccdx models.";
+  if (/GitHub token not found/i.test(message)) return "GitHub token not found. Start ccdx to sign in.";
+  return "Live model lookup failed. Run ccdx models for details.";
+}
+
+function animationState(env, home, { includeFrames = false } = {}) {
+  readUserSettings({ env, home, strict: true });
+  const preference = terminalAnimationPreference({ env, home });
+  return {
+    theme: preference.theme,
+    source: preference.source,
+    disabled_by_environment: DISABLED_ANIMATION.test(String(env.CCDX_TERMINAL_ANIMATION || "").trim()),
+    themes: TERMINAL_ANIMATION_THEMES.map((theme) => ({
+      id: theme.id,
+      label: theme.label,
+      default: theme.id === DEFAULT_TERMINAL_ANIMATION_THEME,
+      ...(includeFrames ? {
+        loop_pause_ms: theme.loopPauseMs,
+        frames: Array.from({ length: theme.frameCount }, (_, offset) => {
+          const index = theme.startFrame + offset;
+          return {
+            ansi: renderTerminalAnimationFrame(theme.id, index),
+            delay_ms: getTerminalAnimationFrameDelay(theme.id, index),
+          };
+        }),
+      } : {}),
+    })),
+  };
+}
+
+function sameOrigin(req) {
+  const origin = req.headers?.origin;
+  const host = req.headers?.host;
+  if (typeof origin !== "string" || typeof host !== "string") return false;
+  try {
+    return new URL(origin).origin === new URL(`http://${host}`).origin;
+  } catch {
+    return false;
+  }
+}
+
+function finite(value) {
+  return Number.isFinite(value) ? Math.max(0, value) : null;
+}
+
+function cacheReadTokens(usage = {}) {
+  const values = [usage.cache_read_input_tokens, usage.cached_input_tokens].filter(Number.isFinite);
+  return values.length ? values.reduce((sum, value) => sum + value, 0) : null;
+}
+
+function usageRow(model, values) {
+  return {
+    model: safeText(model, 100),
+    requests: finite(values.requests),
+    input_tokens: finite(values.input_tokens),
+    cache_read_tokens: cacheReadTokens(values),
+    output_tokens: finite(values.output_tokens),
+    total_tokens: finite(values.total_tokens),
+  };
+}
+
+function usageTable(summary) {
+  const models = Object.entries(summary.byModel || {})
+    .sort(([leftName, left], [rightName, right]) => (right.total_tokens || 0) - (left.total_tokens || 0)
+      || leftName.localeCompare(rightName, "en"));
+  return {
+    total: usageRow("TOTAL", { requests: summary.requests, ...summary.totals }),
+    model_count: models.length,
+    rows: models.slice(0, 100).map(([name, values]) => usageRow(name, values)),
+  };
+}
+
+export async function handleDashboardApi(req, res, pathname, {
+  env = process.env,
+  home = os.homedir(),
+  liveModelsFn = () => fetchLiveCopilotModels({ home }),
+  usageSummaryFn = () => summarizeUsageLogs(),
+} = {}) {
+  if (!isLoopbackAddress(req.socket?.remoteAddress)
+    || req.headers?.host === undefined
+    || !isLoopbackHostHeader(req.headers.host)) {
+    sendJson(res, 403, { error: "Dashboard API is available only at a loopback address" });
+    return;
+  }
+  if (req.headers?.["x-ccdx-dashboard"] !== "1") {
+    sendJson(res, 403, { error: "Dashboard API requires a same-origin page request" });
+    return;
+  }
+
+  if (pathname === ANIMATION_PATH && req.method === "GET") {
+    try {
+      sendJson(res, 200, animationState(env, home, { includeFrames: true }));
+    } catch {
+      sendJson(res, 409, { error: "Animation settings are invalid; inspect them with ccdx animation" });
+    }
+    return;
+  }
+
+  if (pathname === ANIMATION_PATH && req.method === "POST") {
+    if (!sameOrigin(req)) {
+      sendJson(res, 403, { error: "Animation changes require the same-origin dashboard" });
+      return;
+    }
+    if (String(req.headers?.["content-type"] || "").split(";", 1)[0].trim().toLowerCase() !== "application/json") {
+      sendJson(res, 415, { error: "Animation changes require application/json" });
+      return;
+    }
+    const abort = createRequestAbort(req, res);
+    abort.setTimeout(5000, "request_body_timeout");
+    let body;
+    try {
+      body = await readJsonBody(req, { maxBodyBytes: 2048, maxDecodedBodyBytes: 2048, signal: abort.signal });
+    } catch (error) {
+      sendJson(res, error?.statusCode === 413 ? 413 : 400, { error: "Invalid animation request body" });
+      return;
+    } finally {
+      abort.cleanup();
+    }
+    if (!isTerminalAnimationTheme(body?.theme)) {
+      sendJson(res, 400, { error: "Select a listed animation theme" });
+      return;
+    }
+    try {
+      const result = writeTerminalAnimationTheme(body.theme, { env, home });
+      sendJson(res, 200, { changed: result.changed, ...animationState(env, home) });
+    } catch {
+      sendJson(res, 409, { error: "Animation setting was not saved; check ccdx animation" });
+    }
+    return;
+  }
+
+  if (pathname === MODELS_PATH && req.method === "GET") {
+    try {
+      const catalog = await liveModelsFn();
+      if (!Array.isArray(catalog?.models) || !Number.isFinite(catalog?.advertised)) {
+        throw new Error("Invalid live model catalog");
+      }
+      const models = catalog.models;
+      sendJson(res, 200, {
+        source: "live",
+        checked_at: new Date().toISOString(),
+        upstream_host: safeText(catalog?.upstreamHost || "GitHub Copilot", 120),
+        advertised: finite(catalog?.advertised),
+        selectable: models.length,
+        models: models.slice(0, 500).map((model) => ({
+          id: safeText(model.id, 100),
+          vendor: safeText(model.vendor, 80),
+          endpoints: Array.isArray(model.endpoints) ? model.endpoints.filter((value) => value === "responses" || value === "chat") : [],
+          preview: model.preview === true,
+        })),
+      });
+    } catch (error) {
+      sendJson(res, 502, { error: liveModelError(error) });
+    }
+    return;
+  }
+
+  if (pathname === USAGE_PATH && req.method === "GET") {
+    try {
+      sendJson(res, 200, { source: "local_usage_log", ...(usageTable(await usageSummaryFn())) });
+    } catch {
+      sendJson(res, 500, { error: "Could not read local usage summary" });
+    }
+    return;
+  }
+
+  sendJson(res, 405, { error: "Method not allowed" });
+}

package/src/dashboard.mjs

@@ -0,0 +1,30 @@
+import { readFile } from "node:fs/promises";
+import { isLoopbackAddress, isLoopbackHostHeader } from "./observability.mjs";
+
+const ASSETS = new Map([
+  ["/", ["./dashboard/index.html", "text/html; charset=utf-8"]],
+  ["/ui.css", ["./dashboard/ui.css", "text/css; charset=utf-8"]],
+  ["/ui.js", ["./dashboard/ui.js", "text/javascript; charset=utf-8"]],
+]);
+
+export async function serveDashboard(req, res, pathname) {
+  if (!isLoopbackAddress(req.socket?.remoteAddress)
+    || req.headers?.host === undefined
+    || !isLoopbackHostHeader(req.headers.host)) {
+    res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8", "Cache-Control": "no-store" });
+    res.end("The CCDX dashboard is available only at a loopback address.");
+    return;
+  }
+
+  const [file, contentType] = ASSETS.get(pathname);
+  const body = await readFile(new URL(file, import.meta.url));
+  res.writeHead(200, {
+    "Content-Type": contentType,
+    "Cache-Control": "no-store",
+    "Content-Security-Policy": "default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'self'; img-src data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
+    "X-Content-Type-Options": "nosniff",
+    "X-Frame-Options": "DENY",
+    "Referrer-Policy": "no-referrer",
+  });
+  res.end(req.method === "HEAD" ? undefined : body);
+}

package/src/observability.mjs

@@ -108,6 +108,19 @@ export function isLoopbackAddress(address) {
   return isIP(ipv4) === 4 && ipv4.startsWith("127.");
 }
 
+export function isLoopbackHostHeader(host) {
+  if (host === undefined) return true; // HTTP/1.0 and in-process callers may omit Host.
+  if (typeof host !== "string" || !host || host.includes(",")) return false;
+  try {
+    const url = new URL(`http://${host}`);
+    const hostname = url.hostname.replace(/^\[|\]$/g, "");
+    return !url.username && !url.password && url.pathname === "/" && !url.search && !url.hash
+      && (hostname === "localhost" || isLoopbackAddress(hostname));
+  } catch {
+    return false;
+  }
+}
+
 function modelRegistryStatus(modelRegistry) {
   const modelData = Array.isArray(modelRegistry?.models)
     ? modelRegistry.models

package/src/response-history.mjs

@@ -81,6 +81,9 @@ const treeLru = new Map();
 const pinnedTrees = new Map();
 const evictedIds = new Set();
 let totalBytes = 0;
+let evictedEntriesTotal = 0;
+let lookupMisses = 0;
+let evictedLookupMisses = 0;
 const HISTORY_RUNTIME_CONFIG = loadRuntimeConfig();
 let maxBytes = HISTORY_RUNTIME_CONFIG.responseHistoryMaxBytes;
 let maxEntries = HISTORY_RUNTIME_CONFIG.responseHistoryMaxEntries;
@@ -133,6 +136,7 @@ function removeSubtree(rootId) {
   const pending = [rootId];
   const removed = new Set();
   const affectedRoots = new Set();
+  let removedEntries = 0;
   while (pending.length) {
     const id = pending.pop();
     if (removed.has(id)) continue;
@@ -149,7 +153,9 @@ function removeSubtree(rootId) {
     totalBytes -= entry.bytes;
     histories.delete(id);
     rememberEvictedId(id);
+    removedEntries += 1;
   }
+  evictedEntriesTotal += removedEntries;
   for (const affectedRoot of affectedRoots) {
     const entry = histories.get(affectedRoot);
     if (!entry || entry.rootId !== affectedRoot) treeLru.delete(affectedRoot);
@@ -223,6 +229,9 @@ export function clearResponseHistory() {
   pinnedTrees.clear();
   evictedIds.clear();
   totalBytes = 0;
+  evictedEntriesTotal = 0;
+  lookupMisses = 0;
+  evictedLookupMisses = 0;
   return removed;
 }
 
@@ -253,7 +262,18 @@ export function configureResponseHistoryForTests({ maxBytes: nextMaxBytes, maxEn
 }
 
 export function responseHistoryStats() {
+  const trees = new Map();
+  for (const entry of histories.values()) {
+    trees.set(entry.rootId, (trees.get(entry.rootId) || 0) + entry.bytes);
+  }
+  let largestTreeBytes = 0;
+  for (const bytes of trees.values()) largestTreeBytes = Math.max(largestTreeBytes, bytes);
   return { entries: histories.size, bytes: totalBytes, evicted: evictedIds.size,
+    evicted_entries_total: evictedEntriesTotal,
+    lookup_misses: lookupMisses,
+    evicted_lookup_misses: evictedLookupMisses,
+    tree_count: trees.size,
+    largest_tree_bytes: largestTreeBytes,
     pinnedTrees: pinnedTrees.size, maxBytes, maxEntries };
 }
 
@@ -270,7 +290,10 @@ function responseHistoryChain(responseId) {
     seen.add(currentId);
     const entry = histories.get(currentId);
     if (!entry) {
-      const reason = evictedIds.has(currentId) ? " was evicted after reaching the local history limit" : " is not available";
+      lookupMisses += 1;
+      const wasEvicted = evictedIds.has(currentId);
+      if (wasEvicted) evictedLookupMisses += 1;
+      const reason = wasEvicted ? " was evicted after reaching the local history limit" : " is not available";
       throw httpError(`previous_response_id${reason}: ${currentId}`, 400);
     }
     chain.push(entry);