codex-copilot-dx 0.9.10 → 0.9.12

package/README.md

@@ -20,7 +20,7 @@ The adapter handles response history, encrypted reasoning state, function/custom
 
 Codex can select Standard or Fast without changing CCDX configuration. When the client requests a model with `service_tier: "priority"`, CCDX uses its exact `-fast` model only when the live Copilot catalog advertises that variant as enabled, selectable, OpenAI-owned, and Responses-only. Standard mode continues to use the base model; CCDX does not invent Fast availability when the upstream catalog does not provide it. This retains the established `gpt-5.6-sol` / `gpt-5.6-sol-fast` mapping and applies the same exact-match rule to future models.
 
-Codex Auto-review uses the hidden `codex-auto-review` model ID. CCDX maps it to Copilot's `gpt-5.5` Responses model by default, independently of the interactive Fast/Standard selection, and logs both model IDs when the mapping is used. The review target can be changed interactively without reinstalling or restarting CCDX.
+Codex Auto-review uses the hidden `codex-auto-review` model ID. CCDX maps it to Copilot's `gpt-6.1-sol` Responses model by default, independently of the interactive Fast/Standard selection, and logs both model IDs when the mapping is used. An omitted Auto-review reasoning effort defaults to `low`; explicit efforts and other reasoning fields are preserved. The review target can be changed interactively without reinstalling or restarting CCDX.
 
 ### GPT-6 model catalog
 
@@ -117,7 +117,7 @@ ccdx auto-review-model
 
 The selector first queries the running adapter, including its last-known-good model list when live refresh is unavailable, then falls back to a local model cache no older than seven days. It offers model IDs that advertise a Responses endpoint and are not explicitly hidden from the model picker. This selection does not itself verify policy or inference access.
 
-The selection is saved in `~/.config/codex-copilot-dx/config.json`, or under `XDG_CONFIG_HOME` when set. Choosing `gpt-5.5` clears the override and restores the package default. A running adapter reads the setting on the next Auto-review request.
+The selection is saved in `~/.config/codex-copilot-dx/config.json`, or under `XDG_CONFIG_HOME` when set. Choosing `gpt-6.1-sol` clears the override and restores the package default. Existing saved models, including `gpt-5.5`, and environment overrides remain effective. A running adapter reads the setting on the next Auto-review request. The selector changes the model, not the reasoning effort; Codex Guardian currently sends `low`. GPT-6.1 Sol does not support explicit `none` or `minimal` efforts.
 
 ### Runtime caches
 
@@ -352,7 +352,7 @@ Recovery first tries compatible local credentials and starts Device Flow only wh
 | `CCDX_STREAM_IDLE_TIMEOUT_MS` | `120000` | Maximum idle time between upstream streaming body chunks |
 | `CCDX_UPSTREAM_RETRIES` | `2` | Retries for safe requests and clearly pre-connect POST failures; capped at `5` |
 | `CCDX_UPSTREAM_RETRY_DELAY_MS` | `300` | Initial upstream retry backoff in milliseconds; capped at `5000` |
-| `CCDX_AUTO_REVIEW_MODEL` | saved selection or `gpt-5.5` | Copilot Responses model used for Codex Auto-review; overrides the interactive selection |
+| `CCDX_AUTO_REVIEW_MODEL` | saved selection or `gpt-6.1-sol` | Copilot Responses model used for Codex Auto-review; overrides the interactive selection |
 | `CCDX_LOG_PATH` | unset | Mirror terminal logs to a file; set to `1` for `~/.local/share/codex-copilot-dx/debug.log` |
 | `CCDX_LOG_LEVEL` | `info` | Set to `debug` for upstream attempts, status codes, retry causes, and timings |
 | `CCDX_LOG_MAX_BYTES` | `16777216` | Rotate the debug log at this size and retain one `.1` backup; set to `0` to disable rotation |
@@ -394,6 +394,10 @@ The summary covers the current log and its single rotated backup, not an unbound
 
 Usage writes are asynchronous and batched under the existing cross-process rotation lock. Pending and in-flight records share a 4096-record / 4 MiB ceiling. If either ceiling is reached, new excess records are dropped with a warning and a status counter; inference does not wait or retry. Normal records and per-record rotation boundaries are unchanged. The bounded shutdown flush remains 1.5 seconds; disk failures and shutdown deadlines can prevent persistence, so usage is diagnostic rather than a billing ledger.
 
+Repeated plain usage summaries in the same process reuse one bounded cache entry when both retained log files are unchanged. File identity, size, modification/change timestamps and a two-second recent-write guard control reuse; concurrent settled-file queries share one scan. The serialized summary budget is 256 KiB and at most 128 model groups; larger results remain complete but uncached. Warnings, unstable reads, metadata errors and scans with changed files are not retained. Each caller receives an independent result. Analytics record callbacks and custom-warning reads keep the original streaming path. There is no persistent index, background polling, cross-process cache or change to usage writes; opening analytics still scans the retained records.
+
+Diagnostic redaction removes Basic authorization payloads and URL userinfo, and consumes escaped quotes inside sensitive JSON fields. Ordinary Basic-related prose, safe host/path information and error codes are retained. These protections apply to existing failure/status/debug diagnostics, not forwarded requests or upstream response bodies. They do not make arbitrary upstream prose guaranteed safe to share.
+
 ## Debug logging
 
 Set `CCDX_LOG_PATH=1` to mirror terminal logs to `~/.local/share/codex-copilot-dx/debug.log`, or provide a custom path. Add `CCDX_LOG_LEVEL=debug` for upstream attempts, retry causes, status codes, and timings. The adapter does not deliberately dump request/response bodies or authorization headers. File diagnostics redact common credential forms and labelled content echoes, but this cannot identify every secret in arbitrary external prose; review logs before sharing them. File writes are asynchronous and batched with a 4096-record / 2 MiB pending-and-in-flight ceiling. Overflow drops excess file records with one warning and a status counter; terminal output continues. CLI exit paths flush for at most 1.5 seconds. `ccdx doctor config` bypasses file logging entirely.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-copilot-dx",
-  "version": "0.9.10",
+  "version": "0.9.12",
   "description": "Use Codex App with GitHub Copilot",
   "author": "Dale Xiao",
   "type": "module",

package/src/diagnostic-text.mjs

@@ -2,9 +2,16 @@
 // but remove common credential forms and explicitly labelled content echoes.
 export function redactDiagnosticText(value) {
   return String(value ?? "")
-    .replace(/\bBearer\s+[^\s,;"'<>]+/gi, "Bearer [redacted]")
+    .replace(/(\b(?:proxy[-_]?)?authorization["']?\s*[:=]\s*)(?:Basic|Bearer)\s+[^\s,;"'<>\\]+/gi, "$1[redacted]")
+    .replace(/\b(Bearer|Basic)\s+([^\s,;"'<>\\]+)/gi, (match, scheme, value) => {
+      // Standalone ordinary prose such as "basic authentication" is not a credential.
+      if (scheme.toLowerCase() === "basic"
+        && (!/^[a-z0-9+/_-]+={0,2}$/i.test(value) || !Buffer.from(value, "base64").includes(0x3a))) return match;
+      return `${scheme} [redacted]`;
+    })
+    .replace(/\b([a-z][a-z0-9+.-]{0,63}:\/\/)[^\s/?#"'<>]*@/gi, "$1[redacted]@")
     .replace(/\b(?:github_pat_|gh[pousr]_|sk-|copilot_)[A-Za-z0-9._-]+/gi, "[redacted]")
-    .replace(/((?:api[_-]?key|access[_-]?token|refresh[_-]?token|authorization|cookie)["']?\s*[:=]\s*)(?:"[^"\n]*"|'[^'\n]*'|[^\s,;]+)/gi, "$1[redacted]")
+    .replace(/((?:api[_-]?key|access[_-]?token|refresh[_-]?token|authorization|cookie)["']?\s*[:=]\s*)(?:"(?:\\.|[^"\\\n])*"|'(?:\\.|[^'\\\n])*'|[^\s,;]+)/gi, "$1[redacted]")
     .replace(/((?:prompt|input|completion|tool_arguments|arguments|content)["']?\s*[:=]\s*)[^\n]+/gi, "$1[redacted]")
     .replace(/(encrypted(?: function output)? content\s+)[A-Za-z0-9+/_=-]{24,}/gi, "$1[redacted]")
     .replace(/\b[A-Za-z0-9+/_=-]{96,}\b/g, "[redacted]");

package/src/models.mjs

@@ -1,5 +1,5 @@
 export const CODEX_AUTO_REVIEW_MODEL = "codex-auto-review";
-export const DEFAULT_CODEX_AUTO_REVIEW_MODEL = "gpt-5.5";
+export const DEFAULT_CODEX_AUTO_REVIEW_MODEL = "gpt-6.1-sol";
 export const CODEX_GPT6_MODEL = "gpt-6-astra";
 
 function hasOpenAIEndpoint(model) {

package/src/responses-handler.mjs

@@ -272,7 +272,12 @@ export function createResponsesHandler(options) {
         delete prepared.body.service_tier;
       }
       stripUnsupportedGpt6ServiceTier(prepared.body, requestedModel, upstreamModel, priorityTierModel);
-      if (requestedModel === CODEX_AUTO_REVIEW_MODEL) delete prepared.body.service_tier;
+      if (requestedModel === CODEX_AUTO_REVIEW_MODEL) {
+        delete prepared.body.service_tier;
+        if (prepared.body.reasoning?.effort === undefined) {
+          prepared.body.reasoning = { ...prepared.body.reasoning, effort: "low" };
+        }
+      }
       if (upstreamModel !== requestedModel) prepared.body.model = upstreamModel;
       markResponseModel(upstreamModel);
       const upstreamLog = upstreamModel === requestedModel ? "" : ` upstream_model=${upstreamModel}`;
@@ -537,7 +542,12 @@ export function createResponsesCompactHandler(options) {
         delete prepared.body.service_tier;
       }
       stripUnsupportedGpt6ServiceTier(prepared.body, requestedModel, upstreamModel, priorityTierModel);
-      if (requestedModel === CODEX_AUTO_REVIEW_MODEL) delete prepared.body.service_tier;
+      if (requestedModel === CODEX_AUTO_REVIEW_MODEL) {
+        delete prepared.body.service_tier;
+        if (prepared.body.reasoning?.effort === undefined) {
+          prepared.body.reasoning = { ...prepared.body.reasoning, effort: "low" };
+        }
+      }
       if (upstreamModel !== requestedModel) prepared.body.model = upstreamModel;
       const upstreamLog = upstreamModel === requestedModel ? "" : ` upstream_model=${upstreamModel}`;
       console.log(status("info", `responses compact model=${requestedModel}${upstreamLog} stream=false`));

package/src/usage.mjs

@@ -288,7 +288,7 @@ export function summarizeUsage(records) {
   return summary;
 }
 
-export async function summarizeUsageLogs(filePath = usageLogPath(), { warn = console.error, onRecord } = {}) {
+async function summarizeUsageLogFiles(filePath, { warn = console.error, onRecord } = {}) {
   const summary = { requests: 0, totals: {}, byModel: {} };
   for (const candidate of [rotatedFilePath(filePath), filePath]) {
     for await (const record of iterateUsageRecords(candidate, { warn })) {
@@ -305,6 +305,51 @@ export async function summarizeUsageLogs(filePath = usageLogPath(), { warn = con
   return summary;
 }
 
+const SUMMARY_CACHE_MAX_BYTES = 256 * 1024;
+const SUMMARY_CACHE_SETTLED_MS = 2000;
+let cachedSummary = null;
+
+async function usageSummaryVersion(filePath) {
+  try {
+    const files = await Promise.all([rotatedFilePath(filePath), filePath].map(async (file) => {
+      try {
+        const stat = await fs.promises.stat(file, { bigint: true });
+        if (!stat.isFile()) return null;
+        const recent = Math.max(Number(stat.mtimeMs), Number(stat.ctimeMs));
+        if (Date.now() - recent < SUMMARY_CACHE_SETTLED_MS) return null;
+        return [stat.dev, stat.ino, stat.size, stat.mtimeNs, stat.ctimeNs].join(":");
+      } catch (error) {
+        if (error?.code === "ENOENT") return "missing";
+        throw error;
+      }
+    }));
+    return files.some((version) => version === null) ? null : `${path.resolve(filePath)}\0${files.join("|")}`;
+  } catch { return null; } // Uncacheable metadata never replaces the normal read/error path.
+}
+
+export async function summarizeUsageLogs(filePath = usageLogPath(), { warn = console.error, onRecord } = {}) {
+  if (onRecord || warn !== console.error) return summarizeUsageLogFiles(filePath, { warn, onRecord });
+  const version = await usageSummaryVersion(filePath);
+  if (version === null) {
+    cachedSummary = null;
+    return summarizeUsageLogFiles(filePath, { warn });
+  }
+  if (cachedSummary?.version === version) return structuredClone(await cachedSummary.promise);
+  const entry = { version, promise: null };
+  cachedSummary = entry;
+  entry.promise = (async () => {
+    let warned = false;
+    const summary = await summarizeUsageLogFiles(filePath, { warn(message) { warned = true; warn(message); } });
+    const after = await usageSummaryVersion(filePath);
+    const retain = !warned && after === version && Object.keys(summary.byModel).length <= 128
+      && Buffer.byteLength(JSON.stringify(summary)) <= SUMMARY_CACHE_MAX_BYTES;
+    if (!retain && cachedSummary === entry) cachedSummary = null;
+    return summary;
+  })();
+  try { return structuredClone(await entry.promise); }
+  catch (error) { if (cachedSummary === entry) cachedSummary = null; throw error; }
+}
+
 function fmt(n) {
   return Number.isFinite(n) ? n.toLocaleString("en-US") : "0";
 }