codex-copilot-dx 0.9.16 → 0.9.18

package/src/dashboard.mjs

@@ -1,5 +1,5 @@
 import { readFile } from "node:fs/promises";
-import { isLoopbackAddress, isLoopbackHostHeader } from "./observability.mjs";
+import { isLoopbackAddress, isLoopbackHostHeader } from "./security.mjs";
 
 const ASSETS = new Map([
   ["/", ["./dashboard/index.html", "text/html; charset=utf-8"]],

package/src/http-errors.mjs

@@ -0,0 +1,5 @@
+export function httpError(message, statusCode) {
+  const err = new Error(message);
+  err.statusCode = statusCode;
+  return err;
+}

package/src/http-transport.mjs

@@ -1,10 +1,15 @@
 import { promisify } from "node:util";
 import * as zlib from "node:zlib";
-import { loadRuntimeConfig, parsePositiveInteger } from "./runtime-config.mjs";
+import { loadRuntimeConfig } from "./runtime-config.mjs";
 import { decodedBodyLimitPreference } from "./user-settings.mjs";
 import { status } from "./status.mjs";
 import { safeUpstreamResponseHeaders } from "./upstream-headers.mjs";
 import { redactDiagnosticText } from "./diagnostic-text.mjs";
+import { httpError } from "./http-errors.mjs";
+import { admissionAbortError, contentEncodings, requestContentLength } from "./request-admission.mjs";
+
+export { httpError } from "./http-errors.mjs";
+export { createRequestAdmission } from "./request-admission.mjs";
 
 const COMPRESSED_BODY_WEIGHT_MULTIPLIER = 4;
 const gunzipAsync = promisify(zlib.gunzip);
@@ -15,9 +20,6 @@ const zstdDecompressAsync = zlib.zstdDecompress ? promisify(zlib.zstdDecompress)
 const HTTP_RUNTIME_CONFIG = loadRuntimeConfig();
 const MAX_BODY_BYTES = HTTP_RUNTIME_CONFIG.maxBodyBytes;
 const MAX_DECODED_BODY_BYTES = decodedBodyLimitPreference().bytes;
-const MAX_INFLIGHT_BODY_BYTES = HTTP_RUNTIME_CONFIG.maxInflightBodyBytes;
-const MAX_QUEUED_REQUESTS = HTTP_RUNTIME_CONFIG.maxQueuedRequests;
-const REQUEST_QUEUE_TIMEOUT_MS = HTTP_RUNTIME_CONFIG.requestQueueTimeoutMs;
 
 export const MAX_UPSTREAM_ERROR_BODY_BYTES = 1024 * 1024;
 export const MAX_UPSTREAM_MODEL_CATALOG_BYTES = 8 * 1024 * 1024;
@@ -25,12 +27,6 @@ export const MAX_UPSTREAM_RETRY_DRAIN_BYTES = 64 * 1024;
 export const MAX_UPSTREAM_CHAT_SUCCESS_BODY_BYTES = HTTP_RUNTIME_CONFIG.maxUpstreamChatResponseBytes;
 export const MAX_UPSTREAM_RESPONSES_SUCCESS_BODY_BYTES = HTTP_RUNTIME_CONFIG.maxUpstreamResponsesResponseBytes;
 
-export function httpError(message, statusCode) {
-  const err = new Error(message);
-  err.statusCode = statusCode;
-  return err;
-}
-
 function upstreamBodyTooLarge(label, maxBytes) {
   const error = httpError(`${label} exceeds ${maxBytes} bytes`, 502);
   error.code = "ccdx_upstream_response_too_large";
@@ -167,339 +163,6 @@ function payloadTooLarge(kind, maxBytes) {
   return httpError(`${kind} request body exceeds ${maxBytes} bytes`, 413);
 }
 
-function requestContentLength(req) {
-  return Number.parseInt(req.headers?.["content-length"] || "", 10);
-}
-
-function requestAdmissionWeight(req, maxBytes) {
-  const encodings = contentEncodings(req.headers?.["content-encoding"]);
-  const contentLength = requestContentLength(req);
-  if (!Number.isFinite(contentLength) || contentLength < 0) return maxBytes;
-  const compressed = encodings.some((encoding) => encoding !== "identity");
-  const weightedLength = compressed ? contentLength * COMPRESSED_BODY_WEIGHT_MULTIPLIER : contentLength;
-  return Math.max(1, Math.min(weightedLength, maxBytes));
-}
-
-function admissionAbortError(signal) {
-  if (signal?.reason instanceof Error) return signal.reason;
-  const error = new Error("The operation was aborted");
-  error.name = "AbortError";
-  return error;
-}
-
-function createSupplementalAdmission({ maxWeight, maxQueued, waitTimeoutMs, label, blockBehindExclusive = false }) {
-  const queue = [];
-  let activeWeight = 0;
-  let activeRequestedWeight = 0;
-  let activeRequests = 0;
-
-  const activate = (entry) => {
-    entry.cleanup();
-    activeWeight += entry.weight;
-    activeRequestedWeight += entry.requestedWeight;
-    activeRequests += 1;
-    let released = false;
-    const release = () => {
-      if (released) return;
-      released = true;
-      activeWeight = Math.max(0, activeWeight - entry.weight);
-      activeRequestedWeight = Math.max(0, activeRequestedWeight - entry.requestedWeight);
-      activeRequests = Math.max(0, activeRequests - 1);
-      drain();
-    };
-    release.resize = (requestedWeight) => {
-      if (released) return 0;
-      const parsedWeight = Number.isFinite(requestedWeight) && requestedWeight > 0
-        ? Math.ceil(requestedWeight)
-        : maxWeight;
-      const requested = Math.max(1, parsedWeight);
-      const weight = Math.min(requested, maxWeight);
-      if (weight > entry.weight) {
-        throw new RangeError(`${label} admission weight cannot grow`);
-      }
-      activeWeight = Math.max(0, activeWeight - (entry.weight - weight));
-      activeRequestedWeight = Math.max(0, activeRequestedWeight + requested - entry.requestedWeight);
-      entry.weight = weight;
-      entry.requestedWeight = requested;
-      drain();
-      return weight;
-    };
-    Object.defineProperties(release, {
-      weight: { get: () => released ? 0 : entry.weight },
-      requestedWeight: { get: () => released ? 0 : entry.requestedWeight },
-      maxWeight: { value: maxWeight },
-    });
-    entry.resolve(release);
-  };
-
-  const drain = () => {
-    for (let index = 0; index < queue.length;) {
-      const entry = queue[index];
-      if (activeWeight + entry.weight > maxWeight) {
-        if (blockBehindExclusive && entry.weight === maxWeight) break;
-        index += 1;
-        continue;
-      }
-      queue.splice(index, 1);
-      activate(entry);
-    }
-  };
-
-  const acquire = (requestedWeight, { signal } = {}) => {
-    if (signal?.aborted) return Promise.reject(admissionAbortError(signal));
-    const parsedWeight = Number.isFinite(requestedWeight) && requestedWeight > 0
-      ? Math.ceil(requestedWeight)
-      : maxWeight;
-    const requested = Math.max(1, parsedWeight);
-    const weight = Math.min(requested, maxWeight);
-    const blockedByExclusive = blockBehindExclusive
-      && queue.some((entry) => entry.weight === maxWeight);
-    const mustWait = blockedByExclusive || activeWeight + weight > maxWeight;
-    if (queue.length >= maxQueued && mustWait) {
-      return Promise.reject(httpError(`${label} queue is full (${maxQueued} waiting)`, 503));
-    }
-
-    return new Promise((resolve, reject) => {
-      let timer;
-      const entry = {
-        weight,
-        requestedWeight: requested,
-        resolve,
-        cleanup: () => {
-          if (timer) clearTimeout(timer);
-          signal?.removeEventListener("abort", onAbort);
-        },
-      };
-      const remove = () => {
-        const index = queue.indexOf(entry);
-        if (index >= 0) queue.splice(index, 1);
-      };
-      const fail = (error) => {
-        entry.cleanup();
-        remove();
-        reject(error);
-        drain();
-      };
-      const onAbort = () => fail(admissionAbortError(signal));
-      signal?.addEventListener("abort", onAbort, { once: true });
-      timer = setTimeout(() => {
-        fail(httpError(`${label} admission timed out after ${waitTimeoutMs}ms`, 503));
-      }, waitTimeoutMs);
-      timer.unref?.();
-      queue.push(entry);
-      if (signal?.aborted) onAbort();
-      else drain();
-    });
-  };
-
-  acquire.stats = () => ({
-    activeWeight,
-    activeRequestedWeight,
-    activeRequests,
-    queued: queue.length,
-    maxWeight,
-  });
-  return acquire;
-}
-
-export function createRequestAdmission({
-  maxBytes = MAX_INFLIGHT_BODY_BYTES,
-  maxQueued = MAX_QUEUED_REQUESTS,
-  waitTimeoutMs = REQUEST_QUEUE_TIMEOUT_MS,
-} = {}) {
-  const byteLimit = parsePositiveInteger(maxBytes, MAX_INFLIGHT_BODY_BYTES);
-  const queueLimit = parsePositiveInteger(maxQueued, MAX_QUEUED_REQUESTS);
-  const timeoutMs = parsePositiveInteger(waitTimeoutMs, REQUEST_QUEUE_TIMEOUT_MS);
-  const acquireDecompression = createSupplementalAdmission({
-    maxWeight: 1,
-    maxQueued: queueLimit,
-    waitTimeoutMs: timeoutMs,
-    label: "Request decompression",
-  });
-  const acquireDecodedBody = createSupplementalAdmission({
-    maxWeight: byteLimit,
-    maxQueued: queueLimit,
-    waitTimeoutMs: timeoutMs,
-    label: "Decoded request body",
-    blockBehindExclusive: true,
-  });
-  const acquireResponseHistory = createSupplementalAdmission({
-    maxWeight: byteLimit,
-    maxQueued: queueLimit,
-    waitTimeoutMs: timeoutMs,
-    label: "Response history",
-  });
-  const queue = [];
-  let activeBytes = 0;
-  let activeRequests = 0;
-  const counters = {
-    total: 0,
-    activated: 0,
-    queued: 0,
-    rejected: 0,
-    timedOut: 0,
-    aborted: 0,
-    waitMsTotal: 0,
-    waitMsMax: 0,
-  };
-
-  const remove = (entry) => {
-    const index = queue.indexOf(entry);
-    if (index >= 0) queue.splice(index, 1);
-  };
-
-  const activate = (entry) => {
-    entry.cleanup();
-    activeBytes += entry.weight;
-    activeRequests += 1;
-    counters.activated += 1;
-    const waitMs = Math.max(0, Date.now() - entry.startedAt);
-    counters.waitMsTotal += waitMs;
-    counters.waitMsMax = Math.max(counters.waitMsMax, waitMs);
-    let released = false;
-    const supplementalReleases = new Set();
-    const release = () => {
-      if (released) return;
-      released = true;
-      for (const releaseSupplemental of supplementalReleases) releaseSupplemental();
-      supplementalReleases.clear();
-      activeBytes = Math.max(0, activeBytes - entry.weight);
-      activeRequests = Math.max(0, activeRequests - 1);
-      drain();
-    };
-    const reserve = async (gate, weight, options) => {
-      const releaseSupplemental = await gate(weight, options);
-      if (released) {
-        releaseSupplemental();
-        throw admissionAbortError(options?.signal);
-      }
-      let supplementalReleased = false;
-      const releaseReservation = () => {
-        if (supplementalReleased) return;
-        supplementalReleased = true;
-        supplementalReleases.delete(releaseReservation);
-        releaseSupplemental();
-      };
-      releaseReservation.resize = (nextWeight) => {
-        if (supplementalReleased) return 0;
-        return releaseSupplemental.resize(nextWeight);
-      };
-      Object.defineProperties(releaseReservation, {
-        weight: { get: () => supplementalReleased ? 0 : releaseSupplemental.weight },
-        requestedWeight: {
-          get: () => supplementalReleased ? 0 : releaseSupplemental.requestedWeight,
-        },
-        maxWeight: { value: releaseSupplemental.maxWeight },
-      });
-      supplementalReleases.add(releaseReservation);
-      return releaseReservation;
-    };
-    release.acquireDecompression = (options) => acquireDecompression(1, options);
-    release.reserveDecodedBody = (bytes, options) => reserve(acquireDecodedBody, bytes, options);
-    release.reserveDecodedBody.supportsResize = true;
-    release.reserveResponseHistory = (bytes, options) => reserve(acquireResponseHistory, bytes, options);
-    entry.resolve(release);
-  };
-
-  const drain = () => {
-    for (let index = 0; index < queue.length;) {
-      const entry = queue[index];
-      if (entry.cancelled) {
-        queue.splice(index, 1);
-        continue;
-      }
-      if (activeBytes + entry.weight > byteLimit) {
-        // Unknown-length requests reserve the whole budget. Once one is waiting,
-        // do not let later arrivals keep extending its wait indefinitely.
-        if (entry.weight === byteLimit) break;
-        index += 1;
-        continue;
-      }
-      queue.splice(index, 1);
-      activate(entry);
-    }
-  };
-
-  const acquire = (req, { signal } = {}) => {
-    counters.total += 1;
-    if (signal?.aborted) {
-      counters.aborted += 1;
-      return Promise.reject(admissionAbortError(signal));
-    }
-    const weight = requestAdmissionWeight(req, byteLimit);
-    const blockedByExclusive = queue.some((entry) => !entry.cancelled && entry.weight === byteLimit);
-    const mustWait = blockedByExclusive || activeBytes + weight > byteLimit;
-    if (queue.length >= queueLimit && mustWait) {
-      counters.rejected += 1;
-      return Promise.reject(httpError(`Request queue is full (${queueLimit} waiting)`, 503));
-    }
-    if (mustWait) counters.queued += 1;
-
-    return new Promise((resolve, reject) => {
-      let timer;
-      const entry = {
-        cancelled: false,
-        startedAt: Date.now(),
-        weight,
-        resolve,
-        cleanup: () => {
-          if (timer) clearTimeout(timer);
-          signal?.removeEventListener("abort", onAbort);
-        },
-      };
-      const cancel = (error, reason) => {
-        if (entry.cancelled) return;
-        entry.cancelled = true;
-        if (reason === "aborted") counters.aborted += 1;
-        if (reason === "timed_out") counters.timedOut += 1;
-        entry.cleanup();
-        remove(entry);
-        reject(error);
-        drain();
-      };
-      const onAbort = () => cancel(admissionAbortError(signal), "aborted");
-      signal?.addEventListener("abort", onAbort, { once: true });
-      timer = setTimeout(() => {
-        cancel(httpError(`Request admission timed out after ${timeoutMs}ms`, 503), "timed_out");
-      }, timeoutMs);
-      timer.unref?.();
-      queue.push(entry);
-      if (signal?.aborted) onAbort();
-      else drain();
-    });
-  };
-
-  acquire.stats = () => ({ activeBytes, queued: queue.length, maxBytes: byteLimit });
-  acquire.diagnostics = () => ({
-    activeBytes,
-    activeRequests,
-    queued: queue.length,
-    maxBytes: byteLimit,
-    maxQueued: queueLimit,
-    waitTimeoutMs: timeoutMs,
-    total: counters.total,
-    activated: counters.activated,
-    queuedTotal: counters.queued,
-    rejected: counters.rejected,
-    timedOut: counters.timedOut,
-    aborted: counters.aborted,
-    waitMsAvg: counters.activated > 0
-      ? Number((counters.waitMsTotal / counters.activated).toFixed(1))
-      : 0,
-    waitMsMax: counters.waitMsMax,
-    decompressionsActive: acquireDecompression.stats().activeRequests,
-    decompressionsQueued: acquireDecompression.stats().queued,
-    decodedBodyBytes: acquireDecodedBody.stats().activeRequestedWeight,
-    decodedBodyAdmissionBytes: acquireDecodedBody.stats().activeWeight,
-    decodedBodiesActive: acquireDecodedBody.stats().activeRequests,
-    decodedBodiesQueued: acquireDecodedBody.stats().queued,
-    responseHistoryBytes: acquireResponseHistory.stats().activeWeight,
-    responseHistoriesActive: acquireResponseHistory.stats().activeRequests,
-    responseHistoriesQueued: acquireResponseHistory.stats().queued,
-  });
-  return acquire;
-}
-
 function consumeRequestChunks(req, { signal, onChunk }) {
   return new Promise((resolve, reject) => {
     let settled = false;
@@ -610,13 +273,6 @@ async function readIdentityText(req, maxBodyBytes, maxDecodedBodyBytes, signal)
   return text + decoder.decode();
 }
 
-function contentEncodings(contentEncoding) {
-  return String(contentEncoding || "identity")
-    .split(",")
-    .map((value) => value.trim().toLowerCase())
-    .filter(Boolean);
-}
-
 async function decompressBody(decompress, buffer, maxBytes) {
   try {
     return await decompress(buffer, { maxOutputLength: maxBytes });

package/src/image-mcp.mjs

@@ -2,7 +2,8 @@ import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { randomUUID } from "node:crypto";
-import { isLoopbackAddress } from "./observability.mjs";
+import { isIP } from "node:net";
+import { isLoopbackAddress, isLoopbackHostHeader } from "./security.mjs";
 import { generateImage, supportsImageEditing, IMAGE_MAX_BYTES } from "./image-provider.mjs";
 import { readImageProviderConfig } from "./image-provider-config.mjs";
 import { createImageReferenceStore } from "./image-references.mjs";
@@ -49,6 +50,28 @@ function sameHostSocket(socket) {
   return remote && local && remote === local;
 }
 
+function canonicalIpHost(hostname) {
+  const address = hostname.replace(/^\[|\]$/g, "");
+  const mapped = /^::ffff:([a-f0-9]{1,4}):([a-f0-9]{1,4})$/.exec(address);
+  if (!mapped) return address;
+  const high = Number.parseInt(mapped[1], 16);
+  const low = Number.parseInt(mapped[2], 16);
+  return [high >> 8, high & 255, low >> 8, low & 255].join(".");
+}
+
+function ownHostHeader(host, socket, bindHostname) {
+  if (isLoopbackHostHeader(host)) return true;
+  if (typeof host !== "string" || !host || host.includes(",")) return false;
+  try {
+    const url = new URL(`http://${host}`);
+    if (url.username || url.password || url.pathname !== "/" || url.search || url.hash) return false;
+    if (bindHostname && url.hostname === bindHostname) return true;
+    const local = String(socket?.localAddress || "");
+    if (!isIP(local)) return false;
+    return canonicalIpHost(url.hostname) === canonicalIpHost(new URL(`http://${isIP(local) === 6 ? `[${local}]` : local}`).hostname);
+  } catch { return false; }
+}
+
 function writeJson(res, statusCode, body) {
   if (res.destroyed || res.writableEnded) return;
   res.writeHead(statusCode, {
@@ -134,9 +157,14 @@ export function createImageMcpHandler({
   configLoader = () => readImageProviderConfig(),
   generateImageFn = generateImage,
   maxConcurrent = 2,
+  localHostname = "",
   imageReferences = createImageReferenceStore(),
   imageDirectory = path.join(os.homedir(), ".local", "share", "codex-copilot-dx", "images"),
 } = {}) {
+  let bindHostname = "";
+  if (localHostname && !isIP(localHostname.replace(/^\[|\]$/g, ""))) {
+    try { bindHostname = new URL(`http://${localHostname}`).hostname; } catch {}
+  }
   let active = 0;
   const metrics = { total: 0, succeeded: 0, failed: 0, busy: 0, cancelled: 0, delivery_failures: 0 };
   const handler = async function imageMcpHandler(req, res) {
@@ -144,6 +172,10 @@ export function createImageMcpHandler({
       writeJson(res, 403, jsonRpcError(null, -32001, "Image MCP is available only on this device"));
       return;
     }
+    if (!ownHostHeader(req.headers?.host, req.socket, bindHostname)) {
+      writeJson(res, 403, jsonRpcError(null, -32001, "Image MCP is available only on this device"));
+      return;
+    }
     if (req.method !== "POST") {
       res.setHeader?.("Allow", "POST");
       writeJson(res, 405, jsonRpcError(null, -32600, "Only POST is supported"));

package/src/image-provider.mjs

@@ -207,10 +207,11 @@ function publicAddress(address) {
   catch { return false; }
   if (lower === "::" || lower === "::1" || lower.startsWith("fc") || lower.startsWith("fd")
     || /^fe[89ab]/.test(lower) || lower.startsWith("ff") || lower.startsWith("2001:db8:")) return false;
-  const mapped = /^::ffff:([a-f0-9]{1,4}):([a-f0-9]{1,4})$/.exec(lower);
+  const mapped = /^::ffff:([a-f0-9]{1,4}):([a-f0-9]{1,4})$/.exec(lower)
+    || /^64:ff9b::(?:([a-f0-9]{1,4}):)?([a-f0-9]{1,4})?$/.exec(lower);
   if (!mapped) return true;
-  const high = Number.parseInt(mapped[1], 16);
-  const low = Number.parseInt(mapped[2], 16);
+  const high = Number.parseInt(mapped[1] || "0", 16);
+  const low = Number.parseInt(mapped[2] || "0", 16);
   return ipv4Public([high >> 8, high & 255, low >> 8, low & 255].join("."));
 }
 
@@ -305,20 +306,36 @@ export async function generateImage(config, {
   const timeout = AbortSignal.timeout(timeoutMs);
   const requestSignal = signal ? AbortSignal.any([signal, timeout]) : timeout;
   let response;
-  try {
-    response = await fetchImpl(config.endpoint, {
-      method: "POST",
-      headers: {
-        Authorization: `Bearer ${config.api_key}`,
-        "Content-Type": "application/json",
-        Accept: "application/json",
-      },
-      body: JSON.stringify(generationBody(config, normalizedPrompt, normalizedSize, normalizedImage)),
-      signal: requestSignal,
-    });
-  } catch (error) {
-    if (requestSignal.aborted) throw providerError("Image generation timed out or was cancelled", "ccdx_image_timeout");
-    throw providerError("Image API could not be reached");
+  let requestUrl = config.endpoint;
+  let method = "POST";
+  let requestBody = JSON.stringify(generationBody(config, normalizedPrompt, normalizedSize, normalizedImage));
+  let headers = { Authorization: `Bearer ${config.api_key}`, "Content-Type": "application/json", Accept: "application/json" };
+  for (let redirects = 0; ; redirects += 1) {
+    try {
+      if (requestSignal.aborted) throw requestSignal.reason;
+      response = await fetchImpl(requestUrl, { method, headers, body: requestBody, signal: requestSignal, redirect: "manual" });
+    } catch (error) {
+      if (requestSignal.aborted) throw providerError("Image generation timed out or was cancelled", "ccdx_image_timeout");
+      throw providerError("Image API could not be reached");
+    }
+    const location = [301, 302, 303, 307, 308].includes(response.status) ? response.headers?.get?.("location") : null;
+    if (location == null) break;
+    await response.body?.cancel?.().catch?.(() => {});
+    let target;
+    try { target = new URL(location, requestUrl); }
+    catch { throw providerError("Image API returned an invalid redirect", "ccdx_image_redirect_unsafe"); }
+    if (target.protocol !== "https:" || target.username || target.password || target.origin !== new URL(requestUrl).origin) {
+      throw providerError("Image API redirect was refused; use a same-origin HTTPS endpoint", "ccdx_image_redirect_unsafe");
+    }
+    if (redirects >= 20) throw providerError("Image API returned too many redirects", "ccdx_image_redirect_limit");
+    // Preserve Fetch's method/body rules for legitimate same-origin redirects.
+    if (((response.status === 301 || response.status === 302) && method === "POST") || (response.status === 303 && method !== "GET")) {
+      method = "GET";
+      requestBody = undefined;
+      headers = { ...headers };
+      delete headers["Content-Type"];
+    }
+    requestUrl = target.href;
   }
   const body = await boundedJson(response);
   if (!response.ok) {

package/src/live-models.mjs

@@ -0,0 +1,137 @@
+import os from "node:os";
+import { validateGithubToken } from "./auth.mjs";
+import { AUTH_PROFILE_CODEX, readAuthProfileCredentials } from "./auth-profile.mjs";
+import { buildHeaders, FALLBACK_VSCODE_VERSION, parseApiBase } from "./copilot.mjs";
+
+const DEFAULT_MODELS_TIMEOUT_MS = 10000;
+const SUPPORTED_ENDPOINTS = [
+  ["responses", new Set(["/responses", "/v1/responses"])],
+  ["chat", new Set(["/chat/completions"])],
+];
+
+function safeText(value, fallback = "") {
+  const text = String(value ?? "")
+    .replace(/[\u0000-\u001f\u007f-\u009f]/g, " ")
+    .replace(/\s+/g, " ")
+    .trim();
+  return text || fallback;
+}
+
+function endpointLabels(model) {
+  const advertised = new Set(Array.isArray(model?.supported_endpoints) ? model.supported_endpoints : []);
+  return SUPPORTED_ENDPOINTS
+    .filter(([, values]) => [...values].some((value) => advertised.has(value)))
+    .map(([label]) => label);
+}
+
+export function selectableCopilotModels(payload) {
+  const data = Array.isArray(payload) ? payload : payload?.data;
+  if (!Array.isArray(data)) throw new Error("Copilot models response contained no model list");
+
+  const models = [];
+  const seen = new Set();
+  for (const model of data) {
+    if (model?.model_picker_enabled !== true) continue;
+    const policyState = safeText(model?.policy?.state).toLowerCase();
+    if (policyState && policyState !== "enabled") continue;
+    const capabilityType = safeText(model?.capabilities?.type).toLowerCase();
+    if (capabilityType && capabilityType !== "chat") continue;
+
+    const id = safeText(model?.id);
+    const endpoints = endpointLabels(model);
+    if (!id.startsWith("gpt-") || id === "codex-auto-review" || !endpoints.length || seen.has(id)) continue;
+    seen.add(id);
+    models.push({
+      id,
+      vendor: safeText(model?.vendor || model?.owned_by, "Unknown"),
+      endpoints,
+      preview: model?.preview === true,
+    });
+  }
+
+  models.sort((left, right) => left.vendor.localeCompare(right.vendor, "en")
+    || left.id.localeCompare(right.id, "en"));
+  return { advertised: data.length, models };
+}
+
+function validationFailure(validation) {
+  const httpStatus = validation?.status ? ` (HTTP ${validation.status})` : "";
+  return `GitHub Copilot authentication failed: ${validation?.reason || "unknown error"}${httpStatus}`;
+}
+
+async function responseText(response) {
+  try {
+    return await response.text();
+  } catch {
+    return "";
+  }
+}
+
+function readModelCredentials(home) {
+  let credentials;
+  try {
+    credentials = readAuthProfileCredentials(AUTH_PROFILE_CODEX, { home });
+  } catch (error) {
+    throw new Error(`Could not read the GitHub token: ${error.message}`);
+  }
+  if (credentials.valid) return credentials;
+  if (!credentials.configured) throw new Error("GitHub token not found. Start ccdx once to log in.");
+  if (credentials.reason === "empty_token") throw new Error("GitHub token file is empty. Start ccdx again to log in.");
+  throw new Error(`GitHub token is unavailable (${credentials.reason || "unknown"}). Start ccdx again to log in.`);
+}
+
+export async function fetchLiveCopilotModels({
+  home = os.homedir(),
+  fetchImpl = fetch,
+  timeoutMs = DEFAULT_MODELS_TIMEOUT_MS,
+  vscodeVersion = FALLBACK_VSCODE_VERSION,
+} = {}) {
+  const credentials = readModelCredentials(home);
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const validation = await validateGithubToken(credentials.token, {
+      fetchImpl,
+      signal: controller.signal,
+    });
+    if (controller.signal.aborted) throw new Error(`Live model lookup timed out after ${timeoutMs}ms`);
+    if (!validation.ok) throw new Error(validationFailure(validation));
+
+    const tokenData = validation.copilotTokenData;
+    const apiBase = parseApiBase(tokenData);
+    const headers = buildHeaders({
+      token: tokenData.token,
+      version: vscodeVersion,
+      initiator: "user",
+      vision: false,
+    });
+    const response = await fetchImpl(`${apiBase}/models`, {
+      headers,
+      redirect: "error",
+      signal: controller.signal,
+    });
+    const body = await responseText(response);
+    if (!response.ok) {
+      const detail = safeText(body).slice(0, 240);
+      throw new Error(`Copilot models endpoint returned HTTP ${response.status}${detail ? `: ${detail}` : ""}`);
+    }
+
+    let payload;
+    try {
+      payload = JSON.parse(body);
+    } catch {
+      throw new Error("Copilot models endpoint returned invalid JSON");
+    }
+    const catalog = selectableCopilotModels(payload);
+    let upstreamHost = "GitHub Copilot";
+    try { upstreamHost = new URL(apiBase).hostname; } catch {}
+    return { ...catalog, profile: AUTH_PROFILE_CODEX, upstreamHost: safeText(upstreamHost, "GitHub Copilot") };
+  } catch (error) {
+    if (controller.signal.aborted && !/timed out/.test(error?.message || "")) {
+      throw new Error(`Live model lookup timed out after ${timeoutMs}ms`);
+    }
+    throw error;
+  } finally {
+    clearTimeout(timer);
+  }
+}