codex-copilot-dx 0.9.17 → 0.9.18

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-copilot-dx",
-  "version": "0.9.17",
+  "version": "0.9.18",
   "description": "Use Codex App with GitHub Copilot",
   "author": "Dale Xiao",
   "type": "module",

package/src/adapter.mjs

@@ -6,8 +6,6 @@ import {
   ADAPTER_STATUS_PATH,
   classifyAdapterRoute,
   createRequestMetrics,
-  isLoopbackAddress,
-  isLoopbackHostHeader,
   runtimeStatusPayload,
 } from "./observability.mjs";
 import { createRequestId, runWithRequestContext } from "./request-context.mjs";
@@ -26,13 +24,14 @@ import {
 } from "./cache-control.mjs";
 import { loadRuntimeConfig, parsePositiveInteger } from "./runtime-config.mjs";
 import {
-  createRequestAdmission,
   createRequestAbort,
-  httpError,
   logRequestFailure,
   readJsonBody,
   sendJsonError,
 } from "./http-transport.mjs";
+import { httpError } from "./http-errors.mjs";
+import { createRequestAdmission } from "./request-admission.mjs";
+import { isLoopbackAddress, isLoopbackHostHeader } from "./security.mjs";
 
 export {
   abortErrorStatusCode,

package/src/auth-status.mjs

@@ -0,0 +1,175 @@
+import os from "node:os";
+import { validateGithubToken } from "./auth.mjs";
+import { AUTH_PROFILE_CODEX, readAuthProfileCredentials } from "./auth-profile.mjs";
+import { buildHeaders, FALLBACK_VSCODE_VERSION, parseApiBase } from "./copilot.mjs";
+import { MAX_UPSTREAM_MODEL_CATALOG_BYTES, readBoundedResponseText } from "./http-transport.mjs";
+import { profileRouting } from "./profile-routing.mjs";
+
+const DEFAULT_COPILOT_CATALOG_TIMEOUT_MS = 30 * 1000;
+
+function responseDetail(value) {
+  return String(value || "").replace(/\s+/g, " ").trim().slice(0, 240);
+}
+
+function abortError(signal) {
+  if (signal?.reason instanceof Error) return signal.reason;
+  const error = new Error("The operation was aborted");
+  error.name = "AbortError";
+  return error;
+}
+
+function catalogModels(payload) {
+  const models = Array.isArray(payload) ? payload : payload?.data;
+  if (!Array.isArray(models)) throw new Error("Copilot model catalog contained no model list");
+  return models;
+}
+
+async function fetchCopilotCatalog(tokenData, {
+  fetchImpl,
+  signal,
+  vscodeVersion = FALLBACK_VSCODE_VERSION,
+  timeoutMs = DEFAULT_COPILOT_CATALOG_TIMEOUT_MS,
+} = {}) {
+  const parsedTimeout = Number(timeoutMs);
+  const deadlineMs = Number.isFinite(parsedTimeout) && parsedTimeout > 0
+    ? parsedTimeout
+    : DEFAULT_COPILOT_CATALOG_TIMEOUT_MS;
+  const controller = new AbortController();
+  const onCallerAbort = () => controller.abort(signal?.reason);
+  signal?.addEventListener("abort", onCallerAbort, { once: true });
+  if (signal?.aborted) onCallerAbort();
+  const timer = setTimeout(() => controller.abort(new Error(`Copilot model catalog timed out after ${deadlineMs}ms`)), deadlineMs);
+  try {
+    const apiBase = parseApiBase(tokenData);
+    const headers = buildHeaders({
+      token: tokenData.token,
+      version: vscodeVersion,
+      initiator: "user",
+      vision: false,
+    });
+    const response = await fetchImpl(`${apiBase}/models`, {
+      headers,
+      redirect: "error",
+      signal: controller.signal,
+    });
+    const modelText = await readBoundedResponseText(response, {
+      maxBytes: MAX_UPSTREAM_MODEL_CATALOG_BYTES,
+      label: "Copilot model catalog",
+      signal: controller.signal,
+    });
+    if (!response.ok) {
+      const detail = responseDetail(modelText);
+      throw new Error(`Copilot model catalog failed with HTTP ${response.status}${detail ? `: ${detail}` : ""}`);
+    }
+
+    let catalog;
+    try {
+      catalog = JSON.parse(modelText);
+    } catch {
+      throw new Error("Copilot model catalog returned invalid JSON");
+    }
+    catalogModels(catalog);
+    return { catalog, apiBase };
+  } catch (error) {
+    if (signal?.aborted) throw abortError(signal);
+    if (controller.signal.aborted) throw abortError(controller.signal);
+    throw error;
+  } finally {
+    clearTimeout(timer);
+    signal?.removeEventListener("abort", onCallerAbort);
+  }
+}
+
+function publicProfile(credentials) {
+  return {
+    configured: credentials.configured,
+    valid: credentials.valid,
+    reason: credentials.reason,
+    login: credentials.identity?.login || "",
+    id: credentials.identity?.id || "",
+    source: "legacy",
+  };
+}
+
+function readStatusCredentials(home) {
+  try {
+    return readAuthProfileCredentials(AUTH_PROFILE_CODEX, { home });
+  } catch {
+    return {
+      profile: AUTH_PROFILE_CODEX,
+      configured: true,
+      valid: false,
+      reason: "credential_read_failed",
+      token: "",
+      identity: null,
+    };
+  }
+}
+
+export function authStatus({ home = os.homedir() } = {}) {
+  const codex = readStatusCredentials(home);
+  return {
+    profiles: { codex: publicProfile(codex) },
+    routing: profileRouting(),
+  };
+}
+
+async function inspectProfileOnline(credentials, { fetchImpl, timeoutMs } = {}) {
+  if (!credentials.valid) {
+    return { checked: false, ok: false, reason: credentials.reason || "unconfigured" };
+  }
+
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(new Error(`timed out after ${timeoutMs}ms`)), timeoutMs);
+  try {
+    const validation = await validateGithubToken(credentials.token, {
+      fetchImpl,
+      signal: controller.signal,
+    });
+    if (controller.signal.aborted) throw abortError(controller.signal);
+    if (!validation.ok) {
+      return {
+        checked: true,
+        ok: false,
+        reason: validation.reason,
+        httpStatus: validation.status || null,
+      };
+    }
+    const { catalog, apiBase } = await fetchCopilotCatalog(validation.copilotTokenData, {
+      fetchImpl,
+      signal: controller.signal,
+    });
+    let upstreamHost = "GitHub Copilot";
+    try { upstreamHost = new URL(apiBase).hostname; } catch {}
+    return {
+      checked: true,
+      ok: true,
+      login: validation.login || credentials.identity?.login || "",
+      models: catalogModels(catalog).length,
+      upstreamHost,
+    };
+  } catch (error) {
+    return {
+      checked: true,
+      ok: false,
+      reason: controller.signal.aborted ? `timed out after ${timeoutMs}ms` : error.message,
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+export async function authStatusOnline({
+  home = os.homedir(),
+  fetchImpl = fetch,
+  timeoutMs = 10000,
+} = {}) {
+  const local = authStatus({ home });
+  const online = await inspectProfileOnline(readStatusCredentials(home), { fetchImpl, timeoutMs });
+  return {
+    ...local,
+    profiles: {
+      codex: { ...local.profiles.codex, online },
+    },
+  };
+}

package/src/cli-auth.mjs

@@ -1,15 +1,4 @@
-import os from "node:os";
-import { validateGithubToken } from "./auth.mjs";
-import {
-  AUTH_PROFILE_CODEX,
-  readAuthProfileCredentials,
-} from "./auth-profile.mjs";
-import { buildHeaders, FALLBACK_VSCODE_VERSION, parseApiBase } from "./copilot.mjs";
-import {
-  MAX_UPSTREAM_MODEL_CATALOG_BYTES,
-  readBoundedResponseText,
-} from "./http-transport.mjs";
-import { profileRouting } from "./profile-routing.mjs";
+import { authStatus, authStatusOnline } from "./auth-status.mjs";
 import { status } from "./status.mjs";
 import {
   cliOutputFormat,
@@ -18,174 +7,7 @@ import {
   terminalCell,
 } from "./cli-table.mjs";
 
-const DEFAULT_COPILOT_CATALOG_TIMEOUT_MS = 30 * 1000;
-
-function responseDetail(value) {
-  return String(value || "").replace(/\s+/g, " ").trim().slice(0, 240);
-}
-
-function abortError(signal) {
-  if (signal?.reason instanceof Error) return signal.reason;
-  const error = new Error("The operation was aborted");
-  error.name = "AbortError";
-  return error;
-}
-
-function catalogModels(payload) {
-  const models = Array.isArray(payload) ? payload : payload?.data;
-  if (!Array.isArray(models)) throw new Error("Copilot model catalog contained no model list");
-  return models;
-}
-
-async function fetchCopilotCatalog(tokenData, {
-  fetchImpl,
-  signal,
-  vscodeVersion = FALLBACK_VSCODE_VERSION,
-  timeoutMs = DEFAULT_COPILOT_CATALOG_TIMEOUT_MS,
-} = {}) {
-  const parsedTimeout = Number(timeoutMs);
-  const deadlineMs = Number.isFinite(parsedTimeout) && parsedTimeout > 0
-    ? parsedTimeout
-    : DEFAULT_COPILOT_CATALOG_TIMEOUT_MS;
-  const controller = new AbortController();
-  const onCallerAbort = () => controller.abort(signal?.reason);
-  signal?.addEventListener("abort", onCallerAbort, { once: true });
-  if (signal?.aborted) onCallerAbort();
-  const timer = setTimeout(() => controller.abort(new Error(`Copilot model catalog timed out after ${deadlineMs}ms`)), deadlineMs);
-  try {
-    const apiBase = parseApiBase(tokenData);
-    const headers = buildHeaders({
-      token: tokenData.token,
-      version: vscodeVersion,
-      initiator: "user",
-      vision: false,
-    });
-    const response = await fetchImpl(`${apiBase}/models`, {
-      headers,
-      redirect: "error",
-      signal: controller.signal,
-    });
-    const modelText = await readBoundedResponseText(response, {
-      maxBytes: MAX_UPSTREAM_MODEL_CATALOG_BYTES,
-      label: "Copilot model catalog",
-      signal: controller.signal,
-    });
-    if (!response.ok) {
-      const detail = responseDetail(modelText);
-      throw new Error(`Copilot model catalog failed with HTTP ${response.status}${detail ? `: ${detail}` : ""}`);
-    }
-
-    let catalog;
-    try {
-      catalog = JSON.parse(modelText);
-    } catch {
-      throw new Error("Copilot model catalog returned invalid JSON");
-    }
-    catalogModels(catalog);
-    return { catalog, apiBase };
-  } catch (error) {
-    if (signal?.aborted) throw abortError(signal);
-    if (controller.signal.aborted) throw abortError(controller.signal);
-    throw error;
-  } finally {
-    clearTimeout(timer);
-    signal?.removeEventListener("abort", onCallerAbort);
-  }
-}
-
-function publicProfile(credentials) {
-  return {
-    configured: credentials.configured,
-    valid: credentials.valid,
-    reason: credentials.reason,
-    login: credentials.identity?.login || "",
-    id: credentials.identity?.id || "",
-    source: "legacy",
-  };
-}
-
-function readStatusCredentials(home) {
-  try {
-    return readAuthProfileCredentials(AUTH_PROFILE_CODEX, { home });
-  } catch {
-    return {
-      profile: AUTH_PROFILE_CODEX,
-      configured: true,
-      valid: false,
-      reason: "credential_read_failed",
-      token: "",
-      identity: null,
-    };
-  }
-}
-
-export function authStatus({ home = os.homedir() } = {}) {
-  const codex = readStatusCredentials(home);
-  return {
-    profiles: { codex: publicProfile(codex) },
-    routing: profileRouting(),
-  };
-}
-
-async function inspectProfileOnline(credentials, { fetchImpl, timeoutMs } = {}) {
-  if (!credentials.valid) {
-    return { checked: false, ok: false, reason: credentials.reason || "unconfigured" };
-  }
-
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(new Error(`timed out after ${timeoutMs}ms`)), timeoutMs);
-  try {
-    const validation = await validateGithubToken(credentials.token, {
-      fetchImpl,
-      signal: controller.signal,
-    });
-    if (controller.signal.aborted) throw abortError(controller.signal);
-    if (!validation.ok) {
-      return {
-        checked: true,
-        ok: false,
-        reason: validation.reason,
-        httpStatus: validation.status || null,
-      };
-    }
-    const { catalog, apiBase } = await fetchCopilotCatalog(validation.copilotTokenData, {
-      fetchImpl,
-      signal: controller.signal,
-    });
-    let upstreamHost = "GitHub Copilot";
-    try { upstreamHost = new URL(apiBase).hostname; } catch {}
-    return {
-      checked: true,
-      ok: true,
-      login: validation.login || credentials.identity?.login || "",
-      models: catalogModels(catalog).length,
-      upstreamHost,
-    };
-  } catch (error) {
-    return {
-      checked: true,
-      ok: false,
-      reason: controller.signal.aborted ? `timed out after ${timeoutMs}ms` : error.message,
-    };
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
-export async function authStatusOnline({
-  home = os.homedir(),
-  fetchImpl = fetch,
-  timeoutMs = 10000,
-} = {}) {
-  const local = authStatus({ home });
-  const online = await inspectProfileOnline(readStatusCredentials(home), { fetchImpl, timeoutMs });
-  return {
-    ...local,
-    profiles: {
-      codex: { ...local.profiles.codex, online },
-    },
-  };
-}
+export { authStatus, authStatusOnline } from "./auth-status.mjs";
 
 function accountLabel(profile) {
   if (!profile.configured) return "not configured";

package/src/cli-models.mjs

@@ -1,10 +1,3 @@
-import os from "node:os";
-import { validateGithubToken } from "./auth.mjs";
-import {
-  AUTH_PROFILE_CODEX,
-  readAuthProfileCredentials,
-} from "./auth-profile.mjs";
-import { buildHeaders, FALLBACK_VSCODE_VERSION, parseApiBase } from "./copilot.mjs";
 import { status } from "./status.mjs";
 import {
   cliOutputFormat,
@@ -13,11 +6,7 @@ import {
   terminalCell,
 } from "./cli-table.mjs";
 
-const DEFAULT_MODELS_TIMEOUT_MS = 10000;
-const SUPPORTED_ENDPOINTS = [
-  ["responses", new Set(["/responses", "/v1/responses"])],
-  ["chat", new Set(["/chat/completions"])],
-];
+export { fetchLiveCopilotModels, selectableCopilotModels } from "./live-models.mjs";
 
 function safeText(value, fallback = "") {
   const text = String(value ?? "")
@@ -27,125 +16,6 @@ function safeText(value, fallback = "") {
   return text || fallback;
 }
 
-function endpointLabels(model) {
-  const advertised = new Set(Array.isArray(model?.supported_endpoints) ? model.supported_endpoints : []);
-  return SUPPORTED_ENDPOINTS
-    .filter(([, values]) => [...values].some((value) => advertised.has(value)))
-    .map(([label]) => label);
-}
-
-export function selectableCopilotModels(payload) {
-  const data = Array.isArray(payload) ? payload : payload?.data;
-  if (!Array.isArray(data)) throw new Error("Copilot models response contained no model list");
-
-  const models = [];
-  const seen = new Set();
-  for (const model of data) {
-    if (model?.model_picker_enabled !== true) continue;
-    const policyState = safeText(model?.policy?.state).toLowerCase();
-    if (policyState && policyState !== "enabled") continue;
-    const capabilityType = safeText(model?.capabilities?.type).toLowerCase();
-    if (capabilityType && capabilityType !== "chat") continue;
-
-    const id = safeText(model?.id);
-    const endpoints = endpointLabels(model);
-    if (!id.startsWith("gpt-") || id === "codex-auto-review" || !endpoints.length || seen.has(id)) continue;
-    seen.add(id);
-    models.push({
-      id,
-      vendor: safeText(model?.vendor || model?.owned_by, "Unknown"),
-      endpoints,
-      preview: model?.preview === true,
-    });
-  }
-
-  models.sort((left, right) => left.vendor.localeCompare(right.vendor, "en")
-    || left.id.localeCompare(right.id, "en"));
-  return { advertised: data.length, models };
-}
-
-function validationFailure(validation) {
-  const httpStatus = validation?.status ? ` (HTTP ${validation.status})` : "";
-  return `GitHub Copilot authentication failed: ${validation?.reason || "unknown error"}${httpStatus}`;
-}
-
-async function responseText(response) {
-  try {
-    return await response.text();
-  } catch {
-    return "";
-  }
-}
-
-function readModelCredentials(home) {
-  let credentials;
-  try {
-    credentials = readAuthProfileCredentials(AUTH_PROFILE_CODEX, { home });
-  } catch (error) {
-    throw new Error(`Could not read the GitHub token: ${error.message}`);
-  }
-  if (credentials.valid) return credentials;
-  if (!credentials.configured) throw new Error("GitHub token not found. Start ccdx once to log in.");
-  if (credentials.reason === "empty_token") throw new Error("GitHub token file is empty. Start ccdx again to log in.");
-  throw new Error(`GitHub token is unavailable (${credentials.reason || "unknown"}). Start ccdx again to log in.`);
-}
-
-export async function fetchLiveCopilotModels({
-  home = os.homedir(),
-  fetchImpl = fetch,
-  timeoutMs = DEFAULT_MODELS_TIMEOUT_MS,
-  vscodeVersion = FALLBACK_VSCODE_VERSION,
-} = {}) {
-  const credentials = readModelCredentials(home);
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    const validation = await validateGithubToken(credentials.token, {
-      fetchImpl,
-      signal: controller.signal,
-    });
-    if (controller.signal.aborted) throw new Error(`Live model lookup timed out after ${timeoutMs}ms`);
-    if (!validation.ok) throw new Error(validationFailure(validation));
-
-    const tokenData = validation.copilotTokenData;
-    const apiBase = parseApiBase(tokenData);
-    const headers = buildHeaders({
-      token: tokenData.token,
-      version: vscodeVersion,
-      initiator: "user",
-      vision: false,
-    });
-    const response = await fetchImpl(`${apiBase}/models`, {
-      headers,
-      redirect: "error",
-      signal: controller.signal,
-    });
-    const body = await responseText(response);
-    if (!response.ok) {
-      const detail = safeText(body).slice(0, 240);
-      throw new Error(`Copilot models endpoint returned HTTP ${response.status}${detail ? `: ${detail}` : ""}`);
-    }
-
-    let payload;
-    try {
-      payload = JSON.parse(body);
-    } catch {
-      throw new Error("Copilot models endpoint returned invalid JSON");
-    }
-    const catalog = selectableCopilotModels(payload);
-    let upstreamHost = "GitHub Copilot";
-    try { upstreamHost = new URL(apiBase).hostname; } catch {}
-    return { ...catalog, profile: AUTH_PROFILE_CODEX, upstreamHost: safeText(upstreamHost, "GitHub Copilot") };
-  } catch (error) {
-    if (controller.signal.aborted && !/timed out/.test(error?.message || "")) {
-      throw new Error(`Live model lookup timed out after ${timeoutMs}ms`);
-    }
-    throw error;
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
 function liveCatalogHeader(catalog, { commandName, models }) {
   const responses = models.filter((model) => model.endpoints.includes("responses")).length;
   const chat = models.filter((model) => model.endpoints.includes("chat")).length;

package/src/cli-table.mjs

@@ -1,4 +1,6 @@
-import { stripVTControlCharacters } from "node:util";
+import { terminalCell } from "./terminal-text.mjs";
+
+export { terminalCell } from "./terminal-text.mjs";
 
 const DEFAULT_TERMINAL_COLUMNS = 120;
 const COMBINING_MARK = /\p{Mark}/u;
@@ -50,16 +52,6 @@ function padded(value, width, align) {
   return align === "right" ? `${spaces}${value}` : `${value}${spaces}`;
 }
 
-export function terminalCell(value, { fallback = "—" } = {}) {
-  if (value === undefined || value === null) return fallback;
-  const text = stripVTControlCharacters(String(value))
-    .replace(/[\u0000-\u001f\u007f-\u009f]/g, " ")
-    .replace(/[\u061c\u200b\u200e\u200f\u202a-\u202e\u2060\u2066-\u2069\ufeff]/g, "")
-    .replace(/\s+/g, " ")
-    .trim();
-  return text || fallback;
-}
-
 export function cliOutputFormat(format = "auto", output = process.stdout) {
   if (format === "table" || format === "plain") return format;
   return output?.isTTY === true ? "table" : "plain";

package/src/copilot-responses-compat.mjs

@@ -5,10 +5,10 @@ import {
   sanitizeImageNamespaceCollisionRequest,
 } from "./copilot-responses-policy.mjs";
 import {
-  httpError,
   MAX_UPSTREAM_ERROR_BODY_BYTES,
   readBoundedResponseText,
 } from "./http-transport.mjs";
+import { httpError } from "./http-errors.mjs";
 import {
   finalizeEncryptedHistoryRebase,
   sanitizeEncryptedReasoningRequest,

package/src/dashboard-api.mjs

@@ -1,9 +1,9 @@
 import os from "node:os";
-import { fetchLiveCopilotModels } from "./cli-models.mjs";
-import { authStatus } from "./cli-auth.mjs";
+import { fetchLiveCopilotModels } from "./live-models.mjs";
+import { authStatus } from "./auth-status.mjs";
 import { redactDiagnosticText } from "./diagnostic-text.mjs";
 import { createRequestAbort, readJsonBody } from "./http-transport.mjs";
-import { isLoopbackAddress, isLoopbackHostHeader } from "./observability.mjs";
+import { isLoopbackAddress, isLoopbackHostHeader } from "./security.mjs";
 import {
   DEFAULT_TERMINAL_ANIMATION_THEME,
   getTerminalAnimationFrameDelay,
@@ -11,7 +11,7 @@ import {
   renderTerminalAnimationFrame,
   TERMINAL_ANIMATION_THEMES,
 } from "./terminal-animation.mjs";
-import { cacheReadTokens, summarizeUsageLogs, usageCacheHitRate } from "./usage.mjs";
+import { cacheReadTokens, summarizeUsageLogs, usageCacheHitRate } from "./usage-store.mjs";
 import { createUsageAnalytics } from "./usage-analytics.mjs";
 import { readUserSettings, terminalAnimationPreference, writeTerminalAnimationTheme } from "./user-settings.mjs";
 

package/src/dashboard.mjs

@@ -1,5 +1,5 @@
 import { readFile } from "node:fs/promises";
-import { isLoopbackAddress, isLoopbackHostHeader } from "./observability.mjs";
+import { isLoopbackAddress, isLoopbackHostHeader } from "./security.mjs";
 
 const ASSETS = new Map([
   ["/", ["./dashboard/index.html", "text/html; charset=utf-8"]],

package/src/http-errors.mjs

@@ -0,0 +1,5 @@
+export function httpError(message, statusCode) {
+  const err = new Error(message);
+  err.statusCode = statusCode;
+  return err;
+}