codex-copilot-dx 0.9.17 → 0.9.19

package/README.md

@@ -68,6 +68,8 @@ The dashboard does not poll in the background; refresh when needed.
   expose it to the public internet. The dashboard is not an authentication wall
   for the API. Diagnostic errors may contain sensitive upstream text.
 
+Startup checks GitHub Releases, not npm, and suggests `ccdx update github` when a newer stable version is available. GitHub updates install the exact release tag; dependency downloads still use npm's configured registry.
+
 See the [complete command/configuration reference](https://github.com/DaleXiao/codex-copilot-dx/blob/main/docs/REFERENCE.md)
 for authentication recovery, configuration-write boundaries, advanced limits,
 logging, image setup and client compatibility details.

package/bin/cli.mjs

@@ -307,7 +307,7 @@ async function printUpdateNotice() {
     const { latestVersion, updateAvailable } = await checkForUpdate({ currentVersion: LOCAL_VERSION });
     if (!updateAvailable) return;
     console.log(`\n  ${status("warn", `Update available: ${LOCAL_VERSION} -> ${latestVersion}`)}`);
-    console.log("  npm install -g codex-copilot-dx@latest\n");
+    console.log(`  Run ${CLI_NAME} update github to update, then restart ${CLI_NAME}.\n`);
   } catch {
     // Never block startup on the update check.
   }
@@ -315,8 +315,10 @@ async function printUpdateNotice() {
 
 try {
   assertSafeAdapterHost(ADAPTER_HOST, process.env);
-  void runInBackground(printUpdateNotice);
+  const updateNotice = runInBackground(printUpdateNotice);
   if (await reuseRunningAdapterIfAvailable()) {
+    // Ready is already displayed; finish the bounded check before this short-lived CLI exits.
+    await updateNotice;
     await LOGGING.cleanup();
     process.exit(0);
   }

package/docs/README.md

@@ -15,6 +15,7 @@ These reports record a specific release and test environment. Their version,
 test counts, timings, live-provider observations, and limitations remain
 historical facts rather than current guarantees.
 
+- [0.9.19: GitHub startup checks and stable-release updates](RELEASE_0.9.19.md)
 - [0.9.13: model-bound Auto-review reasoning selection](RELEASE_0.9.13.md)
 - [0.9.12: GPT-6.1 Sol / low Auto-review default](RELEASE_0.9.12.md)
 - [0.9.11: bounded usage-summary cache and diagnostic redaction](RELEASE_0.9.11.md)

package/docs/REFERENCE.md

@@ -230,7 +230,11 @@ ccdx update npm
 ccdx update github
 ```
 
-`ccdx update gh` is accepted as shorthand for the GitHub source. The npm source installs `codex-copilot-dx@latest` through the registry already configured for npm, including a company mirror. The GitHub source installs the latest commit from `DaleXiao/codex-copilot-dx` `main` and opts in to Git fetching only for that command. It does not change npm's persistent `allow-git` setting.
+Normal startup checks the latest stable GitHub Release once in the background, without accessing the npm registry. The anonymous check requires no PAT or Copilot credentials, has a two-second deadline and a bounded response body, and silently skips network errors, rate limits and invalid metadata. It never falls back to npm, retries, polls, installs an update or restarts the service. When a newer release is found, it prints the versions and `ccdx update github`. On adapter reuse, Ready is displayed before waiting for any remaining check budget so the short-lived command does not lose its notification.
+
+`ccdx update gh` is accepted as shorthand for the GitHub source. The npm source installs `codex-copilot-dx@latest` through the registry already configured for npm, including a company mirror. The GitHub source queries the latest stable published Release (ten-second deadline), validates its version tag, and installs that exact tag from `DaleXiao/codex-copilot-dx`, not `main`. Lookup failure stops before installation, without an npm fallback. It opts in to Git fetching only for that command and does not change npm's persistent `allow-git` setting.
+
+GitHub is the package source, not a replacement for the npm installer. Dependencies such as `sharp` may still need the configured npm registry during an explicit update; use a company-approved mirror/cache where required. GitHub updates do not promise an entirely registry-free installation.
 
 If a configured npm mirror has not synchronized the current release yet, use the GitHub source. A running adapter keeps its loaded version until it is stopped and restarted.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-copilot-dx",
-  "version": "0.9.17",
+  "version": "0.9.19",
   "description": "Use Codex App with GitHub Copilot",
   "author": "Dale Xiao",
   "type": "module",

package/src/adapter.mjs

@@ -6,8 +6,6 @@ import {
   ADAPTER_STATUS_PATH,
   classifyAdapterRoute,
   createRequestMetrics,
-  isLoopbackAddress,
-  isLoopbackHostHeader,
   runtimeStatusPayload,
 } from "./observability.mjs";
 import { createRequestId, runWithRequestContext } from "./request-context.mjs";
@@ -26,13 +24,14 @@ import {
 } from "./cache-control.mjs";
 import { loadRuntimeConfig, parsePositiveInteger } from "./runtime-config.mjs";
 import {
-  createRequestAdmission,
   createRequestAbort,
-  httpError,
   logRequestFailure,
   readJsonBody,
   sendJsonError,
 } from "./http-transport.mjs";
+import { httpError } from "./http-errors.mjs";
+import { createRequestAdmission } from "./request-admission.mjs";
+import { isLoopbackAddress, isLoopbackHostHeader } from "./security.mjs";
 
 export {
   abortErrorStatusCode,

package/src/auth-status.mjs

@@ -0,0 +1,175 @@
+import os from "node:os";
+import { validateGithubToken } from "./auth.mjs";
+import { AUTH_PROFILE_CODEX, readAuthProfileCredentials } from "./auth-profile.mjs";
+import { buildHeaders, FALLBACK_VSCODE_VERSION, parseApiBase } from "./copilot.mjs";
+import { MAX_UPSTREAM_MODEL_CATALOG_BYTES, readBoundedResponseText } from "./http-transport.mjs";
+import { profileRouting } from "./profile-routing.mjs";
+
+const DEFAULT_COPILOT_CATALOG_TIMEOUT_MS = 30 * 1000;
+
+function responseDetail(value) {
+  return String(value || "").replace(/\s+/g, " ").trim().slice(0, 240);
+}
+
+function abortError(signal) {
+  if (signal?.reason instanceof Error) return signal.reason;
+  const error = new Error("The operation was aborted");
+  error.name = "AbortError";
+  return error;
+}
+
+function catalogModels(payload) {
+  const models = Array.isArray(payload) ? payload : payload?.data;
+  if (!Array.isArray(models)) throw new Error("Copilot model catalog contained no model list");
+  return models;
+}
+
+async function fetchCopilotCatalog(tokenData, {
+  fetchImpl,
+  signal,
+  vscodeVersion = FALLBACK_VSCODE_VERSION,
+  timeoutMs = DEFAULT_COPILOT_CATALOG_TIMEOUT_MS,
+} = {}) {
+  const parsedTimeout = Number(timeoutMs);
+  const deadlineMs = Number.isFinite(parsedTimeout) && parsedTimeout > 0
+    ? parsedTimeout
+    : DEFAULT_COPILOT_CATALOG_TIMEOUT_MS;
+  const controller = new AbortController();
+  const onCallerAbort = () => controller.abort(signal?.reason);
+  signal?.addEventListener("abort", onCallerAbort, { once: true });
+  if (signal?.aborted) onCallerAbort();
+  const timer = setTimeout(() => controller.abort(new Error(`Copilot model catalog timed out after ${deadlineMs}ms`)), deadlineMs);
+  try {
+    const apiBase = parseApiBase(tokenData);
+    const headers = buildHeaders({
+      token: tokenData.token,
+      version: vscodeVersion,
+      initiator: "user",
+      vision: false,
+    });
+    const response = await fetchImpl(`${apiBase}/models`, {
+      headers,
+      redirect: "error",
+      signal: controller.signal,
+    });
+    const modelText = await readBoundedResponseText(response, {
+      maxBytes: MAX_UPSTREAM_MODEL_CATALOG_BYTES,
+      label: "Copilot model catalog",
+      signal: controller.signal,
+    });
+    if (!response.ok) {
+      const detail = responseDetail(modelText);
+      throw new Error(`Copilot model catalog failed with HTTP ${response.status}${detail ? `: ${detail}` : ""}`);
+    }
+
+    let catalog;
+    try {
+      catalog = JSON.parse(modelText);
+    } catch {
+      throw new Error("Copilot model catalog returned invalid JSON");
+    }
+    catalogModels(catalog);
+    return { catalog, apiBase };
+  } catch (error) {
+    if (signal?.aborted) throw abortError(signal);
+    if (controller.signal.aborted) throw abortError(controller.signal);
+    throw error;
+  } finally {
+    clearTimeout(timer);
+    signal?.removeEventListener("abort", onCallerAbort);
+  }
+}
+
+function publicProfile(credentials) {
+  return {
+    configured: credentials.configured,
+    valid: credentials.valid,
+    reason: credentials.reason,
+    login: credentials.identity?.login || "",
+    id: credentials.identity?.id || "",
+    source: "legacy",
+  };
+}
+
+function readStatusCredentials(home) {
+  try {
+    return readAuthProfileCredentials(AUTH_PROFILE_CODEX, { home });
+  } catch {
+    return {
+      profile: AUTH_PROFILE_CODEX,
+      configured: true,
+      valid: false,
+      reason: "credential_read_failed",
+      token: "",
+      identity: null,
+    };
+  }
+}
+
+export function authStatus({ home = os.homedir() } = {}) {
+  const codex = readStatusCredentials(home);
+  return {
+    profiles: { codex: publicProfile(codex) },
+    routing: profileRouting(),
+  };
+}
+
+async function inspectProfileOnline(credentials, { fetchImpl, timeoutMs } = {}) {
+  if (!credentials.valid) {
+    return { checked: false, ok: false, reason: credentials.reason || "unconfigured" };
+  }
+
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(new Error(`timed out after ${timeoutMs}ms`)), timeoutMs);
+  try {
+    const validation = await validateGithubToken(credentials.token, {
+      fetchImpl,
+      signal: controller.signal,
+    });
+    if (controller.signal.aborted) throw abortError(controller.signal);
+    if (!validation.ok) {
+      return {
+        checked: true,
+        ok: false,
+        reason: validation.reason,
+        httpStatus: validation.status || null,
+      };
+    }
+    const { catalog, apiBase } = await fetchCopilotCatalog(validation.copilotTokenData, {
+      fetchImpl,
+      signal: controller.signal,
+    });
+    let upstreamHost = "GitHub Copilot";
+    try { upstreamHost = new URL(apiBase).hostname; } catch {}
+    return {
+      checked: true,
+      ok: true,
+      login: validation.login || credentials.identity?.login || "",
+      models: catalogModels(catalog).length,
+      upstreamHost,
+    };
+  } catch (error) {
+    return {
+      checked: true,
+      ok: false,
+      reason: controller.signal.aborted ? `timed out after ${timeoutMs}ms` : error.message,
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+export async function authStatusOnline({
+  home = os.homedir(),
+  fetchImpl = fetch,
+  timeoutMs = 10000,
+} = {}) {
+  const local = authStatus({ home });
+  const online = await inspectProfileOnline(readStatusCredentials(home), { fetchImpl, timeoutMs });
+  return {
+    ...local,
+    profiles: {
+      codex: { ...local.profiles.codex, online },
+    },
+  };
+}

package/src/cli-auth.mjs

@@ -1,15 +1,4 @@
-import os from "node:os";
-import { validateGithubToken } from "./auth.mjs";
-import {
-  AUTH_PROFILE_CODEX,
-  readAuthProfileCredentials,
-} from "./auth-profile.mjs";
-import { buildHeaders, FALLBACK_VSCODE_VERSION, parseApiBase } from "./copilot.mjs";
-import {
-  MAX_UPSTREAM_MODEL_CATALOG_BYTES,
-  readBoundedResponseText,
-} from "./http-transport.mjs";
-import { profileRouting } from "./profile-routing.mjs";
+import { authStatus, authStatusOnline } from "./auth-status.mjs";
 import { status } from "./status.mjs";
 import {
   cliOutputFormat,
@@ -18,174 +7,7 @@ import {
   terminalCell,
 } from "./cli-table.mjs";
 
-const DEFAULT_COPILOT_CATALOG_TIMEOUT_MS = 30 * 1000;
-
-function responseDetail(value) {
-  return String(value || "").replace(/\s+/g, " ").trim().slice(0, 240);
-}
-
-function abortError(signal) {
-  if (signal?.reason instanceof Error) return signal.reason;
-  const error = new Error("The operation was aborted");
-  error.name = "AbortError";
-  return error;
-}
-
-function catalogModels(payload) {
-  const models = Array.isArray(payload) ? payload : payload?.data;
-  if (!Array.isArray(models)) throw new Error("Copilot model catalog contained no model list");
-  return models;
-}
-
-async function fetchCopilotCatalog(tokenData, {
-  fetchImpl,
-  signal,
-  vscodeVersion = FALLBACK_VSCODE_VERSION,
-  timeoutMs = DEFAULT_COPILOT_CATALOG_TIMEOUT_MS,
-} = {}) {
-  const parsedTimeout = Number(timeoutMs);
-  const deadlineMs = Number.isFinite(parsedTimeout) && parsedTimeout > 0
-    ? parsedTimeout
-    : DEFAULT_COPILOT_CATALOG_TIMEOUT_MS;
-  const controller = new AbortController();
-  const onCallerAbort = () => controller.abort(signal?.reason);
-  signal?.addEventListener("abort", onCallerAbort, { once: true });
-  if (signal?.aborted) onCallerAbort();
-  const timer = setTimeout(() => controller.abort(new Error(`Copilot model catalog timed out after ${deadlineMs}ms`)), deadlineMs);
-  try {
-    const apiBase = parseApiBase(tokenData);
-    const headers = buildHeaders({
-      token: tokenData.token,
-      version: vscodeVersion,
-      initiator: "user",
-      vision: false,
-    });
-    const response = await fetchImpl(`${apiBase}/models`, {
-      headers,
-      redirect: "error",
-      signal: controller.signal,
-    });
-    const modelText = await readBoundedResponseText(response, {
-      maxBytes: MAX_UPSTREAM_MODEL_CATALOG_BYTES,
-      label: "Copilot model catalog",
-      signal: controller.signal,
-    });
-    if (!response.ok) {
-      const detail = responseDetail(modelText);
-      throw new Error(`Copilot model catalog failed with HTTP ${response.status}${detail ? `: ${detail}` : ""}`);
-    }
-
-    let catalog;
-    try {
-      catalog = JSON.parse(modelText);
-    } catch {
-      throw new Error("Copilot model catalog returned invalid JSON");
-    }
-    catalogModels(catalog);
-    return { catalog, apiBase };
-  } catch (error) {
-    if (signal?.aborted) throw abortError(signal);
-    if (controller.signal.aborted) throw abortError(controller.signal);
-    throw error;
-  } finally {
-    clearTimeout(timer);
-    signal?.removeEventListener("abort", onCallerAbort);
-  }
-}
-
-function publicProfile(credentials) {
-  return {
-    configured: credentials.configured,
-    valid: credentials.valid,
-    reason: credentials.reason,
-    login: credentials.identity?.login || "",
-    id: credentials.identity?.id || "",
-    source: "legacy",
-  };
-}
-
-function readStatusCredentials(home) {
-  try {
-    return readAuthProfileCredentials(AUTH_PROFILE_CODEX, { home });
-  } catch {
-    return {
-      profile: AUTH_PROFILE_CODEX,
-      configured: true,
-      valid: false,
-      reason: "credential_read_failed",
-      token: "",
-      identity: null,
-    };
-  }
-}
-
-export function authStatus({ home = os.homedir() } = {}) {
-  const codex = readStatusCredentials(home);
-  return {
-    profiles: { codex: publicProfile(codex) },
-    routing: profileRouting(),
-  };
-}
-
-async function inspectProfileOnline(credentials, { fetchImpl, timeoutMs } = {}) {
-  if (!credentials.valid) {
-    return { checked: false, ok: false, reason: credentials.reason || "unconfigured" };
-  }
-
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(new Error(`timed out after ${timeoutMs}ms`)), timeoutMs);
-  try {
-    const validation = await validateGithubToken(credentials.token, {
-      fetchImpl,
-      signal: controller.signal,
-    });
-    if (controller.signal.aborted) throw abortError(controller.signal);
-    if (!validation.ok) {
-      return {
-        checked: true,
-        ok: false,
-        reason: validation.reason,
-        httpStatus: validation.status || null,
-      };
-    }
-    const { catalog, apiBase } = await fetchCopilotCatalog(validation.copilotTokenData, {
-      fetchImpl,
-      signal: controller.signal,
-    });
-    let upstreamHost = "GitHub Copilot";
-    try { upstreamHost = new URL(apiBase).hostname; } catch {}
-    return {
-      checked: true,
-      ok: true,
-      login: validation.login || credentials.identity?.login || "",
-      models: catalogModels(catalog).length,
-      upstreamHost,
-    };
-  } catch (error) {
-    return {
-      checked: true,
-      ok: false,
-      reason: controller.signal.aborted ? `timed out after ${timeoutMs}ms` : error.message,
-    };
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
-export async function authStatusOnline({
-  home = os.homedir(),
-  fetchImpl = fetch,
-  timeoutMs = 10000,
-} = {}) {
-  const local = authStatus({ home });
-  const online = await inspectProfileOnline(readStatusCredentials(home), { fetchImpl, timeoutMs });
-  return {
-    ...local,
-    profiles: {
-      codex: { ...local.profiles.codex, online },
-    },
-  };
-}
+export { authStatus, authStatusOnline } from "./auth-status.mjs";
 
 function accountLabel(profile) {
   if (!profile.configured) return "not configured";

package/src/cli-models.mjs

@@ -1,10 +1,3 @@
-import os from "node:os";
-import { validateGithubToken } from "./auth.mjs";
-import {
-  AUTH_PROFILE_CODEX,
-  readAuthProfileCredentials,
-} from "./auth-profile.mjs";
-import { buildHeaders, FALLBACK_VSCODE_VERSION, parseApiBase } from "./copilot.mjs";
 import { status } from "./status.mjs";
 import {
   cliOutputFormat,
@@ -13,11 +6,7 @@ import {
   terminalCell,
 } from "./cli-table.mjs";
 
-const DEFAULT_MODELS_TIMEOUT_MS = 10000;
-const SUPPORTED_ENDPOINTS = [
-  ["responses", new Set(["/responses", "/v1/responses"])],
-  ["chat", new Set(["/chat/completions"])],
-];
+export { fetchLiveCopilotModels, selectableCopilotModels } from "./live-models.mjs";
 
 function safeText(value, fallback = "") {
   const text = String(value ?? "")
@@ -27,125 +16,6 @@ function safeText(value, fallback = "") {
   return text || fallback;
 }
 
-function endpointLabels(model) {
-  const advertised = new Set(Array.isArray(model?.supported_endpoints) ? model.supported_endpoints : []);
-  return SUPPORTED_ENDPOINTS
-    .filter(([, values]) => [...values].some((value) => advertised.has(value)))
-    .map(([label]) => label);
-}
-
-export function selectableCopilotModels(payload) {
-  const data = Array.isArray(payload) ? payload : payload?.data;
-  if (!Array.isArray(data)) throw new Error("Copilot models response contained no model list");
-
-  const models = [];
-  const seen = new Set();
-  for (const model of data) {
-    if (model?.model_picker_enabled !== true) continue;
-    const policyState = safeText(model?.policy?.state).toLowerCase();
-    if (policyState && policyState !== "enabled") continue;
-    const capabilityType = safeText(model?.capabilities?.type).toLowerCase();
-    if (capabilityType && capabilityType !== "chat") continue;
-
-    const id = safeText(model?.id);
-    const endpoints = endpointLabels(model);
-    if (!id.startsWith("gpt-") || id === "codex-auto-review" || !endpoints.length || seen.has(id)) continue;
-    seen.add(id);
-    models.push({
-      id,
-      vendor: safeText(model?.vendor || model?.owned_by, "Unknown"),
-      endpoints,
-      preview: model?.preview === true,
-    });
-  }
-
-  models.sort((left, right) => left.vendor.localeCompare(right.vendor, "en")
-    || left.id.localeCompare(right.id, "en"));
-  return { advertised: data.length, models };
-}
-
-function validationFailure(validation) {
-  const httpStatus = validation?.status ? ` (HTTP ${validation.status})` : "";
-  return `GitHub Copilot authentication failed: ${validation?.reason || "unknown error"}${httpStatus}`;
-}
-
-async function responseText(response) {
-  try {
-    return await response.text();
-  } catch {
-    return "";
-  }
-}
-
-function readModelCredentials(home) {
-  let credentials;
-  try {
-    credentials = readAuthProfileCredentials(AUTH_PROFILE_CODEX, { home });
-  } catch (error) {
-    throw new Error(`Could not read the GitHub token: ${error.message}`);
-  }
-  if (credentials.valid) return credentials;
-  if (!credentials.configured) throw new Error("GitHub token not found. Start ccdx once to log in.");
-  if (credentials.reason === "empty_token") throw new Error("GitHub token file is empty. Start ccdx again to log in.");
-  throw new Error(`GitHub token is unavailable (${credentials.reason || "unknown"}). Start ccdx again to log in.`);
-}
-
-export async function fetchLiveCopilotModels({
-  home = os.homedir(),
-  fetchImpl = fetch,
-  timeoutMs = DEFAULT_MODELS_TIMEOUT_MS,
-  vscodeVersion = FALLBACK_VSCODE_VERSION,
-} = {}) {
-  const credentials = readModelCredentials(home);
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    const validation = await validateGithubToken(credentials.token, {
-      fetchImpl,
-      signal: controller.signal,
-    });
-    if (controller.signal.aborted) throw new Error(`Live model lookup timed out after ${timeoutMs}ms`);
-    if (!validation.ok) throw new Error(validationFailure(validation));
-
-    const tokenData = validation.copilotTokenData;
-    const apiBase = parseApiBase(tokenData);
-    const headers = buildHeaders({
-      token: tokenData.token,
-      version: vscodeVersion,
-      initiator: "user",
-      vision: false,
-    });
-    const response = await fetchImpl(`${apiBase}/models`, {
-      headers,
-      redirect: "error",
-      signal: controller.signal,
-    });
-    const body = await responseText(response);
-    if (!response.ok) {
-      const detail = safeText(body).slice(0, 240);
-      throw new Error(`Copilot models endpoint returned HTTP ${response.status}${detail ? `: ${detail}` : ""}`);
-    }
-
-    let payload;
-    try {
-      payload = JSON.parse(body);
-    } catch {
-      throw new Error("Copilot models endpoint returned invalid JSON");
-    }
-    const catalog = selectableCopilotModels(payload);
-    let upstreamHost = "GitHub Copilot";
-    try { upstreamHost = new URL(apiBase).hostname; } catch {}
-    return { ...catalog, profile: AUTH_PROFILE_CODEX, upstreamHost: safeText(upstreamHost, "GitHub Copilot") };
-  } catch (error) {
-    if (controller.signal.aborted && !/timed out/.test(error?.message || "")) {
-      throw new Error(`Live model lookup timed out after ${timeoutMs}ms`);
-    }
-    throw error;
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
 function liveCatalogHeader(catalog, { commandName, models }) {
   const responses = models.filter((model) => model.endpoints.includes("responses")).length;
   const chat = models.filter((model) => model.endpoints.includes("chat")).length;

package/src/cli-options.mjs

@@ -356,7 +356,7 @@ function topicHelp(name, topic) {
     "disable-image": `Usage:\n  ${name} disable-image\n\nDisables the local CCDX image tool and removes its stored API credential and unmodified CCDX image guidance.`,
     "image-status": `Usage:\n  ${name} image-status\n\nShows provider configuration and probes local image-tool readiness without generating an image or exposing its API key.`,
     "auto-review-model": `Usage:\n  ${name} auto-review-model\n\nSelect a Responses model, then an advertised reasoning effort. Enter keeps the default/current choice; q cancels both steps without saving. Effort 0 follows the client (low when omitted). Settings apply only to Auto-review on the next request; no client patch or restart is required for adapters running 0.9.13 or newer.`,
-    update: `Usage:\n  ${name} update [npm|github]\n\nUpdates the global package from the configured npm registry or GitHub main. With no source, an interactive terminal prompts for one.`,
+    update: `Usage:\n  ${name} update [npm|github]\n\nUpdates the global package from the configured npm registry or the latest stable GitHub release. With no source, an interactive terminal prompts for one.`,
     version: `Usage:\n  ${name} --version`,
   };
   return sections[topic];

package/src/cli-table.mjs

@@ -1,4 +1,6 @@
-import { stripVTControlCharacters } from "node:util";
+import { terminalCell } from "./terminal-text.mjs";
+
+export { terminalCell } from "./terminal-text.mjs";
 
 const DEFAULT_TERMINAL_COLUMNS = 120;
 const COMBINING_MARK = /\p{Mark}/u;
@@ -50,16 +52,6 @@ function padded(value, width, align) {
   return align === "right" ? `${spaces}${value}` : `${value}${spaces}`;
 }
 
-export function terminalCell(value, { fallback = "—" } = {}) {
-  if (value === undefined || value === null) return fallback;
-  const text = stripVTControlCharacters(String(value))
-    .replace(/[\u0000-\u001f\u007f-\u009f]/g, " ")
-    .replace(/[\u061c\u200b\u200e\u200f\u202a-\u202e\u2060\u2066-\u2069\ufeff]/g, "")
-    .replace(/\s+/g, " ")
-    .trim();
-  return text || fallback;
-}
-
 export function cliOutputFormat(format = "auto", output = process.stdout) {
   if (format === "table" || format === "plain") return format;
   return output?.isTTY === true ? "table" : "plain";

package/src/copilot-responses-compat.mjs

@@ -5,10 +5,10 @@ import {
   sanitizeImageNamespaceCollisionRequest,
 } from "./copilot-responses-policy.mjs";
 import {
-  httpError,
   MAX_UPSTREAM_ERROR_BODY_BYTES,
   readBoundedResponseText,
 } from "./http-transport.mjs";
+import { httpError } from "./http-errors.mjs";
 import {
   finalizeEncryptedHistoryRebase,
   sanitizeEncryptedReasoningRequest,

package/src/dashboard-api.mjs

@@ -1,9 +1,9 @@
 import os from "node:os";
-import { fetchLiveCopilotModels } from "./cli-models.mjs";
-import { authStatus } from "./cli-auth.mjs";
+import { fetchLiveCopilotModels } from "./live-models.mjs";
+import { authStatus } from "./auth-status.mjs";
 import { redactDiagnosticText } from "./diagnostic-text.mjs";
 import { createRequestAbort, readJsonBody } from "./http-transport.mjs";
-import { isLoopbackAddress, isLoopbackHostHeader } from "./observability.mjs";
+import { isLoopbackAddress, isLoopbackHostHeader } from "./security.mjs";
 import {
   DEFAULT_TERMINAL_ANIMATION_THEME,
   getTerminalAnimationFrameDelay,
@@ -11,7 +11,7 @@ import {
   renderTerminalAnimationFrame,
   TERMINAL_ANIMATION_THEMES,
 } from "./terminal-animation.mjs";
-import { cacheReadTokens, summarizeUsageLogs, usageCacheHitRate } from "./usage.mjs";
+import { cacheReadTokens, summarizeUsageLogs, usageCacheHitRate } from "./usage-store.mjs";
 import { createUsageAnalytics } from "./usage-analytics.mjs";
 import { readUserSettings, terminalAnimationPreference, writeTerminalAnimationTheme } from "./user-settings.mjs";