codex-copilot-dx 0.9.23 → 0.9.24

package/src/native-prediction.mjs

@@ -0,0 +1,146 @@
+import fs from "node:fs";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import { predictionPaths, readPredictionSettings, writePredictionSettings, assertPredictionProxyCompatible,
+  assertCodexClosed, installedPredictionApp, predictionAppMatches, readPredictionCertificate,
+  createPredictionCertificate, updatePredictionTrust } from "./native-prediction-profile.mjs";
+import { retirePredictionIntegration } from "./prediction-retirement.mjs";
+
+function systemProxy(exec = execFileSync) {
+  return exec("/usr/sbin/scutil", ["--proxy"], { encoding: "utf8", timeout: 2000, maxBuffer: 64 * 1024 });
+}
+
+function certificateDirectory(settings, paths) {
+  if (!settings.credentialsDirectory) return paths.directory;
+  const directory = path.resolve(settings.credentialsDirectory);
+  if (path.dirname(directory) !== paths.directory || !/^credentials-[A-Za-z0-9]+$/.test(path.basename(directory))) {
+    throw new Error("Unexpected prediction key directory; it was not changed");
+  }
+  return directory;
+}
+
+export async function runPredictionCommand({ action = "status", env = process.env,
+  platform = process.platform, output = console.log, resolveApp = installedPredictionApp,
+  writeSettings = writePredictionSettings, ...options } = {}) {
+  const opts = { ...options, env };
+  const settings = readPredictionSettings(opts);
+  if (action === "status") {
+    output(`Native prediction preference: ${settings.enabled ? "on" : "off"} (default: off)`);
+    output("Uses the conversation's model. No prediction MCP, Hook, or panel.");
+    if (settings.enabled && !predictionAppMatches(settings.app)) output("Codex App changed; quit it and run ccdx prediction on to recheck compatibility.");
+    return settings;
+  }
+  if (!["on", "off"].includes(action)) throw new Error("Prediction action must be on, off, or status");
+  if (platform !== "darwin") throw new Error("Native prediction setup currently supports macOS only; no configuration changed");
+  const paths = predictionPaths(opts);
+  if (action === "off") {
+    // Disable the response overlay first, even when App-owned trust is busy.
+    if (settings.enabled) writeSettings({ ...settings, enabled: false }, opts);
+    if (settings.certificateHash && settings.store) {
+      try {
+        assertCodexClosed(options);
+        const certificate = readPredictionCertificate(certificateDirectory(settings, paths), { allowExpired: true });
+        if (certificate.hash !== settings.certificateHash) throw new Error("Prediction certificate changed; trust cleanup was skipped");
+        await updatePredictionTrust(settings.store, certificate, { remove: true });
+      } catch (error) {
+        output(`Predictions disabled. ${error.message}. Quit Codex and run ccdx prediction off again to finish cleanup.`);
+        return { ...settings, enabled: false, cleanupPending: true };
+      }
+    }
+    const { store, certificateHash, app, ...disabled } = settings;
+    if (store || certificateHash || app) writeSettings({ ...disabled, enabled: false }, opts);
+    try { retirePredictionIntegration(opts); }
+    catch (error) { output(`Legacy prediction cleanup skipped: ${error.message}`); }
+    output("Native predictions off. Restart Codex to clear cached predictions and its temporary route.");
+    return { ...settings, enabled: false };
+  }
+  assertCodexClosed(options);
+  assertPredictionProxyCompatible({ env, systemProxy: systemProxy(options.exec) });
+  const app = resolveApp(options);
+  if (settings.store && settings.store !== paths.store) throw new Error("Codex profile changed; disable the previous profile before enabling another");
+  let certificate, previous, generated = false;
+  let credentialsDirectory = certificateDirectory(settings, paths);
+  try { certificate = readPredictionCertificate(credentialsDirectory); }
+  catch (error) {
+    if (error.code !== "ENOENT" && !error.message.includes("needs renewal")) throw error;
+    if (settings.certificateHash) {
+      previous = readPredictionCertificate(credentialsDirectory, { allowExpired: true });
+      if (previous.hash !== settings.certificateHash) throw new Error("Existing prediction certificate changed; it was preserved");
+    }
+    fs.mkdirSync(paths.directory, { recursive: true, mode: 0o700 });
+    credentialsDirectory = fs.mkdtempSync(path.join(paths.directory, "credentials-"));
+    generated = true;
+    try { certificate = createPredictionCertificate(credentialsDirectory, options); }
+    catch (failure) { fs.rmSync(credentialsDirectory, { recursive: true, force: true }); throw failure; }
+  }
+  const next = { version: 1, enabled: true, app, store: paths.store, certificateHash: certificate.hash, credentialsDirectory };
+  let trustAdded = false;
+  try {
+    // Add the new trust before committing activation; retain the old record
+    // until the commit succeeds so a failed write cannot break an existing setup.
+    trustAdded = await updatePredictionTrust(paths.store, certificate);
+    writeSettings(next, opts);
+  }
+  catch (error) {
+    if (trustAdded) await updatePredictionTrust(paths.store, certificate, { remove: true }).catch(() => {});
+    if (generated) fs.rmSync(credentialsDirectory, { recursive: true, force: true });
+    throw error;
+  }
+  if (previous && previous.hash !== certificate.hash) {
+    await updatePredictionTrust(paths.store, previous, { remove: true });
+    const previousDirectory = certificateDirectory(settings, paths);
+    if (previousDirectory !== paths.directory) fs.rmSync(previousDirectory, { recursive: true, force: true });
+  }
+  try { retirePredictionIntegration(opts); }
+  catch (error) { output(`Legacy prediction cleanup skipped: ${error.message}`); }
+  output("Native predictions on. Restart ccdx to launch Codex with the local bridge.");
+  output("Only chatgpt.com and ab.chatgpt.com use the App-only route. Their HTTPS traffic is decrypted locally; only prediction configuration is changed. No credentials are stored, no system certificate is installed, and client program files are unchanged.");
+  output("Existing official prediction configuration is preserved. The conversation's model generates predictions through your configured CCDX API.");
+  return next;
+}
+
+export async function startNativePrediction({ env = process.env, platform = process.platform,
+  warning = () => {}, ...options } = {}) {
+  const opts = { ...options, env };
+  const settings = readPredictionSettings(opts);
+  if (!settings.enabled) return null;
+  if (platform !== "darwin") throw new Error("Native predictions were skipped: unsupported platform");
+  assertPredictionProxyCompatible({ env, systemProxy: systemProxy(options.exec) });
+  if (!predictionAppMatches(settings.app)) throw new Error("Codex App changed; run ccdx prediction on after quitting it to recheck compatibility");
+  const paths = predictionPaths(opts);
+  if (settings.store !== paths.store || !fs.existsSync(paths.store)) throw new Error("Prediction profile trust is unavailable; run ccdx prediction on after quitting Codex");
+  const certificate = readPredictionCertificate(certificateDirectory(settings, paths));
+  if (certificate.hash !== settings.certificateHash) throw new Error("Prediction certificate changed; setup must be checked again");
+  const [{ startPredictionTransport }, { applyNativePredictionOverlay, normalizeStatsigRequest }] = await Promise.all([
+    import("./native-prediction-transport.mjs"), import("./native-prediction-overlay.mjs"),
+  ]);
+  // An in-memory switch is refreshed independently of request bodies and never
+  // touches the model path. A failed read turns off this optional overlay.
+  let enabled = true;
+  const timer = setInterval(() => {
+    try { enabled = readPredictionSettings(opts).enabled; }
+    catch { enabled = false; }
+  }, 1000);
+  timer.unref();
+  let transport;
+  try {
+    transport = await startPredictionTransport({ ...certificate, enabled: () => enabled,
+      overlay: ({ host, pathname, status, body, enabled }) => {
+        const result = applyNativePredictionOverlay({ hostname: host, pathname, statusCode: status, body, enabled });
+        return result.changed ? { body: result.body, status: result.statusCode } : null;
+      },
+      normalizeRequest: (parsed) => {
+        const result = normalizeStatsigRequest({ hostname: "ab.chatgpt.com", pathname: "/v1/initialize", body: JSON.stringify(parsed), enabled });
+        return result.changed ? JSON.parse(result.body) : parsed;
+      },
+    });
+  } catch (error) { clearInterval(timer); throw error; }
+  warning("Native prediction bridge enabled; only the two configuration hosts use its App-only route.");
+  warning("If Codex is already running, quit it and run ccdx again to apply the route.");
+  return {
+    app: settings.app.app,
+    pacUrl: transport.pacUrl,
+    args: [`--proxy-pac-url=${transport.pacUrl}`],
+    async close() { clearInterval(timer); await transport.close(); },
+  };
+}

package/src/prediction-retirement.mjs

@@ -0,0 +1,75 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { isDeepStrictEqual } from "node:util";
+import { atomicWriteFileIfChangedSync, atomicWriteFilePairSync } from "./atomic-file.mjs";
+import { codexTomlStatements, parseCodexToml, validateManagedConfigEdit } from "./config-toml.mjs";
+import { userSettingsPath } from "./user-settings.mjs";
+
+const SERVER_PATH = ["mcp_servers", "ccdx_suggestion"];
+const same = (left, right) => isDeepStrictEqual(left, right);
+
+export function computeRetiredPredictionConfig(content, filePath) {
+  const before = parseCodexToml(content);
+  const expected = {
+    command: process.execPath,
+    args: [fileURLToPath(new URL("./suggestion-mcp.mjs", import.meta.url))],
+    env: { CCDX_SUGGESTION_CONFIG: filePath },
+    tool_timeout_sec: 40n,
+  };
+  const existing = before.mcp_servers?.ccdx_suggestion;
+  const owned = existing && typeof existing.enabled === "boolean"
+    && same({ ...existing, enabled: undefined }, { ...expected, enabled: undefined });
+  const statements = codexTomlStatements(content);
+  const declarations = statements.filter(item => ["table", "value"].includes(item.kind)
+    && same(item.keys.slice(0, 2), SERVER_PATH));
+  const ranges = owned ? declarations.map(item => {
+    const start = content.lastIndexOf("\n", item.start - 1) + 1;
+    const end = content.indexOf("\n", item.end);
+    return [start, end < 0 ? content.length : end + 1];
+  }) : [];
+  // Only remove the exact block emitted by 0.9.23. Modified handlers and
+  // Codex's own trust records remain untouched.
+  const quote = value => `'${value.replaceAll("'", "'\\''")}'`;
+  const command = `CCDX_SUGGESTION_CONFIG=${quote(filePath)} ${quote(process.execPath)} ${quote(fileURLToPath(new URL("./suggestion-auto.mjs", import.meta.url)))}`;
+  const block = `# ccdx:suggestion-auto:start\n[[hooks.Stop]]\n[[hooks.Stop.hooks]]\ntype = "command"\ncommand = ${JSON.stringify(command)}\nasync = true\ntimeout = 35\n# ccdx:suggestion-auto:end\n`;
+  const hookStart = content.indexOf(block);
+  const hookOwned = hookStart >= 0 && content.indexOf(block, hookStart + block.length) < 0
+    && statements.some(item => item.kind === "comment" && item.start === hookStart && item.source === "# ccdx:suggestion-auto:start");
+  if (hookOwned) ranges.push([hookStart, hookStart + block.length]);
+  let updated = content;
+  for (const [start, end] of ranges.sort((a, b) => b[0] - a[0])) updated = updated.slice(0, start) + updated.slice(end);
+  validateManagedConfigEdit(before, updated, [SERVER_PATH, ["hooks", "Stop"]]);
+  const after = parseCodexToml(updated);
+  const remaining = [...(before.hooks?.Stop || [])];
+  if (hookOwned) {
+    const index = remaining.findIndex(group => same(group, { hooks: [{ type: "command", command, async: true, timeout: 35n }] }));
+    if (index < 0) throw new Error("Retired prediction hook could not be safely removed");
+    remaining.splice(index, 1);
+  }
+  if (!same(after.hooks?.Stop || [], remaining)) throw new Error("Unrelated hooks changed; prediction cleanup was skipped");
+  return { content: updated, changed: updated !== content, preserved: Boolean(existing && !owned) || (content.includes("# ccdx:suggestion-auto:start") && !hookOwned) };
+}
+
+export function retirePredictionIntegration({ env = process.env, home = os.homedir(), dryRun = false } = {}) {
+  const settings = path.resolve(env.CCDX_SUGGESTION_CONFIG || path.join(path.dirname(userSettingsPath({ env, home })), "suggestion.json"));
+  const codex = path.join(env.CODEX_HOME || path.join(home, ".codex"), "config.toml");
+  let content;
+  try { content = new TextDecoder("utf-8", { fatal: true }).decode(fs.readFileSync(codex)); }
+  catch (error) { if (error.code !== "ENOENT") throw new Error("Cannot safely read prediction configuration"); }
+  let serialized;
+  try {
+    const preference = JSON.parse(fs.readFileSync(settings, "utf8"));
+    if (!preference || typeof preference !== "object" || Array.isArray(preference)
+      || typeof preference.enabled !== "boolean" || typeof preference.model !== "string") throw new Error();
+    if (preference.enabled || preference.automatic) serialized = JSON.stringify({ ...preference, enabled: false, automatic: false }, null, 2) + "\n";
+  } catch (error) { if (error.code !== "ENOENT") throw new Error("Prediction settings are invalid; cleanup was skipped"); }
+  const result = content?.includes("ccdx_suggestion") || content?.includes("ccdx:suggestion-auto:start")
+    ? computeRetiredPredictionConfig(content, settings) : { content, changed: false, preserved: false };
+  if (dryRun) return { changed: result.changed || Boolean(serialized), preserved: result.preserved };
+  if (result.changed && serialized) atomicWriteFilePairSync(codex, result.content, settings, serialized);
+  else if (result.changed) atomicWriteFileIfChangedSync(codex, result.content);
+  else if (serialized) atomicWriteFileIfChangedSync(settings, serialized);
+  return { changed: result.changed || Boolean(serialized), preserved: result.preserved };
+}

package/src/suggestion-auto.mjs

@@ -1,107 +1,7 @@
-import fs from "node:fs";
-import path from "node:path";
-import { createHash, randomUUID } from "node:crypto";
 import { pathToFileURL } from "node:url";
-import { atomicWriteFileIfChangedSync } from "./atomic-file.mjs";
-import { readSuggestionConfig, suggestionConfigPath } from "./suggestion-config.mjs";
-import { readSuggestionContext } from "./suggestion-context.mjs";
-import { generateSuggestion } from "./suggestion-provider.mjs";
 
-const UUID = /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i;
-const RETENTION_MS = 10 * 60_000;
-function storeDirectory(filePath) { return path.join(path.dirname(filePath), "suggestion-state"); }
-function keyFile(filePath, threadId) {
-  if (!UUID.test(threadId)) throw new Error("Invalid suggestion conversation ID");
-  return path.join(storeDirectory(filePath), `${createHash("sha256").update(threadId).digest("hex")}.json`);
-}
-function readRecord(file) {
-  try {
-    const stat=fs.lstatSync(file);
-    if (!stat.isFile() || stat.size > 8192) return null;
-    const record = JSON.parse(fs.readFileSync(file,"utf8"));
-    return record && typeof record === "object" && !Array.isArray(record) ? record : null;
-  } catch { return null; }
-}
-export function readAutomaticSuggestion(filePath, threadId) { return readRecord(keyFile(filePath, threadId)); }
-function save(filePath, threadId, record) { atomicWriteFileIfChangedSync(keyFile(filePath,threadId),JSON.stringify(record)+"\n"); }
-function cleanup(directory, now) {
-  const files = fs.readdirSync(directory).filter(name=>/^[a-f0-9]{64}\.json$/.test(name));
-  const retained = [];
-  for (const name of files) {
-    const file=path.join(directory,name),record=readRecord(file);
-    if (!record || !Number.isFinite(record.at) || now-record.at>RETENTION_MS) fs.unlinkSync(file);
-    else retained.push({file,at:record.at});
-  }
-  retained.sort((a,b)=>b.at-a.at);
-  for(const record of retained.slice(31))fs.unlinkSync(record.file);
-}
-export function automaticSuggestionStatus(filePath, now = Date.now()) {
-  try {
-    const directory=storeDirectory(filePath);
-    const records=fs.readdirSync(directory).filter(name=>/^[a-f0-9]{64}\.json$/.test(name)).slice(0,64)
-      .map(name=>readRecord(path.join(directory,name))).filter(record=>record && Number.isFinite(record.at)&&now-record.at<=RETENTION_MS);
-    const recent=records.sort((a,b)=>b.at-a.at)[0];
-    return recent ? { state:["generating","ready","empty","failed","cancelled"].includes(recent.state)?recent.state:"unknown",
-      at:new Date(recent.at).toISOString(),reason:["context_unavailable","model_failed","settings_changed","turn_changed","timeout"].includes(recent.reason)?recent.reason:null } : {state:"idle",at:null,reason:null};
-  } catch { return {state:"idle",at:null,reason:null}; }
-}
-
-export async function runAutomaticSuggestion(event, {
-  filePath = suggestionConfigPath(), readContext = readSuggestionContext, generate = generateSuggestion,
-  now = Date.now, timeoutMs = 30_000,
-} = {}) {
-  const config=readSuggestionConfig({filePath});
-  if(!config.enabled || !config.automatic || event?.hook_event_name!=="Stop" || event.stop_hook_active===true
-    || !UUID.test(event.session_id||"") || !UUID.test(event.turn_id||"")) return {skipped:true};
-  const threadId=event.session_id,turnId=event.turn_id,directory=storeDirectory(filePath);
-  fs.mkdirSync(directory,{recursive:true,mode:0o700});
-  if(!fs.lstatSync(directory).isDirectory())return {skipped:true};
-  cleanup(directory,now());
-  const prior=readAutomaticSuggestion(filePath,threadId);
-  if(prior?.turnId===turnId)return {skipped:true};
-  // One local slot bounds independent asynchronous hook processes. Only owned
-  // lock files are reclaimed after their 30-second operation deadline.
-  let lock;
-  for(let slot=0;slot<1;slot++){
-    const file=path.join(directory,`slot-${slot}.lock`);
-    try{if(now()-fs.statSync(file).mtimeMs>60_000)fs.unlinkSync(file)}catch(error){if(error.code!=="ENOENT")return {skipped:true}}
-    try{const fd=fs.openSync(file,"wx",0o600);fs.closeSync(fd);lock=file;break}catch(error){if(error.code!=="EEXIST")return {skipped:true}}
-  }
-  if(!lock)return {skipped:true,busy:true};
-  const abort=new AbortController(),timer=setTimeout(()=>abort.abort(),timeoutMs);
-  let stage="context_unavailable";
-  try {
-    // The slot acquisition and marker commit are synchronous within this process.
-    if(readAutomaticSuggestion(filePath,threadId)?.turnId===turnId)return {skipped:true};
-    save(filePath,threadId,{state:"generating",at:now(),turnId,model:config.model});
-    const page=await readContext(threadId,config,{signal:abort.signal,includePage:true});
-    if(page.latestTurnId!==turnId){save(filePath,threadId,{state:"cancelled",at:now(),turnId,model:config.model,reason:"turn_changed"});return {skipped:true};}
-    const current=readSuggestionConfig({filePath});
-    if(!current.enabled||!current.automatic||current.model!==config.model||current.adapter_url!==config.adapter_url){stage="settings_changed";throw new Error();}
-    stage="model_failed";
-    const suggestion=await generate(page.messages,config,{signal:abort.signal});
-    abort.signal.throwIfAborted();
-    const latest=readSuggestionConfig({filePath});
-    if(!latest.enabled||!latest.automatic||latest.model!==config.model||latest.adapter_url!==config.adapter_url){stage="settings_changed";throw new Error();}
-    stage="context_unavailable";
-    const finalPage=await readContext(threadId,config,{signal:abort.signal,includePage:true});
-    if(finalPage.latestTurnId!==turnId){stage="turn_changed";throw new Error();}
-    const result={state:suggestion?"ready":"empty",at:now(),turnId,model:config.model,suggestion,candidate_id:suggestion?randomUUID():null};
-    save(filePath,threadId,result);return result;
-  } catch {
-    const result={state:abort.signal.aborted?"cancelled":"failed",at:now(),turnId,model:config.model,reason:abort.signal.aborted?"timeout":stage};
-    // Don't overwrite a newer hook's marker.
-    if(readAutomaticSuggestion(filePath,threadId)?.turnId===turnId)save(filePath,threadId,result);
-    return result;
-  } finally {clearTimeout(timer);try{fs.unlinkSync(lock)}catch{}}
-}
-
-async function main(){
-  let chunks=[],bytes=0;
-  for await(const chunk of process.stdin){bytes+=chunk.length;if(bytes>64*1024)return;chunks.push(chunk)}
-  let event;try{event=JSON.parse(Buffer.concat(chunks).toString("utf8"))}catch{return}
-  // Informational hook: no continuation, warnings, approval or user messages.
-  await runAutomaticSuggestion(event);
+// Older configurations may still invoke this retired hook after an upgrade.
+// Do not consume stdin, read session data, or request another model response.
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
   process.stdout.write("{}\n");
 }
-if(process.argv[1]&&import.meta.url===pathToFileURL(process.argv[1]).href)main().catch(()=>{process.stdout.write("{}\n")});

package/src/suggestion-mcp.mjs

@@ -1,145 +1,77 @@
-import fs from "node:fs";
-import { pathToFileURL } from "node:url";
-import { randomUUID } from "node:crypto";
 import { StringDecoder } from "node:string_decoder";
-import { readSuggestionConfig, suggestionConfigPath } from "./suggestion-config.mjs";
-import { readSuggestionContext, suggestionThreadId } from "./suggestion-context.mjs";
-import { generateSuggestion } from "./suggestion-provider.mjs";
-import { readAutomaticSuggestion } from "./suggestion-auto.mjs";
+import { pathToFileURL } from "node:url";
+
+const MAX_LINE_BYTES = 64 * 1024;
+const PROTOCOL_VERSIONS = new Set(["2025-11-25", "2025-06-18", "2025-03-26", "2024-11-05"]);
+const RETIRED = "CCDX next-message MCP has been retired. Remove the old ccdx_suggestion MCP configuration.";
 
-const URI = "ui://ccdx-suggestion/panel.html";
-const protocolVersions = new Set(["2024-11-05", "2025-03-26", "2025-06-18", "2025-11-25", "2026-07-28"]);
-export const SUGGESTION_TOOLS = [
-  {
-    name: "suggest_next_message", title: "Next message / 下一句",
-    description: "Open an optional next-message suggestion for this local conversation. Use only when the user asks for a suggestion. Reads a bounded page of recent user/assistant text and makes one request to the user's selected model through local CCDX. Does not send a message, modify a draft, execute tools, or grant approval. The user can add the suggestion to their ordinary draft in the panel.",
-    inputSchema: { type: "object", properties: {}, additionalProperties: false },
-    annotations: { readOnlyHint: true, openWorldHint: true, destructiveHint: false },
-    _meta: { ui: { resourceUri: URI }, "openai/ui": { entrypoints: [{ type: "thread" }] } },
-  },
-  {
-    name: "prepare_suggestion_draft", title: "Check draft destination",
-    description: "Validate a suggestion's originating conversation before the user explicitly adds it to their draft. Does not send or write anything.",
-    inputSchema: { type: "object", properties: { candidate_id: { type: "string" } }, required: ["candidate_id"], additionalProperties: false },
-    annotations: { readOnlyHint: true, openWorldHint: false, destructiveHint: false },
-    _meta: { ui: { visibility: ["app"] } },
-  },
-  {
-    name:"latest_suggestion",title:"Read latest suggestion",
-    description:"Read an already-generated candidate for this local conversation. Does not invoke a model or edit a draft.",
-    inputSchema:{type:"object",properties:{},additionalProperties:false},
-    annotations:{readOnlyHint:true,openWorldHint:false,destructiveHint:false},_meta:{ui:{visibility:["app"]}},
-  },
-];
+function reply(request) {
+  const id = request?.id;
+  const validId = id === null || typeof id === "string" || (typeof id === "number" && Number.isFinite(id));
+  if (!request || Array.isArray(request) || request.jsonrpc !== "2.0" || typeof request.method !== "string"
+    || (id !== undefined && !validId)) {
+    return { jsonrpc: "2.0", id: validId ? id : null, error: { code: -32600, message: "Invalid JSON-RPC request" } };
+  }
+  if (id === undefined) return null;
+  let result;
+  switch (request.method) {
+    case "initialize":
+      result = {
+        protocolVersion: PROTOCOL_VERSIONS.has(request.params?.protocolVersion) ? request.params.protocolVersion : "2025-11-25",
+        capabilities: { tools: { listChanged: false }, resources: {} },
+        serverInfo: { name: "ccdx-suggestion", version: "1" },
+        instructions: RETIRED,
+      };
+      break;
+    case "ping": result = {}; break;
+    case "tools/list": result = { tools: [] }; break;
+    case "resources/list": result = { resources: [] }; break;
+    case "resources/templates/list": result = { resourceTemplates: [] }; break;
+    case "tools/call": result = { isError: true, content: [{ type: "text", text: RETIRED }] }; break;
+    default: return { jsonrpc: "2.0", id, error: { code: -32601, message: RETIRED } };
+  }
+  return { jsonrpc: "2.0", id, result };
+}
 
-export function createSuggestionMcp({
-  loadConfig = () => readSuggestionConfig({ filePath: suggestionConfigPath() }),
-  readContext = readSuggestionContext, generate = generateSuggestion,
-  now = Date.now, timeoutMs = 30_000,
-  loadAutomatic = threadId => readAutomaticSuggestion(suggestionConfigPath(),threadId),
-} = {}) {
-  const candidates = new Map();
-  let active = 0;
-  const prune = () => { for (const [id, item] of candidates) if (now() - item.at > 10 * 60_000) candidates.delete(id); };
-  const result = data => ({ content: [{ type: "text", text: data.suggestion || "No suggestion available. Open the panel to try again." }], structuredContent: data });
-  return async function handle(request, { signal } = {}) {
-    const config = loadConfig();
-    if (request.method === "initialize") return {
-      protocolVersion: protocolVersions.has(request.params?.protocolVersion) ? request.params.protocolVersion : "2025-11-25",
-      capabilities: { tools: { listChanged: false }, resources: {} },
-      serverInfo: { name: "ccdx-suggestion", version: "1" },
-      instructions: "Optional next-message panel. Call only when requested by the user. No automatic messages, no client patch, no approvals implied. Disabled until the user runs ccdx suggestion on.",
-    };
-    if (request.method === "ping") return {};
-    if (request.method === "tools/list") return { tools: config.enabled ? SUGGESTION_TOOLS : [] };
-    if (request.method === "resources/list") return { resources: config.enabled ? [{ uri: URI, name: "Next message", mimeType: "text/html;profile=mcp-app" }] : [] };
-    if (request.method === "resources/templates/list") return { resourceTemplates: [] };
-    if (!config.enabled) { candidates.clear(); throw new Error("Next-message suggestions are disabled. Run ccdx suggestion on to enable them"); }
-    if (request.method === "resources/read" && request.params?.uri === URI) return {
-      contents: [{ uri: URI, mimeType: "text/html;profile=mcp-app", text: fs.readFileSync(new URL("./suggestion-ui.html", import.meta.url), "utf8") }],
-    };
-    if (request.method !== "tools/call") throw new Error("Unsupported suggestion method");
-    const threadId = suggestionThreadId(request.params?._meta);
-    const args = request.params?.arguments || {};
-    if (typeof args !== "object" || Array.isArray(args)) throw new Error("Invalid suggestion parameters");
-    prune();
-    const automatic = () => {
-      const item=loadAutomatic(threadId);
-      return item?.state==="ready" && typeof item.suggestion==="string" && item.suggestion.length<=300
-        && typeof item.candidate_id==="string" && item.model===config.model && Number.isFinite(item.at) && now()-item.at<=10*60_000 ? item : null;
-    };
-    if(request.params.name==="latest_suggestion"){
-      if(Object.keys(args).length)throw new Error("Invalid latest suggestion parameters");
-      const item=automatic();return result(item?{suggestion:item.suggestion,candidate_id:item.candidate_id,model:item.model}:{suggestion:null,candidate_id:null,model:config.model});
+export function runSuggestionStdio({ input = process.stdin, output = process.stdout } = {}) {
+  let decoder = new StringDecoder("utf8"), line = "", bytes = 0, closed = false;
+  const close = () => { closed = true; input.destroy(); };
+  const write = value => {
+    if (value && !closed && !output.destroyed && !output.writableEnded) {
+      if (!output.write(JSON.stringify(value) + "\n")) input.pause();
     }
-    if (request.params.name === "prepare_suggestion_draft") {
-      if (Object.keys(args).some(key => key !== "candidate_id")) throw new Error("Invalid draft parameters");
-      const stored=automatic();
-      const item = candidates.get(args.candidate_id) || (stored?.candidate_id===args.candidate_id?{...stored,threadId}:null);
-      if (!item || item.threadId !== threadId || item.model !== config.model) throw new Error("Suggestion expired or conversation changed; generate a new suggestion");
-      if(stored?.candidate_id===args.candidate_id){
-        const page=await readContext(threadId,config,{signal,includePage:true});
-        if(page.latestTurnId!==stored.turnId)throw new Error("Conversation changed; generate a new suggestion");
-      }
-      return result({ candidate_id: args.candidate_id, suggestion: item.suggestion, model: item.model });
+  };
+  const finishLine = () => {
+    line += decoder.end();
+    if (line.trim()) {
+      let request;
+      try { request = JSON.parse(line); }
+      catch { write({ jsonrpc: "2.0", id: null, error: { code: -32700, message: "Invalid JSON" } }); }
+      if (request !== undefined) write(reply(request));
     }
-    if (request.params.name !== "suggest_next_message" || Object.keys(args).length) throw new Error("Invalid suggestion tool or parameters");
-    if (active >= 2) throw new Error("Suggestions are busy. Wait for the current request; no extra model call was made");
-    active += 1;
-    const controller = new AbortController();
-    const abort = () => controller.abort(new Error("Suggestion cancelled"));
-    signal?.addEventListener("abort", abort, { once: true });
-    if (signal?.aborted) abort();
-    const timer = setTimeout(abort, timeoutMs);
-    try {
-      const messages = await readContext(threadId, config, { signal: controller.signal });
-      controller.signal.throwIfAborted();
-      const latest = loadConfig();
-      if (!latest.enabled || latest.model !== config.model || latest.adapter_url !== config.adapter_url) throw new Error("Suggestion settings changed; generate again with the current selection");
-      const suggestion = await generate(messages, config, { signal: controller.signal });
-      controller.signal.throwIfAborted();
-      if (!loadConfig().enabled) throw new Error("Suggestions were disabled");
-      const candidate_id = suggestion ? randomUUID() : null;
-      if (candidate_id) {
-        while (candidates.size >= 16) candidates.delete(candidates.keys().next().value);
-        candidates.set(candidate_id, { suggestion, model: config.model, threadId, at: now() });
-      }
-      return result({ suggestion, candidate_id, model: config.model });
-    } finally { active -= 1; clearTimeout(timer); signal?.removeEventListener("abort", abort); }
+    line = ""; bytes = 0; decoder = new StringDecoder("utf8");
   };
-}
-
-export function runSuggestionStdio({ input = process.stdin, output = process.stdout, handle = createSuggestionMcp() } = {}) {
-  const decoder = new StringDecoder("utf8"), pending = new Map();
-  let buffer = "";
-  const write = value => { if (!output.destroyed) output.write(JSON.stringify(value) + "\n"); };
-  const close = () => { for (const controller of pending.values()) controller.abort(); pending.clear(); };
-  input.on("end", close);
   input.on("error", close);
   output.on("error", close);
+  output.on("drain", () => { if (!closed) input.resume(); });
+  input.on("end", () => { if (!closed && bytes) finishLine(); });
   input.on("data", chunk => {
-    buffer += decoder.write(chunk);
-    if (Buffer.byteLength(buffer) > 64 * 1024) { close(); input.destroy(); return; }
-    let end;
-    while ((end = buffer.indexOf("\n")) >= 0) {
-      const line = buffer.slice(0, end); buffer = buffer.slice(end + 1);
-      let request;
-      try { request = JSON.parse(line); } catch { write({ jsonrpc: "2.0", id: null, error: { code: -32700, message: "Invalid JSON" } }); continue; }
-      if (request?.method === "notifications/cancelled") { pending.get(request.params?.requestId)?.abort(); continue; }
-      if (request?.id === undefined) continue;
-      const id = request.id;
-      if (request.jsonrpc !== "2.0" || !["string", "number"].includes(typeof id) || typeof request.method !== "string" || pending.has(id) || pending.size >= 16) {
-        write({ jsonrpc: "2.0", id: typeof id === "string" || typeof id === "number" ? id : null, error: { code: -32600, message: "Invalid or busy request" } }); continue;
+    if (closed) return;
+    const data = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    let start = 0;
+    while (start < data.length && !closed) {
+      const end = data.indexOf(10, start);
+      const limit = end < 0 ? data.length : end;
+      bytes += limit - start;
+      if (bytes > MAX_LINE_BYTES) {
+        write({ jsonrpc: "2.0", id: null, error: { code: -32600, message: "MCP request exceeds 65536 bytes" } });
+        close();
+        return;
       }
-      const controller = new AbortController(); pending.set(id, controller);
-      Promise.resolve().then(() => handle(request, { signal: controller.signal }))
-        .then(result => write({ jsonrpc: "2.0", id, result }), error => {
-          // Never expose raw upstream responses, prompts, stack traces or config.
-          const message = String(error?.message || "Suggestion failed").replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0,300);
-          write({ jsonrpc: "2.0", id, ...(request.method === "tools/call"
-            ? { result: { isError: true, content: [{ type: "text", text: message }] } }
-            : { error: { code: -32603, message } }) });
-        }).finally(() => pending.delete(id));
+      line += decoder.write(data.subarray(start, limit));
+      if (end < 0) break;
+      finishLine();
+      start = end + 1;
     }
   });
 }