codex-copilot-dx 0.9.23 → 0.9.25

package/src/native-prediction-profile.mjs

@@ -0,0 +1,178 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import { createHash, X509Certificate, createPrivateKey, createPublicKey } from "node:crypto";
+import { atomicWriteFileSync } from "./atomic-file.mjs";
+import { userSettingsPath } from "./user-settings.mjs";
+import { resolveNetworkRoute } from "./network-route.mjs";
+import { codexPaths } from "./codex-paths.mjs";
+
+export function predictionPaths({ env = process.env, home = os.homedir() } = {}) {
+  const directory = path.join(path.dirname(userSettingsPath({ env, home })), "native-prediction");
+  const { profile, certificateStore } = codexPaths({ env, home });
+  return { directory, settings: path.join(directory, "settings.json"), profile,
+    store: certificateStore };
+}
+
+export function readPredictionSettings(options = {}) {
+  const { settings } = predictionPaths(options);
+  try {
+    const value = JSON.parse(fs.readFileSync(settings, "utf8"));
+    if (value?.version !== 1 || typeof value.enabled !== "boolean") throw new Error();
+    return value;
+  } catch (error) {
+    if (error.code === "ENOENT") return { version: 1, enabled: false };
+    throw new Error("Native prediction settings are invalid; no settings were changed");
+  }
+}
+
+export function writePredictionSettings(value, options = {}) {
+  atomicWriteFileSync(predictionPaths(options).settings, JSON.stringify(value, null, 2) + "\n", { preserveMode: false });
+}
+
+export function assertPredictionProxyCompatible({ env = process.env, systemProxy = "" } = {}) {
+  return resolveNetworkRoute({ env, systemProxy });
+}
+
+export function assertCodexClosed({ exec = execFileSync } = {}) {
+  for (const name of ["ChatGPT", "Codex"]) {
+    try {
+      exec("/usr/bin/pgrep", ["-x", name], { stdio: "pipe", timeout: 2000 });
+    } catch (error) {
+      if (error.status === 1) continue;
+      throw new Error("Could not check whether Codex is closed; prediction setup was skipped");
+    }
+    throw new Error("Quit Codex App before changing native prediction setup; no running App will be stopped");
+  }
+}
+
+export function installedPredictionApp({ exec = execFileSync } = {}) {
+  for (const app of ["/Applications/ChatGPT.app", "/Applications/Codex.app"]) {
+    const archive = path.join(app, "Contents", "Resources", "app.asar");
+    if (!fs.existsSync(archive)) continue;
+    // Check only during explicit setup; startup uses the cheap identity check.
+    const fd = fs.openSync(archive, "r");
+    try {
+      const prefix = Buffer.alloc(16); fs.readSync(fd, prefix, 0, 16, 0);
+      const headerSize = prefix.readUInt32LE(12);
+      if (headerSize > 32 * 1024 * 1024) continue;
+      const header = Buffer.alloc(headerSize); fs.readSync(fd, header, 0, header.length, 16);
+      const files = JSON.parse(header).files?.[".vite"]?.files?.build?.files;
+      const entry = Object.entries(files || {}).find(([name]) => /^main-[\w-]+\.js$/.test(name))?.[1];
+      if (!entry || entry.size > 32 * 1024 * 1024 || entry.unpacked) continue;
+      const bytes = Buffer.alloc(entry.size);
+      fs.readSync(fd, bytes, 0, bytes.length, 8 + prefix.readUInt32LE(4) + Number(entry.offset));
+      const source = bytes.toString();
+      if (!["/wham/predictions/config", "experimentalPredictionMode"].every((value) => source.includes(value))) continue;
+      const renderer = Object.entries(JSON.parse(header).files?.webview?.files?.assets?.files || {})
+        .find(([name]) => /^general-settings-[\w-]+\.js$/.test(name))?.[1];
+      if (!renderer || renderer.unpacked || renderer.size > 4 * 1024 * 1024) continue;
+      const rendererBytes = Buffer.alloc(renderer.size);
+      fs.readSync(fd, rendererBytes, 0, rendererBytes.length, 8 + prefix.readUInt32LE(4) + Number(renderer.offset));
+      if (!rendererBytes.includes(Buffer.from("4290031608"))) continue;
+      exec("/usr/bin/codesign", ["--verify", "--deep", "--strict", app], { stdio: "pipe", timeout: 15_000 });
+      const stat = fs.statSync(archive);
+      return { app, archive, size: stat.size, mtimeMs: stat.mtimeMs };
+    } finally { fs.closeSync(fd); }
+  }
+  throw new Error("This Codex App does not expose the verified native prediction protocol; setup was skipped");
+}
+
+export function predictionAppMatches(app) {
+  try { const stat = fs.statSync(app.archive); return stat.size === app.size && stat.mtimeMs === app.mtimeMs; }
+  catch { return false; }
+}
+
+function privateDirectory(directory) {
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  const stat = fs.lstatSync(directory);
+  if (!stat.isDirectory() || stat.isSymbolicLink() || (stat.mode & 0o077)) {
+    throw new Error("Prediction key directory must be private and must not be a symlink");
+  }
+}
+
+export function readPredictionCertificate(directory, { allowExpired = false } = {}) {
+  const cert = fs.readFileSync(path.join(directory, "bridge.pem"));
+  const ca = new X509Certificate(fs.readFileSync(path.join(directory, "ca.pem")));
+  const keyFile = path.join(directory, "bridge.key");
+  const info = fs.lstatSync(keyFile);
+  if (!info.isFile() || info.isSymbolicLink() || (info.mode & 0o077)) throw new Error("Prediction key is not private");
+  const key = fs.readFileSync(keyFile);
+  const x509 = new X509Certificate(cert);
+  const publicKey = createPublicKey(createPrivateKey(key)).export({ type: "spki", format: "der" });
+  if (!x509.publicKey.export({ type: "spki", format: "der" }).equals(publicKey)
+    || (!allowExpired && Date.parse(x509.validTo) <= Date.now()) || !x509.checkHost("chatgpt.com") || !x509.checkHost("ab.chatgpt.com")
+    || !x509.verify(ca.publicKey) || !ca.ca || x509.ca) {
+    throw new Error("Prediction certificate needs renewal; quit Codex and run ccdx prediction on");
+  }
+  return { cert, key, ca: ca.toString(), hash: createHash("sha256").update(ca.raw).digest("hex").toUpperCase(), der: ca.raw };
+}
+
+export function createPredictionCertificate(directory, { exec = execFileSync } = {}) {
+  privateDirectory(directory);
+  const temporary = fs.mkdtempSync(path.join(directory, "certificate-"));
+  try {
+    const config = `[req]\nprompt=no\ndistinguished_name=dn\nx509_extensions=ext\n[dn]\nCN=CCDX native prediction local bridge\n[ext]\nbasicConstraints=critical,CA:TRUE,pathlen:0\nkeyUsage=critical,keyCertSign,digitalSignature\nextendedKeyUsage=serverAuth\nsubjectAltName=DNS:chatgpt.com,DNS:ab.chatgpt.com\nnameConstraints=critical,permitted;DNS:chatgpt.com\n`;
+    const configFile = path.join(temporary, "openssl.cnf");
+    atomicWriteFileSync(configFile, config);
+    const certFile = path.join(temporary, "cert.pem"), keyFile = path.join(temporary, "key.pem");
+    const caFile = path.join(temporary, "ca.pem"), caKey = path.join(temporary, "ca.key");
+    const run = (args) => exec("/usr/bin/openssl", args, { stdio: "pipe", timeout: 15_000 });
+    run(["req", "-x509", "-newkey", "rsa:2048", "-nodes", "-days", "90", "-config", configFile, "-out", caFile, "-keyout", caKey]);
+    const csr = path.join(temporary, "leaf.csr"), extensions = path.join(temporary, "leaf.cnf");
+    atomicWriteFileSync(extensions, "basicConstraints=critical,CA:FALSE\nkeyUsage=critical,digitalSignature,keyEncipherment\nextendedKeyUsage=serverAuth\nsubjectAltName=DNS:chatgpt.com,DNS:ab.chatgpt.com\n");
+    run(["req", "-newkey", "rsa:2048", "-nodes", "-keyout", keyFile, "-out", csr, "-subj", "/CN=CCDX local prediction bridge"]);
+    run(["x509", "-req", "-in", csr, "-CA", caFile, "-CAkey", caKey, "-CAcreateserial", "-days", "90", "-extfile", extensions, "-out", certFile]);
+    atomicWriteFileSync(path.join(directory, "bridge.key"), fs.readFileSync(keyFile), { preserveMode: false });
+    atomicWriteFileSync(path.join(directory, "bridge.pem"), fs.readFileSync(certFile), { preserveMode: false });
+    atomicWriteFileSync(path.join(directory, "ca.pem"), fs.readFileSync(caFile), { preserveMode: false });
+    return readPredictionCertificate(directory);
+  } finally { fs.rmSync(temporary, { recursive: true, force: true }); }
+}
+
+// Chromium certificate metadata: trusted anchor, exact DNS constraints. This
+// private record is scoped to one App profile; no system keychain is changed.
+export function predictionTrustMetadata() {
+  const names = ["chatgpt.com", "ab.chatgpt.com"].map((name) => Buffer.concat([Buffer.from([10, Buffer.byteLength(name)]), Buffer.from(name)]));
+  const constraints = Buffer.concat(names);
+  return Buffer.concat([Buffer.from([10, 2, 8, 3, 18, constraints.length]), constraints]);
+}
+
+export async function updatePredictionTrust(store, certificate, { remove = false, priorHash = null } = {}) {
+  if (remove && !fs.existsSync(store)) return false;
+  if (fs.existsSync(store) && !fs.lstatSync(store).isFile()) throw new Error("Unexpected certificate-store file; skipped");
+  fs.mkdirSync(path.dirname(store), { recursive: true, mode: 0o700 });
+  const { DatabaseSync } = await import("node:sqlite");
+  const db = new DatabaseSync(store);
+  try {
+    db.exec("PRAGMA busy_timeout=1000; BEGIN IMMEDIATE");
+    const tables = db.prepare("SELECT name FROM sqlite_master WHERE type='table'").all().map((item) => item.name);
+    if (!tables.length && !remove) {
+      db.exec("CREATE TABLE meta(key LONGVARCHAR NOT NULL UNIQUE PRIMARY KEY,value LONGVARCHAR); CREATE TABLE certificates(sha256hash_hex TEXT PRIMARY KEY,der_cert BLOB NOT NULL,trust_settings BLOB NOT NULL)");
+      db.prepare("INSERT INTO meta VALUES(?,?)").run("version", "1");
+      db.prepare("INSERT INTO meta VALUES(?,?)").run("last_compatible_version", "1");
+    }
+    const meta = db.prepare("SELECT value FROM meta WHERE key='version'").get();
+    const columns = db.prepare("PRAGMA table_info(certificates)").all().map((item) => item.name);
+    if (String(meta?.value) !== "1" || columns.join(",") !== "sha256hash_hex,der_cert,trust_settings") throw new Error("Unknown certificate-store schema; skipped");
+    const metadata = predictionTrustMetadata();
+    const existing = db.prepare("SELECT der_cert,trust_settings FROM certificates WHERE sha256hash_hex=?").get(certificate.hash);
+    if (existing && (!Buffer.from(existing.der_cert).equals(certificate.der) || !Buffer.from(existing.trust_settings).equals(metadata))) throw new Error("Prediction trust was modified; it was preserved");
+    if (remove) {
+      if (existing) db.prepare("DELETE FROM certificates WHERE sha256hash_hex=?").run(certificate.hash);
+    } else {
+      if (priorHash && priorHash !== certificate.hash) {
+        const previous = db.prepare("SELECT trust_settings FROM certificates WHERE sha256hash_hex=?").get(priorHash);
+        if (previous && !Buffer.from(previous.trust_settings).equals(metadata)) throw new Error("Previous prediction trust was modified; it was preserved");
+        db.prepare("DELETE FROM certificates WHERE sha256hash_hex=?").run(priorHash);
+      }
+      if (!existing) db.prepare("INSERT INTO certificates VALUES(?,?,?)").run(certificate.hash, certificate.der, metadata);
+    }
+    db.exec("COMMIT");
+    return remove ? Boolean(existing) : !existing;
+  } catch (error) {
+    try { db.exec("ROLLBACK"); } catch {}
+    throw error;
+  } finally { db.close(); }
+}

package/src/native-prediction-state.mjs

@@ -0,0 +1,29 @@
+import { redactDiagnosticText } from "./diagnostic-text.mjs";
+import { operationErrorDetails } from "./operation-error.mjs";
+
+export function createPredictionState({ now = () => new Date().toISOString() } = {}) {
+  let state = { configured: false, bridge: "stopped", client_route: "unknown", candidate: "unknown", reason: null,
+    configuration: {}, counters: { configuration_responses: 0, modified: 0, tls_errors: 0, upstream_errors: 0 }, last_event_at: null };
+  return {
+    configure(enabled) { state.configured = enabled === true; },
+    running(proxy) { state.bridge = "running"; state.reason = null; state.proxy = proxy; },
+    stopped() { state.bridge = "stopped"; },
+    unavailable(error) {
+      state.bridge = "unavailable";
+      state.reason = redactDiagnosticText(String(error?.message || "Prediction setup failed")).slice(0, 400);
+      state.error = operationErrorDetails(error);
+    },
+    event(event) {
+      state.last_event_at = now();
+      if (event.type === "configuration") {
+        state.client_route = "observed";
+        state.counters.configuration_responses++;
+        if (event.changed) state.counters.modified++;
+        state.configuration[event.route] = { status: event.status, modified: event.changed === true, official: event.official === true };
+      } else if (event.type === "tls_error") state.counters.tls_errors++;
+      else if (event.type === "upstream_error") state.counters.upstream_errors++;
+      if (event.error) state.last_error = { code: event.error.code, source: event.error.source, message: event.error.message, status: event.error.status };
+    },
+    snapshot() { return structuredClone(state); },
+  };
+}

package/src/native-prediction-transport.mjs

@@ -0,0 +1,255 @@
+import http from "node:http";
+import https from "node:https";
+import { promisify } from "node:util";
+import { gunzip, inflate, brotliDecompress } from "node:zlib";
+import { networkPredictionPac } from "./network-route.mjs";
+import { operationErrorDetails } from "./operation-error.mjs";
+
+export const PREDICTION_HOSTS = Object.freeze(["chatgpt.com", "ab.chatgpt.com"]);
+const CONFIG_LIMIT = 16 * 1024 * 1024;
+const REQUEST_LIMIT = 512 * 1024;
+const decoders = { gzip: promisify(gunzip), deflate: promisify(inflate), br: promisify(brotliDecompress) };
+
+export function predictionRoute(host, pathname) {
+  if (host === "chatgpt.com" && pathname === "/backend-api/wham/statsig/bootstrap") return "bootstrap";
+  if (host === "chatgpt.com" && pathname === "/backend-api/wham/predictions/config") return "prediction";
+  if (host === "ab.chatgpt.com" && pathname === "/v1/initialize") return "refresh";
+  return null;
+}
+
+export function predictionPac(port, networkRoute) {
+  if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error("Invalid prediction proxy port");
+  if (networkRoute) return networkPredictionPac(port, networkRoute);
+  return `function FindProxyForURL(url, host) { if (url.indexOf('https:') === 0 && (host === 'chatgpt.com' || host === 'ab.chatgpt.com')) return 'PROXY 127.0.0.1:${port}; DIRECT'; return 'DIRECT'; }\n`;
+}
+
+function cleanHeaders(headers) {
+  const result = { ...headers };
+  for (const name of String(headers.connection || "").split(",")) delete result[name.trim().toLowerCase()];
+  for (const name of ["connection", "proxy-authorization", "proxy-authenticate", "keep-alive", "te", "trailer", "transfer-encoding", "upgrade"]) delete result[name];
+  return result;
+}
+
+function changedHeaders(headers, length) {
+  const result = cleanHeaders(headers);
+  for (const name of ["content-encoding", "etag", "content-md5", "digest", "content-digest"]) delete result[name];
+  result["content-length"] = String(length);
+  result["cache-control"] = "no-store";
+  return result;
+}
+
+async function decode(bytes, encoding, limit) {
+  if (!encoding || encoding === "identity") return bytes;
+  if (!decoders[encoding]) throw new Error("Unsupported configuration encoding");
+  return decoders[encoding](bytes, { maxOutputLength: limit });
+}
+
+function listen(server) {
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      server.removeListener("error", reject);
+      resolve(server.address().port);
+    });
+  });
+}
+
+// Only selected configuration bodies are buffered. Other traffic is streamed,
+// without retries, redirects, credential storage or request/response logging.
+export async function startPredictionTransport({
+  key, cert, overlay, normalizeRequest = (value) => value,
+  enabled = () => true, requestImpl = https.request,
+  agent, networkRoute, onEvent = () => {},
+  timeoutMs = 30_000, maxConnections = 128,
+}) {
+  const sockets = new Set();
+  const upstreams = new Set();
+  let closing = false;
+  const gateway = https.createServer({ key, cert, minVersion: "TLSv1.2" }, (req, res) => {
+    let target;
+    try {
+      target = new URL(req.url, `https://${req.headers.host}`);
+      if (!PREDICTION_HOSTS.includes(target.hostname) || target.port || target.protocol !== "https:"
+        || target.username || target.password || !req.url.startsWith("/") || req.url.startsWith("//")
+        || req.headers.host !== target.hostname || req.socket.servername !== target.hostname) throw new Error("Invalid target");
+    } catch {
+      res.writeHead(403); res.end(); return;
+    }
+    const route = predictionRoute(target.hostname, target.pathname);
+    const headers = cleanHeaders(req.headers);
+    // No decoding/re-encoding on pass-through paths.
+    if (route && enabled()) headers["accept-encoding"] = "identity";
+    let upstream;
+    const fail = (error) => {
+      onEvent({ type: "upstream_error", error: operationErrorDetails(error) });
+      if (!res.headersSent) { res.writeHead(502); res.end(); } else res.destroy();
+    };
+    const send = (body, streamRemainder = false) => {
+      if (res.destroyed || closing) return;
+      upstream = requestImpl({
+        protocol: "https:", hostname: target.hostname, port: 443,
+        servername: target.hostname, method: req.method,
+        path: req.url, headers,
+        rejectUnauthorized: true,
+        ...(agent ? { agent } : {}),
+      }, (reply) => {
+        const pass = () => {
+          res.writeHead(reply.statusCode, cleanHeaders(reply.headers));
+          reply.pipe(res);
+        };
+        reply.on("error", fail);
+        // Error and non-JSON responses are forwarded as received. The overlay
+        // decides whether the narrowly allowed missing-config response applies.
+        const mediaType = String(reply.headers["content-type"] || "").split(";", 1)[0].trim();
+        if (!route || !enabled() || mediaType !== "application/json") {
+          if (route) onEvent({ type: "configuration", route, status: reply.statusCode, changed: false });
+          pass(); return;
+        }
+        let size = 0;
+        const parts = [];
+        let streaming = false;
+        reply.on("data", (chunk) => {
+          if (streaming) return;
+          parts.push(chunk); size += chunk.length;
+          if (size > CONFIG_LIMIT) {
+            streaming = true;
+            res.writeHead(reply.statusCode, cleanHeaders(reply.headers));
+            reply.pause();
+            const buffered = Buffer.concat(parts); parts.length = 0;
+            if (res.write(buffered)) reply.pipe(res);
+            else res.once("drain", () => reply.pipe(res));
+          }
+        });
+        reply.on("end", () => void (async () => {
+          if (streaming || res.destroyed) return;
+          const original = Buffer.concat(parts);
+          let next = null;
+          try {
+            const decoded = await decode(original, reply.headers["content-encoding"], CONFIG_LIMIT);
+            if (decoded.length <= CONFIG_LIMIT) next = overlay({
+              route, host: target.hostname, pathname: target.pathname,
+              status: reply.statusCode, body: decoded.toString("utf8"),
+              enabled: enabled(),
+            });
+          } catch { /* Preserve unexpected upstream payloads byte-for-byte. */ }
+          if (next?.body !== undefined && (next.body !== original.toString("utf8") || next.status !== reply.statusCode)) {
+            onEvent({ type: "configuration", route, status: next.status ?? reply.statusCode, changed: true });
+            const bytes = Buffer.from(next.body);
+            res.writeHead(next.status ?? reply.statusCode, changedHeaders(reply.headers, bytes.length));
+            res.end(bytes);
+          } else {
+            onEvent({ type: "configuration", route, status: reply.statusCode, changed: false, official: next?.official });
+            res.writeHead(reply.statusCode, cleanHeaders(reply.headers)); res.end(original);
+          }
+        })().catch(fail));
+      });
+      upstreams.add(upstream);
+      upstream.once("close", () => upstreams.delete(upstream));
+      if (route && enabled()) upstream.setTimeout(timeoutMs, () => upstream.destroy(new Error("Upstream timeout")));
+      upstream.on("error", fail);
+      if (streamRemainder) {
+        if (upstream.write(body)) req.pipe(upstream);
+        else upstream.once("drain", () => req.pipe(upstream));
+      } else if (body !== undefined) upstream.end(body); else req.pipe(upstream);
+    };
+    req.on("aborted", () => upstream?.destroy());
+    req.on("error", () => upstream?.destroy());
+    res.on("close", () => { if (!res.writableFinished) upstream?.destroy(); });
+    if (route !== "refresh" || req.method !== "POST" || !enabled()) { send(); return; }
+    // Statsig deltas use a checksum of prior values. Ask for a complete response
+    // so the client never merges an upstream delta with locally changed values.
+    void (async () => {
+      const parts = []; let size = 0;
+      for await (const part of req.iterator({ destroyOnReturn: false })) {
+        size += part.length;
+        parts.push(part);
+        if (size > REQUEST_LIMIT) { send(Buffer.concat(parts), true); return; }
+      }
+      let body = Buffer.concat(parts);
+      try {
+        const decoded = await decode(body, headers["content-encoding"], REQUEST_LIMIT);
+        const encoded = target.searchParams.get("se") === "1";
+        const text = encoded ? Buffer.from(decoded.toString().split("").reverse().join(""), "base64").toString() : decoded.toString();
+        const parsed = JSON.parse(text);
+        const normalized = normalizeRequest(parsed);
+        if (normalized !== parsed) {
+          const json = JSON.stringify(normalized);
+          body = Buffer.from(encoded ? Buffer.from(json).toString("base64").split("").reverse().join("") : json);
+          delete headers["content-encoding"];
+          headers["content-length"] = String(body.length);
+        }
+      } catch { /* Unknown request encoding stays untouched. */ }
+      send(body);
+    })().catch(fail);
+  });
+  gateway.on("secureConnection", (socket) => socket.setTimeout(0));
+  gateway.on("upgrade", (req, socket, head) => {
+    const host = req.headers.host;
+    if (!PREDICTION_HOSTS.includes(host) || req.socket.servername !== host
+      || !req.url.startsWith("/") || req.url.startsWith("//")) { socket.destroy(); return; }
+    const upstream = requestImpl({
+      protocol: "https:", hostname: host, port: 443, servername: host,
+      method: req.method, path: req.url, rejectUnauthorized: true,
+      ...(agent ? { agent } : {}),
+      headers: { ...cleanHeaders(req.headers), connection: "Upgrade", upgrade: req.headers.upgrade },
+    });
+    upstreams.add(upstream);
+    upstream.on("error", () => socket.destroy());
+    upstream.on("response", (reply) => {
+      const headers = Object.entries(cleanHeaders(reply.headers)).flatMap(([name, values]) =>
+        (Array.isArray(values) ? values : [values]).map((value) => `${name}: ${value}`));
+      socket.write(`HTTP/1.1 ${reply.statusCode} ${reply.statusMessage}\r\n${headers.join("\r\n")}\r\nConnection: close\r\n\r\n`);
+      reply.on("error", () => socket.destroy()); reply.pipe(socket);
+    });
+    upstream.on("upgrade", (reply, peer, peerHead) => {
+      upstreams.delete(upstream);
+      sockets.add(peer); peer.once("close", () => sockets.delete(peer));
+      const headers = Object.entries(reply.headers).flatMap(([name, values]) =>
+        (Array.isArray(values) ? values : [values]).map((value) => `${name}: ${value}`));
+      socket.write(`HTTP/1.1 ${reply.statusCode} ${reply.statusMessage}\r\n${headers.join("\r\n")}\r\n\r\n`);
+      if (peerHead.length) socket.write(peerHead);
+      if (head.length) peer.write(head);
+      socket.on("error", () => peer.destroy()); peer.on("error", () => socket.destroy());
+      socket.once("close", () => peer.destroy()); peer.once("close", () => socket.destroy());
+      socket.pipe(peer); peer.pipe(socket);
+    });
+    socket.once("close", () => { upstreams.delete(upstream); upstream.destroy(); });
+    upstream.end();
+  });
+  gateway.on("tlsClientError", (error, socket) => { onEvent({ type: "tls_error", error: operationErrorDetails(error) }); socket.destroy(); });
+  gateway.on("clientError", (_error, socket) => socket.destroy());
+  const proxy = http.createServer((req, res) => {
+    if (req.method === "GET" && req.url === "/proxy.pac" && !req.headers.origin
+      && ["127.0.0.1", "localhost"].includes(String(req.headers.host || "").split(":")[0])) {
+      res.writeHead(200, { "Content-Type": "application/x-ns-proxy-autoconfig", "Cache-Control": "no-store" });
+      res.end(predictionPac(proxy.address().port, networkRoute)); return;
+    }
+    res.writeHead(403); res.end();
+  });
+  proxy.on("connection", (socket) => {
+    if (closing || sockets.size >= maxConnections) { socket.destroy(); return; }
+    sockets.add(socket); socket.once("close", () => sockets.delete(socket));
+  });
+  proxy.on("connect", (req, socket, head) => {
+    if (closing || !PREDICTION_HOSTS.some((host) => req.url === `${host}:443`) || req.headers.origin) {
+      socket.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n"); return;
+    }
+    socket.setTimeout(timeoutMs, () => socket.destroy());
+    socket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+    if (head.length) socket.unshift(head);
+    gateway.emit("connection", socket);
+  });
+  proxy.on("clientError", (_error, socket) => socket.destroy());
+  const port = await listen(proxy);
+  return {
+    port, pacUrl: `http://127.0.0.1:${port}/proxy.pac`,
+    async close() {
+      closing = true;
+      for (const upstream of upstreams) upstream.destroy();
+      agent?.destroy();
+      for (const socket of sockets) socket.destroy();
+      await new Promise((resolve) => proxy.close(resolve));
+      gateway.close();
+    },
+  };
+}

package/src/native-prediction.mjs

@@ -0,0 +1,170 @@
+import fs from "node:fs";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import { predictionPaths, readPredictionSettings, writePredictionSettings, assertPredictionProxyCompatible,
+  assertCodexClosed, installedPredictionApp, predictionAppMatches, readPredictionCertificate,
+  createPredictionCertificate, updatePredictionTrust } from "./native-prediction-profile.mjs";
+import { retirePredictionIntegration } from "./prediction-retirement.mjs";
+import { networkRouteSnapshot } from "./network-route.mjs";
+import { withFileLock } from "./lock.mjs";
+
+function systemProxy(exec = execFileSync) {
+  return exec("/usr/sbin/scutil", ["--proxy"], { encoding: "utf8", timeout: 2000, maxBuffer: 64 * 1024 });
+}
+
+function certificateDirectory(settings, paths) {
+  if (!settings.credentialsDirectory) return paths.directory;
+  const directory = path.resolve(settings.credentialsDirectory);
+  if (path.dirname(directory) !== paths.directory || !/^credentials-[A-Za-z0-9]+$/.test(path.basename(directory))) {
+    throw new Error("Unexpected prediction key directory; it was not changed");
+  }
+  return directory;
+}
+
+export async function runPredictionCommand(options = {}) {
+  if (!options.action || options.action === "status") return runPredictionCommandUnlocked(options);
+  if ((options.platform || process.platform) !== "darwin") return runPredictionCommandUnlocked(options);
+  const { settings } = predictionPaths(options);
+  return withFileLock(`${settings}.lock`, () => runPredictionCommandUnlocked(options), { timeoutMs: 2000 });
+}
+
+async function runPredictionCommandUnlocked({ action = "status", env = process.env,
+  platform = process.platform, output = console.log, resolveApp = installedPredictionApp,
+  writeSettings = writePredictionSettings, runtimeSnapshot, ...options } = {}) {
+  const opts = { ...options, env };
+  const settings = readPredictionSettings(opts);
+  if (action === "status") {
+    output(`Native prediction preference: ${settings.enabled ? "on" : "off"} (default: off)`);
+    output("Uses the conversation's model. No prediction MCP, Hook, or panel.");
+    if (settings.enabled && !predictionAppMatches(settings.app)) output("Codex App changed; quit it and run ccdx prediction on to recheck compatibility.");
+    if (runtimeSnapshot) {
+      try {
+        const runtime = (await runtimeSnapshot())?.client_integrations?.prediction;
+        if (runtime) {
+          output(`Bridge: ${runtime.bridge}; client route: ${runtime.client_route}; visible candidate: ${runtime.candidate}`);
+          if (runtime.reason) output(runtime.reason);
+          for (const [name, event] of Object.entries(runtime.configuration || {})) output(`${name}: HTTP ${event.status}${event.modified ? " (local compatibility)" : " (upstream)"}`);
+        } else output("Runtime prediction state: unavailable; status is a saved preference, not proof of a visible suggestion.");
+      } catch { output("Runtime prediction state: unavailable; start ccdx and check again."); }
+    }
+    return settings;
+  }
+  if (!["on", "off"].includes(action)) throw new Error("Prediction action must be on, off, or status");
+  if (platform !== "darwin") throw new Error("Native prediction setup currently supports macOS only; no configuration changed");
+  const paths = predictionPaths(opts);
+  if (action === "off") {
+    // Disable the response overlay first, even when App-owned trust is busy.
+    if (settings.enabled) writeSettings({ ...settings, enabled: false }, opts);
+    if (settings.certificateHash && settings.store) {
+      try {
+        assertCodexClosed(options);
+        const certificate = readPredictionCertificate(certificateDirectory(settings, paths), { allowExpired: true });
+        if (certificate.hash !== settings.certificateHash) throw new Error("Prediction certificate changed; trust cleanup was skipped");
+        await updatePredictionTrust(settings.store, certificate, { remove: true });
+      } catch (error) {
+        output(`Predictions disabled. ${error.message}. Quit Codex and run ccdx prediction off again to finish cleanup.`);
+        return { ...settings, enabled: false, cleanupPending: true };
+      }
+    }
+    const { store, certificateHash, app, ...disabled } = settings;
+    if (store || certificateHash || app) writeSettings({ ...disabled, enabled: false }, opts);
+    try { retirePredictionIntegration(opts); }
+    catch (error) { output(`Legacy prediction cleanup skipped: ${error.message}`); }
+    output("Native predictions off. Restart Codex to clear cached predictions and its temporary route.");
+    return { ...settings, enabled: false };
+  }
+  assertCodexClosed(options);
+  assertPredictionProxyCompatible({ env, systemProxy: systemProxy(options.exec) });
+  const app = resolveApp(options);
+  if (settings.store && settings.store !== paths.store) throw new Error("Codex profile changed; disable the previous profile before enabling another");
+  let certificate, previous, generated = false;
+  let credentialsDirectory = certificateDirectory(settings, paths);
+  try { certificate = readPredictionCertificate(credentialsDirectory); }
+  catch (error) {
+    if (error.code !== "ENOENT" && !error.message.includes("needs renewal")) throw error;
+    if (settings.certificateHash) {
+      previous = readPredictionCertificate(credentialsDirectory, { allowExpired: true });
+      if (previous.hash !== settings.certificateHash) throw new Error("Existing prediction certificate changed; it was preserved");
+    }
+    fs.mkdirSync(paths.directory, { recursive: true, mode: 0o700 });
+    credentialsDirectory = fs.mkdtempSync(path.join(paths.directory, "credentials-"));
+    generated = true;
+    try { certificate = createPredictionCertificate(credentialsDirectory, options); }
+    catch (failure) { fs.rmSync(credentialsDirectory, { recursive: true, force: true }); throw failure; }
+  }
+  const next = { version: 1, enabled: true, app, store: paths.store, certificateHash: certificate.hash, credentialsDirectory };
+  let trustAdded = false;
+  try {
+    // Add the new trust before committing activation; retain the old record
+    // until the commit succeeds so a failed write cannot break an existing setup.
+    trustAdded = await updatePredictionTrust(paths.store, certificate);
+    writeSettings(next, opts);
+  }
+  catch (error) {
+    if (trustAdded) await updatePredictionTrust(paths.store, certificate, { remove: true }).catch(() => {});
+    if (generated) fs.rmSync(credentialsDirectory, { recursive: true, force: true });
+    throw error;
+  }
+  if (previous && previous.hash !== certificate.hash) {
+    await updatePredictionTrust(paths.store, previous, { remove: true });
+    const previousDirectory = certificateDirectory(settings, paths);
+    if (previousDirectory !== paths.directory) fs.rmSync(previousDirectory, { recursive: true, force: true });
+  }
+  try { retirePredictionIntegration(opts); }
+  catch (error) { output(`Legacy prediction cleanup skipped: ${error.message}`); }
+  output("Native predictions on. Restart ccdx to launch Codex with the local bridge.");
+  output("Only chatgpt.com and ab.chatgpt.com use the App-only route. Their HTTPS traffic is decrypted locally; only prediction configuration is changed. No credentials are stored, no system certificate is installed, and client program files are unchanged.");
+  output("Existing official prediction configuration is preserved. The conversation's model generates predictions through your configured CCDX API.");
+  return next;
+}
+
+export async function startNativePrediction({ env = process.env, platform = process.platform,
+  warning = () => {}, state, ...options } = {}) {
+  const opts = { ...options, env };
+  const settings = readPredictionSettings(opts);
+  state?.configure(settings.enabled);
+  if (!settings.enabled) return null;
+  if (platform !== "darwin") throw new Error("Native predictions were skipped: unsupported platform");
+  const networkRoute = assertPredictionProxyCompatible({ env, systemProxy: systemProxy(options.exec) });
+  if (!predictionAppMatches(settings.app)) throw new Error("Codex App changed; run ccdx prediction on after quitting it to recheck compatibility");
+  const paths = predictionPaths(opts);
+  if (settings.store !== paths.store || !fs.existsSync(paths.store)) throw new Error("Prediction profile trust is unavailable; run ccdx prediction on after quitting Codex");
+  const certificate = readPredictionCertificate(certificateDirectory(settings, paths));
+  if (certificate.hash !== settings.certificateHash) throw new Error("Prediction certificate changed; setup must be checked again");
+  const [{ startPredictionTransport }, { applyNativePredictionOverlay, normalizeStatsigRequest }, { createProxyAgent }] = await Promise.all([
+    import("./native-prediction-transport.mjs"), import("./native-prediction-overlay.mjs"),
+    import("./proxy-tunnel.mjs"),
+  ]);
+  // An in-memory switch is refreshed independently of request bodies and never
+  // touches the model path. A failed read turns off this optional overlay.
+  let enabled = true;
+  const timer = setInterval(() => {
+    try { enabled = readPredictionSettings(opts).enabled; state?.configure(enabled); }
+    catch { enabled = false; }
+  }, 1000);
+  timer.unref();
+  let transport;
+  try {
+    transport = await startPredictionTransport({ ...certificate, enabled: () => enabled,
+      networkRoute, agent: networkRoute.https ? createProxyAgent(networkRoute) : undefined,
+      onEvent: (event) => state?.event(event),
+      overlay: ({ host, pathname, status, body, enabled }) => {
+        const result = applyNativePredictionOverlay({ hostname: host, pathname, statusCode: status, body, enabled });
+        return result.changed ? { body: result.body, status: result.statusCode } : { official: result.official };
+      },
+      normalizeRequest: (parsed) => {
+        const result = normalizeStatsigRequest({ hostname: "ab.chatgpt.com", pathname: "/v1/initialize", body: JSON.stringify(parsed), enabled });
+        return result.changed ? JSON.parse(result.body) : parsed;
+      },
+    });
+  } catch (error) { clearInterval(timer); throw error; }
+  state?.running(networkRouteSnapshot(networkRoute));
+  warning("Native prediction bridge enabled; only the two configuration hosts use its App-only route.");
+  warning("If Codex is already running, quit it and run ccdx again to apply the route.");
+  return {
+    app: settings.app.app,
+    pacUrl: transport.pacUrl,
+    args: [`--proxy-pac-url=${transport.pacUrl}`],
+    async close() { clearInterval(timer); await transport.close(); state?.stopped(); },
+  };
+}