codex-copilot-dx 0.9.24 → 0.9.25

package/src/dashboard/language.js

@@ -1,5 +1,18 @@
 (() => {
   const translations = {
+    "CLIENT FEATURES": ["CLIENT FEATURES", "接入能力"],
+    "OBSERVED STATE": ["OBSERVED STATE", "实际状态"],
+    "Native predictions": ["Native predictions", "输入建议"],
+    "Local bridge": ["Local bridge", "本地接入"],
+    "Client route": ["Client route", "配置请求"],
+    "Visible candidate": ["Visible candidate", "显示结果"],
+    "Configured does not mean displayed. Use ccdx prediction status for details.": ["Enabled is not proof of a visible suggestion. Check ccdx prediction status.", "开启不等于已显示。\n终端命令可查看详情。"],
+    "Enabled": ["Enabled", "已开启"],
+    "Disabled": ["Disabled", "已关闭"],
+    "Running": ["Running", "运行中"],
+    "Stopped": ["Stopped", "未运行"],
+    "Unavailable": ["Unavailable", "不可用"],
+    "Observed": ["Observed", "已收到配置请求"],
     "First output": ["First output", "首次输出"],
     "Token time": ["Token time", "输出耗时"],
     "Gateway timing. Token time is estimated.": ["Observed at the gateway. Token time is an estimate.", "网关观测时间。\n每Token耗时为估算值。"],

package/src/dashboard/ui.js

@@ -168,6 +168,15 @@ function render(data) {
 
   renderFailures(data.response_failures?.recent, data.stream_performance?.recent_requests);
   renderContext(data.stream_performance);
+  if (element("prediction-preference")) {
+    const prediction = data.client_integrations?.prediction;
+    text("prediction-preference", prediction ? prediction.configured ? "Enabled" : "Disabled" : "Unknown");
+    text("prediction-bridge", ({ running: "Running", stopped: "Stopped", unavailable: "Unavailable" })[prediction?.bridge] || "Unknown");
+    text("prediction-route", prediction?.client_route === "observed" ? "Observed" : "Unknown");
+    text("prediction-candidate", "Unknown");
+    const note = element("prediction-note");
+    if (note) note.textContent = prediction?.reason || "";
+  }
   text("updated", "Snapshot {time}", { time: new Date().toLocaleTimeString() });
 }
 

package/src/lock.mjs

@@ -6,6 +6,35 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
+// Synchronous configuration writers share the same cross-process lock format.
+// Readers never take the lock. A live lock is never stolen on timeout.
+export function withFileLockSync(lockPath, fn, { timeoutMs = 1000, staleMs = 60_000 } = {}) {
+  fs.mkdirSync(path.dirname(lockPath), { recursive: true, mode: 0o700 });
+  const started = Date.now(), owner = randomUUID();
+  const sleeper = new Int32Array(new SharedArrayBuffer(4));
+  while (true) {
+    if (lockPathExists(reclaimGuardPath(lockPath), fs)) {
+      if (Date.now() - started >= timeoutMs) throw new Error("Configuration lock recovery is in progress; retry shortly");
+      Atomics.wait(sleeper, 0, 0, 10);
+      continue;
+    }
+    try {
+      const fd = writeLockRecord(lockPath, { pid: process.pid, owner, created_at: new Date().toISOString() }, fs);
+      fs.closeSync(fd);
+      if (lockPathExists(reclaimGuardPath(lockPath), fs)) { removeOwnedLock(lockPath, owner, fs); continue; }
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      if (maybeRemoveStaleLock(lockPath, staleMs, Date.now(), fs, processIsAlive)) continue;
+      let sameProcess = false;
+      try { sameProcess = readLockSnapshot(lockPath).pid === process.pid; } catch {}
+      if (sameProcess || Date.now() - started >= timeoutMs) throw new Error("Configuration is being updated by another operation; retry shortly");
+      Atomics.wait(sleeper, 0, 0, 10);
+    }
+  }
+  try { return fn(); } finally { removeOwnedLock(lockPath, owner, fs); }
+}
+
 function readLockSnapshot(lockPath) {
   const stat = fs.statSync(lockPath);
   let record = {};

package/src/native-prediction-profile.mjs

@@ -5,13 +5,14 @@ import { execFileSync } from "node:child_process";
 import { createHash, X509Certificate, createPrivateKey, createPublicKey } from "node:crypto";
 import { atomicWriteFileSync } from "./atomic-file.mjs";
 import { userSettingsPath } from "./user-settings.mjs";
+import { resolveNetworkRoute } from "./network-route.mjs";
+import { codexPaths } from "./codex-paths.mjs";
 
 export function predictionPaths({ env = process.env, home = os.homedir() } = {}) {
   const directory = path.join(path.dirname(userSettingsPath({ env, home })), "native-prediction");
-  const profile = env.CODEX_ELECTRON_USER_DATA_PATH?.trim()
-    || path.join(home, "Library", "Application Support", "Codex");
+  const { profile, certificateStore } = codexPaths({ env, home });
   return { directory, settings: path.join(directory, "settings.json"), profile,
-    store: path.join(profile, "Default", "ServerCertificate") };
+    store: certificateStore };
 }
 
 export function readPredictionSettings(options = {}) {
@@ -31,11 +32,7 @@ export function writePredictionSettings(value, options = {}) {
 }
 
 export function assertPredictionProxyCompatible({ env = process.env, systemProxy = "" } = {}) {
-  if (["HTTPS_PROXY", "HTTP_PROXY", "ALL_PROXY", "https_proxy", "http_proxy", "all_proxy", "CODEX_API_BASE_URL"]
-    .some((key) => env[key]?.trim())
-    || /(?:HTTPEnable|HTTPSEnable|SOCKSEnable|ProxyAutoConfigEnable|ProxyAutoDiscoveryEnable)\s*:\s*1/.test(systemProxy)) {
-    throw new Error("Native prediction setup skipped: an existing proxy or API route is configured; it was not replaced");
-  }
+  return resolveNetworkRoute({ env, systemProxy });
 }
 
 export function assertCodexClosed({ exec = execFileSync } = {}) {

package/src/native-prediction-state.mjs

@@ -0,0 +1,29 @@
+import { redactDiagnosticText } from "./diagnostic-text.mjs";
+import { operationErrorDetails } from "./operation-error.mjs";
+
+export function createPredictionState({ now = () => new Date().toISOString() } = {}) {
+  let state = { configured: false, bridge: "stopped", client_route: "unknown", candidate: "unknown", reason: null,
+    configuration: {}, counters: { configuration_responses: 0, modified: 0, tls_errors: 0, upstream_errors: 0 }, last_event_at: null };
+  return {
+    configure(enabled) { state.configured = enabled === true; },
+    running(proxy) { state.bridge = "running"; state.reason = null; state.proxy = proxy; },
+    stopped() { state.bridge = "stopped"; },
+    unavailable(error) {
+      state.bridge = "unavailable";
+      state.reason = redactDiagnosticText(String(error?.message || "Prediction setup failed")).slice(0, 400);
+      state.error = operationErrorDetails(error);
+    },
+    event(event) {
+      state.last_event_at = now();
+      if (event.type === "configuration") {
+        state.client_route = "observed";
+        state.counters.configuration_responses++;
+        if (event.changed) state.counters.modified++;
+        state.configuration[event.route] = { status: event.status, modified: event.changed === true, official: event.official === true };
+      } else if (event.type === "tls_error") state.counters.tls_errors++;
+      else if (event.type === "upstream_error") state.counters.upstream_errors++;
+      if (event.error) state.last_error = { code: event.error.code, source: event.error.source, message: event.error.message, status: event.error.status };
+    },
+    snapshot() { return structuredClone(state); },
+  };
+}

package/src/native-prediction-transport.mjs

@@ -2,6 +2,8 @@ import http from "node:http";
 import https from "node:https";
 import { promisify } from "node:util";
 import { gunzip, inflate, brotliDecompress } from "node:zlib";
+import { networkPredictionPac } from "./network-route.mjs";
+import { operationErrorDetails } from "./operation-error.mjs";
 
 export const PREDICTION_HOSTS = Object.freeze(["chatgpt.com", "ab.chatgpt.com"]);
 const CONFIG_LIMIT = 16 * 1024 * 1024;
@@ -15,8 +17,9 @@ export function predictionRoute(host, pathname) {
   return null;
 }
 
-export function predictionPac(port) {
+export function predictionPac(port, networkRoute) {
   if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error("Invalid prediction proxy port");
+  if (networkRoute) return networkPredictionPac(port, networkRoute);
   return `function FindProxyForURL(url, host) { if (url.indexOf('https:') === 0 && (host === 'chatgpt.com' || host === 'ab.chatgpt.com')) return 'PROXY 127.0.0.1:${port}; DIRECT'; return 'DIRECT'; }\n`;
 }
 
@@ -56,6 +59,7 @@ function listen(server) {
 export async function startPredictionTransport({
   key, cert, overlay, normalizeRequest = (value) => value,
   enabled = () => true, requestImpl = https.request,
+  agent, networkRoute, onEvent = () => {},
   timeoutMs = 30_000, maxConnections = 128,
 }) {
   const sockets = new Set();
@@ -76,7 +80,8 @@ export async function startPredictionTransport({
     // No decoding/re-encoding on pass-through paths.
     if (route && enabled()) headers["accept-encoding"] = "identity";
     let upstream;
-    const fail = () => {
+    const fail = (error) => {
+      onEvent({ type: "upstream_error", error: operationErrorDetails(error) });
       if (!res.headersSent) { res.writeHead(502); res.end(); } else res.destroy();
     };
     const send = (body, streamRemainder = false) => {
@@ -86,6 +91,7 @@ export async function startPredictionTransport({
         servername: target.hostname, method: req.method,
         path: req.url, headers,
         rejectUnauthorized: true,
+        ...(agent ? { agent } : {}),
       }, (reply) => {
         const pass = () => {
           res.writeHead(reply.statusCode, cleanHeaders(reply.headers));
@@ -95,7 +101,10 @@ export async function startPredictionTransport({
         // Error and non-JSON responses are forwarded as received. The overlay
         // decides whether the narrowly allowed missing-config response applies.
         const mediaType = String(reply.headers["content-type"] || "").split(";", 1)[0].trim();
-        if (!route || !enabled() || mediaType !== "application/json") { pass(); return; }
+        if (!route || !enabled() || mediaType !== "application/json") {
+          if (route) onEvent({ type: "configuration", route, status: reply.statusCode, changed: false });
+          pass(); return;
+        }
         let size = 0;
         const parts = [];
         let streaming = false;
@@ -124,10 +133,12 @@ export async function startPredictionTransport({
             });
           } catch { /* Preserve unexpected upstream payloads byte-for-byte. */ }
           if (next?.body !== undefined && (next.body !== original.toString("utf8") || next.status !== reply.statusCode)) {
+            onEvent({ type: "configuration", route, status: next.status ?? reply.statusCode, changed: true });
             const bytes = Buffer.from(next.body);
             res.writeHead(next.status ?? reply.statusCode, changedHeaders(reply.headers, bytes.length));
             res.end(bytes);
           } else {
+            onEvent({ type: "configuration", route, status: reply.statusCode, changed: false, official: next?.official });
             res.writeHead(reply.statusCode, cleanHeaders(reply.headers)); res.end(original);
           }
         })().catch(fail));
@@ -179,6 +190,7 @@ export async function startPredictionTransport({
     const upstream = requestImpl({
       protocol: "https:", hostname: host, port: 443, servername: host,
       method: req.method, path: req.url, rejectUnauthorized: true,
+      ...(agent ? { agent } : {}),
       headers: { ...cleanHeaders(req.headers), connection: "Upgrade", upgrade: req.headers.upgrade },
     });
     upstreams.add(upstream);
@@ -204,13 +216,13 @@ export async function startPredictionTransport({
     socket.once("close", () => { upstreams.delete(upstream); upstream.destroy(); });
     upstream.end();
   });
-  gateway.on("tlsClientError", (_error, socket) => socket.destroy());
+  gateway.on("tlsClientError", (error, socket) => { onEvent({ type: "tls_error", error: operationErrorDetails(error) }); socket.destroy(); });
   gateway.on("clientError", (_error, socket) => socket.destroy());
   const proxy = http.createServer((req, res) => {
     if (req.method === "GET" && req.url === "/proxy.pac" && !req.headers.origin
       && ["127.0.0.1", "localhost"].includes(String(req.headers.host || "").split(":")[0])) {
       res.writeHead(200, { "Content-Type": "application/x-ns-proxy-autoconfig", "Cache-Control": "no-store" });
-      res.end(predictionPac(proxy.address().port)); return;
+      res.end(predictionPac(proxy.address().port, networkRoute)); return;
     }
     res.writeHead(403); res.end();
   });
@@ -234,6 +246,7 @@ export async function startPredictionTransport({
     async close() {
       closing = true;
       for (const upstream of upstreams) upstream.destroy();
+      agent?.destroy();
       for (const socket of sockets) socket.destroy();
       await new Promise((resolve) => proxy.close(resolve));
       gateway.close();

package/src/native-prediction.mjs

@@ -5,6 +5,8 @@ import { predictionPaths, readPredictionSettings, writePredictionSettings, asser
   assertCodexClosed, installedPredictionApp, predictionAppMatches, readPredictionCertificate,
   createPredictionCertificate, updatePredictionTrust } from "./native-prediction-profile.mjs";
 import { retirePredictionIntegration } from "./prediction-retirement.mjs";
+import { networkRouteSnapshot } from "./network-route.mjs";
+import { withFileLock } from "./lock.mjs";
 
 function systemProxy(exec = execFileSync) {
   return exec("/usr/sbin/scutil", ["--proxy"], { encoding: "utf8", timeout: 2000, maxBuffer: 64 * 1024 });
@@ -19,15 +21,32 @@ function certificateDirectory(settings, paths) {
   return directory;
 }
 
-export async function runPredictionCommand({ action = "status", env = process.env,
+export async function runPredictionCommand(options = {}) {
+  if (!options.action || options.action === "status") return runPredictionCommandUnlocked(options);
+  if ((options.platform || process.platform) !== "darwin") return runPredictionCommandUnlocked(options);
+  const { settings } = predictionPaths(options);
+  return withFileLock(`${settings}.lock`, () => runPredictionCommandUnlocked(options), { timeoutMs: 2000 });
+}
+
+async function runPredictionCommandUnlocked({ action = "status", env = process.env,
   platform = process.platform, output = console.log, resolveApp = installedPredictionApp,
-  writeSettings = writePredictionSettings, ...options } = {}) {
+  writeSettings = writePredictionSettings, runtimeSnapshot, ...options } = {}) {
   const opts = { ...options, env };
   const settings = readPredictionSettings(opts);
   if (action === "status") {
     output(`Native prediction preference: ${settings.enabled ? "on" : "off"} (default: off)`);
     output("Uses the conversation's model. No prediction MCP, Hook, or panel.");
     if (settings.enabled && !predictionAppMatches(settings.app)) output("Codex App changed; quit it and run ccdx prediction on to recheck compatibility.");
+    if (runtimeSnapshot) {
+      try {
+        const runtime = (await runtimeSnapshot())?.client_integrations?.prediction;
+        if (runtime) {
+          output(`Bridge: ${runtime.bridge}; client route: ${runtime.client_route}; visible candidate: ${runtime.candidate}`);
+          if (runtime.reason) output(runtime.reason);
+          for (const [name, event] of Object.entries(runtime.configuration || {})) output(`${name}: HTTP ${event.status}${event.modified ? " (local compatibility)" : " (upstream)"}`);
+        } else output("Runtime prediction state: unavailable; status is a saved preference, not proof of a visible suggestion.");
+      } catch { output("Runtime prediction state: unavailable; start ccdx and check again."); }
+    }
     return settings;
   }
   if (!["on", "off"].includes(action)) throw new Error("Prediction action must be on, off, or status");
@@ -100,34 +119,38 @@ export async function runPredictionCommand({ action = "status", env = process.en
 }
 
 export async function startNativePrediction({ env = process.env, platform = process.platform,
-  warning = () => {}, ...options } = {}) {
+  warning = () => {}, state, ...options } = {}) {
   const opts = { ...options, env };
   const settings = readPredictionSettings(opts);
+  state?.configure(settings.enabled);
   if (!settings.enabled) return null;
   if (platform !== "darwin") throw new Error("Native predictions were skipped: unsupported platform");
-  assertPredictionProxyCompatible({ env, systemProxy: systemProxy(options.exec) });
+  const networkRoute = assertPredictionProxyCompatible({ env, systemProxy: systemProxy(options.exec) });
   if (!predictionAppMatches(settings.app)) throw new Error("Codex App changed; run ccdx prediction on after quitting it to recheck compatibility");
   const paths = predictionPaths(opts);
   if (settings.store !== paths.store || !fs.existsSync(paths.store)) throw new Error("Prediction profile trust is unavailable; run ccdx prediction on after quitting Codex");
   const certificate = readPredictionCertificate(certificateDirectory(settings, paths));
   if (certificate.hash !== settings.certificateHash) throw new Error("Prediction certificate changed; setup must be checked again");
-  const [{ startPredictionTransport }, { applyNativePredictionOverlay, normalizeStatsigRequest }] = await Promise.all([
+  const [{ startPredictionTransport }, { applyNativePredictionOverlay, normalizeStatsigRequest }, { createProxyAgent }] = await Promise.all([
     import("./native-prediction-transport.mjs"), import("./native-prediction-overlay.mjs"),
+    import("./proxy-tunnel.mjs"),
   ]);
   // An in-memory switch is refreshed independently of request bodies and never
   // touches the model path. A failed read turns off this optional overlay.
   let enabled = true;
   const timer = setInterval(() => {
-    try { enabled = readPredictionSettings(opts).enabled; }
+    try { enabled = readPredictionSettings(opts).enabled; state?.configure(enabled); }
     catch { enabled = false; }
   }, 1000);
   timer.unref();
   let transport;
   try {
     transport = await startPredictionTransport({ ...certificate, enabled: () => enabled,
+      networkRoute, agent: networkRoute.https ? createProxyAgent(networkRoute) : undefined,
+      onEvent: (event) => state?.event(event),
       overlay: ({ host, pathname, status, body, enabled }) => {
         const result = applyNativePredictionOverlay({ hostname: host, pathname, statusCode: status, body, enabled });
-        return result.changed ? { body: result.body, status: result.statusCode } : null;
+        return result.changed ? { body: result.body, status: result.statusCode } : { official: result.official };
       },
       normalizeRequest: (parsed) => {
         const result = normalizeStatsigRequest({ hostname: "ab.chatgpt.com", pathname: "/v1/initialize", body: JSON.stringify(parsed), enabled });
@@ -135,12 +158,13 @@ export async function startNativePrediction({ env = process.env, platform = proc
       },
     });
   } catch (error) { clearInterval(timer); throw error; }
+  state?.running(networkRouteSnapshot(networkRoute));
   warning("Native prediction bridge enabled; only the two configuration hosts use its App-only route.");
   warning("If Codex is already running, quit it and run ccdx again to apply the route.");
   return {
     app: settings.app.app,
     pacUrl: transport.pacUrl,
     args: [`--proxy-pac-url=${transport.pacUrl}`],
-    async close() { clearInterval(timer); await transport.close(); },
+    async close() { clearInterval(timer); await transport.close(); state?.stopped(); },
   };
 }

package/src/network-route.mjs

@@ -0,0 +1,102 @@
+import net from "node:net";
+
+const OFFICIAL_API = "https://chatgpt.com/backend-api";
+
+function proxy(value, source) {
+  if (!value) return null;
+  let url;
+  try { url = new URL(value); } catch { throw new Error(`Invalid proxy address in ${source}`); }
+  if (!["http:", "https:", "socks5:", "socks5h:"].includes(url.protocol)
+    || !url.hostname || !["", "/"].includes(url.pathname) || url.search || url.hash) {
+    throw new Error(`Unsupported proxy address in ${source}; expected HTTP, HTTPS or SOCKS5`);
+  }
+  return { url, source };
+}
+
+function variable(env, lower, upper) {
+  const key = String(env[lower] || "").trim() ? lower : upper;
+  return { value: String(env[key] || "").trim(), source: key };
+}
+
+export function resolveNetworkRoute({ env = process.env, systemProxy = "", checkApi = true } = {}) {
+  const api = String(env.CODEX_API_BASE_URL || "").trim().replace(/\/+$/, "");
+  if (checkApi && api && api !== OFFICIAL_API) {
+    throw new Error("Native prediction setup skipped: CODEX_API_BASE_URL selects a custom API route; it was preserved");
+  }
+  const settings = Object.fromEntries([...systemProxy.matchAll(/^\s*([A-Za-z]+)\s*:\s*(.+?)\s*$/gm)].map((m) => [m[1], m[2]]));
+  for (const key of ["ProxyAutoConfigEnable", "ProxyAutoDiscoveryEnable"]) {
+    if (settings[key] === "1") throw new Error(`Native prediction setup skipped: system ${key === "ProxyAutoConfigEnable" ? "PAC" : "WPAD"} (${key}) needs dynamic routing; its rules were preserved`);
+  }
+  const system = (prefix, scheme) => {
+    if (settings[`${prefix}Enable`] !== "1") return null;
+    const host = settings[`${prefix}Proxy`], port = settings[`${prefix}Port`];
+    if (!host || !/^\d+$/.test(port || "") || Number(port) < 1 || Number(port) > 65535) {
+      throw new Error(`Invalid system ${prefix} proxy settings`);
+    }
+    return proxy(`${scheme}://${net.isIP(host) === 6 ? `[${host}]` : host}:${port}`, `system ${prefix}`);
+  };
+  const httpEnv = variable(env, "http_proxy", "HTTP_PROXY"), httpsEnv = variable(env, "https_proxy", "HTTPS_PROXY");
+  const allEnv = variable(env, "all_proxy", "ALL_PROXY");
+  const all = proxy(allEnv.value, allEnv.source);
+  const systemSocks = system("SOCKS", "socks5");
+  const systemHttp = system("HTTP", "http"), systemHttps = system("HTTPS", "http");
+  const http = proxy(httpEnv.value, httpEnv.source) || all || systemHttp || systemSocks;
+  const https = proxy(httpsEnv.value, httpsEnv.source) || all || systemHttps || systemSocks;
+  const noProxy = variable(env, "no_proxy", "NO_PROXY").value;
+  const exceptions = /ExceptionsList\s*:\s*<array>\s*\{([^}]+)\}/.exec(systemProxy)?.[1] || "";
+  const bypass = [...new Set([...noProxy.split(","), ...[...exceptions.matchAll(/\d+\s*:\s*([^\n]+)/g)].map((m) => m[1])]
+    .map((s) => s.trim().toLowerCase()).filter(Boolean))];
+  if (bypass.some((rule) => rule.includes("/"))) throw new Error("Unsupported proxy bypass CIDR rule in NO_PROXY or system exceptions; existing routes were preserved");
+  return { http, https, bypass, excludeSimple: settings.ExcludeSimpleHostnames === "1" };
+}
+
+export function bypassNetworkProxy(hostname, port, plan) {
+  const host = hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  if (["localhost", "127.0.0.1", "::1"].includes(host) || (plan.excludeSimple && !host.includes("."))) return true;
+  return plan.bypass.some((raw) => {
+    if (raw === "*") return true;
+    const match = /^(.*):(\d+)$/.exec(raw);
+    const rule = match ? match[1] : raw;
+    if (match && Number(match[2]) !== Number(port)) return false;
+    const suffix = rule.replace(/^\*?\./, "");
+    if (rule.includes("*")) {
+      const expression = rule.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replaceAll("*", ".*");
+      return new RegExp(`^${expression}$`).test(host);
+    }
+    return host === suffix || host.endsWith(`.${suffix}`);
+  });
+}
+
+export function networkProxyFor(url, plan) {
+  if (bypassNetworkProxy(url.hostname, url.port || (url.protocol === "https:" ? 443 : 80), plan)) return null;
+  return url.protocol === "https:" ? plan.https : plan.http;
+}
+
+export function networkRouteSnapshot(plan) {
+  const route = plan.https;
+  return { source: route?.source || "direct", type: route?.url.protocol.replace(":", "") || "direct",
+    bypass_rules: plan.bypass.length, proxy_credentials: Boolean(route?.url.username || route?.url.password) };
+}
+
+function pacProxy(route) {
+  if (!route) return "DIRECT";
+  const type = route.url.protocol.startsWith("socks5") ? "SOCKS5" : route.url.protocol === "https:" ? "HTTPS" : "PROXY";
+  const port = route.url.port || (type === "HTTPS" ? 443 : type === "SOCKS5" ? 1080 : 80);
+  return `${type} ${route.url.hostname}:${port}`;
+}
+
+export function networkPredictionPac(port, plan) {
+  if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error("Invalid prediction proxy port");
+  // Embed only routing rules, never proxy passwords or API credentials.
+  return `var ccdxRoute=${JSON.stringify({ http: pacProxy(plan.http), https: pacProxy(plan.https), bypass: plan.bypass, excludeSimple: plan.excludeSimple })};
+function FindProxyForURL(url,host) {
+  var secure=url.indexOf('https:')===0, p=secure?443:80;
+  var authority=url.split('/')[2]||'', explicit=/:([0-9]+)$/.exec(authority);if(explicit)p=Number(explicit[1]);
+  var skip=host==='localhost'||host==='127.0.0.1'||host==='::1'||(ccdxRoute.excludeSimple&&host.indexOf('.')<0);
+  for(var i=0;i<ccdxRoute.bypass.length&&!skip;i++){var raw=ccdxRoute.bypass[i],m=/^(.*):([0-9]+)$/.exec(raw),r=m?m[1]:raw;if(m&&Number(m[2])!==p)continue;
+    var suffix=r.indexOf('*.')===0?r.slice(2):r[0]==='.'?r.slice(1):r;skip=r==='*'||(r.indexOf('*')>=0?shExpMatch(host,r):host===suffix||dnsDomainIs(host,'.'+suffix));}
+  var original=skip?'DIRECT':secure?ccdxRoute.https:ccdxRoute.http;
+  if(secure&&(host==='chatgpt.com'||host==='ab.chatgpt.com'))return 'PROXY 127.0.0.1:${port}; '+original;
+  return original;
+}\n`;
+}

package/src/observability.mjs

@@ -159,6 +159,7 @@ export function runtimeStatusPayload({
   codexClient,
   codexModelRegistry,
   codexModelCatalog,
+  clientIntegrations,
 } = {}) {
   const memory = process.memoryUsage();
   const codexRuntime = safeClientRuntimeStatus(codexClient);
@@ -196,6 +197,7 @@ export function runtimeStatusPayload({
     response_history: history,
     image_optimization: imageOptimizationStats(),
     image_generation: imageGeneration || null,
+    client_integrations: clientIntegrations || null,
     logging: { usage: usageLoggingStats(), debug: debugLoggingStats() },
     image_history_pressure: imagePressure?.snapshot?.() || null,
     response_failures: responseFailures?.snapshot?.() || null,

package/src/operation-error.mjs

@@ -0,0 +1,37 @@
+import { redactDiagnosticText } from "./diagnostic-text.mjs";
+
+export function operationError(code, message, { status = null, retryAt = null } = {}) {
+  return Object.assign(new Error(message), { code, status, retryAt });
+}
+
+export function operationErrorDetails(error) {
+  const code = String(error?.code || error?.cause?.code || "unknown");
+  let source = "unknown";
+  if (/proxy/i.test(code)) source = "proxy";
+  else if (/cert|tls|ssl/i.test(code)) source = "tls";
+  else if (/timeout|abort/i.test(code) || error?.name === "AbortError" || error?.name === "TimeoutError") source = "timeout";
+  else if (/limit|429/.test(code)) source = "rate_limit";
+  else if (/config|format|route|redirect/.test(code)) source = "configuration";
+  else if (/HTTP|http/.test(code)) source = "upstream";
+  else if (/ENOTFOUND|ECONN|EAI_/.test(code)) source = "network";
+  return { code: /^[A-Za-z0-9_-]{1,80}$/.test(code) ? code : "unknown", source,
+    message: redactDiagnosticText(String(error?.message || "Operation failed")).slice(0, 400),
+    status: Number.isInteger(error?.status) ? error.status : null };
+}
+
+// Error classifiers consume decoded string fields; responses retain their
+// original bytes. Only escaped, bounded JSON errors need this extra work.
+export function errorEvidenceText(value) {
+  const text = String(value || "");
+  if (!text.includes("\\u") || text.length > 16 * 1024) return text;
+  try {
+    const strings = [];
+    const visit = (node, depth) => {
+      if (depth > 4 || strings.length >= 32) return;
+      if (typeof node === "string") strings.push(node);
+      else if (node && typeof node === "object") for (const child of Object.values(node)) visit(child, depth + 1);
+    };
+    visit(JSON.parse(text), 0);
+    return `${text}\n${strings.join("\n")}`;
+  } catch { return text; }
+}

package/src/package-update.mjs

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
 import { createInterface } from "node:readline/promises";
-import { fetchLatestRelease, githubReleaseVersion } from "./version.mjs";
+import { lookupLatestRelease, githubReleaseVersion } from "./version.mjs";
 
 const PACKAGE_NAME = "codex-copilot-dx";
 const UPDATE_SPECS = {
@@ -95,8 +95,7 @@ export async function runPackageUpdateCommand({
   let release;
   if (selectedSource === "github") {
     output.write("Checking the latest stable GitHub release...\n");
-    release = await fetchLatestRelease({ fetchImpl, timeoutMs: 10000 });
-    if (!release) throw new Error("Could not read the latest stable GitHub release. No update was installed.");
+    release = await lookupLatestRelease({ fetchImpl, timeoutMs: 10000 });
   }
   const update = globalUpdateCommand(selectedSource, { platform, releaseTag: release?.tagName });
   const sourceLabel = selectedSource === "npm" ? "npm registry" : `GitHub release ${release.tagName}`;

package/src/prediction-retirement.mjs

@@ -6,6 +6,8 @@ import { isDeepStrictEqual } from "node:util";
 import { atomicWriteFileIfChangedSync, atomicWriteFilePairSync } from "./atomic-file.mjs";
 import { codexTomlStatements, parseCodexToml, validateManagedConfigEdit } from "./config-toml.mjs";
 import { userSettingsPath } from "./user-settings.mjs";
+import { codexPaths } from "./codex-paths.mjs";
+import { withFileLockSync } from "./lock.mjs";
 
 const SERVER_PATH = ["mcp_servers", "ccdx_suggestion"];
 const same = (left, right) => isDeepStrictEqual(left, right);
@@ -52,9 +54,18 @@ export function computeRetiredPredictionConfig(content, filePath) {
   return { content: updated, changed: updated !== content, preserved: Boolean(existing && !owned) || (content.includes("# ccdx:suggestion-auto:start") && !hookOwned) };
 }
 
-export function retirePredictionIntegration({ env = process.env, home = os.homedir(), dryRun = false } = {}) {
+export function retirePredictionIntegration(options = {}) {
+  if (options.dryRun) return retirePredictionIntegrationUnlocked(options);
+  const { config } = codexPaths(options);
+  // No registration/settings means no lock directory or other write on startup.
+  const env = options.env || process.env;
+  const settings = path.resolve(env.CCDX_SUGGESTION_CONFIG || path.join(path.dirname(userSettingsPath(options)), "suggestion.json"));
+  if (!fs.existsSync(config) && !fs.existsSync(settings)) return { changed: false, preserved: false };
+  return withFileLockSync(`${config}.ccdx.lock`, () => retirePredictionIntegrationUnlocked(options));
+}
+function retirePredictionIntegrationUnlocked({ env = process.env, home = os.homedir(), dryRun = false } = {}) {
   const settings = path.resolve(env.CCDX_SUGGESTION_CONFIG || path.join(path.dirname(userSettingsPath({ env, home })), "suggestion.json"));
-  const codex = path.join(env.CODEX_HOME || path.join(home, ".codex"), "config.toml");
+  const codex = codexPaths({ env, home }).config;
   let content;
   try { content = new TextDecoder("utf-8", { fatal: true }).decode(fs.readFileSync(codex)); }
   catch (error) { if (error.code !== "ENOENT") throw new Error("Cannot safely read prediction configuration"); }