copilot-cursor-proxy 1.1.0 → 1.2.0

package/README.md

@@ -46,7 +46,7 @@ Copy the HTTPS URL (e.g., `https://xxxxx.trycloudflare.com`).
 
 ## 🏗 Architecture
 
-```
+```text
 Cursor → (HTTPS tunnel) → proxy-router (:4142) → copilot-api (:4141) → GitHub Copilot
 ```
 

package/auth-config.ts

@@ -20,15 +20,19 @@ const CONFIG_PATH = join(CONFIG_DIR, 'auth.json');
 
 const DEFAULT_CONFIG: AuthConfig = { requireApiKey: false, keys: [] };
 
+let cachedConfig: AuthConfig | null = null;
+
 export function loadAuthConfig(): AuthConfig {
+    if (cachedConfig) return cachedConfig;
     try {
         if (!existsSync(CONFIG_PATH)) return { ...DEFAULT_CONFIG, keys: [] };
         const raw = readFileSync(CONFIG_PATH, 'utf-8');
         const parsed = JSON.parse(raw);
-        return {
+        cachedConfig = {
             requireApiKey: !!parsed.requireApiKey,
             keys: Array.isArray(parsed.keys) ? parsed.keys : [],
         };
+        return cachedConfig;
     } catch {
         return { ...DEFAULT_CONFIG, keys: [] };
     }
@@ -37,6 +41,7 @@ export function loadAuthConfig(): AuthConfig {
 export function saveAuthConfig(config: AuthConfig): void {
     if (!existsSync(CONFIG_DIR)) mkdirSync(CONFIG_DIR, { recursive: true });
     writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2), 'utf-8');
+    cachedConfig = null; // Invalidate cache on write
 }
 
 function randomHex(bytes: number): string {

package/dashboard.html

@@ -354,10 +354,10 @@ tr:hover td { background: var(--bg-hover); }
 </div>
 
 <!-- Tabs -->
-<div class="tabs">
-    <div class="tab active" data-tab="endpoint">Endpoint</div>
-    <div class="tab" data-tab="usage">Usage</div>
-    <div class="tab" data-tab="console">Console Log</div>
+<div class="tabs" role="tablist">
+    <div class="tab active" data-tab="endpoint" role="tab" tabindex="0" aria-selected="true">Endpoint</div>
+    <div class="tab" data-tab="usage" role="tab" tabindex="0" aria-selected="false">Usage</div>
+    <div class="tab" data-tab="console" role="tab" tabindex="0" aria-selected="false">Console Log</div>
 </div>
 
 <!-- Content -->
@@ -374,10 +374,10 @@ tr:hover td { background: var(--bg-hover); }
                 </div>
             </div>
             <div class="card">
-                <div class="card-label">API Key</div>
+                <div class="card-label">API Key (copilot-api)</div>
                 <div class="copy-row">
-                    <div class="card-value mono">dummy</div>
-                    <button class="copy-btn" onclick="copyText('dummy',this)">Copy</button>
+                    <div class="card-value mono" id="upstream-key-display">Loading…</div>
+                    <button class="copy-btn" id="upstream-key-copy-btn" style="display:none" onclick="copyUpstreamKey(this)">Copy</button>
                 </div>
             </div>
             <div class="card" style="grid-column: 1 / -1">
@@ -388,10 +388,32 @@ tr:hover td { background: var(--bg-hover); }
             </div>
         </div>
 
+        <!-- Upstream (copilot-api) Keys -->
+        <div class="card" style="margin-bottom: 24px;">
+            <div style="display: flex; justify-content: space-between; align-items: center; margin-bottom: 16px;">
+                <h3 style="margin: 0; border: none; padding: 0;">Copilot API Keys</h3>
+                <button onclick="handleCreateUpstreamKey()" style="background: var(--accent); color: #000; border: none; padding: 8px 16px; border-radius: 6px; cursor: pointer; font-weight: 600; white-space: nowrap;">+ New Key</button>
+            </div>
+            <p style="color: #888; font-size: 13px; margin-bottom: 12px;">
+                Keys stored in copilot-api's <code style="color:var(--accent)">config.json</code>. The first key is used by the proxy for upstream requests.
+                <br><span style="color:var(--yellow);">Note:</span> New keys require a copilot-api restart to take effect.
+            </p>
+
+            <div id="newUpstreamKeyAlert" style="display: none; background: #1a2e1a; border: 1px solid #22c55e; border-radius: 8px; padding: 12px; margin-bottom: 16px;">
+                <div style="color: #22c55e; font-weight: 600; margin-bottom: 4px;">Copy this key now — it won't be shown in full again!</div>
+                <div style="display: flex; align-items: center; gap: 8px;">
+                    <code id="newUpstreamKeyValue" style="flex: 1; background: #111; padding: 8px; border-radius: 4px; font-size: 13px; color: #22c55e; word-break: break-all;"></code>
+                    <button onclick="copyText(document.getElementById('newUpstreamKeyValue').textContent, this)" style="background: #333; border: none; color: #fff; padding: 6px 12px; border-radius: 4px; cursor: pointer;">Copy</button>
+                </div>
+            </div>
+
+            <div id="upstreamKeysList"></div>
+        </div>
+
         <!-- API Key Management -->
         <div class="card" style="margin-bottom: 24px;">
             <div style="display: flex; justify-content: space-between; align-items: center; margin-bottom: 16px;">
-                <h3 style="margin: 0; border: none; padding: 0;">API Key Protection</h3>
+                <h3 style="margin: 0; border: none; padding: 0;">Proxy API Key Protection</h3>
                 <label class="toggle">
                     <input type="checkbox" id="requireKeyToggle" onchange="toggleRequireKey(this.checked)">
                     <span class="toggle-slider"></span>
@@ -537,13 +559,20 @@ tr:hover td { background: var(--bg-hover); }
 <script>
 /* ── Tab switching ──────────────────────────────────────────── */
 const tabs = document.querySelectorAll('.tab');
-tabs.forEach(t => t.addEventListener('click', () => {
-    tabs.forEach(x => x.classList.remove('active'));
+function switchTab(t) {
+    tabs.forEach(x => { x.classList.remove('active'); x.setAttribute('aria-selected', 'false'); });
     document.querySelectorAll('.tab-panel').forEach(p => p.classList.remove('active'));
     t.classList.add('active');
+    t.setAttribute('aria-selected', 'true');
     document.getElementById('tab-' + t.dataset.tab).classList.add('active');
     if (t.dataset.tab === 'usage') fetchUsage();
-}));
+}
+tabs.forEach(t => {
+    t.addEventListener('click', () => switchTab(t));
+    t.addEventListener('keydown', (e) => {
+        if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); switchTab(t); }
+    });
+});
 
 /* ── Helpers ────────────────────────────────────────────────── */
 function copyText(text, btn) {
@@ -578,7 +607,8 @@ function esc(s) {
 /* ── Tab 1: Models ──────────────────────────────────────────── */
 async function fetchModels() {
     try {
-        const res = await fetch('/v1/models');
+        // Fetch via /api/models to bypass API key auth for dashboard
+        const res = await fetch('/api/models');
         if (!res.ok) throw new Error('HTTP ' + res.status);
         const data = await res.json();
         const models = (data.data || []).sort((a, b) => a.id.localeCompare(b.id));
@@ -598,7 +628,9 @@ async function fetchModels() {
                 '<td><span class="model-badge">' + esc(m.id) + '</span></td>' +
                 '<td style="color:var(--text-dim)">' + esc(origId) + '</td>' +
                 '<td style="color:var(--text-dim)">' + esc(m.display_name || m.id) + '</td>' +
-                '<td><button class="copy-btn" onclick="copyText(\'' + esc(m.id).replace(/'/g, "\\'") + '\',this)">Copy</button></td>';
+                '<td><button class="copy-btn">Copy</button></td>';
+            const btn = tr.querySelector('.copy-btn');
+            btn.addEventListener('click', function() { copyText(m.id, this); });
             tbody.appendChild(tr);
         });
     } catch (e) {
@@ -607,6 +639,87 @@ async function fetchModels() {
 }
 fetchModels();
 
+/* ── Tab 1: Upstream (copilot-api) Keys ───────────────────── */
+let fullUpstreamKey = '';
+
+async function loadUpstreamKeys() {
+    try {
+        const resp = await fetch('/api/upstream-keys');
+        const data = await resp.json();
+        const display = document.getElementById('upstream-key-display');
+        const copyBtn = document.getElementById('upstream-key-copy-btn');
+
+        if (data.keys && data.keys.length > 0) {
+            display.textContent = data.keys[0];
+            copyBtn.style.display = '';
+        } else {
+            display.textContent = 'No keys configured';
+            display.style.color = 'var(--yellow)';
+        }
+
+        renderUpstreamKeys(data.keys || []);
+    } catch (e) {
+        document.getElementById('upstream-key-display').textContent = 'Failed to load';
+    }
+}
+
+function renderUpstreamKeys(maskedKeys) {
+    const list = document.getElementById('upstreamKeysList');
+    if (maskedKeys.length === 0) {
+        list.innerHTML = '<div style="color: #666; font-size: 13px; padding: 12px 0;">No API keys configured. Create one to authenticate with copilot-api.</div>';
+        return;
+    }
+    list.innerHTML = '';
+    maskedKeys.forEach((k, i) => {
+        const row = document.createElement('div');
+        row.style.cssText = 'display: flex; align-items: center; gap: 12px; padding: 10px 0; border-bottom: 1px solid #222;';
+        const badge = i === 0
+            ? '<span style="font-size:11px;padding:2px 8px;border-radius:10px;background:#1a2332;color:var(--accent);margin-left:8px;">Active</span>'
+            : '';
+        row.innerHTML =
+            '<div style="flex: 1; min-width: 0;">' +
+                '<code style="color: #aaa; font-size: 13px;">' + esc(k) + '</code>' + badge +
+            '</div>' +
+            '<button class="copy-btn" title="Copy masked key" onclick="copyText(\'' + esc(k) + '\', this)">Copy</button>' +
+            '<button style="background: none; border: none; color: #666; cursor: pointer; font-size: 16px; padding: 4px 8px;" title="Delete" data-key="' + esc(k) + '">🗑</button>';
+        row.querySelector('button[title="Delete"]').addEventListener('click', function() { handleDeleteUpstreamKey(this.dataset.key); });
+        list.appendChild(row);
+    });
+}
+
+function copyUpstreamKey(btn) {
+    const display = document.getElementById('upstream-key-display').textContent;
+    copyText(display, btn);
+}
+
+async function handleCreateUpstreamKey() {
+    try {
+        const resp = await fetch('/api/upstream-keys', { method: 'POST' });
+        const data = await resp.json();
+        if (data.key) {
+            document.getElementById('newUpstreamKeyAlert').style.display = 'block';
+            document.getElementById('newUpstreamKeyValue').textContent = data.key;
+            loadUpstreamKeys();
+        }
+    } catch (e) {
+        alert('Failed to create key: ' + e.message);
+    }
+}
+
+async function handleDeleteUpstreamKey(maskedKey) {
+    if (!confirm('Delete this copilot-api key?')) return;
+    const prefix = maskedKey.split('...')[0];
+    try {
+        await fetch('/api/upstream-keys/' + encodeURIComponent(prefix), { method: 'DELETE' });
+        document.getElementById('newUpstreamKeyAlert').style.display = 'none';
+        loadUpstreamKeys();
+    } catch (e) {
+        alert('Failed to delete key: ' + e.message);
+    }
+}
+
+loadUpstreamKeys();
+
 /* ── Tab 1: API Key Management ─────────────────────────────── */
 let authConfig = { requireApiKey: false, keys: [] };
 
@@ -631,10 +744,13 @@ function renderKeys() {
         list.innerHTML = '<div style="color: #666; font-size: 13px; padding: 12px 0;">No API keys created yet.</div>';
         return;
     }
-    list.innerHTML = authConfig.keys.map(k => `
-        <div style="display: flex; align-items: center; gap: 12px; padding: 10px 0; border-bottom: 1px solid #222;">
+    list.innerHTML = '';
+    authConfig.keys.forEach(k => {
+        const row = document.createElement('div');
+        row.style.cssText = 'display: flex; align-items: center; gap: 12px; padding: 10px 0; border-bottom: 1px solid #222;';
+        row.innerHTML = `
             <label class="toggle" style="flex-shrink: 0;">
-                <input type="checkbox" ${k.active ? 'checked' : ''} onchange="toggleKey('${esc(k.id)}', this.checked)">
+                <input type="checkbox" ${k.active ? 'checked' : ''}>
                 <span class="toggle-slider"></span>
             </label>
             <div style="flex: 1; min-width: 0;">
@@ -642,9 +758,12 @@ function renderKeys() {
                 <code style="color: #888; font-size: 12px;">${esc(k.key)}</code>
             </div>
             <div style="color: #666; font-size: 12px; white-space: nowrap;">${timeAgo(k.createdAt)}</div>
-            <button onclick="deleteKey('${esc(k.id)}')" style="background: none; border: none; color: #666; cursor: pointer; font-size: 16px; padding: 4px 8px;" title="Delete">🗑</button>
-        </div>
-    `).join('');
+            <button style="background: none; border: none; color: #666; cursor: pointer; font-size: 16px; padding: 4px 8px;" title="Delete">🗑</button>
+        `;
+        row.querySelector('input[type="checkbox"]').addEventListener('change', function() { toggleKey(k.id, this.checked); });
+        row.querySelector('button[title="Delete"]').addEventListener('click', function() { deleteKey(k.id); });
+        list.appendChild(row);
+    });
 }
 
 async function toggleRequireKey(enabled) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "copilot-cursor-proxy",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Proxy that bridges GitHub Copilot API to Cursor IDE — translates Anthropic format, bridges Responses API for GPT 5.x, and more",
   "bin": {
     "copilot-cursor-proxy": "bin/cli.js"
@@ -12,9 +12,9 @@
     "README.md"
   ],
   "scripts": {
-    "build": "bun build start.ts proxy-router.ts anthropic-transforms.ts responses-bridge.ts responses-converters.ts stream-proxy.ts debug-logger.ts auth-config.ts --outdir dist --target node",
+    "build": "bun build start.ts proxy-router.ts anthropic-transforms.ts responses-bridge.ts responses-converters.ts stream-proxy.ts debug-logger.ts auth-config.ts upstream-auth.ts --outdir dist --target node",
     "dev": "bun run start.ts",
-    "start": "node dist/start.js"
+    "start": "bun dist/start.js"
   },
   "keywords": [
     "copilot",

package/proxy-router.ts

@@ -4,6 +4,7 @@ import { createStreamProxy } from './stream-proxy';
 import { logIncomingRequest, logTransformedRequest } from './debug-logger';
 import { addRequestLog, getNextRequestId, getUsageStats, flushToDisk, type RequestLog } from './usage-db';
 import { loadAuthConfig, saveAuthConfig, generateApiKey, validateApiKey } from './auth-config';
+import { getUpstreamAuthHeader, getUpstreamApiKeys, createUpstreamApiKey, deleteUpstreamApiKey } from './upstream-auth';
 
 // ── Console capture for SSE streaming ─────────────────────────────────────────
 interface ConsoleLine {
@@ -124,7 +125,19 @@ Bun.serve({
     }
 
     if (url.pathname === "/api/keys" && req.method === "POST") {
-        const { name } = await req.json();
+        let body: unknown;
+        try {
+            body = await req.json();
+        } catch {
+            return Response.json({ error: "Invalid JSON body" }, { status: 400, headers: corsHeaders });
+        }
+        if (typeof body !== 'object' || body === null) {
+            return Response.json({ error: "Request body must be a JSON object" }, { status: 400, headers: corsHeaders });
+        }
+        const { name } = body as { name?: unknown };
+        if (name !== undefined && typeof name !== 'string') {
+            return Response.json({ error: "`name` must be a string if provided" }, { status: 400, headers: corsHeaders });
+        }
         const config = loadAuthConfig();
         const newKey = generateApiKey(name || 'Untitled');
         config.keys.push(newKey);
@@ -157,6 +170,57 @@ Bun.serve({
         return Response.json({ ok: true }, { headers: corsHeaders });
     }
 
+    // ── Upstream (copilot-api) key management ────────────────────────
+    if (url.pathname === "/api/upstream-keys" && req.method === "GET") {
+        const keys = getUpstreamApiKeys();
+        const masked = keys.map(k => k.slice(0, 14) + '...' + k.slice(-4));
+        return Response.json({ keys: masked, count: keys.length }, { headers: corsHeaders });
+    }
+
+    if (url.pathname === "/api/upstream-keys" && req.method === "POST") {
+        try {
+            const newKey = createUpstreamApiKey();
+            return Response.json({ key: newKey }, { headers: corsHeaders });
+        } catch (e: any) {
+            return Response.json({ error: e?.message || 'Failed to create key' }, { status: 500, headers: corsHeaders });
+        }
+    }
+
+    if (url.pathname.startsWith("/api/upstream-keys/") && req.method === "DELETE") {
+        const keyPrefix = decodeURIComponent(url.pathname.split('/').pop() || '');
+        const keys = getUpstreamApiKeys();
+        const match = keys.find(k => k.startsWith(keyPrefix) || k.endsWith(keyPrefix));
+        if (match) {
+            deleteUpstreamApiKey(match);
+            return Response.json({ ok: true }, { headers: corsHeaders });
+        }
+        return Response.json({ error: 'Key not found' }, { status: 404, headers: corsHeaders });
+    }
+
+    // ── Dashboard API: model list (bypasses API key auth) ──────────────
+    if (url.pathname === "/api/models" && req.method === "GET") {
+        try {
+            const modelsUrl = new URL('/v1/models', TARGET_URL);
+            const response = await fetch(modelsUrl.toString(), {
+                headers: { 'Authorization': getUpstreamAuthHeader() },
+            });
+            const data = await response.json();
+            if (data.data && Array.isArray(data.data)) {
+                data.data = data.data.map((model: any) => ({
+                    ...model,
+                    id: PREFIX + model.id,
+                    display_name: PREFIX + (model.display_name || model.id)
+                }));
+            }
+            return new Response(JSON.stringify(data), {
+                status: response.status,
+                headers: { "Content-Type": "application/json", "Access-Control-Allow-Origin": "*" }
+            });
+        } catch (e: any) {
+            return Response.json({ error: e?.message || 'Failed to fetch models' }, { status: 502, headers: corsHeaders });
+        }
+    }
+
     // ── Proxy logic ───────────────────────────────────────────────────────
     const targetUrl = new URL(url.pathname + url.search, TARGET_URL);
 
@@ -170,9 +234,8 @@ Bun.serve({
       });
     }
 
-    try {
-      if (req.method === "POST" && url.pathname.includes("/chat/completions")) {
-        // Check API key if required
+    // ── Enforce API key auth on all /v1/* routes ──────────────────────────
+    if (url.pathname.startsWith("/v1/")) {
         const authConfig = loadAuthConfig();
         if (authConfig.requireApiKey) {
             const authHeader = req.headers.get('authorization');
@@ -184,7 +247,10 @@ Bun.serve({
                 );
             }
         }
+    }
 
+    try {
+      if (req.method === "POST" && url.pathname.includes("/chat/completions")) {
         const startTime = Date.now();
         let json = await req.json();
 
@@ -207,6 +273,7 @@ Bun.serve({
 
         const headers = new Headers(req.headers);
         headers.set("host", targetUrl.host);
+        headers.set("authorization", getUpstreamAuthHeader());
 
         const needsResponsesAPI = targetModel.match(/^gpt-5\.[2-9]|^gpt-5\.\d+-codex|^o[1-9]|^goldeneye/i);
         
@@ -220,13 +287,15 @@ Bun.serve({
             console.log(`🔀 Model ${targetModel} — using Responses API bridge`);
             const chatId = `chatcmpl-proxy-${++responseCounter}`;
             try {
-                const result = await handleResponsesAPIBridge(json, req, chatId, TARGET_URL);
+                const bridgeResult = await handleResponsesAPIBridge(json, req, chatId, TARGET_URL);
                 addRequestLog({
                     id: getNextRequestId(), timestamp: startTime, model: targetModel,
-                    promptTokens: 0, completionTokens: 0, totalTokens: 0,
-                    status: result.status, duration: Date.now() - startTime, stream: !!json.stream,
+                    promptTokens: bridgeResult.usage.promptTokens,
+                    completionTokens: bridgeResult.usage.completionTokens,
+                    totalTokens: bridgeResult.usage.totalTokens,
+                    status: bridgeResult.response.status, duration: Date.now() - startTime, stream: !!json.stream,
                 });
-                return result;
+                return bridgeResult.response;
             } catch (e: any) {
                 console.error(`❌ Responses API bridge failed for ${targetModel}:`, e?.message || e);
                 return new Response(
@@ -303,21 +372,9 @@ Bun.serve({
       }
 
       if (req.method === "GET" && url.pathname.includes("/models")) {
-        // Check API key if required
-        const authConfig = loadAuthConfig();
-        if (authConfig.requireApiKey) {
-            const authHeader = req.headers.get('authorization');
-            const providedKey = authHeader?.replace('Bearer ', '');
-            if (!providedKey || !validateApiKey(providedKey)) {
-                return Response.json(
-                    { error: { message: "Invalid API key. Generate one from the dashboard.", type: "invalid_api_key" } },
-                    { status: 401, headers: { "Access-Control-Allow-Origin": "*" } }
-                );
-            }
-        }
-
         const headers = new Headers(req.headers);
         headers.set("host", targetUrl.host);
+        headers.set("authorization", getUpstreamAuthHeader());
         const response = await fetch(targetUrl.toString(), { method: "GET", headers: headers });
         const data = await response.json();
         
@@ -336,6 +393,7 @@ Bun.serve({
 
       const headers = new Headers(req.headers);
       headers.set("host", targetUrl.host);
+      headers.set("authorization", getUpstreamAuthHeader());
       const response = await fetch(targetUrl.toString(), {
         method: req.method,
         headers: headers,

package/responses-bridge.ts

@@ -1,6 +1,12 @@
 import { convertResponsesSyncToChatCompletions, convertResponsesStreamToChatCompletions } from './responses-converters';
+import { getUpstreamAuthHeader } from './upstream-auth';
 
-export async function handleResponsesAPIBridge(json: any, req: Request, chatId: string, targetUrl: string) {
+export interface BridgeResult {
+    response: Response;
+    usage: { promptTokens: number; completionTokens: number; totalTokens: number };
+}
+
+export async function handleResponsesAPIBridge(json: any, req: Request, chatId: string, targetUrl: string): Promise<BridgeResult> {
     const corsHeaders = { "Access-Control-Allow-Origin": "*" };
 
     const responsesReq: any = {
@@ -55,7 +61,7 @@ export async function handleResponsesAPIBridge(json: any, req: Request, chatId:
 
             return {
                 role: m.role === 'assistant' ? 'assistant' : 'user',
-                content: typeof content === 'string' ? content : content,
+                content,
             };
         }).flat();
     } else {
@@ -96,6 +102,7 @@ export async function handleResponsesAPIBridge(json: any, req: Request, chatId:
     headers.set("host", responsesUrl.host);
     headers.set("content-type", "application/json");
     headers.set("content-length", String(new TextEncoder().encode(responsesBody).length));
+    headers.set("authorization", getUpstreamAuthHeader());
 
     const response = await fetch(responsesUrl.toString(), {
         method: "POST",
@@ -108,12 +115,28 @@ export async function handleResponsesAPIBridge(json: any, req: Request, chatId:
     if (!response.ok) {
         const errText = await response.text();
         console.error(`❌ Responses API Error (${response.status}):`, errText);
-        return new Response(errText, { status: response.status, headers: corsHeaders });
+        return {
+            response: new Response(errText, { status: response.status, headers: corsHeaders }),
+            usage: { promptTokens: 0, completionTokens: 0, totalTokens: 0 },
+        };
     }
 
     if (json.stream && response.body) {
-        return convertResponsesStreamToChatCompletions(response, json.model, chatId, corsHeaders);
+        return {
+            response: convertResponsesStreamToChatCompletions(response, json.model, chatId, corsHeaders),
+            // Streaming usage is embedded in the stream; not available synchronously
+            usage: { promptTokens: 0, completionTokens: 0, totalTokens: 0 },
+        };
     } else {
-        return convertResponsesSyncToChatCompletions(response, json.model, chatId, corsHeaders);
+        const data = await response.json() as any;
+        const usage = data.usage ? {
+            promptTokens: data.usage.input_tokens || 0,
+            completionTokens: data.usage.output_tokens || 0,
+            totalTokens: data.usage.total_tokens || 0,
+        } : { promptTokens: 0, completionTokens: 0, totalTokens: 0 };
+        return {
+            response: convertResponsesSyncToChatCompletions(data, json.model, chatId, corsHeaders),
+            usage,
+        };
     }
 }

package/responses-converters.ts

@@ -1,5 +1,4 @@
-export async function convertResponsesSyncToChatCompletions(response: Response, model: string, chatId: string, corsHeaders: any) {
-    const data = await response.json() as any;
+export function convertResponsesSyncToChatCompletions(data: any, model: string, chatId: string, corsHeaders: any) {
     const result: any = {
         id: chatId,
         object: 'chat.completion',
@@ -49,7 +48,13 @@ export async function convertResponsesSyncToChatCompletions(response: Response,
 }
 
 export function convertResponsesStreamToChatCompletions(response: Response, model: string, chatId: string, corsHeaders: any) {
-    const reader = response.body!.getReader();
+    if (!response.body) {
+        return new Response(JSON.stringify({ error: 'No response body' }), {
+            status: 502,
+            headers: { ...corsHeaders, "Content-Type": "application/json" },
+        });
+    }
+    const reader = response.body.getReader();
     const decoder = new TextDecoder();
     const encoder = new TextEncoder();
     let buffer = '';
@@ -101,6 +106,7 @@ export function convertResponsesStreamToChatCompletions(response: Response, mode
             }
 
             else if (eventType === 'response.function_call_arguments.delta') {
+                if (toolCallIndex < 1) continue; // Guard against out-of-order events
                 controller.enqueue(encoder.encode(makeChatChunk({
                     tool_calls: [{
                         index: toolCallIndex - 1,

package/start.ts

@@ -6,6 +6,7 @@
 
 import { spawn, sleep } from 'bun';
 import { existsSync } from 'fs';
+import { getUpstreamAuthHeader } from './upstream-auth';
 
 const COPILOT_API_PORT = 4141;
 const PROXY_PORT = 4142;
@@ -30,7 +31,9 @@ async function waitForPort(port: number, timeoutMs = 30000): Promise<boolean> {
     const start = Date.now();
     while (Date.now() - start < timeoutMs) {
         try {
-            const resp = await fetch(`http://localhost:${port}/v1/models`);
+            const resp = await fetch(`http://localhost:${port}/v1/models`, {
+                headers: { 'Authorization': getUpstreamAuthHeader() },
+            });
             if (resp.ok) return true;
         } catch {}
         await sleep(500);

package/upstream-auth.ts

@@ -0,0 +1,82 @@
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+import { randomBytes } from 'crypto';
+
+const DEFAULT_DATA_DIR = join(homedir(), '.local', 'share', 'copilot-api');
+
+interface CopilotApiConfig {
+    auth?: { apiKeys?: string[] };
+    [key: string]: unknown;
+}
+
+let cachedKey: string | null = null;
+
+function getConfigPath(): string {
+    const dataDir = process.env.COPILOT_API_HOME || DEFAULT_DATA_DIR;
+    return join(dataDir, 'config.json');
+}
+
+function loadUpstreamConfig(): CopilotApiConfig {
+    const configPath = getConfigPath();
+    try {
+        if (existsSync(configPath)) {
+            return JSON.parse(readFileSync(configPath, 'utf-8'));
+        }
+    } catch {}
+    return {};
+}
+
+function saveUpstreamConfig(config: CopilotApiConfig): void {
+    const configPath = getConfigPath();
+    const dir = join(configPath, '..');
+    if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+    writeFileSync(configPath, JSON.stringify(config, null, 2), 'utf-8');
+    cachedKey = null;
+}
+
+export function getUpstreamApiKeys(): string[] {
+    const config = loadUpstreamConfig();
+    return Array.isArray(config.auth?.apiKeys) ? config.auth!.apiKeys! : [];
+}
+
+export function getUpstreamApiKey(): string {
+    if (cachedKey) return cachedKey;
+
+    const keys = getUpstreamApiKeys();
+    if (keys.length > 0) {
+        cachedKey = keys[0];
+        return cachedKey;
+    }
+
+    cachedKey = 'dummy';
+    return cachedKey;
+}
+
+export function getUpstreamAuthHeader(): string {
+    return `Bearer ${getUpstreamApiKey()}`;
+}
+
+export function createUpstreamApiKey(): string {
+    const config = loadUpstreamConfig();
+    if (!config.auth) config.auth = {};
+    if (!Array.isArray(config.auth.apiKeys)) config.auth.apiKeys = [];
+
+    const newKey = 'sk-copilot-' + randomBytes(16).toString('base64url');
+    config.auth.apiKeys.push(newKey);
+    saveUpstreamConfig(config);
+    return newKey;
+}
+
+export function deleteUpstreamApiKey(key: string): boolean {
+    const config = loadUpstreamConfig();
+    const keys = config.auth?.apiKeys;
+    if (!Array.isArray(keys)) return false;
+
+    const idx = keys.indexOf(key);
+    if (idx === -1) return false;
+
+    keys.splice(idx, 1);
+    saveUpstreamConfig(config);
+    return true;
+}

package/usage-db.ts

@@ -1,4 +1,5 @@
-import { mkdirSync, existsSync, readFileSync, writeFileSync } from 'fs';
+import { mkdirSync, existsSync, readFileSync } from 'fs';
+import { writeFile } from 'fs/promises';
 import { homedir } from 'os';
 import { join } from 'path';
 
@@ -86,7 +87,7 @@ const loadSync = (): UsageData => {
 const saveToDisk = async () => {
     try {
         data.lastSavedAt = Date.now();
-        writeFileSync(USAGE_FILE, JSON.stringify(data, null, 2), 'utf-8');
+        await writeFile(USAGE_FILE, JSON.stringify(data, null, 2), 'utf-8');
     } catch (e) {
         console.error('Failed to save usage data:', e);
     }
@@ -205,6 +206,6 @@ export const flushToDisk = async () => {
     await saveToDisk();
 };
 
-process.on('beforeExit', () => { flushToDisk(); });
+process.on('beforeExit', async () => { await flushToDisk(); });
 process.on('SIGINT', async () => { await flushToDisk(); process.exit(0); });
 process.on('SIGTERM', async () => { await flushToDisk(); process.exit(0); });