[LutzLange]

Stacked on this fork so the diff is this PR only. James gets one integration PR from copilot/integration (the tip of the stack) when the series is ready.

Second listener change, stacked on #3 (and #2). Includes those commits until they merge.

Routes. Besides the prefix-less route (unchanged: client id from daemon.llmProxy.clientId, credential mode from llmGateway.githubOAuth, upstream proxyUrl or url), three fixed prefixes for the managed Copilot programs: /copilot-cli and /vscode-copilot send only the gateway identity with client ids copilot-cli and vscode-copilot; /vscode-copilot-passthrough moves the client's own bearer to x-llm-token, adds the gateway identity and forwards to llmGateway.proxyUrl (503 when unset). The prefix is stripped before forwarding. A first path segment that resembles a route name without matching one exactly (case, suffix, doubled slash) is refused with 404 route_unknown instead of being served as the prefix-less route. Program gating of the prefixes comes with the reconcilers.

Pairing. Every route requires a per-device pairing value in x-agentdesktop-pairing, only there, checked before any configuration is read. Created once in the state directory (llm-proxy-pairing, 0600), kept across restarts, constant-time compare, never forwarded upstream even if sent as a bearer. A missing or unusable file (too short, not text) is regenerated with a warning; any other read error is an error, so an existing pairing is never silently rotated. It keeps other local users on a shared host and browser pages off the proxy, provided the client files carrying it are owner-only; it does not restrict the current user's own processes. If it cannot be created the proxy stays off, reported through daemon-info like a failed bind.

Guards. Loopback Host (any 127/8 or ::1, bracketed or bare, localhost any case, with or without port; no Host → refused), Origin/CONNECT as before, OPTIONS refused, .. segments refused on a percent-decoded copy of the path (bytes, so %2e%2e and encoded separators are caught; an escape that is not two hex digits is refused). The path checks run before the configuration is read.

Errors. OpenAI-style JSON {"error":{"message","type","code"}} so the clients display the message. Credential failures are coded agentdesktop_credential; a configuration read error gets a generic message with the error chain in the daemon log. Identity is fetched only after every other check.

Reconcilers get the bound address and pairing via ReconcileContext.llm_proxy (Reconciler::with_llm_proxy); the bind happens before the reconciler is built. The context states the owner-only file requirement and that None means "remove the pointer".

Review process. Frozen acceptance spec, then three review lenses on two models (conformance, adversarial, maintainer fit), refutation of the majors by a third pass, and delta re-reviews until two passes without majors. Findings folded in over three versions: default route was unpaired; pairing checked after the config read (leaked file detail); .. only caught unencoded; near-miss route names served as the default route; README VS Code snippet had an invented shape (now the lab-verified chatLanguageModels.json array); non-hex escapes decoded; non-UTF-8 pairing file left the proxy off until deleted.

Checks: agent 110 + core 18 tests (proxy + daemon proxy tests 35), clippy -D warnings, fmt, schema unchanged. README section rewritten (route table, pairing, upgrade note for manual setups, error codes, allowedClientIds for the new ids).

Lab, Linux VM, user mode, Copilot CLI 1.0.88, independent run against the stacked build: default route without pairing → 403 pairing_invalid, with the header → 200 (Enterprise gateway log http.path=/v1/chat/completions http.status=200 llm.client="copilot-cli"); prefixed route with the pairing as bearer → 403, with the header → 200; /vscode-copilot → gateway log llm.client="vscode-copilot" user="demo@ai-demo.example"; Host: 127.0.0.2:18095 → 200, Host: attacker.example → 403 host_not_allowed; /copilot-cli/../admin → 400 path_invalid; /Copilot-cli/v1/... → 404 route_unknown; Copilot CLI 1.0.88 with providers.json on /copilot-cli/v1 plus the pairing header answers, gateway log llm.client="copilot-cli". Note for the prefix-less route: the path is appended to the base URL as sent, so clients there send /v1/... (a bare /chat/completions reached the provider and got its 404).

🤖 Generated with Claude Code

[LutzLange]

Superseded: landed upstream in agentdesktop-dev#134 (local LLM proxy).