@ai-sdk/harness-github-copilot 1.0.1 → 1.0.3

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @ai-sdk/harness-github-copilot
 
+## 1.0.3
+
+### Patch Changes
+
+- cdc12a1: feat(harness): add support for using adapter-native subscriptions where available
+- Updated dependencies [4d1bf28]
+- Updated dependencies [cdc12a1]
+- Updated dependencies [d70a334]
+- Updated dependencies [81ba84c]
+- Updated dependencies [813bb36]
+- Updated dependencies [c43e4b7]
+  - @ai-sdk/harness@1.0.108
+  - @ai-sdk/harness-acp@1.0.46
+  - @ai-sdk/provider-utils@5.0.40
+
+## 1.0.2
+
+### Patch Changes
+
+- @ai-sdk/harness@1.0.107
+- @ai-sdk/provider-utils@5.0.39
+- @ai-sdk/harness-acp@1.0.45
+
 ## 1.0.1
 
 ### Patch Changes

package/README.md

@@ -38,6 +38,6 @@ try {
 
 The adapter uses `@ai-sdk/harness-acp`, which installs the pinned GitHub Copilot CLI inside the sandbox. The sandbox must provide network access and at least one exposed TCP port.
 
-Set one of `COPILOT_GITHUB_TOKEN`, `GH_TOKEN`, or `GITHUB_TOKEN` for direct authentication. Set `AI_GATEWAY_API_KEY` or `VERCEL_OIDC_TOKEN` to use AI Gateway instead, or pass an isolated authentication environment with `createGitHubCopilot({ auth: { AI_GATEWAY_API_KEY: token } })`.
+Set one of `COPILOT_GITHUB_TOKEN`, `GH_TOKEN`, or `GITHUB_TOKEN` for direct authentication. Without one of these variables, direct authentication reads the GitHub Copilot CLI login from the host's native credential store or plaintext fallback. If neither contains a token and the host has `gh` on `PATH`, the adapter reads `gh auth token` without modifying either credential store. Set `AI_GATEWAY_API_KEY` or `VERCEL_OIDC_TOKEN` to use AI Gateway instead, or pass an isolated authentication environment with `createGitHubCopilot({ auth: { AI_GATEWAY_API_KEY: token } })`.
 
 See the [GitHub Copilot harness documentation](https://ai-sdk.dev/providers/ai-sdk-harnesses/github-copilot) for authentication security, settings, tools, and lifecycle support.

package/dist/index.js

@@ -1,14 +1,224 @@
 // src/github-copilot-harness.ts
+import { createHash } from "crypto";
 import {
   commonTool
 } from "@ai-sdk/harness";
-import { createCredentialRequestTransformation } from "@ai-sdk/harness/utils";
+import {
+  createCredentialRequestTransformation,
+  isSandboxCredentialPlaceholder
+} from "@ai-sdk/harness/utils";
 import { createACP } from "@ai-sdk/harness-acp";
 import { tool } from "@ai-sdk/provider-utils";
 import { z } from "zod/v4";
 
+// src/github-copilot-subscription.ts
+import { execFile } from "child_process";
+import { constants } from "fs";
+import { access, readFile } from "fs/promises";
+import { homedir } from "os";
+import { join, resolve } from "path";
+import { promisify } from "util";
+import {
+  isHarnessAuthenticationEnvironment,
+  isLinux,
+  isMacOS,
+  isWindows,
+  readLinuxSecretServicePassword,
+  readMacOSKeychainPassword,
+  readWindowsCredentialManagerPassword,
+  shouldResolveNativeSubscription
+} from "@ai-sdk/harness/utils";
+import { isRecord } from "@ai-sdk/provider-utils";
+import { parse } from "jsonc-parser";
+var COPILOT_KEYRING_SERVICE = "copilot-cli";
+var execFileAsync = promisify(execFile);
+async function resolveGitHubCopilotSubscriptionEnvironment({
+  auth,
+  env,
+  readSubscription = readGitHubCopilotSubscription
+}) {
+  if (isHarnessAuthenticationEnvironment(auth)) return auth;
+  if (!shouldResolveNativeSubscription({
+    auth,
+    env,
+    hasDirectCredential: env.COPILOT_GITHUB_TOKEN != null || env.GH_TOKEN != null || env.GITHUB_TOKEN != null
+  })) {
+    return env;
+  }
+  const subscription = await readSubscription({ env });
+  if (subscription == null) return env;
+  return {
+    ...env,
+    COPILOT_GITHUB_TOKEN: subscription.token,
+    COPILOT_GH_HOST: normalizeGitHubHost(subscription.host)
+  };
+}
+async function readGitHubCopilotSubscription({
+  env = process.env,
+  homeDirectory = homedir(),
+  platform = process.platform,
+  readSecureCredential,
+  findGitHubCliExecutable = findHostGitHubCliExecutable,
+  readGitHubCliToken = readHostGitHubCliToken
+} = {}) {
+  const copilotHome = resolve(
+    env.COPILOT_HOME ?? join(homeDirectory, ".copilot")
+  );
+  const config = await readGitHubCopilotConfig({
+    path: join(copilotHome, "config.json")
+  });
+  const account = selectGitHubCopilotAccount({ config });
+  if (account != null) {
+    const accountKey = `${account.host}:${account.login}`;
+    const secureToken = await (readSecureCredential ?? ((options) => readGitHubCopilotSecureCredential({ ...options, platform })))({
+      service: COPILOT_KEYRING_SERVICE,
+      account: accountKey
+    }).catch(() => void 0);
+    if (isNonEmptyString(secureToken)) {
+      return { token: secureToken, host: account.host };
+    }
+    const plaintextToken = getPlaintextToken({ config, accountKey });
+    if (plaintextToken != null) {
+      return { token: plaintextToken, host: account.host };
+    }
+  }
+  const host = account?.host ?? normalizeGitHubOrigin(env.COPILOT_GH_HOST ?? env.GH_HOST ?? "github.com");
+  if (host == null) return void 0;
+  const executable = await findGitHubCliExecutable({ env, platform });
+  if (executable == null) return void 0;
+  const token = await readGitHubCliToken({
+    executable,
+    hostname: normalizeGitHubHost(host),
+    env
+  }).catch(() => void 0);
+  return isNonEmptyString(token) ? { token: token.trim(), host } : void 0;
+}
+async function findHostGitHubCliExecutable({
+  env,
+  platform
+}) {
+  const path = env.PATH ?? env.Path ?? env.path;
+  if (path == null) return void 0;
+  const separator = isWindows(platform) ? ";" : ":";
+  const names = isWindows(platform) ? getWindowsGitHubCliExecutableNames({ pathExt: env.PATHEXT }) : ["gh"];
+  const mode = isWindows(platform) ? constants.F_OK : constants.X_OK;
+  for (const directory of path.split(separator)) {
+    const normalizedDirectory = directory.replace(/^"|"$/g, "");
+    if (normalizedDirectory.length === 0) continue;
+    for (const executableName of names) {
+      const candidate = resolve(normalizedDirectory, executableName);
+      try {
+        await access(candidate, mode);
+        return candidate;
+      } catch {
+      }
+    }
+  }
+  return void 0;
+}
+async function readGitHubCopilotConfig({
+  path
+}) {
+  const text = await readFile(path, "utf8").catch(() => void 0);
+  if (text == null) return void 0;
+  const errors = [];
+  const value = parse(text, errors, { allowTrailingComma: true });
+  return errors.length === 0 && isRecord(value) ? value : void 0;
+}
+function selectGitHubCopilotAccount({
+  config
+}) {
+  if (config == null) return void 0;
+  for (const value of [config.last_logged_in_user, config.lastLoggedInUser]) {
+    const account = toGitHubCopilotAccount(value);
+    if (account != null) return account;
+  }
+  for (const values of [config.logged_in_users, config.loggedInUsers]) {
+    if (!Array.isArray(values)) continue;
+    for (const value of values) {
+      const account = toGitHubCopilotAccount(value);
+      if (account != null) return account;
+    }
+  }
+  return void 0;
+}
+function toGitHubCopilotAccount(value) {
+  if (!isRecord(value) || !isNonEmptyString(value.host) || !isNonEmptyString(value.login)) {
+    return void 0;
+  }
+  const host = normalizeGitHubOrigin(value.host);
+  return host == null ? void 0 : { host, login: value.login };
+}
+function getPlaintextToken({
+  config,
+  accountKey
+}) {
+  if (config == null || !isRecord(config.copilotTokens)) return void 0;
+  const token = config.copilotTokens[accountKey];
+  return isNonEmptyString(token) ? token : void 0;
+}
+async function readGitHubCopilotSecureCredential({
+  service,
+  account,
+  platform
+}) {
+  if (isMacOS(platform)) {
+    return readMacOSKeychainPassword({ service, account });
+  }
+  if (isLinux(platform)) {
+    return readLinuxSecretServicePassword({
+      attributes: { service, username: account }
+    });
+  }
+  if (isWindows(platform)) {
+    return readWindowsCredentialManagerPassword({
+      targetName: `${account}.${service}`
+    });
+  }
+  return void 0;
+}
+async function readHostGitHubCliToken({
+  executable,
+  hostname,
+  env
+}) {
+  try {
+    const result = await execFileAsync(
+      executable,
+      ["auth", "token", "--hostname", hostname],
+      {
+        env: { ...env },
+        timeout: 1e4,
+        windowsHide: true
+      }
+    );
+    return isNonEmptyString(result.stdout) ? result.stdout.trim() : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function getWindowsGitHubCliExecutableNames({
+  pathExt
+}) {
+  const extensions = (pathExt ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(isNonEmptyString);
+  return ["gh", ...extensions.map((extension) => `gh${extension}`)];
+}
+function normalizeGitHubOrigin(host) {
+  try {
+    return new URL(host.includes("://") ? host : `https://${host}`).origin;
+  } catch {
+    return void 0;
+  }
+}
+function normalizeGitHubHost(host) {
+  return new URL(host.includes("://") ? host : `https://${host}`).hostname;
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+
 // src/version.ts
-var VERSION = true ? "1.0.1" : "0.0.0-test";
+var VERSION = true ? "1.0.3" : "0.0.0-test";
 
 // src/github-copilot-harness.ts
 var GITHUB_COPILOT_CLIENT_APP = {
@@ -18,6 +228,13 @@ var GITHUB_COPILOT_CLIENT_APP = {
 var GITHUB_COPILOT_IMPLEMENTATION_PACKAGE_JSON = '{\n  "name": "harness-github-copilot-bridge",\n  "version": "0.0.0",\n  "private": true,\n  "type": "module",\n  "dependencies": {\n    "@github/copilot": "1.0.82"\n  }\n}\n';
 var GITHUB_COPILOT_IMPLEMENTATION_PNPM_LOCK = "lockfileVersion: '9.0'\n\nsettings:\n  autoInstallPeers: true\n  excludeLinksFromLockfile: false\n\nimporters:\n\n  .:\n    dependencies:\n      '@github/copilot':\n        specifier: 1.0.82\n        version: 1.0.82\n\npackages:\n\n  '@github/copilot-darwin-arm64@1.0.82':\n    resolution: {integrity: sha512-UpVSFA0COmlIakAr7/6WJqJlabtKgY8y5en6La3IxGxXsLlbkGoeevSqyfXvqJyHxaGn0YGpOC1oEPL379JfCw==}\n    cpu: [arm64]\n    os: [darwin]\n    hasBin: true\n\n  '@github/copilot-darwin-x64@1.0.82':\n    resolution: {integrity: sha512-wMKbxK8fpKsbATjn9dE31Pae67H1xu6dmaCuyXpXjXLsNPVjeLFszJZ30MAOwxRWz4dmA8VvEJZmLgJekojo2Q==}\n    cpu: [x64]\n    os: [darwin]\n    hasBin: true\n\n  '@github/copilot-linux-arm64@1.0.82':\n    resolution: {integrity: sha512-YDQmh0F+GzWORPmNNxQdcjHcXHxcy08dhMhbAhu4cqtMeA2sZWQqhfk9mJhHppMm9U0uR7h0KAB6nsgw/8Bsuw==}\n    cpu: [arm64]\n    os: [linux]\n    libc: [glibc]\n    hasBin: true\n\n  '@github/copilot-linux-x64@1.0.82':\n    resolution: {integrity: sha512-vqmG9665ktgLHAkGKMjp4uVMdHqLxi8uS9zL+g2pMwZUPoM7JxkaSfOoeyYr99caF7J6VIJTWv4LdRNQyG5jrQ==}\n    cpu: [x64]\n    os: [linux]\n    libc: [glibc]\n    hasBin: true\n\n  '@github/copilot-linuxmusl-arm64@1.0.82':\n    resolution: {integrity: sha512-14dWfa4rBME55bKmF+Z8V+WzZNgPQZKFFBQX+EOiAgLVV/arQCnQ1m7wwa5oXjQeCIgkS/L9J8uM8jNm6cZbOA==}\n    cpu: [arm64]\n    os: [linux]\n    libc: [musl]\n    hasBin: true\n\n  '@github/copilot-linuxmusl-x64@1.0.82':\n    resolution: {integrity: sha512-Mauqa2TBjtB8W/1KXF/jJ4MbtwnLvoEQNHYoSyoX+s+nIpttmixmYBJDwKV89ZlQRdjOCuxOgraRLQ9hjjXvNQ==}\n    cpu: [x64]\n    os: [linux]\n    libc: [musl]\n    hasBin: true\n\n  '@github/copilot-win32-arm64@1.0.82':\n    resolution: {integrity: sha512-PaW9s0GTgM+svtDkB583dZRrhLrO4o10y2ozMmQ0Hi5eB11C24UdC5U81nFlvKPED7+GlnBJIFQ+oHaxHrnp3A==}\n    cpu: [arm64]\n    os: [win32]\n    hasBin: true\n\n  '@github/copilot-win32-x64@1.0.82':\n    resolution: {integrity: sha512-m4iSROOMEPp1yRIQQwbnO0CDfwB4syESyHoeSLLFuynMR4/ApghAdyBrBQQcTKGsUu3R5rOE64RYlVmyKmuA9A==}\n    cpu: [x64]\n    os: [win32]\n    hasBin: true\n\n  '@github/copilot@1.0.82':\n    resolution: {integrity: sha512-+mDIwBO3dCpL3k2rVLc4+1tFzqcVBTJNA/0co+okEpmCgcHjaz91Cqq7++pJKN5yJQuGC6bKangm7PSoheI1Xw==}\n    hasBin: true\n\n  detect-libc@2.1.2:\n    resolution: {integrity: sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==}\n    engines: {node: '>=8'}\n\nsnapshots:\n\n  '@github/copilot-darwin-arm64@1.0.82':\n    optional: true\n\n  '@github/copilot-darwin-x64@1.0.82':\n    optional: true\n\n  '@github/copilot-linux-arm64@1.0.82':\n    optional: true\n\n  '@github/copilot-linux-x64@1.0.82':\n    optional: true\n\n  '@github/copilot-linuxmusl-arm64@1.0.82':\n    optional: true\n\n  '@github/copilot-linuxmusl-x64@1.0.82':\n    optional: true\n\n  '@github/copilot-win32-arm64@1.0.82':\n    optional: true\n\n  '@github/copilot-win32-x64@1.0.82':\n    optional: true\n\n  '@github/copilot@1.0.82':\n    dependencies:\n      detect-libc: 2.1.2\n    optionalDependencies:\n      '@github/copilot-darwin-arm64': 1.0.82\n      '@github/copilot-darwin-x64': 1.0.82\n      '@github/copilot-linux-arm64': 1.0.82\n      '@github/copilot-linux-x64': 1.0.82\n      '@github/copilot-linuxmusl-arm64': 1.0.82\n      '@github/copilot-linuxmusl-x64': 1.0.82\n      '@github/copilot-win32-arm64': 1.0.82\n      '@github/copilot-win32-x64': 1.0.82\n\n  detect-libc@2.1.2: {}\n";
 var GITHUB_COPILOT_IMPLEMENTATION_PNPM_WORKSPACE = "allowBuilds:\n  '@github/copilot@1.0.82': true\n";
+var GITHUB_COPILOT_TOKEN_ENVIRONMENT_VARIABLES = /* @__PURE__ */ new Set([
+  "COPILOT_GITHUB_TOKEN",
+  "GH_TOKEN",
+  "GITHUB_TOKEN"
+]);
+var GITHUB_OAUTH_TOKEN_BODY_LENGTH = 36;
+var GITHUB_OAUTH_SANDBOX_CREDENTIAL_MARKER = "aisdkhc";
 var GITHUB_COPILOT_BUILTIN_TOOLS = {
   bash: {
     ...commonTool("bash", {
@@ -216,6 +433,7 @@ function createGitHubCopilot(settings = {}) {
       ...settings.reasoningEffort == null ? [] : [`--reasoning-effort=${settings.reasoningEffort}`]
     ],
     auth: settings.auth,
+    resolveAuthenticationEnvironment: resolveGitHubCopilotSubscriptionEnvironment,
     /*
      * The Copilot CLI drops every MCP server that a client passes in ACP
      * `session/new` unless it is declared with the `http` or `sse` transport,
@@ -367,7 +585,9 @@ function createGitHubCopilot(settings = {}) {
       }
       return transformations;
     },
-    credentialForwarding: settings.credentialForwarding,
+    credentialForwarding: createGitHubCopilotCredentialForwarding({
+      credentialForwarding: settings.credentialForwarding
+    }),
     providerAuthentication: {
       gateway: {
         env: {
@@ -406,8 +626,25 @@ function createGitHubCopilot(settings = {}) {
     mintBridgeToken: settings.mintBridgeToken
   });
 }
-function normalizeGitHubHost(host) {
-  return new URL(host.includes("://") ? host : `https://${host}`).hostname;
+function createGitHubCopilotCredentialForwarding({
+  credentialForwarding
+}) {
+  return ({ credential, environmentVariableName }) => {
+    const sandboxCredential = GITHUB_COPILOT_TOKEN_ENVIRONMENT_VARIABLES.has(environmentVariableName) && isSandboxCredentialPlaceholder(credential) ? createGitHubOAuthSandboxCredentialPlaceholder({ credential }) : credential;
+    return credentialForwarding == null ? sandboxCredential : credentialForwarding({
+      credential: sandboxCredential,
+      environmentVariableName
+    });
+  };
+}
+function createGitHubOAuthSandboxCredentialPlaceholder({
+  credential
+}) {
+  const tokenBody = createHash("sha256").update(credential).digest("hex").slice(
+    0,
+    GITHUB_OAUTH_TOKEN_BODY_LENGTH - GITHUB_OAUTH_SANDBOX_CREDENTIAL_MARKER.length
+  );
+  return `gho_${GITHUB_OAUTH_SANDBOX_CREDENTIAL_MARKER}${tokenBody}`;
 }
 
 // src/index.ts

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/github-copilot-harness.ts","../src/version.ts","../src/index.ts"],"sourcesContent":["import {\n  commonTool,\n  type HarnessV1,\n  type HarnessV1BuiltinTool,\n  type HarnessV1CredentialForwarding,\n  type HarnessV1PortEndpoint,\n  type HarnessV1RequestTransformation,\n} from '@ai-sdk/harness';\nimport { createCredentialRequestTransformation } from '@ai-sdk/harness/utils';\nimport { createACP, type ACPAuthenticationMode } from '@ai-sdk/harness-acp';\nimport { tool } from '@ai-sdk/provider-utils';\nimport { z } from 'zod/v4';\nimport { VERSION } from './version';\n\ndeclare const __GITHUB_COPILOT_IMPLEMENTATION_PACKAGE_JSON__: string;\ndeclare const __GITHUB_COPILOT_IMPLEMENTATION_PNPM_LOCK_YAML__: string;\ndeclare const __GITHUB_COPILOT_IMPLEMENTATION_PNPM_WORKSPACE_YAML__: string;\n\nconst GITHUB_COPILOT_CLIENT_APP = {\n  name: 'ai-sdk/harness-github-copilot',\n  version: VERSION,\n} as const;\nconst GITHUB_COPILOT_IMPLEMENTATION_PACKAGE_JSON =\n  __GITHUB_COPILOT_IMPLEMENTATION_PACKAGE_JSON__;\nconst GITHUB_COPILOT_IMPLEMENTATION_PNPM_LOCK =\n  __GITHUB_COPILOT_IMPLEMENTATION_PNPM_LOCK_YAML__;\nconst GITHUB_COPILOT_IMPLEMENTATION_PNPM_WORKSPACE =\n  __GITHUB_COPILOT_IMPLEMENTATION_PNPM_WORKSPACE_YAML__;\n\nexport type GitHubCopilotAuthenticationMode = ACPAuthenticationMode;\n\nexport type GitHubCopilotHarnessSettings = {\n  readonly auth?: GitHubCopilotAuthenticationMode;\n  readonly credentialForwarding?: HarnessV1CredentialForwarding;\n  readonly reasoningEffort?:\n    | 'none'\n    | 'minimal'\n    | 'low'\n    | 'medium'\n    | 'high'\n    | 'xhigh'\n    | 'max';\n  readonly mcpServers?: Record<string, unknown>;\n  readonly port?: number;\n  readonly portEndpoint?: HarnessV1PortEndpoint;\n  readonly startupTimeoutMs?: number;\n  readonly mintBridgeToken?: (sandboxId: string) => string;\n};\n\n/*\n * This catalog reflects the stable, non-MCP tool surface emitted by GitHub\n * Copilot CLI 1.0.82. Loose object schemas preserve compatibility when the\n * CLI adds fields without changing the established inputs.\n */\nconst GITHUB_COPILOT_BUILTIN_TOOLS = {\n  bash: {\n    ...commonTool('bash', {\n      nativeName: 'bash',\n      toolUseKind: 'bash',\n      inputSchema: z.looseObject({\n        command: z.string(),\n        description: z.string().optional(),\n        shellId: z.string().optional(),\n        mode: z.enum(['sync', 'async']).optional(),\n        detach: z.boolean().optional(),\n        initial_wait: z.number().optional(),\n      }),\n    }),\n  },\n  read_bash: {\n    ...tool({\n      title: 'Reading shell output',\n      inputSchema: z.looseObject({\n        shellId: z.string(),\n        delay: z.number(),\n      }),\n    }),\n    toolUseKind: 'readonly',\n  },\n  stop_bash: {\n    ...tool({\n      title: 'Stopping shell session',\n      inputSchema: z.looseObject({ shellId: z.string() }),\n    }),\n    toolUseKind: 'bash',\n  },\n  list_bash: {\n    ...tool({\n      title: 'list_bash',\n      inputSchema: z.looseObject({}),\n    }),\n    toolUseKind: 'readonly',\n  },\n  view: {\n    ...tool({\n      title: 'Viewing ',\n      inputSchema: z.looseObject({\n        path: z.string(),\n        view_range: z.array(z.number()).optional(),\n        forceReadLargeFiles: z.boolean().optional(),\n      }),\n    }),\n    toolUseKind: 'readonly',\n  },\n  create: {\n    ...tool({\n      title: 'Creating ',\n      inputSchema: z.looseObject({\n        path: z.string(),\n        file_text: z.string(),\n      }),\n    }),\n    toolUseKind: 'edit',\n  },\n  edit: {\n    ...tool({\n      title: 'Editing ',\n      inputSchema: z.looseObject({\n        path: z.string(),\n        old_str: z.string().optional(),\n        new_str: z.string(),\n      }),\n    }),\n    toolUseKind: 'edit',\n  },\n  web_fetch: {\n    ...tool({\n      title: 'Fetching ',\n      inputSchema: z.looseObject({\n        url: z.string(),\n        max_length: z.number().optional(),\n        start_index: z.number().optional(),\n        raw: z.boolean().optional(),\n      }),\n    }),\n    toolUseKind: 'readonly',\n  },\n  skill: tool({\n    title: 'Using skill: ',\n    inputSchema: z.looseObject({ skill: z.string() }),\n  }),\n  sql: tool({\n    inputSchema: z.looseObject({\n      description: z.string(),\n      query: z.string(),\n      database: z.enum(['session', 'session_store']).optional(),\n    }),\n  }),\n  read_agent: {\n    ...tool({\n      title: 'read_agent',\n      inputSchema: z.looseObject({\n        agent_id: z.string(),\n        wait: z.boolean().optional(),\n        timeout: z.number().optional(),\n        since_turn: z.number().int().nonnegative().optional(),\n      }),\n    }),\n    toolUseKind: 'readonly',\n  },\n  list_agents: {\n    ...tool({\n      title: 'list_agents',\n      inputSchema: z.looseObject({\n        include_completed: z.boolean().optional(),\n        scope: z.enum(['siblings', 'children', 'all']).optional(),\n      }),\n    }),\n    toolUseKind: 'readonly',\n  },\n  write_agent: tool({\n    title: 'write_agent',\n    inputSchema: z.looseObject({\n      message: z.string(),\n      agent_id: z.string().optional(),\n      agent_ids: z.array(z.string()).optional(),\n      scope: z.enum(['siblings', 'children']).optional(),\n    }),\n  }),\n  grep: {\n    ...commonTool('grep', {\n      nativeName: 'grep',\n      toolUseKind: 'readonly',\n      inputSchema: z.looseObject({\n        pattern: z.string(),\n        path: z.string().optional(),\n        paths: z.array(z.string()).optional(),\n        glob: z.string().optional(),\n        output_mode: z\n          .enum(['content', 'files_with_matches', 'count'])\n          .optional(),\n        case_insensitive: z.boolean().optional(),\n        multiline: z.boolean().optional(),\n        head_limit: z.number().optional(),\n        context: z.number().optional(),\n        before_context: z.number().optional(),\n        after_context: z.number().optional(),\n      }),\n    }),\n    title: 'Searching for ',\n  },\n  glob: {\n    ...commonTool('glob', {\n      nativeName: 'glob',\n      toolUseKind: 'readonly',\n      inputSchema: z.looseObject({\n        pattern: z.string(),\n        paths: z.array(z.string()).optional(),\n      }),\n    }),\n    title: 'Finding files matching ',\n  },\n  task: tool({\n    inputSchema: z.looseObject({\n      name: z.string(),\n      prompt: z.string(),\n      agent_type: z.enum([\n        'explore',\n        'task',\n        'general-purpose',\n        'code-review',\n        'research',\n        'security-review',\n      ]),\n      description: z.string(),\n      model: z.string().optional(),\n      context_tier: z.enum(['default', 'long_context']).optional(),\n      mode: z.enum(['sync', 'background']).optional(),\n    }),\n  }),\n} as const satisfies Record<string, HarnessV1BuiltinTool<any, any>>;\n\nexport type GitHubCopilotBuiltinTools = typeof GITHUB_COPILOT_BUILTIN_TOOLS;\n\nexport function createGitHubCopilot(\n  settings: GitHubCopilotHarnessSettings = {},\n): HarnessV1<GitHubCopilotBuiltinTools> {\n  const mcpToolTitlePrefixes = [\n    'github-mcp-server-',\n    ...Object.keys(settings.mcpServers ?? {}).map(name => `${name}-`),\n  ];\n\n  return createACP({\n    version: 'v1',\n    harnessId: 'github-copilot',\n    clientApp: GITHUB_COPILOT_CLIENT_APP,\n    source: {\n      type: 'npm-locked',\n      packageJson: GITHUB_COPILOT_IMPLEMENTATION_PACKAGE_JSON,\n      pnpmLockYaml: GITHUB_COPILOT_IMPLEMENTATION_PNPM_LOCK,\n      pnpmWorkspaceYaml: GITHUB_COPILOT_IMPLEMENTATION_PNPM_WORKSPACE,\n    },\n    executable: 'copilot',\n    args: [\n      '--acp',\n      '--stdio',\n      '--no-auto-update',\n      ...(settings.reasoningEffort == null\n        ? []\n        : [`--reasoning-effort=${settings.reasoningEffort}`]),\n    ],\n    auth: settings.auth,\n    /*\n     * The Copilot CLI drops every MCP server that a client passes in ACP\n     * `session/new` unless it is declared with the `http` or `sse` transport,\n     * so host tools must be exposed over the bridge's HTTP MCP endpoint.\n     */\n    hostToolMcpTransport: 'http',\n    forwardEnv: ['COPILOT_GH_HOST', 'GH_HOST'],\n    credentialEnv: ['COPILOT_GITHUB_TOKEN', 'GH_TOKEN', 'GITHUB_TOKEN'],\n    credentialBrokering: ({ env, sandboxEnv, headers }) => {\n      const transformations: HarnessV1RequestTransformation[] = [];\n      const githubHost = normalizeGitHubHost(\n        env.COPILOT_GH_HOST ?? env.GH_HOST ?? 'github.com',\n      );\n      const githubHosts = [\n        githubHost,\n        `*.${githubHost}`,\n        ...(githubHost === 'github.com'\n          ? ['githubcopilot.com', '*.githubcopilot.com']\n          : []),\n      ];\n\n      for (const host of githubHosts) {\n        if (env.COPILOT_GITHUB_TOKEN && sandboxEnv?.COPILOT_GITHUB_TOKEN) {\n          transformations.push(\n            {\n              match: {\n                host,\n                headers: [\n                  {\n                    key: { exact: 'Authorization' },\n                    value: {\n                      exact: `Bearer ${sandboxEnv.COPILOT_GITHUB_TOKEN}`,\n                    },\n                  },\n                ],\n              },\n              transform: {\n                headers: {\n                  Authorization: `Bearer ${env.COPILOT_GITHUB_TOKEN}`,\n                },\n              },\n            },\n            {\n              match: {\n                host,\n                headers: [\n                  {\n                    key: { exact: 'Authorization' },\n                    value: {\n                      exact: `token ${sandboxEnv.COPILOT_GITHUB_TOKEN}`,\n                    },\n                  },\n                ],\n              },\n              transform: {\n                headers: {\n                  Authorization: `token ${env.COPILOT_GITHUB_TOKEN}`,\n                },\n              },\n            },\n          );\n        }\n\n        if (env.GH_TOKEN && sandboxEnv?.GH_TOKEN) {\n          transformations.push(\n            {\n              match: {\n                host,\n                headers: [\n                  {\n                    key: { exact: 'Authorization' },\n                    value: { exact: `Bearer ${sandboxEnv.GH_TOKEN}` },\n                  },\n                ],\n              },\n              transform: {\n                headers: { Authorization: `Bearer ${env.GH_TOKEN}` },\n              },\n            },\n            {\n              match: {\n                host,\n                headers: [\n                  {\n                    key: { exact: 'Authorization' },\n                    value: { exact: `token ${sandboxEnv.GH_TOKEN}` },\n                  },\n                ],\n              },\n              transform: {\n                headers: { Authorization: `token ${env.GH_TOKEN}` },\n              },\n            },\n          );\n        }\n\n        if (env.GITHUB_TOKEN && sandboxEnv?.GITHUB_TOKEN) {\n          transformations.push(\n            {\n              match: {\n                host,\n                headers: [\n                  {\n                    key: { exact: 'Authorization' },\n                    value: { exact: `Bearer ${sandboxEnv.GITHUB_TOKEN}` },\n                  },\n                ],\n              },\n              transform: {\n                headers: { Authorization: `Bearer ${env.GITHUB_TOKEN}` },\n              },\n            },\n            {\n              match: {\n                host,\n                headers: [\n                  {\n                    key: { exact: 'Authorization' },\n                    value: { exact: `token ${sandboxEnv.GITHUB_TOKEN}` },\n                  },\n                ],\n              },\n              transform: {\n                headers: { Authorization: `token ${env.GITHUB_TOKEN}` },\n              },\n            },\n          );\n        }\n      }\n\n      const providerCredential = env.COPILOT_PROVIDER_API_KEY;\n      const sandboxProviderCredential = sandboxEnv?.COPILOT_PROVIDER_API_KEY;\n      const providerBaseUrl = env.COPILOT_PROVIDER_BASE_URL;\n      if (providerCredential && sandboxProviderCredential && providerBaseUrl) {\n        transformations.push(\n          createCredentialRequestTransformation({\n            matchUrl: providerBaseUrl,\n            matchHeaders: {\n              Authorization: `Bearer ${sandboxProviderCredential}`,\n            },\n            transformHeaders: {\n              ...headers,\n              Authorization: `Bearer ${providerCredential}`,\n            },\n          }),\n        );\n      } else if (headers != null) {\n        const copilotHosts =\n          githubHost === 'github.com'\n            ? ['githubcopilot.com', '*.githubcopilot.com']\n            : [githubHost, `*.${githubHost}`];\n        for (const host of copilotHosts) {\n          transformations.push({\n            match: { host },\n            transform: { headers },\n          });\n        }\n      }\n\n      return transformations;\n    },\n    credentialForwarding: settings.credentialForwarding,\n    providerAuthentication: {\n      gateway: {\n        env: {\n          COPILOT_PROVIDER_BASE_URL: {\n            $source: 'gateway-base-url',\n            ensureSuffix: '/v1',\n          },\n          COPILOT_PROVIDER_TYPE: 'openai',\n          COPILOT_PROVIDER_API_KEY: {\n            $source: 'gateway-api-key',\n          },\n          COPILOT_PROVIDER_WIRE_API: 'responses',\n          COPILOT_MODEL: 'openai/gpt-5.5',\n          COPILOT_PROVIDER_HEADERS: {\n            $source: 'client-app',\n            prefix: 'x-client-app: ',\n          },\n        },\n      },\n    },\n    modelMapping: {\n      type: 'session-config-option',\n      path: 'model',\n    },\n    skillsDirectory: '.copilot/skills',\n    instructionMapping: {\n      type: 'filesystem',\n      path: '.copilot/copilot-instructions.md',\n    },\n    builtinTools: GITHUB_COPILOT_BUILTIN_TOOLS,\n    mcpServers: settings.mcpServers,\n    isMcpToolCall: toolCall =>\n      mcpToolTitlePrefixes.some(prefix => toolCall.title.startsWith(prefix)),\n    port: settings.port,\n    portEndpoint: settings.portEndpoint,\n    startupTimeoutMs: settings.startupTimeoutMs,\n    mintBridgeToken: settings.mintBridgeToken,\n  });\n}\n\nfunction normalizeGitHubHost(host: string): string {\n  return new URL(host.includes('://') ? host : `https://${host}`).hostname;\n}\n","declare const __PACKAGE_VERSION__: string | undefined;\nexport const VERSION: string =\n  typeof __PACKAGE_VERSION__ !== 'undefined'\n    ? __PACKAGE_VERSION__\n    : '0.0.0-test';\n","import { createGitHubCopilot } from './github-copilot-harness';\n\n/**\n * Default GitHub Copilot harness instance. Equivalent to\n * `createGitHubCopilot()`.\n */\nexport const githubCopilot = createGitHubCopilot();\n\nexport { createGitHubCopilot } from './github-copilot-harness';\nexport type {\n  GitHubCopilotAuthenticationMode,\n  GitHubCopilotBuiltinTools,\n  GitHubCopilotHarnessSettings,\n} from './github-copilot-harness';\nexport { VERSION } from './version';\n"],"mappings":";AAAA;AAAA,EACE;AAAA,OAMK;AACP,SAAS,6CAA6C;AACtD,SAAS,iBAA6C;AACtD,SAAS,YAAY;AACrB,SAAS,SAAS;;;ACVX,IAAM,UACX,OACI,UACA;;;ADcN,IAAM,4BAA4B;AAAA,EAChC,MAAM;AAAA,EACN,SAAS;AACX;AACA,IAAM,6CACJ;AACF,IAAM,0CACJ;AACF,IAAM,+CACJ;AA2BF,IAAM,+BAA+B;AAAA,EACnC,MAAM;AAAA,IACJ,GAAG,WAAW,QAAQ;AAAA,MACpB,YAAY;AAAA,MACZ,aAAa;AAAA,MACb,aAAa,EAAE,YAAY;AAAA,QACzB,SAAS,EAAE,OAAO;AAAA,QAClB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,QACjC,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,QAC7B,MAAM,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC,EAAE,SAAS;AAAA,QACzC,QAAQ,EAAE,QAAQ,EAAE,SAAS;AAAA,QAC7B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,MACpC,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA,EACA,WAAW;AAAA,IACT,GAAG,KAAK;AAAA,MACN,OAAO;AAAA,MACP,aAAa,EAAE,YAAY;AAAA,QACzB,SAAS,EAAE,OAAO;AAAA,QAClB,OAAO,EAAE,OAAO;AAAA,MAClB,CAAC;AAAA,IACH,CAAC;AAAA,IACD,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,GAAG,KAAK;AAAA,MACN,OAAO;AAAA,MACP,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAAA,IACpD,CAAC;AAAA,IACD,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,GAAG,KAAK;AAAA,MACN,OAAO;AAAA,MACP,aAAa,EAAE,YAAY,CAAC,CAAC;AAAA,IAC/B,CAAC;AAAA,IACD,aAAa;AAAA,EACf;AAAA,EACA,MAAM;AAAA,IACJ,GAAG,KAAK;AAAA,MACN,OAAO;AAAA,MACP,aAAa,EAAE,YAAY;AAAA,QACzB,MAAM,EAAE,OAAO;AAAA,QACf,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,QACzC,qBAAqB,EAAE,QAAQ,EAAE,SAAS;AAAA,MAC5C,CAAC;AAAA,IACH,CAAC;AAAA,IACD,aAAa;AAAA,EACf;AAAA,EACA,QAAQ;AAAA,IACN,GAAG,KAAK;AAAA,MACN,OAAO;AAAA,MACP,aAAa,EAAE,YAAY;AAAA,QACzB,MAAM,EAAE,OAAO;AAAA,QACf,WAAW,EAAE,OAAO;AAAA,MACtB,CAAC;AAAA,IACH,CAAC;AAAA,IACD,aAAa;AAAA,EACf;AAAA,EACA,MAAM;AAAA,IACJ,GAAG,KAAK;AAAA,MACN,OAAO;AAAA,MACP,aAAa,EAAE,YAAY;AAAA,QACzB,MAAM,EAAE,OAAO;AAAA,QACf,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,QAC7B,SAAS,EAAE,OAAO;AAAA,MACpB,CAAC;AAAA,IACH,CAAC;AAAA,IACD,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,GAAG,KAAK;AAAA,MACN,OAAO;AAAA,MACP,aAAa,EAAE,YAAY;AAAA,QACzB,KAAK,EAAE,OAAO;AAAA,QACd,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,QAChC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,QACjC,KAAK,EAAE,QAAQ,EAAE,SAAS;AAAA,MAC5B,CAAC;AAAA,IACH,CAAC;AAAA,IACD,aAAa;AAAA,EACf;AAAA,EACA,OAAO,KAAK;AAAA,IACV,OAAO;AAAA,IACP,aAAa,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,EAClD,CAAC;AAAA,EACD,KAAK,KAAK;AAAA,IACR,aAAa,EAAE,YAAY;AAAA,MACzB,aAAa,EAAE,OAAO;AAAA,MACtB,OAAO,EAAE,OAAO;AAAA,MAChB,UAAU,EAAE,KAAK,CAAC,WAAW,eAAe,CAAC,EAAE,SAAS;AAAA,IAC1D,CAAC;AAAA,EACH,CAAC;AAAA,EACD,YAAY;AAAA,IACV,GAAG,KAAK;AAAA,MACN,OAAO;AAAA,MACP,aAAa,EAAE,YAAY;AAAA,QACzB,UAAU,EAAE,OAAO;AAAA,QACnB,MAAM,EAAE,QAAQ,EAAE,SAAS;AAAA,QAC3B,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,QAC7B,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,MACtD,CAAC;AAAA,IACH,CAAC;AAAA,IACD,aAAa;AAAA,EACf;AAAA,EACA,aAAa;AAAA,IACX,GAAG,KAAK;AAAA,MACN,OAAO;AAAA,MACP,aAAa,EAAE,YAAY;AAAA,QACzB,mBAAmB,EAAE,QAAQ,EAAE,SAAS;AAAA,QACxC,OAAO,EAAE,KAAK,CAAC,YAAY,YAAY,KAAK,CAAC,EAAE,SAAS;AAAA,MAC1D,CAAC;AAAA,IACH,CAAC;AAAA,IACD,aAAa;AAAA,EACf;AAAA,EACA,aAAa,KAAK;AAAA,IAChB,OAAO;AAAA,IACP,aAAa,EAAE,YAAY;AAAA,MACzB,SAAS,EAAE,OAAO;AAAA,MAClB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,MAC9B,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACxC,OAAO,EAAE,KAAK,CAAC,YAAY,UAAU,CAAC,EAAE,SAAS;AAAA,IACnD,CAAC;AAAA,EACH,CAAC;AAAA,EACD,MAAM;AAAA,IACJ,GAAG,WAAW,QAAQ;AAAA,MACpB,YAAY;AAAA,MACZ,aAAa;AAAA,MACb,aAAa,EAAE,YAAY;AAAA,QACzB,SAAS,EAAE,OAAO;AAAA,QAClB,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,QAC1B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,QACpC,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,QAC1B,aAAa,EACV,KAAK,CAAC,WAAW,sBAAsB,OAAO,CAAC,EAC/C,SAAS;AAAA,QACZ,kBAAkB,EAAE,QAAQ,EAAE,SAAS;AAAA,QACvC,WAAW,EAAE,QAAQ,EAAE,SAAS;AAAA,QAChC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,QAChC,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,QAC7B,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,QACpC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,MACrC,CAAC;AAAA,IACH,CAAC;AAAA,IACD,OAAO;AAAA,EACT;AAAA,EACA,MAAM;AAAA,IACJ,GAAG,WAAW,QAAQ;AAAA,MACpB,YAAY;AAAA,MACZ,aAAa;AAAA,MACb,aAAa,EAAE,YAAY;AAAA,QACzB,SAAS,EAAE,OAAO;AAAA,QAClB,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACtC,CAAC;AAAA,IACH,CAAC;AAAA,IACD,OAAO;AAAA,EACT;AAAA,EACA,MAAM,KAAK;AAAA,IACT,aAAa,EAAE,YAAY;AAAA,MACzB,MAAM,EAAE,OAAO;AAAA,MACf,QAAQ,EAAE,OAAO;AAAA,MACjB,YAAY,EAAE,KAAK;AAAA,QACjB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,MACD,aAAa,EAAE,OAAO;AAAA,MACtB,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,MAC3B,cAAc,EAAE,KAAK,CAAC,WAAW,cAAc,CAAC,EAAE,SAAS;AAAA,MAC3D,MAAM,EAAE,KAAK,CAAC,QAAQ,YAAY,CAAC,EAAE,SAAS;AAAA,IAChD,CAAC;AAAA,EACH,CAAC;AACH;AAIO,SAAS,oBACd,WAAyC,CAAC,GACJ;AACtC,QAAM,uBAAuB;AAAA,IAC3B;AAAA,IACA,GAAG,OAAO,KAAK,SAAS,cAAc,CAAC,CAAC,EAAE,IAAI,UAAQ,GAAG,IAAI,GAAG;AAAA,EAClE;AAEA,SAAO,UAAU;AAAA,IACf,SAAS;AAAA,IACT,WAAW;AAAA,IACX,WAAW;AAAA,IACX,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,MACb,cAAc;AAAA,MACd,mBAAmB;AAAA,IACrB;AAAA,IACA,YAAY;AAAA,IACZ,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAI,SAAS,mBAAmB,OAC5B,CAAC,IACD,CAAC,sBAAsB,SAAS,eAAe,EAAE;AAAA,IACvD;AAAA,IACA,MAAM,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMf,sBAAsB;AAAA,IACtB,YAAY,CAAC,mBAAmB,SAAS;AAAA,IACzC,eAAe,CAAC,wBAAwB,YAAY,cAAc;AAAA,IAClE,qBAAqB,CAAC,EAAE,KAAK,YAAY,QAAQ,MAAM;AACrD,YAAM,kBAAoD,CAAC;AAC3D,YAAM,aAAa;AAAA,QACjB,IAAI,mBAAmB,IAAI,WAAW;AAAA,MACxC;AACA,YAAM,cAAc;AAAA,QAClB;AAAA,QACA,KAAK,UAAU;AAAA,QACf,GAAI,eAAe,eACf,CAAC,qBAAqB,qBAAqB,IAC3C,CAAC;AAAA,MACP;AAEA,iBAAW,QAAQ,aAAa;AAC9B,YAAI,IAAI,wBAAwB,YAAY,sBAAsB;AAChE,0BAAgB;AAAA,YACd;AAAA,cACE,OAAO;AAAA,gBACL;AAAA,gBACA,SAAS;AAAA,kBACP;AAAA,oBACE,KAAK,EAAE,OAAO,gBAAgB;AAAA,oBAC9B,OAAO;AAAA,sBACL,OAAO,UAAU,WAAW,oBAAoB;AAAA,oBAClD;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,cACA,WAAW;AAAA,gBACT,SAAS;AAAA,kBACP,eAAe,UAAU,IAAI,oBAAoB;AAAA,gBACnD;AAAA,cACF;AAAA,YACF;AAAA,YACA;AAAA,cACE,OAAO;AAAA,gBACL;AAAA,gBACA,SAAS;AAAA,kBACP;AAAA,oBACE,KAAK,EAAE,OAAO,gBAAgB;AAAA,oBAC9B,OAAO;AAAA,sBACL,OAAO,SAAS,WAAW,oBAAoB;AAAA,oBACjD;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,cACA,WAAW;AAAA,gBACT,SAAS;AAAA,kBACP,eAAe,SAAS,IAAI,oBAAoB;AAAA,gBAClD;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAEA,YAAI,IAAI,YAAY,YAAY,UAAU;AACxC,0BAAgB;AAAA,YACd;AAAA,cACE,OAAO;AAAA,gBACL;AAAA,gBACA,SAAS;AAAA,kBACP;AAAA,oBACE,KAAK,EAAE,OAAO,gBAAgB;AAAA,oBAC9B,OAAO,EAAE,OAAO,UAAU,WAAW,QAAQ,GAAG;AAAA,kBAClD;AAAA,gBACF;AAAA,cACF;AAAA,cACA,WAAW;AAAA,gBACT,SAAS,EAAE,eAAe,UAAU,IAAI,QAAQ,GAAG;AAAA,cACrD;AAAA,YACF;AAAA,YACA;AAAA,cACE,OAAO;AAAA,gBACL;AAAA,gBACA,SAAS;AAAA,kBACP;AAAA,oBACE,KAAK,EAAE,OAAO,gBAAgB;AAAA,oBAC9B,OAAO,EAAE,OAAO,SAAS,WAAW,QAAQ,GAAG;AAAA,kBACjD;AAAA,gBACF;AAAA,cACF;AAAA,cACA,WAAW;AAAA,gBACT,SAAS,EAAE,eAAe,SAAS,IAAI,QAAQ,GAAG;AAAA,cACpD;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAEA,YAAI,IAAI,gBAAgB,YAAY,cAAc;AAChD,0BAAgB;AAAA,YACd;AAAA,cACE,OAAO;AAAA,gBACL;AAAA,gBACA,SAAS;AAAA,kBACP;AAAA,oBACE,KAAK,EAAE,OAAO,gBAAgB;AAAA,oBAC9B,OAAO,EAAE,OAAO,UAAU,WAAW,YAAY,GAAG;AAAA,kBACtD;AAAA,gBACF;AAAA,cACF;AAAA,cACA,WAAW;AAAA,gBACT,SAAS,EAAE,eAAe,UAAU,IAAI,YAAY,GAAG;AAAA,cACzD;AAAA,YACF;AAAA,YACA;AAAA,cACE,OAAO;AAAA,gBACL;AAAA,gBACA,SAAS;AAAA,kBACP;AAAA,oBACE,KAAK,EAAE,OAAO,gBAAgB;AAAA,oBAC9B,OAAO,EAAE,OAAO,SAAS,WAAW,YAAY,GAAG;AAAA,kBACrD;AAAA,gBACF;AAAA,cACF;AAAA,cACA,WAAW;AAAA,gBACT,SAAS,EAAE,eAAe,SAAS,IAAI,YAAY,GAAG;AAAA,cACxD;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAEA,YAAM,qBAAqB,IAAI;AAC/B,YAAM,4BAA4B,YAAY;AAC9C,YAAM,kBAAkB,IAAI;AAC5B,UAAI,sBAAsB,6BAA6B,iBAAiB;AACtE,wBAAgB;AAAA,UACd,sCAAsC;AAAA,YACpC,UAAU;AAAA,YACV,cAAc;AAAA,cACZ,eAAe,UAAU,yBAAyB;AAAA,YACpD;AAAA,YACA,kBAAkB;AAAA,cAChB,GAAG;AAAA,cACH,eAAe,UAAU,kBAAkB;AAAA,YAC7C;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF,WAAW,WAAW,MAAM;AAC1B,cAAM,eACJ,eAAe,eACX,CAAC,qBAAqB,qBAAqB,IAC3C,CAAC,YAAY,KAAK,UAAU,EAAE;AACpC,mBAAW,QAAQ,cAAc;AAC/B,0BAAgB,KAAK;AAAA,YACnB,OAAO,EAAE,KAAK;AAAA,YACd,WAAW,EAAE,QAAQ;AAAA,UACvB,CAAC;AAAA,QACH;AAAA,MACF;AAEA,aAAO;AAAA,IACT;AAAA,IACA,sBAAsB,SAAS;AAAA,IAC/B,wBAAwB;AAAA,MACtB,SAAS;AAAA,QACP,KAAK;AAAA,UACH,2BAA2B;AAAA,YACzB,SAAS;AAAA,YACT,cAAc;AAAA,UAChB;AAAA,UACA,uBAAuB;AAAA,UACvB,0BAA0B;AAAA,YACxB,SAAS;AAAA,UACX;AAAA,UACA,2BAA2B;AAAA,UAC3B,eAAe;AAAA,UACf,0BAA0B;AAAA,YACxB,SAAS;AAAA,YACT,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AAAA,IACA,iBAAiB;AAAA,IACjB,oBAAoB;AAAA,MAClB,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AAAA,IACA,cAAc;AAAA,IACd,YAAY,SAAS;AAAA,IACrB,eAAe,cACb,qBAAqB,KAAK,YAAU,SAAS,MAAM,WAAW,MAAM,CAAC;AAAA,IACvE,MAAM,SAAS;AAAA,IACf,cAAc,SAAS;AAAA,IACvB,kBAAkB,SAAS;AAAA,IAC3B,iBAAiB,SAAS;AAAA,EAC5B,CAAC;AACH;AAEA,SAAS,oBAAoB,MAAsB;AACjD,SAAO,IAAI,IAAI,KAAK,SAAS,KAAK,IAAI,OAAO,WAAW,IAAI,EAAE,EAAE;AAClE;;;AE5cO,IAAM,gBAAgB,oBAAoB;","names":[]}
+{"version":3,"sources":["../src/github-copilot-harness.ts","../src/github-copilot-subscription.ts","../src/version.ts","../src/index.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\nimport {\n  commonTool,\n  type HarnessV1,\n  type HarnessV1BuiltinTool,\n  type HarnessV1CredentialForwarding,\n  type HarnessV1PortEndpoint,\n  type HarnessV1RequestTransformation,\n} from '@ai-sdk/harness';\nimport {\n  createCredentialRequestTransformation,\n  isSandboxCredentialPlaceholder,\n} from '@ai-sdk/harness/utils';\nimport { createACP, type ACPAuthenticationMode } from '@ai-sdk/harness-acp';\nimport { tool } from '@ai-sdk/provider-utils';\nimport { z } from 'zod/v4';\nimport {\n  normalizeGitHubHost,\n  resolveGitHubCopilotSubscriptionEnvironment,\n} from './github-copilot-subscription';\nimport { VERSION } from './version';\n\ndeclare const __GITHUB_COPILOT_IMPLEMENTATION_PACKAGE_JSON__: string;\ndeclare const __GITHUB_COPILOT_IMPLEMENTATION_PNPM_LOCK_YAML__: string;\ndeclare const __GITHUB_COPILOT_IMPLEMENTATION_PNPM_WORKSPACE_YAML__: string;\n\nconst GITHUB_COPILOT_CLIENT_APP = {\n  name: 'ai-sdk/harness-github-copilot',\n  version: VERSION,\n} as const;\nconst GITHUB_COPILOT_IMPLEMENTATION_PACKAGE_JSON =\n  __GITHUB_COPILOT_IMPLEMENTATION_PACKAGE_JSON__;\nconst GITHUB_COPILOT_IMPLEMENTATION_PNPM_LOCK =\n  __GITHUB_COPILOT_IMPLEMENTATION_PNPM_LOCK_YAML__;\nconst GITHUB_COPILOT_IMPLEMENTATION_PNPM_WORKSPACE =\n  __GITHUB_COPILOT_IMPLEMENTATION_PNPM_WORKSPACE_YAML__;\nconst GITHUB_COPILOT_TOKEN_ENVIRONMENT_VARIABLES = new Set([\n  'COPILOT_GITHUB_TOKEN',\n  'GH_TOKEN',\n  'GITHUB_TOKEN',\n]);\nconst GITHUB_OAUTH_TOKEN_BODY_LENGTH = 36;\nconst GITHUB_OAUTH_SANDBOX_CREDENTIAL_MARKER = 'aisdkhc';\n\nexport type GitHubCopilotAuthenticationMode = ACPAuthenticationMode;\n\nexport type GitHubCopilotHarnessSettings = {\n  readonly auth?: GitHubCopilotAuthenticationMode;\n  readonly credentialForwarding?: HarnessV1CredentialForwarding;\n  readonly reasoningEffort?:\n    | 'none'\n    | 'minimal'\n    | 'low'\n    | 'medium'\n    | 'high'\n    | 'xhigh'\n    | 'max';\n  readonly mcpServers?: Record<string, unknown>;\n  readonly port?: number;\n  readonly portEndpoint?: HarnessV1PortEndpoint;\n  readonly startupTimeoutMs?: number;\n  readonly mintBridgeToken?: (sandboxId: string) => string;\n};\n\n/*\n * This catalog reflects the stable, non-MCP tool surface emitted by GitHub\n * Copilot CLI 1.0.82. Loose object schemas preserve compatibility when the\n * CLI adds fields without changing the established inputs.\n */\nconst GITHUB_COPILOT_BUILTIN_TOOLS = {\n  bash: {\n    ...commonTool('bash', {\n      nativeName: 'bash',\n      toolUseKind: 'bash',\n      inputSchema: z.looseObject({\n        command: z.string(),\n        description: z.string().optional(),\n        shellId: z.string().optional(),\n        mode: z.enum(['sync', 'async']).optional(),\n        detach: z.boolean().optional(),\n        initial_wait: z.number().optional(),\n      }),\n    }),\n  },\n  read_bash: {\n    ...tool({\n      title: 'Reading shell output',\n      inputSchema: z.looseObject({\n        shellId: z.string(),\n        delay: z.number(),\n      }),\n    }),\n    toolUseKind: 'readonly',\n  },\n  stop_bash: {\n    ...tool({\n      title: 'Stopping shell session',\n      inputSchema: z.looseObject({ shellId: z.string() }),\n    }),\n    toolUseKind: 'bash',\n  },\n  list_bash: {\n    ...tool({\n      title: 'list_bash',\n      inputSchema: z.looseObject({}),\n    }),\n    toolUseKind: 'readonly',\n  },\n  view: {\n    ...tool({\n      title: 'Viewing ',\n      inputSchema: z.looseObject({\n        path: z.string(),\n        view_range: z.array(z.number()).optional(),\n        forceReadLargeFiles: z.boolean().optional(),\n      }),\n    }),\n    toolUseKind: 'readonly',\n  },\n  create: {\n    ...tool({\n      title: 'Creating ',\n      inputSchema: z.looseObject({\n        path: z.string(),\n        file_text: z.string(),\n      }),\n    }),\n    toolUseKind: 'edit',\n  },\n  edit: {\n    ...tool({\n      title: 'Editing ',\n      inputSchema: z.looseObject({\n        path: z.string(),\n        old_str: z.string().optional(),\n        new_str: z.string(),\n      }),\n    }),\n    toolUseKind: 'edit',\n  },\n  web_fetch: {\n    ...tool({\n      title: 'Fetching ',\n      inputSchema: z.looseObject({\n        url: z.string(),\n        max_length: z.number().optional(),\n        start_index: z.number().optional(),\n        raw: z.boolean().optional(),\n      }),\n    }),\n    toolUseKind: 'readonly',\n  },\n  skill: tool({\n    title: 'Using skill: ',\n    inputSchema: z.looseObject({ skill: z.string() }),\n  }),\n  sql: tool({\n    inputSchema: z.looseObject({\n      description: z.string(),\n      query: z.string(),\n      database: z.enum(['session', 'session_store']).optional(),\n    }),\n  }),\n  read_agent: {\n    ...tool({\n      title: 'read_agent',\n      inputSchema: z.looseObject({\n        agent_id: z.string(),\n        wait: z.boolean().optional(),\n        timeout: z.number().optional(),\n        since_turn: z.number().int().nonnegative().optional(),\n      }),\n    }),\n    toolUseKind: 'readonly',\n  },\n  list_agents: {\n    ...tool({\n      title: 'list_agents',\n      inputSchema: z.looseObject({\n        include_completed: z.boolean().optional(),\n        scope: z.enum(['siblings', 'children', 'all']).optional(),\n      }),\n    }),\n    toolUseKind: 'readonly',\n  },\n  write_agent: tool({\n    title: 'write_agent',\n    inputSchema: z.looseObject({\n      message: z.string(),\n      agent_id: z.string().optional(),\n      agent_ids: z.array(z.string()).optional(),\n      scope: z.enum(['siblings', 'children']).optional(),\n    }),\n  }),\n  grep: {\n    ...commonTool('grep', {\n      nativeName: 'grep',\n      toolUseKind: 'readonly',\n      inputSchema: z.looseObject({\n        pattern: z.string(),\n        path: z.string().optional(),\n        paths: z.array(z.string()).optional(),\n        glob: z.string().optional(),\n        output_mode: z\n          .enum(['content', 'files_with_matches', 'count'])\n          .optional(),\n        case_insensitive: z.boolean().optional(),\n        multiline: z.boolean().optional(),\n        head_limit: z.number().optional(),\n        context: z.number().optional(),\n        before_context: z.number().optional(),\n        after_context: z.number().optional(),\n      }),\n    }),\n    title: 'Searching for ',\n  },\n  glob: {\n    ...commonTool('glob', {\n      nativeName: 'glob',\n      toolUseKind: 'readonly',\n      inputSchema: z.looseObject({\n        pattern: z.string(),\n        paths: z.array(z.string()).optional(),\n      }),\n    }),\n    title: 'Finding files matching ',\n  },\n  task: tool({\n    inputSchema: z.looseObject({\n      name: z.string(),\n      prompt: z.string(),\n      agent_type: z.enum([\n        'explore',\n        'task',\n        'general-purpose',\n        'code-review',\n        'research',\n        'security-review',\n      ]),\n      description: z.string(),\n      model: z.string().optional(),\n      context_tier: z.enum(['default', 'long_context']).optional(),\n      mode: z.enum(['sync', 'background']).optional(),\n    }),\n  }),\n} as const satisfies Record<string, HarnessV1BuiltinTool<any, any>>;\n\nexport type GitHubCopilotBuiltinTools = typeof GITHUB_COPILOT_BUILTIN_TOOLS;\n\nexport function createGitHubCopilot(\n  settings: GitHubCopilotHarnessSettings = {},\n): HarnessV1<GitHubCopilotBuiltinTools> {\n  const mcpToolTitlePrefixes = [\n    'github-mcp-server-',\n    ...Object.keys(settings.mcpServers ?? {}).map(name => `${name}-`),\n  ];\n\n  return createACP({\n    version: 'v1',\n    harnessId: 'github-copilot',\n    clientApp: GITHUB_COPILOT_CLIENT_APP,\n    source: {\n      type: 'npm-locked',\n      packageJson: GITHUB_COPILOT_IMPLEMENTATION_PACKAGE_JSON,\n      pnpmLockYaml: GITHUB_COPILOT_IMPLEMENTATION_PNPM_LOCK,\n      pnpmWorkspaceYaml: GITHUB_COPILOT_IMPLEMENTATION_PNPM_WORKSPACE,\n    },\n    executable: 'copilot',\n    args: [\n      '--acp',\n      '--stdio',\n      '--no-auto-update',\n      ...(settings.reasoningEffort == null\n        ? []\n        : [`--reasoning-effort=${settings.reasoningEffort}`]),\n    ],\n    auth: settings.auth,\n    resolveAuthenticationEnvironment:\n      resolveGitHubCopilotSubscriptionEnvironment,\n    /*\n     * The Copilot CLI drops every MCP server that a client passes in ACP\n     * `session/new` unless it is declared with the `http` or `sse` transport,\n     * so host tools must be exposed over the bridge's HTTP MCP endpoint.\n     */\n    hostToolMcpTransport: 'http',\n    forwardEnv: ['COPILOT_GH_HOST', 'GH_HOST'],\n    credentialEnv: ['COPILOT_GITHUB_TOKEN', 'GH_TOKEN', 'GITHUB_TOKEN'],\n    credentialBrokering: ({ env, sandboxEnv, headers }) => {\n      const transformations: HarnessV1RequestTransformation[] = [];\n      const githubHost = normalizeGitHubHost(\n        env.COPILOT_GH_HOST ?? env.GH_HOST ?? 'github.com',\n      );\n      const githubHosts = [\n        githubHost,\n        `*.${githubHost}`,\n        ...(githubHost === 'github.com'\n          ? ['githubcopilot.com', '*.githubcopilot.com']\n          : []),\n      ];\n\n      for (const host of githubHosts) {\n        if (env.COPILOT_GITHUB_TOKEN && sandboxEnv?.COPILOT_GITHUB_TOKEN) {\n          transformations.push(\n            {\n              match: {\n                host,\n                headers: [\n                  {\n                    key: { exact: 'Authorization' },\n                    value: {\n                      exact: `Bearer ${sandboxEnv.COPILOT_GITHUB_TOKEN}`,\n                    },\n                  },\n                ],\n              },\n              transform: {\n                headers: {\n                  Authorization: `Bearer ${env.COPILOT_GITHUB_TOKEN}`,\n                },\n              },\n            },\n            {\n              match: {\n                host,\n                headers: [\n                  {\n                    key: { exact: 'Authorization' },\n                    value: {\n                      exact: `token ${sandboxEnv.COPILOT_GITHUB_TOKEN}`,\n                    },\n                  },\n                ],\n              },\n              transform: {\n                headers: {\n                  Authorization: `token ${env.COPILOT_GITHUB_TOKEN}`,\n                },\n              },\n            },\n          );\n        }\n\n        if (env.GH_TOKEN && sandboxEnv?.GH_TOKEN) {\n          transformations.push(\n            {\n              match: {\n                host,\n                headers: [\n                  {\n                    key: { exact: 'Authorization' },\n                    value: { exact: `Bearer ${sandboxEnv.GH_TOKEN}` },\n                  },\n                ],\n              },\n              transform: {\n                headers: { Authorization: `Bearer ${env.GH_TOKEN}` },\n              },\n            },\n            {\n              match: {\n                host,\n                headers: [\n                  {\n                    key: { exact: 'Authorization' },\n                    value: { exact: `token ${sandboxEnv.GH_TOKEN}` },\n                  },\n                ],\n              },\n              transform: {\n                headers: { Authorization: `token ${env.GH_TOKEN}` },\n              },\n            },\n          );\n        }\n\n        if (env.GITHUB_TOKEN && sandboxEnv?.GITHUB_TOKEN) {\n          transformations.push(\n            {\n              match: {\n                host,\n                headers: [\n                  {\n                    key: { exact: 'Authorization' },\n                    value: { exact: `Bearer ${sandboxEnv.GITHUB_TOKEN}` },\n                  },\n                ],\n              },\n              transform: {\n                headers: { Authorization: `Bearer ${env.GITHUB_TOKEN}` },\n              },\n            },\n            {\n              match: {\n                host,\n                headers: [\n                  {\n                    key: { exact: 'Authorization' },\n                    value: { exact: `token ${sandboxEnv.GITHUB_TOKEN}` },\n                  },\n                ],\n              },\n              transform: {\n                headers: { Authorization: `token ${env.GITHUB_TOKEN}` },\n              },\n            },\n          );\n        }\n      }\n\n      const providerCredential = env.COPILOT_PROVIDER_API_KEY;\n      const sandboxProviderCredential = sandboxEnv?.COPILOT_PROVIDER_API_KEY;\n      const providerBaseUrl = env.COPILOT_PROVIDER_BASE_URL;\n      if (providerCredential && sandboxProviderCredential && providerBaseUrl) {\n        transformations.push(\n          createCredentialRequestTransformation({\n            matchUrl: providerBaseUrl,\n            matchHeaders: {\n              Authorization: `Bearer ${sandboxProviderCredential}`,\n            },\n            transformHeaders: {\n              ...headers,\n              Authorization: `Bearer ${providerCredential}`,\n            },\n          }),\n        );\n      } else if (headers != null) {\n        const copilotHosts =\n          githubHost === 'github.com'\n            ? ['githubcopilot.com', '*.githubcopilot.com']\n            : [githubHost, `*.${githubHost}`];\n        for (const host of copilotHosts) {\n          transformations.push({\n            match: { host },\n            transform: { headers },\n          });\n        }\n      }\n\n      return transformations;\n    },\n    credentialForwarding: createGitHubCopilotCredentialForwarding({\n      credentialForwarding: settings.credentialForwarding,\n    }),\n    providerAuthentication: {\n      gateway: {\n        env: {\n          COPILOT_PROVIDER_BASE_URL: {\n            $source: 'gateway-base-url',\n            ensureSuffix: '/v1',\n          },\n          COPILOT_PROVIDER_TYPE: 'openai',\n          COPILOT_PROVIDER_API_KEY: {\n            $source: 'gateway-api-key',\n          },\n          COPILOT_PROVIDER_WIRE_API: 'responses',\n          COPILOT_MODEL: 'openai/gpt-5.5',\n          COPILOT_PROVIDER_HEADERS: {\n            $source: 'client-app',\n            prefix: 'x-client-app: ',\n          },\n        },\n      },\n    },\n    modelMapping: {\n      type: 'session-config-option',\n      path: 'model',\n    },\n    skillsDirectory: '.copilot/skills',\n    instructionMapping: {\n      type: 'filesystem',\n      path: '.copilot/copilot-instructions.md',\n    },\n    builtinTools: GITHUB_COPILOT_BUILTIN_TOOLS,\n    mcpServers: settings.mcpServers,\n    isMcpToolCall: toolCall =>\n      mcpToolTitlePrefixes.some(prefix => toolCall.title.startsWith(prefix)),\n    port: settings.port,\n    portEndpoint: settings.portEndpoint,\n    startupTimeoutMs: settings.startupTimeoutMs,\n    mintBridgeToken: settings.mintBridgeToken,\n  });\n}\n\nfunction createGitHubCopilotCredentialForwarding({\n  credentialForwarding,\n}: {\n  credentialForwarding: HarnessV1CredentialForwarding | undefined;\n}): HarnessV1CredentialForwarding {\n  return ({ credential, environmentVariableName }) => {\n    const sandboxCredential =\n      GITHUB_COPILOT_TOKEN_ENVIRONMENT_VARIABLES.has(environmentVariableName) &&\n      isSandboxCredentialPlaceholder(credential)\n        ? createGitHubOAuthSandboxCredentialPlaceholder({ credential })\n        : credential;\n    return credentialForwarding == null\n      ? sandboxCredential\n      : credentialForwarding({\n          credential: sandboxCredential,\n          environmentVariableName,\n        });\n  };\n}\n\nfunction createGitHubOAuthSandboxCredentialPlaceholder({\n  credential,\n}: {\n  credential: string;\n}): string {\n  /*\n   * Copilot CLI validates environment credentials as GitHub token formats\n   * before making the request that credential brokering can transform. GitHub\n   * OAuth tokens use `gho_` followed by a 36-character alphanumeric body.\n   */\n  const tokenBody = createHash('sha256')\n    .update(credential)\n    .digest('hex')\n    .slice(\n      0,\n      GITHUB_OAUTH_TOKEN_BODY_LENGTH -\n        GITHUB_OAUTH_SANDBOX_CREDENTIAL_MARKER.length,\n    );\n  return `gho_${GITHUB_OAUTH_SANDBOX_CREDENTIAL_MARKER}${tokenBody}`;\n}\n","import { execFile } from 'node:child_process';\nimport { constants } from 'node:fs';\nimport { access, readFile } from 'node:fs/promises';\nimport { homedir } from 'node:os';\nimport { join, resolve } from 'node:path';\nimport { promisify } from 'node:util';\nimport type { ACPAuthenticationMode } from '@ai-sdk/harness-acp';\nimport {\n  isHarnessAuthenticationEnvironment,\n  isLinux,\n  isMacOS,\n  isWindows,\n  readLinuxSecretServicePassword,\n  readMacOSKeychainPassword,\n  readWindowsCredentialManagerPassword,\n  shouldResolveNativeSubscription,\n} from '@ai-sdk/harness/utils';\nimport { isRecord } from '@ai-sdk/provider-utils';\nimport { parse, type ParseError } from 'jsonc-parser';\n\nconst COPILOT_KEYRING_SERVICE = 'copilot-cli';\nconst execFileAsync = promisify(execFile);\n\ntype GitHubCopilotAccount = {\n  readonly host: string;\n  readonly login: string;\n};\n\nexport type GitHubCopilotSubscription = {\n  readonly token: string;\n  readonly host: string;\n};\n\ntype ReadSecureCredential = (options: {\n  service: string;\n  account: string;\n}) => Promise<string | undefined>;\n\ntype FindGitHubCliExecutable = (options: {\n  env: Readonly<Record<string, string | undefined>>;\n  platform: NodeJS.Platform;\n}) => Promise<string | undefined>;\n\ntype ReadGitHubCliToken = (options: {\n  executable: string;\n  hostname: string;\n  env: Readonly<Record<string, string | undefined>>;\n}) => Promise<string | undefined>;\n\nexport async function resolveGitHubCopilotSubscriptionEnvironment({\n  auth,\n  env,\n  readSubscription = readGitHubCopilotSubscription,\n}: {\n  auth: ACPAuthenticationMode | undefined;\n  env: Readonly<Record<string, string | undefined>>;\n  readSubscription?: (options: {\n    env: Readonly<Record<string, string | undefined>>;\n  }) => Promise<GitHubCopilotSubscription | undefined>;\n}): Promise<Readonly<Record<string, string | undefined>>> {\n  if (isHarnessAuthenticationEnvironment(auth)) return auth;\n  if (\n    !shouldResolveNativeSubscription({\n      auth,\n      env,\n      hasDirectCredential:\n        env.COPILOT_GITHUB_TOKEN != null ||\n        env.GH_TOKEN != null ||\n        env.GITHUB_TOKEN != null,\n    })\n  ) {\n    return env;\n  }\n\n  const subscription = await readSubscription({ env });\n  if (subscription == null) return env;\n\n  return {\n    ...env,\n    COPILOT_GITHUB_TOKEN: subscription.token,\n    COPILOT_GH_HOST: normalizeGitHubHost(subscription.host),\n  };\n}\n\nexport async function readGitHubCopilotSubscription({\n  env = process.env,\n  homeDirectory = homedir(),\n  platform = process.platform,\n  readSecureCredential,\n  findGitHubCliExecutable = findHostGitHubCliExecutable,\n  readGitHubCliToken = readHostGitHubCliToken,\n}: {\n  env?: Readonly<Record<string, string | undefined>>;\n  homeDirectory?: string;\n  platform?: NodeJS.Platform;\n  readSecureCredential?: ReadSecureCredential;\n  findGitHubCliExecutable?: FindGitHubCliExecutable;\n  readGitHubCliToken?: ReadGitHubCliToken;\n} = {}): Promise<GitHubCopilotSubscription | undefined> {\n  const copilotHome = resolve(\n    env.COPILOT_HOME ?? join(homeDirectory, '.copilot'),\n  );\n  const config = await readGitHubCopilotConfig({\n    path: join(copilotHome, 'config.json'),\n  });\n  const account = selectGitHubCopilotAccount({ config });\n\n  if (account != null) {\n    const accountKey = `${account.host}:${account.login}`;\n    const secureToken = await (\n      readSecureCredential ??\n      (options => readGitHubCopilotSecureCredential({ ...options, platform }))\n    )({\n      service: COPILOT_KEYRING_SERVICE,\n      account: accountKey,\n    }).catch(() => undefined);\n    if (isNonEmptyString(secureToken)) {\n      return { token: secureToken, host: account.host };\n    }\n\n    const plaintextToken = getPlaintextToken({ config, accountKey });\n    if (plaintextToken != null) {\n      return { token: plaintextToken, host: account.host };\n    }\n  }\n\n  const host =\n    account?.host ??\n    normalizeGitHubOrigin(env.COPILOT_GH_HOST ?? env.GH_HOST ?? 'github.com');\n  if (host == null) return undefined;\n\n  const executable = await findGitHubCliExecutable({ env, platform });\n  if (executable == null) return undefined;\n\n  const token = await readGitHubCliToken({\n    executable,\n    hostname: normalizeGitHubHost(host),\n    env,\n  }).catch(() => undefined);\n  return isNonEmptyString(token) ? { token: token.trim(), host } : undefined;\n}\n\nexport async function findHostGitHubCliExecutable({\n  env,\n  platform,\n}: {\n  env: Readonly<Record<string, string | undefined>>;\n  platform: NodeJS.Platform;\n}): Promise<string | undefined> {\n  const path = env.PATH ?? env.Path ?? env.path;\n  if (path == null) return undefined;\n\n  const separator = isWindows(platform) ? ';' : ':';\n  const names = isWindows(platform)\n    ? getWindowsGitHubCliExecutableNames({ pathExt: env.PATHEXT })\n    : ['gh'];\n  const mode = isWindows(platform) ? constants.F_OK : constants.X_OK;\n\n  for (const directory of path.split(separator)) {\n    const normalizedDirectory = directory.replace(/^\"|\"$/g, '');\n    if (normalizedDirectory.length === 0) continue;\n    for (const executableName of names) {\n      const candidate = resolve(normalizedDirectory, executableName);\n      try {\n        await access(candidate, mode);\n        return candidate;\n      } catch {}\n    }\n  }\n\n  return undefined;\n}\n\nasync function readGitHubCopilotConfig({\n  path,\n}: {\n  path: string;\n}): Promise<Record<string, unknown> | undefined> {\n  const text = await readFile(path, 'utf8').catch(() => undefined);\n  if (text == null) return undefined;\n\n  const errors: ParseError[] = [];\n  const value = parse(text, errors, { allowTrailingComma: true });\n  return errors.length === 0 && isRecord(value) ? value : undefined;\n}\n\nfunction selectGitHubCopilotAccount({\n  config,\n}: {\n  config: Record<string, unknown> | undefined;\n}): GitHubCopilotAccount | undefined {\n  if (config == null) return undefined;\n\n  for (const value of [config.last_logged_in_user, config.lastLoggedInUser]) {\n    const account = toGitHubCopilotAccount(value);\n    if (account != null) return account;\n  }\n\n  for (const values of [config.logged_in_users, config.loggedInUsers]) {\n    if (!Array.isArray(values)) continue;\n    for (const value of values) {\n      const account = toGitHubCopilotAccount(value);\n      if (account != null) return account;\n    }\n  }\n  return undefined;\n}\n\nfunction toGitHubCopilotAccount(\n  value: unknown,\n): GitHubCopilotAccount | undefined {\n  if (\n    !isRecord(value) ||\n    !isNonEmptyString(value.host) ||\n    !isNonEmptyString(value.login)\n  ) {\n    return undefined;\n  }\n  const host = normalizeGitHubOrigin(value.host);\n  return host == null ? undefined : { host, login: value.login };\n}\n\nfunction getPlaintextToken({\n  config,\n  accountKey,\n}: {\n  config: Record<string, unknown> | undefined;\n  accountKey: string;\n}): string | undefined {\n  if (config == null || !isRecord(config.copilotTokens)) return undefined;\n  const token = config.copilotTokens[accountKey];\n  return isNonEmptyString(token) ? token : undefined;\n}\n\nasync function readGitHubCopilotSecureCredential({\n  service,\n  account,\n  platform,\n}: {\n  service: string;\n  account: string;\n  platform: NodeJS.Platform;\n}): Promise<string | undefined> {\n  if (isMacOS(platform)) {\n    return readMacOSKeychainPassword({ service, account });\n  }\n  if (isLinux(platform)) {\n    return readLinuxSecretServicePassword({\n      attributes: { service, username: account },\n    });\n  }\n  if (isWindows(platform)) {\n    return readWindowsCredentialManagerPassword({\n      targetName: `${account}.${service}`,\n    });\n  }\n  return undefined;\n}\n\nasync function readHostGitHubCliToken({\n  executable,\n  hostname,\n  env,\n}: {\n  executable: string;\n  hostname: string;\n  env: Readonly<Record<string, string | undefined>>;\n}): Promise<string | undefined> {\n  try {\n    const result = await execFileAsync(\n      executable,\n      ['auth', 'token', '--hostname', hostname],\n      {\n        env: { ...env },\n        timeout: 10_000,\n        windowsHide: true,\n      },\n    );\n    return isNonEmptyString(result.stdout) ? result.stdout.trim() : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction getWindowsGitHubCliExecutableNames({\n  pathExt,\n}: {\n  pathExt: string | undefined;\n}): ReadonlyArray<string> {\n  const extensions = (pathExt ?? '.COM;.EXE;.BAT;.CMD')\n    .split(';')\n    .filter(isNonEmptyString);\n  return ['gh', ...extensions.map(extension => `gh${extension}`)];\n}\n\nfunction normalizeGitHubOrigin(host: string): string | undefined {\n  try {\n    return new URL(host.includes('://') ? host : `https://${host}`).origin;\n  } catch {\n    return undefined;\n  }\n}\n\nexport function normalizeGitHubHost(host: string): string {\n  return new URL(host.includes('://') ? host : `https://${host}`).hostname;\n}\n\nfunction isNonEmptyString(value: unknown): value is string {\n  return typeof value === 'string' && value.trim().length > 0;\n}\n","declare const __PACKAGE_VERSION__: string | undefined;\nexport const VERSION: string =\n  typeof __PACKAGE_VERSION__ !== 'undefined'\n    ? __PACKAGE_VERSION__\n    : '0.0.0-test';\n","import { createGitHubCopilot } from './github-copilot-harness';\n\n/**\n * Default GitHub Copilot harness instance. Equivalent to\n * `createGitHubCopilot()`.\n */\nexport const githubCopilot = createGitHubCopilot();\n\nexport { createGitHubCopilot } from './github-copilot-harness';\nexport type {\n  GitHubCopilotAuthenticationMode,\n  GitHubCopilotBuiltinTools,\n  GitHubCopilotHarnessSettings,\n} from './github-copilot-harness';\nexport { VERSION } from './version';\n"],"mappings":";AAAA,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,OAMK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,iBAA6C;AACtD,SAAS,YAAY;AACrB,SAAS,SAAS;;;ACflB,SAAS,gBAAgB;AACzB,SAAS,iBAAiB;AAC1B,SAAS,QAAQ,gBAAgB;AACjC,SAAS,eAAe;AACxB,SAAS,MAAM,eAAe;AAC9B,SAAS,iBAAiB;AAE1B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gBAAgB;AACzB,SAAS,aAA8B;AAEvC,IAAM,0BAA0B;AAChC,IAAM,gBAAgB,UAAU,QAAQ;AA4BxC,eAAsB,4CAA4C;AAAA,EAChE;AAAA,EACA;AAAA,EACA,mBAAmB;AACrB,GAM0D;AACxD,MAAI,mCAAmC,IAAI,EAAG,QAAO;AACrD,MACE,CAAC,gCAAgC;AAAA,IAC/B;AAAA,IACA;AAAA,IACA,qBACE,IAAI,wBAAwB,QAC5B,IAAI,YAAY,QAChB,IAAI,gBAAgB;AAAA,EACxB,CAAC,GACD;AACA,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,MAAM,iBAAiB,EAAE,IAAI,CAAC;AACnD,MAAI,gBAAgB,KAAM,QAAO;AAEjC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,sBAAsB,aAAa;AAAA,IACnC,iBAAiB,oBAAoB,aAAa,IAAI;AAAA,EACxD;AACF;AAEA,eAAsB,8BAA8B;AAAA,EAClD,MAAM,QAAQ;AAAA,EACd,gBAAgB,QAAQ;AAAA,EACxB,WAAW,QAAQ;AAAA,EACnB;AAAA,EACA,0BAA0B;AAAA,EAC1B,qBAAqB;AACvB,IAOI,CAAC,GAAmD;AACtD,QAAM,cAAc;AAAA,IAClB,IAAI,gBAAgB,KAAK,eAAe,UAAU;AAAA,EACpD;AACA,QAAM,SAAS,MAAM,wBAAwB;AAAA,IAC3C,MAAM,KAAK,aAAa,aAAa;AAAA,EACvC,CAAC;AACD,QAAM,UAAU,2BAA2B,EAAE,OAAO,CAAC;AAErD,MAAI,WAAW,MAAM;AACnB,UAAM,aAAa,GAAG,QAAQ,IAAI,IAAI,QAAQ,KAAK;AACnD,UAAM,cAAc,OAClB,yBACC,aAAW,kCAAkC,EAAE,GAAG,SAAS,SAAS,CAAC,IACtE;AAAA,MACA,SAAS;AAAA,MACT,SAAS;AAAA,IACX,CAAC,EAAE,MAAM,MAAM,MAAS;AACxB,QAAI,iBAAiB,WAAW,GAAG;AACjC,aAAO,EAAE,OAAO,aAAa,MAAM,QAAQ,KAAK;AAAA,IAClD;AAEA,UAAM,iBAAiB,kBAAkB,EAAE,QAAQ,WAAW,CAAC;AAC/D,QAAI,kBAAkB,MAAM;AAC1B,aAAO,EAAE,OAAO,gBAAgB,MAAM,QAAQ,KAAK;AAAA,IACrD;AAAA,EACF;AAEA,QAAM,OACJ,SAAS,QACT,sBAAsB,IAAI,mBAAmB,IAAI,WAAW,YAAY;AAC1E,MAAI,QAAQ,KAAM,QAAO;AAEzB,QAAM,aAAa,MAAM,wBAAwB,EAAE,KAAK,SAAS,CAAC;AAClE,MAAI,cAAc,KAAM,QAAO;AAE/B,QAAM,QAAQ,MAAM,mBAAmB;AAAA,IACrC;AAAA,IACA,UAAU,oBAAoB,IAAI;AAAA,IAClC;AAAA,EACF,CAAC,EAAE,MAAM,MAAM,MAAS;AACxB,SAAO,iBAAiB,KAAK,IAAI,EAAE,OAAO,MAAM,KAAK,GAAG,KAAK,IAAI;AACnE;AAEA,eAAsB,4BAA4B;AAAA,EAChD;AAAA,EACA;AACF,GAGgC;AAC9B,QAAM,OAAO,IAAI,QAAQ,IAAI,QAAQ,IAAI;AACzC,MAAI,QAAQ,KAAM,QAAO;AAEzB,QAAM,YAAY,UAAU,QAAQ,IAAI,MAAM;AAC9C,QAAM,QAAQ,UAAU,QAAQ,IAC5B,mCAAmC,EAAE,SAAS,IAAI,QAAQ,CAAC,IAC3D,CAAC,IAAI;AACT,QAAM,OAAO,UAAU,QAAQ,IAAI,UAAU,OAAO,UAAU;AAE9D,aAAW,aAAa,KAAK,MAAM,SAAS,GAAG;AAC7C,UAAM,sBAAsB,UAAU,QAAQ,UAAU,EAAE;AAC1D,QAAI,oBAAoB,WAAW,EAAG;AACtC,eAAW,kBAAkB,OAAO;AAClC,YAAM,YAAY,QAAQ,qBAAqB,cAAc;AAC7D,UAAI;AACF,cAAM,OAAO,WAAW,IAAI;AAC5B,eAAO;AAAA,MACT,QAAQ;AAAA,MAAC;AAAA,IACX;AAAA,EACF;AAEA,SAAO;AACT;AAEA,eAAe,wBAAwB;AAAA,EACrC;AACF,GAEiD;AAC/C,QAAM,OAAO,MAAM,SAAS,MAAM,MAAM,EAAE,MAAM,MAAM,MAAS;AAC/D,MAAI,QAAQ,KAAM,QAAO;AAEzB,QAAM,SAAuB,CAAC;AAC9B,QAAM,QAAQ,MAAM,MAAM,QAAQ,EAAE,oBAAoB,KAAK,CAAC;AAC9D,SAAO,OAAO,WAAW,KAAK,SAAS,KAAK,IAAI,QAAQ;AAC1D;AAEA,SAAS,2BAA2B;AAAA,EAClC;AACF,GAEqC;AACnC,MAAI,UAAU,KAAM,QAAO;AAE3B,aAAW,SAAS,CAAC,OAAO,qBAAqB,OAAO,gBAAgB,GAAG;AACzE,UAAM,UAAU,uBAAuB,KAAK;AAC5C,QAAI,WAAW,KAAM,QAAO;AAAA,EAC9B;AAEA,aAAW,UAAU,CAAC,OAAO,iBAAiB,OAAO,aAAa,GAAG;AACnE,QAAI,CAAC,MAAM,QAAQ,MAAM,EAAG;AAC5B,eAAW,SAAS,QAAQ;AAC1B,YAAM,UAAU,uBAAuB,KAAK;AAC5C,UAAI,WAAW,KAAM,QAAO;AAAA,IAC9B;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,uBACP,OACkC;AAClC,MACE,CAAC,SAAS,KAAK,KACf,CAAC,iBAAiB,MAAM,IAAI,KAC5B,CAAC,iBAAiB,MAAM,KAAK,GAC7B;AACA,WAAO;AAAA,EACT;AACA,QAAM,OAAO,sBAAsB,MAAM,IAAI;AAC7C,SAAO,QAAQ,OAAO,SAAY,EAAE,MAAM,OAAO,MAAM,MAAM;AAC/D;AAEA,SAAS,kBAAkB;AAAA,EACzB;AAAA,EACA;AACF,GAGuB;AACrB,MAAI,UAAU,QAAQ,CAAC,SAAS,OAAO,aAAa,EAAG,QAAO;AAC9D,QAAM,QAAQ,OAAO,cAAc,UAAU;AAC7C,SAAO,iBAAiB,KAAK,IAAI,QAAQ;AAC3C;AAEA,eAAe,kCAAkC;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AACF,GAIgC;AAC9B,MAAI,QAAQ,QAAQ,GAAG;AACrB,WAAO,0BAA0B,EAAE,SAAS,QAAQ,CAAC;AAAA,EACvD;AACA,MAAI,QAAQ,QAAQ,GAAG;AACrB,WAAO,+BAA+B;AAAA,MACpC,YAAY,EAAE,SAAS,UAAU,QAAQ;AAAA,IAC3C,CAAC;AAAA,EACH;AACA,MAAI,UAAU,QAAQ,GAAG;AACvB,WAAO,qCAAqC;AAAA,MAC1C,YAAY,GAAG,OAAO,IAAI,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,eAAe,uBAAuB;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AACF,GAIgC;AAC9B,MAAI;AACF,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA,CAAC,QAAQ,SAAS,cAAc,QAAQ;AAAA,MACxC;AAAA,QACE,KAAK,EAAE,GAAG,IAAI;AAAA,QACd,SAAS;AAAA,QACT,aAAa;AAAA,MACf;AAAA,IACF;AACA,WAAO,iBAAiB,OAAO,MAAM,IAAI,OAAO,OAAO,KAAK,IAAI;AAAA,EAClE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,mCAAmC;AAAA,EAC1C;AACF,GAE0B;AACxB,QAAM,cAAc,WAAW,uBAC5B,MAAM,GAAG,EACT,OAAO,gBAAgB;AAC1B,SAAO,CAAC,MAAM,GAAG,WAAW,IAAI,eAAa,KAAK,SAAS,EAAE,CAAC;AAChE;AAEA,SAAS,sBAAsB,MAAkC;AAC/D,MAAI;AACF,WAAO,IAAI,IAAI,KAAK,SAAS,KAAK,IAAI,OAAO,WAAW,IAAI,EAAE,EAAE;AAAA,EAClE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,oBAAoB,MAAsB;AACxD,SAAO,IAAI,IAAI,KAAK,SAAS,KAAK,IAAI,OAAO,WAAW,IAAI,EAAE,EAAE;AAClE;AAEA,SAAS,iBAAiB,OAAiC;AACzD,SAAO,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS;AAC5D;;;ACpTO,IAAM,UACX,OACI,UACA;;;AFsBN,IAAM,4BAA4B;AAAA,EAChC,MAAM;AAAA,EACN,SAAS;AACX;AACA,IAAM,6CACJ;AACF,IAAM,0CACJ;AACF,IAAM,+CACJ;AACF,IAAM,6CAA6C,oBAAI,IAAI;AAAA,EACzD;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,iCAAiC;AACvC,IAAM,yCAAyC;AA2B/C,IAAM,+BAA+B;AAAA,EACnC,MAAM;AAAA,IACJ,GAAG,WAAW,QAAQ;AAAA,MACpB,YAAY;AAAA,MACZ,aAAa;AAAA,MACb,aAAa,EAAE,YAAY;AAAA,QACzB,SAAS,EAAE,OAAO;AAAA,QAClB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,QACjC,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,QAC7B,MAAM,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC,EAAE,SAAS;AAAA,QACzC,QAAQ,EAAE,QAAQ,EAAE,SAAS;AAAA,QAC7B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,MACpC,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA,EACA,WAAW;AAAA,IACT,GAAG,KAAK;AAAA,MACN,OAAO;AAAA,MACP,aAAa,EAAE,YAAY;AAAA,QACzB,SAAS,EAAE,OAAO;AAAA,QAClB,OAAO,EAAE,OAAO;AAAA,MAClB,CAAC;AAAA,IACH,CAAC;AAAA,IACD,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,GAAG,KAAK;AAAA,MACN,OAAO;AAAA,MACP,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAAA,IACpD,CAAC;AAAA,IACD,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,GAAG,KAAK;AAAA,MACN,OAAO;AAAA,MACP,aAAa,EAAE,YAAY,CAAC,CAAC;AAAA,IAC/B,CAAC;AAAA,IACD,aAAa;AAAA,EACf;AAAA,EACA,MAAM;AAAA,IACJ,GAAG,KAAK;AAAA,MACN,OAAO;AAAA,MACP,aAAa,EAAE,YAAY;AAAA,QACzB,MAAM,EAAE,OAAO;AAAA,QACf,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,QACzC,qBAAqB,EAAE,QAAQ,EAAE,SAAS;AAAA,MAC5C,CAAC;AAAA,IACH,CAAC;AAAA,IACD,aAAa;AAAA,EACf;AAAA,EACA,QAAQ;AAAA,IACN,GAAG,KAAK;AAAA,MACN,OAAO;AAAA,MACP,aAAa,EAAE,YAAY;AAAA,QACzB,MAAM,EAAE,OAAO;AAAA,QACf,WAAW,EAAE,OAAO;AAAA,MACtB,CAAC;AAAA,IACH,CAAC;AAAA,IACD,aAAa;AAAA,EACf;AAAA,EACA,MAAM;AAAA,IACJ,GAAG,KAAK;AAAA,MACN,OAAO;AAAA,MACP,aAAa,EAAE,YAAY;AAAA,QACzB,MAAM,EAAE,OAAO;AAAA,QACf,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,QAC7B,SAAS,EAAE,OAAO;AAAA,MACpB,CAAC;AAAA,IACH,CAAC;AAAA,IACD,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,GAAG,KAAK;AAAA,MACN,OAAO;AAAA,MACP,aAAa,EAAE,YAAY;AAAA,QACzB,KAAK,EAAE,OAAO;AAAA,QACd,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,QAChC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,QACjC,KAAK,EAAE,QAAQ,EAAE,SAAS;AAAA,MAC5B,CAAC;AAAA,IACH,CAAC;AAAA,IACD,aAAa;AAAA,EACf;AAAA,EACA,OAAO,KAAK;AAAA,IACV,OAAO;AAAA,IACP,aAAa,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,EAClD,CAAC;AAAA,EACD,KAAK,KAAK;AAAA,IACR,aAAa,EAAE,YAAY;AAAA,MACzB,aAAa,EAAE,OAAO;AAAA,MACtB,OAAO,EAAE,OAAO;AAAA,MAChB,UAAU,EAAE,KAAK,CAAC,WAAW,eAAe,CAAC,EAAE,SAAS;AAAA,IAC1D,CAAC;AAAA,EACH,CAAC;AAAA,EACD,YAAY;AAAA,IACV,GAAG,KAAK;AAAA,MACN,OAAO;AAAA,MACP,aAAa,EAAE,YAAY;AAAA,QACzB,UAAU,EAAE,OAAO;AAAA,QACnB,MAAM,EAAE,QAAQ,EAAE,SAAS;AAAA,QAC3B,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,QAC7B,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,MACtD,CAAC;AAAA,IACH,CAAC;AAAA,IACD,aAAa;AAAA,EACf;AAAA,EACA,aAAa;AAAA,IACX,GAAG,KAAK;AAAA,MACN,OAAO;AAAA,MACP,aAAa,EAAE,YAAY;AAAA,QACzB,mBAAmB,EAAE,QAAQ,EAAE,SAAS;AAAA,QACxC,OAAO,EAAE,KAAK,CAAC,YAAY,YAAY,KAAK,CAAC,EAAE,SAAS;AAAA,MAC1D,CAAC;AAAA,IACH,CAAC;AAAA,IACD,aAAa;AAAA,EACf;AAAA,EACA,aAAa,KAAK;AAAA,IAChB,OAAO;AAAA,IACP,aAAa,EAAE,YAAY;AAAA,MACzB,SAAS,EAAE,OAAO;AAAA,MAClB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,MAC9B,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACxC,OAAO,EAAE,KAAK,CAAC,YAAY,UAAU,CAAC,EAAE,SAAS;AAAA,IACnD,CAAC;AAAA,EACH,CAAC;AAAA,EACD,MAAM;AAAA,IACJ,GAAG,WAAW,QAAQ;AAAA,MACpB,YAAY;AAAA,MACZ,aAAa;AAAA,MACb,aAAa,EAAE,YAAY;AAAA,QACzB,SAAS,EAAE,OAAO;AAAA,QAClB,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,QAC1B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,QACpC,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,QAC1B,aAAa,EACV,KAAK,CAAC,WAAW,sBAAsB,OAAO,CAAC,EAC/C,SAAS;AAAA,QACZ,kBAAkB,EAAE,QAAQ,EAAE,SAAS;AAAA,QACvC,WAAW,EAAE,QAAQ,EAAE,SAAS;AAAA,QAChC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,QAChC,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,QAC7B,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,QACpC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,MACrC,CAAC;AAAA,IACH,CAAC;AAAA,IACD,OAAO;AAAA,EACT;AAAA,EACA,MAAM;AAAA,IACJ,GAAG,WAAW,QAAQ;AAAA,MACpB,YAAY;AAAA,MACZ,aAAa;AAAA,MACb,aAAa,EAAE,YAAY;AAAA,QACzB,SAAS,EAAE,OAAO;AAAA,QAClB,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACtC,CAAC;AAAA,IACH,CAAC;AAAA,IACD,OAAO;AAAA,EACT;AAAA,EACA,MAAM,KAAK;AAAA,IACT,aAAa,EAAE,YAAY;AAAA,MACzB,MAAM,EAAE,OAAO;AAAA,MACf,QAAQ,EAAE,OAAO;AAAA,MACjB,YAAY,EAAE,KAAK;AAAA,QACjB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,MACD,aAAa,EAAE,OAAO;AAAA,MACtB,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,MAC3B,cAAc,EAAE,KAAK,CAAC,WAAW,cAAc,CAAC,EAAE,SAAS;AAAA,MAC3D,MAAM,EAAE,KAAK,CAAC,QAAQ,YAAY,CAAC,EAAE,SAAS;AAAA,IAChD,CAAC;AAAA,EACH,CAAC;AACH;AAIO,SAAS,oBACd,WAAyC,CAAC,GACJ;AACtC,QAAM,uBAAuB;AAAA,IAC3B;AAAA,IACA,GAAG,OAAO,KAAK,SAAS,cAAc,CAAC,CAAC,EAAE,IAAI,UAAQ,GAAG,IAAI,GAAG;AAAA,EAClE;AAEA,SAAO,UAAU;AAAA,IACf,SAAS;AAAA,IACT,WAAW;AAAA,IACX,WAAW;AAAA,IACX,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,MACb,cAAc;AAAA,MACd,mBAAmB;AAAA,IACrB;AAAA,IACA,YAAY;AAAA,IACZ,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAI,SAAS,mBAAmB,OAC5B,CAAC,IACD,CAAC,sBAAsB,SAAS,eAAe,EAAE;AAAA,IACvD;AAAA,IACA,MAAM,SAAS;AAAA,IACf,kCACE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMF,sBAAsB;AAAA,IACtB,YAAY,CAAC,mBAAmB,SAAS;AAAA,IACzC,eAAe,CAAC,wBAAwB,YAAY,cAAc;AAAA,IAClE,qBAAqB,CAAC,EAAE,KAAK,YAAY,QAAQ,MAAM;AACrD,YAAM,kBAAoD,CAAC;AAC3D,YAAM,aAAa;AAAA,QACjB,IAAI,mBAAmB,IAAI,WAAW;AAAA,MACxC;AACA,YAAM,cAAc;AAAA,QAClB;AAAA,QACA,KAAK,UAAU;AAAA,QACf,GAAI,eAAe,eACf,CAAC,qBAAqB,qBAAqB,IAC3C,CAAC;AAAA,MACP;AAEA,iBAAW,QAAQ,aAAa;AAC9B,YAAI,IAAI,wBAAwB,YAAY,sBAAsB;AAChE,0BAAgB;AAAA,YACd;AAAA,cACE,OAAO;AAAA,gBACL;AAAA,gBACA,SAAS;AAAA,kBACP;AAAA,oBACE,KAAK,EAAE,OAAO,gBAAgB;AAAA,oBAC9B,OAAO;AAAA,sBACL,OAAO,UAAU,WAAW,oBAAoB;AAAA,oBAClD;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,cACA,WAAW;AAAA,gBACT,SAAS;AAAA,kBACP,eAAe,UAAU,IAAI,oBAAoB;AAAA,gBACnD;AAAA,cACF;AAAA,YACF;AAAA,YACA;AAAA,cACE,OAAO;AAAA,gBACL;AAAA,gBACA,SAAS;AAAA,kBACP;AAAA,oBACE,KAAK,EAAE,OAAO,gBAAgB;AAAA,oBAC9B,OAAO;AAAA,sBACL,OAAO,SAAS,WAAW,oBAAoB;AAAA,oBACjD;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,cACA,WAAW;AAAA,gBACT,SAAS;AAAA,kBACP,eAAe,SAAS,IAAI,oBAAoB;AAAA,gBAClD;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAEA,YAAI,IAAI,YAAY,YAAY,UAAU;AACxC,0BAAgB;AAAA,YACd;AAAA,cACE,OAAO;AAAA,gBACL;AAAA,gBACA,SAAS;AAAA,kBACP;AAAA,oBACE,KAAK,EAAE,OAAO,gBAAgB;AAAA,oBAC9B,OAAO,EAAE,OAAO,UAAU,WAAW,QAAQ,GAAG;AAAA,kBAClD;AAAA,gBACF;AAAA,cACF;AAAA,cACA,WAAW;AAAA,gBACT,SAAS,EAAE,eAAe,UAAU,IAAI,QAAQ,GAAG;AAAA,cACrD;AAAA,YACF;AAAA,YACA;AAAA,cACE,OAAO;AAAA,gBACL;AAAA,gBACA,SAAS;AAAA,kBACP;AAAA,oBACE,KAAK,EAAE,OAAO,gBAAgB;AAAA,oBAC9B,OAAO,EAAE,OAAO,SAAS,WAAW,QAAQ,GAAG;AAAA,kBACjD;AAAA,gBACF;AAAA,cACF;AAAA,cACA,WAAW;AAAA,gBACT,SAAS,EAAE,eAAe,SAAS,IAAI,QAAQ,GAAG;AAAA,cACpD;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAEA,YAAI,IAAI,gBAAgB,YAAY,cAAc;AAChD,0BAAgB;AAAA,YACd;AAAA,cACE,OAAO;AAAA,gBACL;AAAA,gBACA,SAAS;AAAA,kBACP;AAAA,oBACE,KAAK,EAAE,OAAO,gBAAgB;AAAA,oBAC9B,OAAO,EAAE,OAAO,UAAU,WAAW,YAAY,GAAG;AAAA,kBACtD;AAAA,gBACF;AAAA,cACF;AAAA,cACA,WAAW;AAAA,gBACT,SAAS,EAAE,eAAe,UAAU,IAAI,YAAY,GAAG;AAAA,cACzD;AAAA,YACF;AAAA,YACA;AAAA,cACE,OAAO;AAAA,gBACL;AAAA,gBACA,SAAS;AAAA,kBACP;AAAA,oBACE,KAAK,EAAE,OAAO,gBAAgB;AAAA,oBAC9B,OAAO,EAAE,OAAO,SAAS,WAAW,YAAY,GAAG;AAAA,kBACrD;AAAA,gBACF;AAAA,cACF;AAAA,cACA,WAAW;AAAA,gBACT,SAAS,EAAE,eAAe,SAAS,IAAI,YAAY,GAAG;AAAA,cACxD;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAEA,YAAM,qBAAqB,IAAI;AAC/B,YAAM,4BAA4B,YAAY;AAC9C,YAAM,kBAAkB,IAAI;AAC5B,UAAI,sBAAsB,6BAA6B,iBAAiB;AACtE,wBAAgB;AAAA,UACd,sCAAsC;AAAA,YACpC,UAAU;AAAA,YACV,cAAc;AAAA,cACZ,eAAe,UAAU,yBAAyB;AAAA,YACpD;AAAA,YACA,kBAAkB;AAAA,cAChB,GAAG;AAAA,cACH,eAAe,UAAU,kBAAkB;AAAA,YAC7C;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF,WAAW,WAAW,MAAM;AAC1B,cAAM,eACJ,eAAe,eACX,CAAC,qBAAqB,qBAAqB,IAC3C,CAAC,YAAY,KAAK,UAAU,EAAE;AACpC,mBAAW,QAAQ,cAAc;AAC/B,0BAAgB,KAAK;AAAA,YACnB,OAAO,EAAE,KAAK;AAAA,YACd,WAAW,EAAE,QAAQ;AAAA,UACvB,CAAC;AAAA,QACH;AAAA,MACF;AAEA,aAAO;AAAA,IACT;AAAA,IACA,sBAAsB,wCAAwC;AAAA,MAC5D,sBAAsB,SAAS;AAAA,IACjC,CAAC;AAAA,IACD,wBAAwB;AAAA,MACtB,SAAS;AAAA,QACP,KAAK;AAAA,UACH,2BAA2B;AAAA,YACzB,SAAS;AAAA,YACT,cAAc;AAAA,UAChB;AAAA,UACA,uBAAuB;AAAA,UACvB,0BAA0B;AAAA,YACxB,SAAS;AAAA,UACX;AAAA,UACA,2BAA2B;AAAA,UAC3B,eAAe;AAAA,UACf,0BAA0B;AAAA,YACxB,SAAS;AAAA,YACT,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AAAA,IACA,iBAAiB;AAAA,IACjB,oBAAoB;AAAA,MAClB,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AAAA,IACA,cAAc;AAAA,IACd,YAAY,SAAS;AAAA,IACrB,eAAe,cACb,qBAAqB,KAAK,YAAU,SAAS,MAAM,WAAW,MAAM,CAAC;AAAA,IACvE,MAAM,SAAS;AAAA,IACf,cAAc,SAAS;AAAA,IACvB,kBAAkB,SAAS;AAAA,IAC3B,iBAAiB,SAAS;AAAA,EAC5B,CAAC;AACH;AAEA,SAAS,wCAAwC;AAAA,EAC/C;AACF,GAEkC;AAChC,SAAO,CAAC,EAAE,YAAY,wBAAwB,MAAM;AAClD,UAAM,oBACJ,2CAA2C,IAAI,uBAAuB,KACtE,+BAA+B,UAAU,IACrC,8CAA8C,EAAE,WAAW,CAAC,IAC5D;AACN,WAAO,wBAAwB,OAC3B,oBACA,qBAAqB;AAAA,MACnB,YAAY;AAAA,MACZ;AAAA,IACF,CAAC;AAAA,EACP;AACF;AAEA,SAAS,8CAA8C;AAAA,EACrD;AACF,GAEW;AAMT,QAAM,YAAY,WAAW,QAAQ,EAClC,OAAO,UAAU,EACjB,OAAO,KAAK,EACZ;AAAA,IACC;AAAA,IACA,iCACE,uCAAuC;AAAA,EAC3C;AACF,SAAO,OAAO,sCAAsC,GAAG,SAAS;AAClE;;;AGpgBO,IAAM,gBAAgB,oBAAoB;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdk/harness-github-copilot",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "type": "module",
   "license": "Apache-2.0",
   "sideEffects": false,
@@ -26,9 +26,10 @@
     }
   },
   "dependencies": {
-    "@ai-sdk/harness": "1.0.106",
-    "@ai-sdk/harness-acp": "1.0.44",
-    "@ai-sdk/provider-utils": "5.0.38"
+    "@ai-sdk/harness": "1.0.108",
+    "@ai-sdk/harness-acp": "1.0.46",
+    "@ai-sdk/provider-utils": "5.0.40",
+    "jsonc-parser": "3.3.1"
   },
   "peerDependencies": {
     "zod": "^3.25.76 || ^4.1.8"

package/src/github-copilot-harness.ts

@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto';
 import {
   commonTool,
   type HarnessV1,
@@ -6,10 +7,17 @@ import {
   type HarnessV1PortEndpoint,
   type HarnessV1RequestTransformation,
 } from '@ai-sdk/harness';
-import { createCredentialRequestTransformation } from '@ai-sdk/harness/utils';
+import {
+  createCredentialRequestTransformation,
+  isSandboxCredentialPlaceholder,
+} from '@ai-sdk/harness/utils';
 import { createACP, type ACPAuthenticationMode } from '@ai-sdk/harness-acp';
 import { tool } from '@ai-sdk/provider-utils';
 import { z } from 'zod/v4';
+import {
+  normalizeGitHubHost,
+  resolveGitHubCopilotSubscriptionEnvironment,
+} from './github-copilot-subscription';
 import { VERSION } from './version';
 
 declare const __GITHUB_COPILOT_IMPLEMENTATION_PACKAGE_JSON__: string;
@@ -26,6 +34,13 @@ const GITHUB_COPILOT_IMPLEMENTATION_PNPM_LOCK =
   __GITHUB_COPILOT_IMPLEMENTATION_PNPM_LOCK_YAML__;
 const GITHUB_COPILOT_IMPLEMENTATION_PNPM_WORKSPACE =
   __GITHUB_COPILOT_IMPLEMENTATION_PNPM_WORKSPACE_YAML__;
+const GITHUB_COPILOT_TOKEN_ENVIRONMENT_VARIABLES = new Set([
+  'COPILOT_GITHUB_TOKEN',
+  'GH_TOKEN',
+  'GITHUB_TOKEN',
+]);
+const GITHUB_OAUTH_TOKEN_BODY_LENGTH = 36;
+const GITHUB_OAUTH_SANDBOX_CREDENTIAL_MARKER = 'aisdkhc';
 
 export type GitHubCopilotAuthenticationMode = ACPAuthenticationMode;
 
@@ -260,6 +275,8 @@ export function createGitHubCopilot(
         : [`--reasoning-effort=${settings.reasoningEffort}`]),
     ],
     auth: settings.auth,
+    resolveAuthenticationEnvironment:
+      resolveGitHubCopilotSubscriptionEnvironment,
     /*
      * The Copilot CLI drops every MCP server that a client passes in ACP
      * `session/new` unless it is declared with the `http` or `sse` transport,
@@ -421,7 +438,9 @@ export function createGitHubCopilot(
 
       return transformations;
     },
-    credentialForwarding: settings.credentialForwarding,
+    credentialForwarding: createGitHubCopilotCredentialForwarding({
+      credentialForwarding: settings.credentialForwarding,
+    }),
     providerAuthentication: {
       gateway: {
         env: {
@@ -462,6 +481,43 @@ export function createGitHubCopilot(
   });
 }
 
-function normalizeGitHubHost(host: string): string {
-  return new URL(host.includes('://') ? host : `https://${host}`).hostname;
+function createGitHubCopilotCredentialForwarding({
+  credentialForwarding,
+}: {
+  credentialForwarding: HarnessV1CredentialForwarding | undefined;
+}): HarnessV1CredentialForwarding {
+  return ({ credential, environmentVariableName }) => {
+    const sandboxCredential =
+      GITHUB_COPILOT_TOKEN_ENVIRONMENT_VARIABLES.has(environmentVariableName) &&
+      isSandboxCredentialPlaceholder(credential)
+        ? createGitHubOAuthSandboxCredentialPlaceholder({ credential })
+        : credential;
+    return credentialForwarding == null
+      ? sandboxCredential
+      : credentialForwarding({
+          credential: sandboxCredential,
+          environmentVariableName,
+        });
+  };
+}
+
+function createGitHubOAuthSandboxCredentialPlaceholder({
+  credential,
+}: {
+  credential: string;
+}): string {
+  /*
+   * Copilot CLI validates environment credentials as GitHub token formats
+   * before making the request that credential brokering can transform. GitHub
+   * OAuth tokens use `gho_` followed by a 36-character alphanumeric body.
+   */
+  const tokenBody = createHash('sha256')
+    .update(credential)
+    .digest('hex')
+    .slice(
+      0,
+      GITHUB_OAUTH_TOKEN_BODY_LENGTH -
+        GITHUB_OAUTH_SANDBOX_CREDENTIAL_MARKER.length,
+    );
+  return `gho_${GITHUB_OAUTH_SANDBOX_CREDENTIAL_MARKER}${tokenBody}`;
 }

package/src/github-copilot-subscription.ts

@@ -0,0 +1,310 @@
+import { execFile } from 'node:child_process';
+import { constants } from 'node:fs';
+import { access, readFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { promisify } from 'node:util';
+import type { ACPAuthenticationMode } from '@ai-sdk/harness-acp';
+import {
+  isHarnessAuthenticationEnvironment,
+  isLinux,
+  isMacOS,
+  isWindows,
+  readLinuxSecretServicePassword,
+  readMacOSKeychainPassword,
+  readWindowsCredentialManagerPassword,
+  shouldResolveNativeSubscription,
+} from '@ai-sdk/harness/utils';
+import { isRecord } from '@ai-sdk/provider-utils';
+import { parse, type ParseError } from 'jsonc-parser';
+
+const COPILOT_KEYRING_SERVICE = 'copilot-cli';
+const execFileAsync = promisify(execFile);
+
+type GitHubCopilotAccount = {
+  readonly host: string;
+  readonly login: string;
+};
+
+export type GitHubCopilotSubscription = {
+  readonly token: string;
+  readonly host: string;
+};
+
+type ReadSecureCredential = (options: {
+  service: string;
+  account: string;
+}) => Promise<string | undefined>;
+
+type FindGitHubCliExecutable = (options: {
+  env: Readonly<Record<string, string | undefined>>;
+  platform: NodeJS.Platform;
+}) => Promise<string | undefined>;
+
+type ReadGitHubCliToken = (options: {
+  executable: string;
+  hostname: string;
+  env: Readonly<Record<string, string | undefined>>;
+}) => Promise<string | undefined>;
+
+export async function resolveGitHubCopilotSubscriptionEnvironment({
+  auth,
+  env,
+  readSubscription = readGitHubCopilotSubscription,
+}: {
+  auth: ACPAuthenticationMode | undefined;
+  env: Readonly<Record<string, string | undefined>>;
+  readSubscription?: (options: {
+    env: Readonly<Record<string, string | undefined>>;
+  }) => Promise<GitHubCopilotSubscription | undefined>;
+}): Promise<Readonly<Record<string, string | undefined>>> {
+  if (isHarnessAuthenticationEnvironment(auth)) return auth;
+  if (
+    !shouldResolveNativeSubscription({
+      auth,
+      env,
+      hasDirectCredential:
+        env.COPILOT_GITHUB_TOKEN != null ||
+        env.GH_TOKEN != null ||
+        env.GITHUB_TOKEN != null,
+    })
+  ) {
+    return env;
+  }
+
+  const subscription = await readSubscription({ env });
+  if (subscription == null) return env;
+
+  return {
+    ...env,
+    COPILOT_GITHUB_TOKEN: subscription.token,
+    COPILOT_GH_HOST: normalizeGitHubHost(subscription.host),
+  };
+}
+
+export async function readGitHubCopilotSubscription({
+  env = process.env,
+  homeDirectory = homedir(),
+  platform = process.platform,
+  readSecureCredential,
+  findGitHubCliExecutable = findHostGitHubCliExecutable,
+  readGitHubCliToken = readHostGitHubCliToken,
+}: {
+  env?: Readonly<Record<string, string | undefined>>;
+  homeDirectory?: string;
+  platform?: NodeJS.Platform;
+  readSecureCredential?: ReadSecureCredential;
+  findGitHubCliExecutable?: FindGitHubCliExecutable;
+  readGitHubCliToken?: ReadGitHubCliToken;
+} = {}): Promise<GitHubCopilotSubscription | undefined> {
+  const copilotHome = resolve(
+    env.COPILOT_HOME ?? join(homeDirectory, '.copilot'),
+  );
+  const config = await readGitHubCopilotConfig({
+    path: join(copilotHome, 'config.json'),
+  });
+  const account = selectGitHubCopilotAccount({ config });
+
+  if (account != null) {
+    const accountKey = `${account.host}:${account.login}`;
+    const secureToken = await (
+      readSecureCredential ??
+      (options => readGitHubCopilotSecureCredential({ ...options, platform }))
+    )({
+      service: COPILOT_KEYRING_SERVICE,
+      account: accountKey,
+    }).catch(() => undefined);
+    if (isNonEmptyString(secureToken)) {
+      return { token: secureToken, host: account.host };
+    }
+
+    const plaintextToken = getPlaintextToken({ config, accountKey });
+    if (plaintextToken != null) {
+      return { token: plaintextToken, host: account.host };
+    }
+  }
+
+  const host =
+    account?.host ??
+    normalizeGitHubOrigin(env.COPILOT_GH_HOST ?? env.GH_HOST ?? 'github.com');
+  if (host == null) return undefined;
+
+  const executable = await findGitHubCliExecutable({ env, platform });
+  if (executable == null) return undefined;
+
+  const token = await readGitHubCliToken({
+    executable,
+    hostname: normalizeGitHubHost(host),
+    env,
+  }).catch(() => undefined);
+  return isNonEmptyString(token) ? { token: token.trim(), host } : undefined;
+}
+
+export async function findHostGitHubCliExecutable({
+  env,
+  platform,
+}: {
+  env: Readonly<Record<string, string | undefined>>;
+  platform: NodeJS.Platform;
+}): Promise<string | undefined> {
+  const path = env.PATH ?? env.Path ?? env.path;
+  if (path == null) return undefined;
+
+  const separator = isWindows(platform) ? ';' : ':';
+  const names = isWindows(platform)
+    ? getWindowsGitHubCliExecutableNames({ pathExt: env.PATHEXT })
+    : ['gh'];
+  const mode = isWindows(platform) ? constants.F_OK : constants.X_OK;
+
+  for (const directory of path.split(separator)) {
+    const normalizedDirectory = directory.replace(/^"|"$/g, '');
+    if (normalizedDirectory.length === 0) continue;
+    for (const executableName of names) {
+      const candidate = resolve(normalizedDirectory, executableName);
+      try {
+        await access(candidate, mode);
+        return candidate;
+      } catch {}
+    }
+  }
+
+  return undefined;
+}
+
+async function readGitHubCopilotConfig({
+  path,
+}: {
+  path: string;
+}): Promise<Record<string, unknown> | undefined> {
+  const text = await readFile(path, 'utf8').catch(() => undefined);
+  if (text == null) return undefined;
+
+  const errors: ParseError[] = [];
+  const value = parse(text, errors, { allowTrailingComma: true });
+  return errors.length === 0 && isRecord(value) ? value : undefined;
+}
+
+function selectGitHubCopilotAccount({
+  config,
+}: {
+  config: Record<string, unknown> | undefined;
+}): GitHubCopilotAccount | undefined {
+  if (config == null) return undefined;
+
+  for (const value of [config.last_logged_in_user, config.lastLoggedInUser]) {
+    const account = toGitHubCopilotAccount(value);
+    if (account != null) return account;
+  }
+
+  for (const values of [config.logged_in_users, config.loggedInUsers]) {
+    if (!Array.isArray(values)) continue;
+    for (const value of values) {
+      const account = toGitHubCopilotAccount(value);
+      if (account != null) return account;
+    }
+  }
+  return undefined;
+}
+
+function toGitHubCopilotAccount(
+  value: unknown,
+): GitHubCopilotAccount | undefined {
+  if (
+    !isRecord(value) ||
+    !isNonEmptyString(value.host) ||
+    !isNonEmptyString(value.login)
+  ) {
+    return undefined;
+  }
+  const host = normalizeGitHubOrigin(value.host);
+  return host == null ? undefined : { host, login: value.login };
+}
+
+function getPlaintextToken({
+  config,
+  accountKey,
+}: {
+  config: Record<string, unknown> | undefined;
+  accountKey: string;
+}): string | undefined {
+  if (config == null || !isRecord(config.copilotTokens)) return undefined;
+  const token = config.copilotTokens[accountKey];
+  return isNonEmptyString(token) ? token : undefined;
+}
+
+async function readGitHubCopilotSecureCredential({
+  service,
+  account,
+  platform,
+}: {
+  service: string;
+  account: string;
+  platform: NodeJS.Platform;
+}): Promise<string | undefined> {
+  if (isMacOS(platform)) {
+    return readMacOSKeychainPassword({ service, account });
+  }
+  if (isLinux(platform)) {
+    return readLinuxSecretServicePassword({
+      attributes: { service, username: account },
+    });
+  }
+  if (isWindows(platform)) {
+    return readWindowsCredentialManagerPassword({
+      targetName: `${account}.${service}`,
+    });
+  }
+  return undefined;
+}
+
+async function readHostGitHubCliToken({
+  executable,
+  hostname,
+  env,
+}: {
+  executable: string;
+  hostname: string;
+  env: Readonly<Record<string, string | undefined>>;
+}): Promise<string | undefined> {
+  try {
+    const result = await execFileAsync(
+      executable,
+      ['auth', 'token', '--hostname', hostname],
+      {
+        env: { ...env },
+        timeout: 10_000,
+        windowsHide: true,
+      },
+    );
+    return isNonEmptyString(result.stdout) ? result.stdout.trim() : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function getWindowsGitHubCliExecutableNames({
+  pathExt,
+}: {
+  pathExt: string | undefined;
+}): ReadonlyArray<string> {
+  const extensions = (pathExt ?? '.COM;.EXE;.BAT;.CMD')
+    .split(';')
+    .filter(isNonEmptyString);
+  return ['gh', ...extensions.map(extension => `gh${extension}`)];
+}
+
+function normalizeGitHubOrigin(host: string): string | undefined {
+  try {
+    return new URL(host.includes('://') ? host : `https://${host}`).origin;
+  } catch {
+    return undefined;
+  }
+}
+
+export function normalizeGitHubHost(host: string): string {
+  return new URL(host.includes('://') ? host : `https://${host}`).hostname;
+}
+
+function isNonEmptyString(value: unknown): value is string {
+  return typeof value === 'string' && value.trim().length > 0;
+}