@bitkyc08/opencodex 2.7.25 → 2.7.26

package/src/oauth/github-copilot.ts

@@ -0,0 +1,427 @@
+/**
+ * GitHub Copilot OAuth (device authorization grant + copilot_internal token exchange).
+ *
+ * Uses the public VS Code GitHub OAuth app client id (community-proven for Copilot Pro).
+ * This is an unofficial bridge — GitHub may tighten or revoke access. See registry note.
+ */
+import type { OAuthController, OAuthCredentials } from "./types";
+
+/** VS Code's public GitHub OAuth app — required for copilot_internal/v2/token to succeed. */
+export const GITHUB_COPILOT_OAUTH_CLIENT_ID = "Iv1.b507a08c87ecfe98";
+export const GITHUB_COPILOT_DEFAULT_API_BASE = "https://api.githubcopilot.com";
+export const GITHUB_DEVICE_VERIFY_ORIGIN = "https://github.com";
+export const GITHUB_DEVICE_VERIFY_PATH = "/login/device";
+
+const DEVICE_CODE_URL = "https://github.com/login/device/code";
+const ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
+const COPILOT_TOKEN_URL = "https://api.github.com/copilot_internal/v2/token";
+const GITHUB_USER_URL = "https://api.github.com/user";
+
+const OAUTH_SCOPE = "read:user";
+const DEFAULT_POLL_INTERVAL_MS = 5000;
+const DEFAULT_DEVICE_FLOW_TTL_MS = 15 * 60 * 1000;
+const OAUTH_EXPIRY_SKEW_MS = 2 * 60 * 1000;
+const MIN_POLL_MS = 1000;
+/** OAuth error codes that make a refresh terminally dead (safe to surface verbatim). */
+const TERMINAL_OAUTH_ERROR_CODES = new Set(["invalid_grant", "access_denied", "expired_token"]);
+const IDENTITY_RETRY_DELAY_MS = 500;
+
+/** Honest OpenCodex client fingerprint; VS Code-shaped values only if API requires them later. */
+export const GITHUB_COPILOT_EDITOR_HEADERS: Readonly<Record<string, string>> = {
+  "Editor-Version": "opencodex/0.1.0",
+  "Editor-Plugin-Version": "opencodex/0.1.0",
+  "Copilot-Integration-Id": "vscode-chat",
+  "User-Agent": "opencodex",
+  Accept: "application/json",
+};
+
+interface DeviceAuthorizationResponse {
+  user_code?: string;
+  device_code?: string;
+  verification_uri?: string;
+  verification_uri_complete?: string;
+  expires_in?: number;
+  interval?: number;
+  error?: string;
+  error_description?: string;
+}
+
+interface GithubTokenResponse {
+  access_token?: string;
+  refresh_token?: string;
+  expires_in?: number;
+  refresh_token_expires_in?: number;
+  error?: string;
+  error_description?: string;
+  interval?: number;
+}
+
+interface CopilotTokenResponse {
+  token?: string;
+  expires_at?: number;
+  refresh_in?: number;
+  endpoints?: { api?: string };
+}
+
+interface GithubUserResponse {
+  login?: string;
+  id?: number;
+  email?: string;
+}
+
+function sleep(ms: number, signal?: AbortSignal): Promise<void> {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) return reject(new Error("Login cancelled"));
+    const t = setTimeout(resolve, ms);
+    signal?.addEventListener("abort", () => {
+      clearTimeout(t);
+      reject(new Error("Login cancelled"));
+    }, { once: true });
+  });
+}
+
+/** Status-only errors — never echo response bodies (may contain tokens). */
+export function githubCopilotHttpError(action: string, status: number): Error {
+  return new Error(`GitHub Copilot ${action} failed (${status})`);
+}
+
+export function buildGithubDeviceVerifyUrl(userCode: string): string {
+  const code = userCode.trim();
+  if (!code || !/^[A-Z0-9-]+$/i.test(code)) {
+    throw new Error("GitHub Copilot device flow returned an invalid user code");
+  }
+  return `${GITHUB_DEVICE_VERIFY_ORIGIN}${GITHUB_DEVICE_VERIFY_PATH}?user_code=${encodeURIComponent(code)}`;
+}
+
+/**
+ * Allowlist for browser-open URLs. Prefer {@link buildGithubDeviceVerifyUrl}; this rejects
+ * phishing redirects if a caller still passes a server-supplied verification URI.
+ */
+export function isAllowedGithubDeviceVerifyUrl(url: string): boolean {
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "https:") return false;
+    if (parsed.username || parsed.password) return false;
+    if (parsed.hostname.toLowerCase() !== "github.com") return false;
+    if (parsed.port && parsed.port !== "443") return false;
+    const path = parsed.pathname.replace(/\/+$/, "") || "/";
+    return path === GITHUB_DEVICE_VERIFY_PATH;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Tight allowlist for Copilot API hosts from token `endpoints.api`.
+ * Rejects IPs, localhost, non-HTTPS, userinfo, and non-default ports.
+ */
+export function validateCopilotApiBaseUrl(raw: string | undefined | null): string | undefined {
+  if (raw === undefined || raw === null) return undefined;
+  const trimmed = String(raw).trim();
+  if (!trimmed) return undefined;
+  let parsed: URL;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    return undefined;
+  }
+  if (parsed.protocol !== "https:") return undefined;
+  if (parsed.username || parsed.password) return undefined;
+  if (parsed.port && parsed.port !== "443") return undefined;
+  const host = parsed.hostname.toLowerCase();
+  if (host === "localhost" || host === "127.0.0.1" || host === "::1" || host.endsWith(".localhost")) {
+    return undefined;
+  }
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host) || host.includes(":")) return undefined;
+  if (host !== "api.githubcopilot.com" && !host.endsWith(".githubcopilot.com")) return undefined;
+  // Normalize to origin only (no path/query from the network).
+  return `https://${host}`;
+}
+
+export function resolveCopilotApiBaseUrl(raw: string | undefined | null): string {
+  return validateCopilotApiBaseUrl(raw) ?? GITHUB_COPILOT_DEFAULT_API_BASE;
+}
+
+async function requestDeviceAuthorization(signal?: AbortSignal): Promise<{
+  userCode: string;
+  deviceCode: string;
+  verifyUrl: string;
+  expiresInMs: number;
+  intervalMs: number;
+}> {
+  const response = await fetch(DEVICE_CODE_URL, {
+    method: "POST",
+    headers: {
+      Accept: "application/json",
+      "Content-Type": "application/x-www-form-urlencoded",
+      "User-Agent": "opencodex",
+    },
+    body: new URLSearchParams({
+      client_id: GITHUB_COPILOT_OAUTH_CLIENT_ID,
+      scope: OAUTH_SCOPE,
+    }),
+    signal,
+  });
+  if (!response.ok) throw githubCopilotHttpError("device authorization", response.status);
+  const payload = (await response.json()) as DeviceAuthorizationResponse;
+  if (!payload.user_code || !payload.device_code) {
+    throw new Error("GitHub Copilot device authorization response missing required fields");
+  }
+  // Construct verify URL ourselves — never trust verification_uri_complete for openUrl.
+  const verifyUrl = buildGithubDeviceVerifyUrl(payload.user_code);
+  return {
+    userCode: payload.user_code,
+    deviceCode: payload.device_code,
+    verifyUrl,
+    expiresInMs: typeof payload.expires_in === "number" ? payload.expires_in * 1000 : DEFAULT_DEVICE_FLOW_TTL_MS,
+    intervalMs: typeof payload.interval === "number" && payload.interval > 0
+      ? payload.interval * 1000
+      : DEFAULT_POLL_INTERVAL_MS,
+  };
+}
+
+async function pollGithubDeviceToken(
+  deviceCode: string,
+  intervalMs: number,
+  expiresInMs: number,
+  signal?: AbortSignal,
+): Promise<{ access: string; refresh?: string }> {
+  const deadline = Date.now() + expiresInMs;
+  let waitMs = Math.max(MIN_POLL_MS, intervalMs);
+  while (Date.now() < deadline) {
+    if (signal?.aborted) throw new Error("Login cancelled");
+    // RFC 8628: wait the interval BEFORE every poll — an immediate first request is a
+    // cadence violation GitHub may answer with slow_down.
+    await sleep(waitMs, signal);
+    if (Date.now() >= deadline) break;
+    const response = await fetch(ACCESS_TOKEN_URL, {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/x-www-form-urlencoded",
+        "User-Agent": "opencodex",
+      },
+      body: new URLSearchParams({
+        client_id: GITHUB_COPILOT_OAUTH_CLIENT_ID,
+        device_code: deviceCode,
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+      }),
+      // Bound each poll by the remaining lifetime so a hung fetch cannot outlive the flow.
+      signal: signal
+        ? AbortSignal.any([signal, AbortSignal.timeout(Math.max(MIN_POLL_MS, deadline - Date.now()))])
+        : AbortSignal.timeout(Math.max(MIN_POLL_MS, deadline - Date.now())),
+    });
+    const payload = (await response.json().catch(() => ({}))) as GithubTokenResponse;
+    if (response.ok && payload.access_token) {
+      // Classic OAuth apps issue a non-expiring `gho_` access token with NO refresh token;
+      // expiring-token apps add `ghr_`. Both are valid device-flow successes.
+      return {
+        access: payload.access_token,
+        ...(payload.refresh_token ? { refresh: payload.refresh_token } : {}),
+      };
+    }
+    const error = payload.error;
+    if (error === "authorization_pending") {
+      continue;
+    }
+    if (error === "slow_down") {
+      // RFC 8628 §3.5: slow_down means increase the interval by 5 seconds; the
+      // server-provided `interval` wins when it demands even more.
+      const retryAfter = typeof payload.interval === "number" && payload.interval > 0
+        ? payload.interval * 1000
+        : 0;
+      waitMs = Math.max(waitMs + 5000, retryAfter);
+      continue;
+    }
+    if (error === "expired_token") throw new Error("GitHub Copilot device authorization expired");
+    if (error === "access_denied") throw new Error("GitHub Copilot device authorization denied");
+    if (error === "unsupported_grant_type" || error === "incorrect_device_code") {
+      throw new Error(`GitHub Copilot device flow failed (${error})`);
+    }
+    if (!response.ok) throw githubCopilotHttpError("device token poll", response.status);
+    throw new Error(`GitHub Copilot device flow failed (${error ?? "unknown"})`);
+  }
+  throw new Error("GitHub Copilot device flow timed out");
+}
+
+async function refreshGithubAccessToken(refreshToken: string, signal?: AbortSignal): Promise<{ access: string; refresh: string }> {
+  const response = await fetch(ACCESS_TOKEN_URL, {
+    method: "POST",
+    headers: {
+      Accept: "application/json",
+      "Content-Type": "application/x-www-form-urlencoded",
+      "User-Agent": "opencodex",
+    },
+    body: new URLSearchParams({
+      client_id: GITHUB_COPILOT_OAUTH_CLIENT_ID,
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+    }),
+    signal,
+  });
+  const payload = (await response.json().catch(() => ({}))) as GithubTokenResponse;
+  if (!response.ok) {
+    // Extract ONLY the allowlisted OAuth error code — never the body or error_description,
+    // which can echo credential material. The code lets the shared terminal-refresh
+    // detector mark the account needsReauth instead of retrying a revoked grant forever.
+    const code = payload.error && TERMINAL_OAUTH_ERROR_CODES.has(payload.error) ? payload.error : undefined;
+    throw new Error(
+      code
+        ? `GitHub Copilot token refresh failed: ${code} (HTTP ${response.status})`
+        : `GitHub Copilot token refresh failed (${response.status})`,
+    );
+  }
+  if (!payload.access_token) throw new Error("GitHub Copilot token refresh missing access token");
+  return {
+    access: payload.access_token,
+    refresh: payload.refresh_token ?? refreshToken,
+  };
+}
+
+async function exchangeCopilotToken(githubAccessToken: string, signal?: AbortSignal): Promise<{
+  access: string;
+  expires: number;
+  apiBaseUrl: string;
+}> {
+  const response = await fetch(COPILOT_TOKEN_URL, {
+    method: "GET",
+    headers: {
+      ...GITHUB_COPILOT_EDITOR_HEADERS,
+      Authorization: `token ${githubAccessToken}`,
+    },
+    signal,
+  });
+  if (!response.ok) throw githubCopilotHttpError("token exchange", response.status);
+  const payload = (await response.json().catch(() => ({}))) as CopilotTokenResponse;
+  if (!payload.token || typeof payload.token !== "string") {
+    throw new Error("GitHub Copilot token exchange missing token");
+  }
+  let expires: number;
+  if (typeof payload.expires_at === "number" && Number.isFinite(payload.expires_at)) {
+    // expires_at is unix seconds from GitHub.
+    expires = payload.expires_at * 1000 - OAUTH_EXPIRY_SKEW_MS;
+  } else if (typeof payload.refresh_in === "number" && payload.refresh_in > 0) {
+    expires = Date.now() + payload.refresh_in * 1000 - OAUTH_EXPIRY_SKEW_MS;
+  } else {
+    expires = Date.now() + 25 * 60 * 1000 - OAUTH_EXPIRY_SKEW_MS;
+  }
+  return {
+    access: payload.token,
+    expires,
+    apiBaseUrl: resolveCopilotApiBaseUrl(payload.endpoints?.api),
+  };
+}
+
+async function fetchGithubIdentityOnce(githubAccessToken: string, signal?: AbortSignal): Promise<{
+  email?: string;
+  accountId?: string;
+}> {
+  const response = await fetch(GITHUB_USER_URL, {
+    headers: {
+      Accept: "application/vnd.github+json",
+      Authorization: `Bearer ${githubAccessToken}`,
+      "User-Agent": "opencodex",
+      "X-GitHub-Api-Version": "2022-11-28",
+    },
+    signal,
+  });
+  if (!response.ok) throw githubCopilotHttpError("identity lookup", response.status);
+  const user = (await response.json()) as GithubUserResponse;
+  // Prefer numeric id for multiauth stability. Only persist email when GitHub returns one —
+  // do not fabricate noreply addresses (privacy-scan + PII hygiene).
+  const accountId = typeof user.id === "number"
+    ? String(user.id)
+    : (typeof user.login === "string" && user.login ? user.login : undefined);
+  const email = typeof user.email === "string" && user.email.includes("@") ? user.email : undefined;
+  return {
+    ...(email ? { email } : {}),
+    ...(accountId ? { accountId } : {}),
+  };
+}
+
+/**
+ * Identity is REQUIRED for multi-account safety: an identity-less credential would
+ * replace the active slot in the auth store and clobber another GitHub account. One
+ * retry covers transient /user failures; a persistent failure fails the login rather
+ * than persisting an anonymous credential.
+ */
+async function fetchGithubIdentity(githubAccessToken: string, signal?: AbortSignal): Promise<{
+  email?: string;
+  accountId?: string;
+}> {
+  try {
+    const identity = await fetchGithubIdentityOnce(githubAccessToken, signal);
+    if (identity.accountId) return identity;
+  } catch { /* retry once below */ }
+  await sleep(IDENTITY_RETRY_DELAY_MS, signal);
+  const identity = await fetchGithubIdentityOnce(githubAccessToken, signal);
+  if (!identity.accountId) {
+    throw new Error("Could not verify GitHub account identity — retry the login");
+  }
+  return identity;
+}
+
+/**
+ * The credential `refresh` field carries the DURABLE GitHub grant:
+ * - `ghr_…` refresh token (expiring-token apps) → renewed via the refresh grant;
+ * - `gho_…` access token (classic apps, no refresh token) → re-exchanged directly.
+ * The `access` field always holds the short-lived Copilot API token.
+ */
+async function credentialsFromGithubAccess(
+  githubAccess: string,
+  durableGrant: string,
+  signal?: AbortSignal,
+): Promise<OAuthCredentials> {
+  const [copilot, identity] = await Promise.all([
+    exchangeCopilotToken(githubAccess, signal),
+    fetchGithubIdentity(githubAccess, signal),
+  ]);
+  return {
+    access: copilot.access,
+    refresh: durableGrant,
+    expires: copilot.expires,
+    apiBaseUrl: copilot.apiBaseUrl,
+    source: "oauth",
+    ...(identity.email ? { email: identity.email } : {}),
+    ...(identity.accountId ? { accountId: identity.accountId } : {}),
+  };
+}
+
+export async function loginGithubCopilot(ctrl: OAuthController): Promise<OAuthCredentials> {
+  const device = await requestDeviceAuthorization(ctrl.signal);
+  if (!isAllowedGithubDeviceVerifyUrl(device.verifyUrl)) {
+    throw new Error("GitHub Copilot refused to open a non-allowlisted verification URL");
+  }
+  ctrl.onAuth?.({
+    url: device.verifyUrl,
+    instructions: `Enter code: ${device.userCode}`,
+  });
+  ctrl.onProgress?.("Waiting for GitHub device authorization…");
+  const github = await pollGithubDeviceToken(
+    device.deviceCode,
+    device.intervalMs,
+    device.expiresInMs,
+    ctrl.signal,
+  );
+  ctrl.onProgress?.("Exchanging GitHub token for Copilot access…");
+  // Access-only responses (classic gho_ tokens) store the access token itself as the
+  // durable grant; expiring-token apps store the ghr_ refresh token.
+  return credentialsFromGithubAccess(github.access, github.refresh ?? github.access, ctrl.signal);
+}
+
+/**
+ * Refresh = renew the durable GitHub grant, then Copilot re-exchange.
+ * `refreshToken` is credentials.refresh: a `ghr_` token runs the GitHub refresh grant;
+ * anything else (a durable `gho_` access token) re-exchanges directly — both shapes
+ * recover expiry AND upstream 401s.
+ */
+export async function refreshGithubCopilotToken(
+  refreshToken: string,
+  signal?: AbortSignal,
+): Promise<OAuthCredentials> {
+  if (refreshToken.startsWith("ghr_")) {
+    const github = await refreshGithubAccessToken(refreshToken, signal);
+    return credentialsFromGithubAccess(github.access, github.refresh, signal);
+  }
+  return credentialsFromGithubAccess(refreshToken, refreshToken, signal);
+}

package/src/oauth/index.ts

@@ -11,6 +11,7 @@ import { loginKiro, readKiroCliSqlite, refreshKiroToken } from "./kiro";
 import { loginChatGPT, refreshChatGPTToken } from "./chatgpt";
 import { loginAntigravity, refreshAntigravityToken } from "./google-antigravity";
 import { loginCursor, refreshCursorToken } from "./cursor";
+import { loginGithubCopilot, refreshGithubCopilotToken, validateCopilotApiBaseUrl } from "./github-copilot";
 import { deriveOAuthDefaultModel, deriveOAuthProviderConfig } from "../providers/derive";
 import { effectiveGoogleMode } from "../providers/registry";
 import { resolveProviderTransport } from "../providers/xai-transport";
@@ -100,6 +101,14 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderDef> = {
     providerConfig: oauthConfig("cursor"),
     defaultModel: oauthDefaultModel("cursor"),
   },
+  "github-copilot": {
+    login: (ctrl) => loginGithubCopilot(ctrl),
+    refresh: (rt, signal) => refreshGithubCopilotToken(rt, signal),
+    providerConfig: oauthConfig("github-copilot"),
+    defaultModel: oauthDefaultModel("github-copilot"),
+    // Unofficial Copilot bridge — keep proactive traffic lazy-only (no background guardian spam).
+    defaultRefreshPolicy: "lazy-only",
+  },
   chatgpt: {
     login: loginChatGPT,
     refresh: (rt) => refreshChatGPTToken(rt),
@@ -137,6 +146,11 @@ export function getOAuthCredentialProjectId(provider: string): string | undefine
   return getCredential(provider)?.projectId;
 }
 
+/** Allowlisted Copilot API origin from the active credential, if still valid. */
+export function getOAuthCredentialApiBaseUrl(provider: string): string | undefined {
+  return validateCopilotApiBaseUrl(getCredential(provider)?.apiBaseUrl);
+}
+
 /** Provider ids that support real OAuth login (drives the GUI's "Log in with …" buttons). */
 export function listOAuthProviders(): string[] {
   return Object.keys(OAUTH_PROVIDERS).filter(isPublicOAuthProvider);
@@ -203,10 +217,13 @@ export async function getValidAccessTokenSnapshot(provider: string): Promise<OAu
   return resolveAccessSnapshotForAccount(provider, set.activeAccountId);
 }
 
+/** Providers whose upstream-401 replay path may force a snapshot refresh. */
+const FORCE_REFRESH_PROVIDERS = new Set(["xai", "github-copilot"]);
+
 export async function forceRefreshOAuthAccessSnapshot(
   rejected: OAuthAccessSnapshot,
 ): Promise<OAuthAccessSnapshot> {
-  if (rejected.provider !== "xai") throw new UnsupportedOAuthProviderError(rejected.provider);
+  if (!FORCE_REFRESH_PROVIDERS.has(rejected.provider)) throw new UnsupportedOAuthProviderError(rejected.provider);
   return resolveAccessSnapshotForAccount(rejected.provider, rejected.accountId, rejected.generation);
 }
 
@@ -233,11 +250,25 @@ function readFreshKiroCliCredential(): OAuthCredentials | undefined {
 /** Terminal refresh failures (revoked/rotated-away grants) — retrying cannot succeed. */
 function isTerminalRefreshError(err: unknown): boolean {
   const msg = (err instanceof Error ? err.message : String(err)).toLowerCase();
-  return msg.includes("invalid_grant") || msg.includes("refresh_token_reused") || msg.includes("revoked");
+  return msg.includes("invalid_grant")
+    || msg.includes("refresh_token_reused")
+    || msg.includes("revoked")
+    // GitHub Copilot refresh surfaces allowlisted OAuth codes (github-copilot.ts):
+    || msg.includes("access_denied")
+    || msg.includes("expired_token");
 }
 function terminal(error:unknown):boolean{return error instanceof XaiTokenRequestError?["invalid_grant","refresh_token_reused","revoked_token"].includes(error.oauthError??""):isTerminalRefreshError(error);}
 function authoritative(stored:OAuthCredentials,active:boolean,now:()=>number):OAuthCredentials{if(stored.source!=="local-cli")return stored;const disk=detectGrokCliToken();if(!disk)return stored;const allowed=isSameGrokIdentity(stored,disk)||(active&&!hasComparableGrokIdentity(stored,disk));return allowed&&shouldAdoptGrokGeneration(stored,disk,now(),REFRESH_SKEW_MS)?disk:stored;}
-function merged(fresh:OAuthCredentials,previous:OAuthCredentials):OAuthCredentials{return{...fresh,source:previous.source==="local-cli"?"oauth":fresh.source??previous.source??"oauth",...(fresh.projectId===undefined&&previous.projectId?{projectId:previous.projectId}:{}),...(fresh.email===undefined&&previous.email?{email:previous.email}:{}),...(fresh.accountId===undefined&&previous.accountId?{accountId:previous.accountId}:{})};}
+function merged(fresh: OAuthCredentials, previous: OAuthCredentials): OAuthCredentials {
+  return {
+    ...fresh,
+    source: previous.source === "local-cli" ? "oauth" : fresh.source ?? previous.source ?? "oauth",
+    ...(fresh.projectId === undefined && previous.projectId ? { projectId: previous.projectId } : {}),
+    ...(fresh.apiBaseUrl === undefined && previous.apiBaseUrl ? { apiBaseUrl: previous.apiBaseUrl } : {}),
+    ...(fresh.email === undefined && previous.email ? { email: previous.email } : {}),
+    ...(fresh.accountId === undefined && previous.accountId ? { accountId: previous.accountId } : {}),
+  };
+}
 export async function refreshXaiAccountWithLock(provider:string,accountId:string,def:OAuthProviderDef,callerCredential:OAuthCredentials,deps:XaiRefreshDeps={}):Promise<string>{const now=deps.now??Date.now;const guard=await(deps.intentLock??createOAuthRefreshIntentLock(provider,accountId)).acquire();try{const stored=getAccountCredential(provider,accountId);if(!stored)throw new OAuthLoginRequiredError(provider);const active=getAccountSet(provider)?.activeAccountId===accountId,candidate=authoritative(stored,active,now);if(credentialGeneration(candidate)!==credentialGeneration(callerCredential)&&candidate.expires>now()+REFRESH_SKEW_MS){if(credentialGeneration(candidate)!==credentialGeneration(stored)){const o=await mergeAccountCredential(provider,accountId,candidate,{expectedGeneration:credentialGeneration(stored),afterPrePersistRead:deps.afterPrePersistRead});if(o.superseded){if(o.stored.expires>now()+REFRESH_SKEW_MS)return o.stored.access;throw new OAuthLoginRequiredError(provider);}}return candidate.access;}if(cached(provider,accountId,candidate,now))throw new OAuthLoginRequiredError(provider);const generation=credentialGeneration(candidate);try{const fresh=merged(await def.refresh(candidate.refresh),candidate);const o=await mergeAccountCredential(provider,accountId,fresh,{expectedGeneration:generation,afterPrePersistRead:deps.afterPrePersistRead});if(o.superseded){if(o.stored.expires>now()+REFRESH_SKEW_MS)return o.stored.access;throw new OAuthLoginRequiredError(provider);}permanentRefreshFailures.delete(verdictKey(provider,accountId,candidate));if(candidate.source==="local-cli")console.warn(XAI_LOCAL_CLI_DETACH_WARNING);return fresh.access;}catch(error){if(!terminal(error))throw error;permanentRefreshFailures.set(verdictKey(provider,accountId,candidate),now()+XAI_PERMANENT_FAILURE_TTL_MS);await markAccountNeedsReauthIfGeneration(provider,accountId,generation);throw new OAuthLoginRequiredError(provider);}}finally{guard.release();}}
 
 async function refreshAndPersistAccessToken(
@@ -269,6 +300,7 @@ async function refreshAndPersistAccessToken(
       // Preserve a previously-discovered project id when a refresh-time re-discovery comes back empty
       // (e.g. a transient network blip), so Antigravity does not lose its CCA project across refresh.
       ...(fresh.projectId === undefined && cred.projectId ? { projectId: cred.projectId } : {}),
+      ...(fresh.apiBaseUrl === undefined && cred.apiBaseUrl ? { apiBaseUrl: cred.apiBaseUrl } : {}),
       // Preserve identity fields the refresh response may omit, so identity matching stays stable.
       ...(fresh.email === undefined && cred.email ? { email: cred.email } : {}),
       ...(fresh.accountId === undefined && cred.accountId ? { accountId: cred.accountId } : {}),
@@ -318,7 +350,12 @@ export async function resolveModelsAuthToken(name: string, prov: OcxProviderConf
  * response.
  */
 export function buildModelsRequest(prov: OcxProviderConfig, apiKey: string | undefined, providerName = ""): { url: string; headers: Record<string, string> } {
-  const effectiveProvider = resolveProviderTransport(providerName, prov);
+  const effectiveProvider = resolveProviderTransport(
+    providerName,
+    prov,
+    undefined,
+    providerName === "github-copilot" ? getOAuthCredentialApiBaseUrl(providerName) : undefined,
+  );
   const headers: Record<string, string> = { ...(effectiveProvider.headers ?? {}) };
   if (effectiveGoogleMode(providerName, effectiveProvider) === "ai-studio") {
     // Generative Language API: API key goes in x-goog-api-key (never Authorization: Bearer),

package/src/oauth/kimi.ts

@@ -32,6 +32,51 @@ interface TokenResponse {
   interval?: number;
 }
 
+interface KimiJwtPayload {
+  user_id?: unknown;
+  sub?: unknown;
+  email?: unknown;
+}
+
+function decodeKimiJwtPayload(token: string): KimiJwtPayload | undefined {
+  const parts = token.split(".");
+  const payload = parts[1];
+  if (parts.length !== 3 || !payload) return undefined;
+  try {
+    return JSON.parse(Buffer.from(payload, "base64url").toString("utf-8")) as KimiJwtPayload;
+  } catch {
+    return undefined;
+  }
+}
+
+function nonEmptyString(value: unknown): string | undefined {
+  return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+
+/**
+ * Stable multiauth identity from Kimi JWTs. `user_id` is preferred ACROSS both tokens
+ * before falling back to `sub` — the two claims come from the same issuer namespace but
+ * `sub` is the weaker fallback, so a refresh-token `user_id` must beat an access-token
+ * `sub`. Email fills from either token and is lowercased.
+ */
+export function identityFromKimiTokens(accessToken: string, refreshToken?: string): {
+  accountId?: string;
+  email?: string;
+} {
+  const access = decodeKimiJwtPayload(accessToken);
+  const refresh = refreshToken ? decodeKimiJwtPayload(refreshToken) : undefined;
+  const accountId =
+    nonEmptyString(access?.user_id) ??
+    nonEmptyString(refresh?.user_id) ??
+    nonEmptyString(access?.sub) ??
+    nonEmptyString(refresh?.sub);
+  const email = (nonEmptyString(access?.email) ?? nonEmptyString(refresh?.email))?.toLowerCase();
+  return {
+    ...(accountId ? { accountId } : {}),
+    ...(email ? { email } : {}),
+  };
+}
+
 function resolveOAuthHost(): string {
   return process.env.KIMI_CODE_OAUTH_HOST || process.env.KIMI_OAUTH_HOST || DEFAULT_OAUTH_HOST;
 }
@@ -109,7 +154,13 @@ function parseTokenPayload(payload: TokenResponse, refreshFallback?: string): OA
   }
   const refresh = payload.refresh_token ?? refreshFallback;
   if (!refresh) throw new Error("Kimi token response missing refresh token");
-  return { access: payload.access_token, refresh, expires: Date.now() + payload.expires_in * 1000 - OAUTH_EXPIRY_SKEW_MS };
+  const identity = identityFromKimiTokens(payload.access_token, refresh);
+  return {
+    access: payload.access_token,
+    refresh,
+    expires: Date.now() + payload.expires_in * 1000 - OAUTH_EXPIRY_SKEW_MS,
+    ...identity,
+  };
 }
 
 async function pollForToken(deviceCode: string, intervalMs: number, expiresInMs: number, signal?: AbortSignal): Promise<OAuthCredentials> {

package/src/oauth/store.ts

@@ -10,15 +10,16 @@
  * Exceptions:
  * - `chatgpt` stays single-slot (always replaced): codex-auth-api uses it as a scratch slot
  *   for Codex pool logins, which have their own ledger (codex-accounts.json).
- * - Credentials without identity (no accountId/email — kimi, kiro) replace the active slot
+ * - Credentials without identity (no accountId/email — e.g. kiro) replace the active slot
  *   instead of appending: their refresh tokens rotate, so a derived id would duplicate the
- *   same human on every re-login. Cursor login extracts JWT `sub` as accountId so multiauth
- *   can append distinct accounts.
+ *   same human on every re-login. Kimi extracts JWT `user_id`/`sub` as accountId; Cursor
+ *   extracts JWT `sub` — both append distinct accounts under multiauth.
  */
 import { createHash, randomUUID } from "node:crypto";
 import { chmodSync, closeSync, copyFileSync, existsSync, fstatSync, mkdirSync, openSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { getConfigDir, atomicWriteFile, backupInvalidConfig, hardenConfigDir, hardenExistingSecret } from "../config";
+import { validateCopilotApiBaseUrl } from "./github-copilot";
 import type { OAuthCredentialSource, OAuthCredentials, ProviderAccount, ProviderAccountSet } from "./types";
 
 type AuthStore = Record<string, ProviderAccountSet>;
@@ -118,6 +119,12 @@ function normalizeCredential(cred: unknown): OAuthCredentials | null {
   if (typeof candidate.accountId === "string" && candidate.accountId.length > 0) normalized.accountId = candidate.accountId;
   if (isCredentialSource(candidate.source)) normalized.source = candidate.source;
   if (typeof candidate.projectId === "string" && candidate.projectId.length > 0) normalized.projectId = candidate.projectId;
+  if (typeof candidate.apiBaseUrl === "string" && candidate.apiBaseUrl.length > 0) {
+    // Persist only allowlisted Copilot origins; drop anything else so auth.json cannot
+    // become an SSRF springboard across reloads.
+    const validated = validateCopilotApiBaseUrl(candidate.apiBaseUrl);
+    if (validated) normalized.apiBaseUrl = validated;
+  }
   return normalized;
 }
 
@@ -223,6 +230,16 @@ export async function saveCredential(provider: string, cred: OAuthCredentials):
         set.activeAccountId = existing.id;
         return;
       }
+      // Legacy migration: a pre-identity row (no accountId/email) for this provider is the
+      // SAME human re-logging in after the identity extraction shipped — upgrading the
+      // active identity-less row in place prevents a stale duplicate that stays selectable
+      // and would re-refresh into a second row with the same identity.
+      const active = set.accounts.find(a => a.id === set.activeAccountId);
+      if (active && active.credential.accountId === undefined && active.credential.email === undefined) {
+        active.credential = safe;
+        delete active.needsReauth;
+        return;
+      }
       const id = newAccountId(safe);
       set.accounts.push({ id, credential: safe, addedAt: Date.now() });
       set.activeAccountId = id;

package/src/oauth/types.ts

@@ -10,6 +10,11 @@ export type OAuthCredentials = {
   source?: OAuthCredentialSource;
   /** Google Antigravity (Cloud Code Assist) discovered project id; injected into the CCA envelope. */
   projectId?: string;
+  /**
+   * GitHub Copilot allowlisted API origin from token `endpoints.api` (HTTPS `*.githubcopilot.com` only).
+   * Never reuse for Antigravity projectId; validated on write and again at request time.
+   */
+  apiBaseUrl?: string;
 };
 
 /** One logged-in account inside a provider's account set (multiauth). */