@capagents/forgeqe 2.2.4 → 2.2.6

package/docs/user-guide.html

@@ -446,7 +446,7 @@ forgeqe models                        # check the profiles
 forgeqe start                         # the shell
 </code></pre>
 <p>With GitHub Copilot licences instead of a model key, sign in rather than exporting one, and set <code>llm.active: copilot</code> in <code>forgeqe.yaml</code> (or <code>&quot;default&quot;: &quot;copilot&quot;</code> in <code>llms.json</code>). The browser engine then runs on your Copilot seat; ForgeQE's agent and Scribe need another profile for now:</p>
-<pre><code class="language-bash">forgeqe auth login copilot            # a fine-grained token with Copilot Requests, or the GitHub CLI's sign-in
+<pre><code class="language-bash">forgeqe auth login copilot            # opens GitHub in your browser to sign in
 forgeqe models                        # the copilot profile is active
 </code></pre>
 <p>In the shell, type a request and press Enter:</p>
@@ -470,7 +470,7 @@ forgeqe suite cases.yaml --parallel 3        # what pipelines call
 pip install forgeqe-cli
 forgeqe --help
 </code></pre>
-<p>That is the only install step on Windows, macOS and Linux. The first run downloads Bun into <code>~/.forgeqe/tools</code> (unless a Bun 1.3+ is already installed), and <code>forgeqe setup</code> downloads the agent runtime and uv, which fetches Python. Nothing is added to PATH or shell profiles; deleting <code>~/.forgeqe</code> removes it all.</p>
+<p>That is the only install step on Windows, macOS and Linux. npm installs Bun with ForgeQE (through your npm registry, so a company mirror works); with pip, or when npm skipped it, the first run downloads Bun into <code>~/.forgeqe/tools</code> (unless a Bun 1.3+ is already installed), and <code>forgeqe setup</code> downloads the agent runtime and uv, which fetches Python. Nothing is added to PATH or shell profiles; deleting <code>~/.forgeqe</code> removes it all.</p>
 <p>Set up the ForgeQE engine once (the first live run does it automatically if you skip this):</p>
 <pre><code class="language-bash">forgeqe setup
 </code></pre>
@@ -488,6 +488,38 @@ bun install
 bun src/index.ts --help
 </code></pre>
 </div></section>
+<section class="doc sub" id="doc-how_to_use-company-networks"><h4>Company networks</h4><div class="prose"><p>On a company laptop, ForgeQE sets itself up for the network without anyone changing settings:</p>
+<div class="tbl"><table>
+<thead>
+<tr><th>What the network does</th><th>What ForgeQE does</th></tr>
+</thead>
+<tbody>
+<tr><td>Inspects HTTPS (Zscaler, Netskope, a firewall), with the company's own certificate</td><td>Uses the certificates this computer trusts: Windows' Trusted Root store, or the macOS System keychain. ForgeQE, the agent runtime, Playwright and Copilot's runtime get them through <code>NODE_EXTRA_CA_CERTS</code> (a copy in <code>~/.forgeqe/cache/system-ca.pem</code>, refreshed weekly); the Python engines check with the system through truststore; uv with <code>UV_SYSTEM_CERTS</code>. Certificates are still verified.</td></tr>
+<tr><td>Sends traffic through a proxy set in Windows</td><td>Reads Windows' proxy setting (or the one proxy its automatic configuration script names) and passes it on as <code>HTTPS_PROXY</code>. ForgeQE's own servers on <code>127.0.0.1</code> always bypass it.</td></tr>
+<tr><td>Blocks downloads from GitHub or the Playwright CDN</td><td>npm brings Bun through your registry; Microsoft Edge is used when Google Chrome is not installed, so no Chromium is downloaded; mirrors can stand in for the rest (below).</td></tr>
+</tbody>
+</table></div>
+<p>To see where the network stops ForgeQE, run:</p>
+<pre><code class="language-bash">forgeqe doctor
+</code></pre>
+<p>It shows the proxy and certificates in use, checks each address ForgeQE needs (GitHub downloads, Python packages, the npm registry, your models, Azure DevOps or Jira), and for anything blocked prints what to ask IT for, ready to forward.</p>
+<p><strong>For IT: mirrors and settings.</strong> Set these as environment variables (for example by Group Policy):</p>
+<div class="tbl"><table>
+<thead>
+<tr><th>Variable</th><th>What it does</th></tr>
+</thead>
+<tbody>
+<tr><td><code>FORGEQE_GITHUB_MIRROR</code></td><td>A mirror of GitHub release downloads (<code>https://artifacts.example.com/github</code>, laid out as <code>&lt;owner&gt;/&lt;repo&gt;/releases/download/&lt;tag&gt;/&lt;file&gt;</code>): Bun, uv, the agent runtime, Python builds and Copilot's runtime come from it. Checksums are still checked.</td></tr>
+<tr><td><code>UV_DEFAULT_INDEX</code> (or <code>PIP_INDEX_URL</code>)</td><td>A mirror of PyPI for the engine's Python packages.</td></tr>
+<tr><td><code>PLAYWRIGHT_DOWNLOAD_HOST</code></td><td>A mirror for Chromium, needed only without Chrome or Edge.</td></tr>
+<tr><td><code>HTTPS_PROXY</code>, <code>NO_PROXY</code></td><td>A proxy other than Windows' setting. A proxy that needs a sign-in takes <code>http://user:password@host:port</code>.</td></tr>
+<tr><td><code>NODE_EXTRA_CA_CERTS</code></td><td>Your own certificate file instead of the system's roots.</td></tr>
+<tr><td><code>FORGEQE_SYSTEM_CERTS=off</code></td><td>Leaves certificates to each tool's built-in list.</td></tr>
+<tr><td><code>FORGEQE_HOME</code></td><td>Where ForgeQE keeps its tools (default <code>~/.forgeqe</code>), for machines where programs may run only from certain folders.</td></tr>
+</tbody>
+</table></div>
+<p>What still needs IT: a proxy that signs in with your Windows account only (NTLM or Kerberos), and policies that block programs in the user folder (set <code>FORGEQE_HOME</code> to an allowed folder). On macOS, the company's certificate must be in the System keychain, where device management puts it.</p>
+</div></section>
 </section>
 <section class="doc" id="doc-how_to_use-2-scaffold-config">
 <h3>Scaffold config</h3>
@@ -537,19 +569,20 @@ bun src/index.ts init --global --profile azure-gpt4o
 <tbody>
 <tr><td><code>model</code></td><td>The Copilot model, as the Copilot SDK names it (<code>gpt-4.1</code>, <code>claude-sonnet-4.6</code>). It must take screenshots. The sign-in lists your seat's models and which of them take images.</td></tr>
 <tr><td><code>engine_model</code></td><td>Optional. Another Copilot model for the browser engine and the desktop agent.</td></tr>
-<tr><td><code>api_key_env</code></td><td>Optional. The variable holding the GitHub token; without it ForgeQE reads <code>COPILOT_GITHUB_TOKEN</code>, then the token <code>forgeqe auth login copilot</code> saved, then the GitHub CLI's sign-in.</td></tr>
+<tr><td><code>api_key_env</code></td><td>Optional. A variable that must hold the GitHub token for this profile. Without it ForgeQE uses <code>COPILOT_GITHUB_TOKEN</code>, then a token <code>forgeqe auth login copilot</code> saved, then the browser sign-in.</td></tr>
 </tbody>
 </table></div>
-<p>Sign in once per machine:</p>
+<p>Sign in once per machine (Windows, macOS or Linux):</p>
 <pre><code class="language-bash">forgeqe auth login copilot
 </code></pre>
-<p>It offers two ways:</p>
+<p>It offers two ways, the ones GitHub's Copilot SDK recommends:</p>
 <ul>
-<li><strong>A fine-grained token</strong> (recommended). ForgeQE opens GitHub's token page: set <strong>Resource owner</strong> to your personal account and add the <strong>Copilot Requests</strong> permission, then paste the token (<code>github_pat_...</code>). The token goes to your system's credential store like ForgeQE's other secrets. Classic tokens (<code>ghp_</code>) do not work with Copilot.</li>
-<li><strong>The GitHub CLI's sign-in</strong>, when <code>gh</code> is signed in.</li>
+<li><strong>Sign in with GitHub in the browser</strong> (recommended on your own computer). ForgeQE runs GitHub's own Copilot sign-in (<code>copilot login</code> from GitHub's Copilot CLI, downloaded once into <code>~/.forgeqe/tools</code> and checked against GitHub's checksums). Your browser opens GitHub; approve <strong>GitHub Copilot CLI</strong> there and you are signed in. GitHub's CLI keeps the sign-in in your system's credential store (Windows Credential Manager, the macOS Keychain); ForgeQE never sees a token. On a remote machine it shows a code to enter at github.com/login/device instead.</li>
+<li><strong>A fine-grained token</strong>, for machines without a browser. ForgeQE opens GitHub's token page: set <strong>Resource owner</strong> to your personal account and add the <strong>Copilot Requests</strong> permission, then paste the token (<code>github_pat_...</code>). Each character shows as <code>*</code>, and ForgeQE confirms what it got (<code>github_pat_11AB…Wz9Q (93 characters)</code>). The token goes to your system's credential store like ForgeQE's other secrets. Classic tokens (<code>ghp_</code>) do not work with Copilot.</li>
 </ul>
-<p>Either way ForgeQE checks the token by asking Copilot for your seat's models and lists them; the first time, the Copilot SDK downloads Copilot's runtime from GitHub (checked against GitHub's checksums). <code>forgeqe auth</code> shows the sign-in on its <code>Copilot</code> line; <code>forgeqe auth logout copilot</code> forgets a saved token.</p>
-<p>The token reaches only the gateway's process. The engine gets the gateway's address and a one-time key that works nowhere else; the gateway refuses requests without that key and any request a web page sends. Model-run shell commands never see the token or the key.</p>
+<p>Either way ForgeQE checks the sign-in by asking Copilot for your seat's models and lists them; the first time, the Copilot SDK downloads Copilot's runtime from GitHub (checked against GitHub's checksums). <code>forgeqe auth</code> shows the sign-in on its <code>Copilot</code> line; <code>forgeqe auth logout copilot</code> makes ForgeQE stop using it (GitHub keeps a browser sign-in until you revoke <strong>GitHub Copilot CLI</strong> at github.com/settings/applications).</p>
+<p>If your organization uses SAML single sign-on, GitHub asks you to authorize the organization during the browser sign-in. A Copilot Business or Enterprise seat needs your organization to allow <strong>Copilot CLI</strong> in its Copilot policies.</p>
+<p>A token reaches only the gateway's process. The engine gets the gateway's address and a one-time key that works nowhere else; the gateway refuses requests without that key and any request a web page sends. Model-run shell commands never see the token or the key.</p>
 <p>Which part uses what:</p>
 <div class="tbl"><table>
 <thead>
@@ -570,13 +603,15 @@ bun src/index.ts init --global --profile azure-gpt4o
 <tr><th>ForgeQE says</th><th>What to do</th></tr>
 </thead>
 <tbody>
-<tr><td><code>GitHub Copilot needs a GitHub token, and there is none</code></td><td>Run <code>forgeqe auth login copilot</code> (or <code>/auth copilot</code> in the shell), or set <code>COPILOT_GITHUB_TOKEN</code>.</td></tr>
-<tr><td><code>GitHub Copilot does not take classic tokens (ghp_)</code></td><td>Make a fine-grained token with the Copilot Requests permission, owned by your personal account.</td></tr>
+<tr><td><code>GitHub Copilot is not signed in</code></td><td>Run <code>forgeqe auth login copilot</code> (or <code>/auth copilot</code> in the shell) and sign in in the browser, or set <code>COPILOT_GITHUB_TOKEN</code>.</td></tr>
+<tr><td><code>The GitHub sign-in did not finish</code></td><td>The browser sign-in was cancelled or denied. Run <code>forgeqe auth login copilot</code> again; with SAML single sign-on, authorize your organization when GitHub asks.</td></tr>
+<tr><td><code>GitHub Copilot does not take classic tokens (ghp_)</code></td><td>Sign in in the browser instead, or make a fine-grained token with the Copilot Requests permission, owned by your personal account.</td></tr>
 <tr><td><code>GitHub Copilot did not accept the token</code></td><td>The token has no Copilot Requests permission, has expired, or the account has no Copilot seat.</td></tr>
 <tr><td><code>… must be a Copilot model id</code>, <code>engine_model must be a Copilot model id</code></td><td>Fix that field in <code>llms.json</code>: the sign-in lists the seat's models. A GitHub Models id such as <code>openai/gpt-4.1</code> is not a Copilot id; use <code>gpt-4.1</code>.</td></tr>
 <tr><td><code>ForgeQE's agent and Scribe cannot run on a github_copilot profile yet</code></td><td>Pick another profile for them (<code>--profile</code>, or Tab in the shell), or set <code>code.model</code>.</td></tr>
 <tr><td>The model is refused, or not found</td><td>The seat's plan or your organization's Copilot policies do not allow that model: pick one the sign-in listed, or ask a Copilot admin to enable it.</td></tr>
 <tr><td><code>GitHub Copilot runs through the ForgeQE engine, which is not set up</code></td><td>Run <code>forgeqe setup</code>.</td></tr>
+<tr><td><code>CERTIFICATE_VERIFY_FAILED</code> while downloading Copilot's runtime</td><td>Your network inspects HTTPS. Update ForgeQE and run <code>forgeqe setup</code>, then sign in again: it uses the certificates your computer trusts (see <a href="../HOW_TO_USE.md#company-networks">Company networks</a>). If it still fails, run <code>forgeqe doctor</code> and send its output to IT.</td></tr>
 </tbody>
 </table></div>
 </div></section>
@@ -600,7 +635,7 @@ forgeqe auth logout jira
 <tbody>
 <tr><td>Azure DevOps</td><td><strong>Sign in with Microsoft in the browser</strong> through the Azure CLI (<code>az login</code>); ForgeQE saves nothing, and the Azure CLI renews the sign-in. Or paste a personal access token: the token page opens with the scopes to tick. Azure DevOps Server (on-premises) uses a personal access token.</td></tr>
 <tr><td>GitHub</td><td><strong>Sign in with GitHub in the browser</strong> through the GitHub CLI (<code>gh auth login</code>): ForgeQE shows the one-time code and opens the page. Or paste a token. Needs <code>gh</code> installed. <code>forgeqe auth login copilot</code> can use this sign-in for a <code>github_copilot</code> profile.</td></tr>
-<tr><td>GitHub Copilot</td><td><code>forgeqe auth login copilot</code>: <strong>Paste a fine-grained token</strong> with the Copilot Requests permission (ForgeQE opens GitHub's token page), or use the GitHub CLI's sign-in. ForgeQE checks it with Copilot and lists the models your seat has. No other app is authorized on your GitHub account. For a <code>github_copilot</code> profile; see <a href="../HOW_TO_USE.md#github-copilot-seats-as-the-model">GitHub Copilot seats as the model</a>.</td></tr>
+<tr><td>GitHub Copilot</td><td><code>forgeqe auth login copilot</code>: <strong>Sign in with GitHub in the browser</strong> (GitHub's own Copilot sign-in), or paste a fine-grained token with the Copilot Requests permission. ForgeQE checks it with Copilot and lists the models your seat has. For a <code>github_copilot</code> profile; see <a href="../HOW_TO_USE.md#github-copilot-seats-as-the-model">GitHub Copilot seats as the model</a>.</td></tr>
 <tr><td>Jira, Confluence</td><td>Your Atlassian API tokens page opens (Cloud) or your personal access tokens page (Server/Data Center); create one and paste it. Confluence on the same Cloud site as Jira reuses the Jira sign-in.</td></tr>
 <tr><td>TestRail, Zephyr Scale, qTest, Xray Cloud</td><td>The page with your API key opens, or ForgeQE says where to find it; paste it.</td></tr>
 <tr><td>Anything else</td><td><code>forgeqe auth login OPENAI_API_KEY</code> (any variable name) saves that one secret: a model key, a Teams webhook URL, an SMTP or saved-login password.</td></tr>
@@ -4617,7 +4652,7 @@ the list again. For a client that ignores it, <code>forgeqe mcp --all-tools</cod
 <tr><td><code>WP_LLMS_JSON</code></td><td>Path to <code>llms.json</code></td></tr>
 <tr><td><code>WP_LLM_PROFILE</code></td><td>Active profile, unless <code>--profile</code> is set</td></tr>
 <tr><td><code>WP_AZURE_API_KEY</code> / <code>OPENAI_API_KEY</code> / <code>WP_API_KEY</code></td><td>Keys referenced by profiles</td></tr>
-<tr><td><code>COPILOT_GITHUB_TOKEN</code></td><td>A <code>github_copilot</code> profile's GitHub token (fine-grained, with the Copilot Requests permission), unless the profile's <code>api_key_env</code> names another; else the saved token, then the GitHub CLI's sign-in</td></tr>
+<tr><td><code>COPILOT_GITHUB_TOKEN</code></td><td>A <code>github_copilot</code> profile's GitHub token (fine-grained, with the Copilot Requests permission), unless the profile's <code>api_key_env</code> names another; else the saved token, then the browser sign-in (<code>forgeqe auth login copilot</code>)</td></tr>
 <tr><td><code>FORGEQE_COPILOT_TOKEN</code></td><td>The token <code>forgeqe auth login copilot</code> saves; set by ForgeQE from the credential store, not by hand</td></tr>
 <tr><td><code>FORGEQE_CONFIG_DIR</code></td><td>Global config folder (default <code>~/.config/forgeqe</code>): <code>forgeqe.yaml</code>, <code>llms.json</code> and <code>.env</code> used when a project has none</td></tr>
 <tr><td><code>FORGEQE_PYTHON</code></td><td>A Python that already has the engine's libraries, used instead of the managed venv (skipped, with a note, when it cannot run the engine)</td></tr>

package/llms.example.json

@@ -51,7 +51,7 @@
     "copilot": {
       "provider": "github_copilot",
       "model": "gpt-4.1",
-      "description": "GitHub Copilot seat for the browser engine, through GitHub's Copilot SDK (forgeqe auth login copilot: a fine-grained token with Copilot Requests, or the GitHub CLI's sign-in)"
+      "description": "GitHub Copilot seat for the browser engine, through GitHub's Copilot SDK (forgeqe auth login copilot: sign in with GitHub in the browser, or a fine-grained token with Copilot Requests)"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capagents/forgeqe",
-  "version": "2.2.4",
+  "version": "2.2.6",
   "description": "ForgeQE: a browser agent CLI that runs goals and test cases in local Chrome or Chromium, or BrowserStack and TestMu AI/LambdaTest when configured, and turns passing runs into tests in your repo",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
@@ -60,6 +60,16 @@
   "dependencies": {
     "@opentui/core": "^0.5.12"
   },
+  "optionalDependencies": {
+    "@oven/bun-darwin-aarch64": "1.4.2",
+    "@oven/bun-darwin-x64-baseline": "1.4.2",
+    "@oven/bun-linux-aarch64": "1.4.2",
+    "@oven/bun-linux-aarch64-musl": "1.4.2",
+    "@oven/bun-linux-x64-baseline": "1.4.2",
+    "@oven/bun-linux-x64-musl-baseline": "1.4.2",
+    "@oven/bun-windows-aarch64": "1.4.2",
+    "@oven/bun-windows-x64-baseline": "1.4.2"
+  },
   "devDependencies": {
     "@opencode-ai/sdk": "1.18.33",
     "@opentui/react": "^0.5.12",

package/py/forgeqe_desktop/__main__.py

@@ -1,3 +1,7 @@
+from forgeqe_engine.systemcerts import use_system_certificates
+
 from .cli import main
 
+use_system_certificates()
+
 raise SystemExit(main())

package/py/forgeqe_engine/__main__.py

@@ -1,3 +1,7 @@
+from forgeqe_engine.systemcerts import use_system_certificates
+
 from .cli import main
 
+use_system_certificates()
+
 raise SystemExit(main())

package/py/forgeqe_engine/browser.py

@@ -7,9 +7,10 @@ import contextlib
 import json
 import logging
 import os
+import sys
 import time
 from pathlib import Path
-from typing import Any, Dict, Optional
+from typing import Any, Dict, List, Optional
 from urllib.parse import quote, urlparse
 
 logger = logging.getLogger("forgeqe_engine.service")
@@ -84,6 +85,24 @@ _UNSUPPORTED_BROWSER_USE_ARGS = (
 _MAC_CHROME_EXECUTABLE = "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
 
 
+def find_edge_executable() -> Optional[str]:
+    """
+    Microsoft Edge, which every Windows PC has: used when Google Chrome is not installed, so that no Chromium has to be
+    downloaded (company networks often block where it comes from).
+    """
+    candidates: List[str] = []
+    if sys.platform == "win32":
+        for var in ("PROGRAMFILES(X86)", "PROGRAMFILES", "LOCALAPPDATA"):
+            base = os.environ.get(var)
+            if base:
+                candidates.append(os.path.join(base, "Microsoft", "Edge", "Application", "msedge.exe"))
+    elif sys.platform == "darwin":
+        candidates.append("/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge")
+    else:
+        candidates += ["/usr/bin/microsoft-edge", "/usr/bin/microsoft-edge-stable", "/opt/microsoft/msedge/msedge"]
+    return next((c for c in candidates if Path(c).is_file()), None)
+
+
 def resolve_browser_channel() -> str:
     """Default is installed Google Chrome (`chrome`). Override with BROWSER_USE_CHANNEL (e.g. `chromium`)."""
     raw = (os.getenv("BROWSER_USE_CHANNEL") or "chrome").strip().lower()
@@ -125,8 +144,12 @@ def local_browser_launch_kwargs(*, headless: bool) -> Dict[str, Any]:
         "ignore_default_args": list(_UNSUPPORTED_BROWSER_USE_ARGS),
     }
     exe = resolve_chrome_executable_path(channel)
+    edge = None if exe or channel not in ("chrome", "msedge") else find_edge_executable()
     if exe:
         kw["executable_path"] = exe
+    elif edge:
+        kw["executable_path"] = edge
+        kw["channel"] = "msedge"
     elif channel == "chrome":
         # No Google Chrome here: let the library use its own Chromium instead of failing on the channel.
         kw["channel"] = "chromium"

package/py/forgeqe_engine/cli.py

@@ -78,6 +78,10 @@ def _doctor(out: TextIO) -> int:
         info["copilot_sdk"] = version("github-copilot-sdk")
     except Exception:
         pass
+    try:
+        info["truststore"] = version("truststore")
+    except Exception:
+        pass
     try:
         info["video"] = version("imageio")
     except Exception:

package/py/forgeqe_engine/copilot_gateway.py

@@ -7,7 +7,8 @@ tools of its own (the system prompt replaced, screenshots attached, a JSON schem
 OpenAI shape.
 
   python -m forgeqe_engine copilot-gateway
-    env    COPILOT_GITHUB_TOKEN          the GitHub token (fine-grained with Copilot Requests, or the GitHub CLI's)
+    env    COPILOT_GITHUB_TOKEN          a fine-grained token with Copilot Requests; without it, the signed-in user
+                                         (forgeqe auth login copilot, kept under ~/.forgeqe/copilot)
            FORGEQE_COPILOT_GATEWAY_KEY   the one-time key every request must carry as "Bearer <key>"
     stdout one line: {"port": N, "login": "<account>"} once it listens, or {"error": "..."}
     stdin  end of input stops it, so it never outlives ForgeQE
@@ -26,6 +27,8 @@ import time
 import uuid
 from typing import Any, Dict, List, Optional, TextIO, Tuple
 
+from .systemcerts import use_system_certificates
+
 TOKEN_ENV = "COPILOT_GITHUB_TOKEN"
 KEY_ENV = "FORGEQE_COPILOT_GATEWAY_KEY"
 
@@ -181,23 +184,37 @@ def local_origin(headers: Dict[str, str]) -> bool:
 # The Copilot SDK
 
 
+def copilot_home() -> str:
+    """Copilot's home for ForgeQE, where `forgeqe auth login copilot` signed in (src/auth/copilotLogin.ts)."""
+    return os.path.join(os.environ.get("FORGEQE_HOME") or os.path.join(os.path.expanduser("~"), ".forgeqe"), "copilot")
+
+
+def client_options(token: Optional[str], home: str, workdir: str) -> Dict[str, Any]:
+    """With a token, that token only; without one, the signed-in user, as the Copilot SDK recommends on a user's machine."""
+    auth: Dict[str, Any] = {"github_token": token, "use_logged_in_user": False} if token else {"use_logged_in_user": True}
+    return {**auth, "base_directory": home, "working_directory": workdir, "log_level": "error"}
+
+
 class Copilot:
-    def __init__(self, token: str):
+    def __init__(self, token: Optional[str]):
         from copilot import CopilotClient
 
         # The SDK keeps its state under this folder, apart from the user's own Copilot CLI.
-        home = os.path.join(os.environ.get("FORGEQE_HOME") or os.path.join(os.path.expanduser("~"), ".forgeqe"), "copilot")
+        home = copilot_home()
         os.makedirs(home, exist_ok=True)
         # An empty working folder: the session reads no project files and no custom instructions.
         self.workdir = tempfile.mkdtemp(prefix="forgeqe-copilot-")
-        self.client = CopilotClient(github_token=token, use_logged_in_user=False, base_directory=home, working_directory=self.workdir, log_level="error")
+        self.signed_in_user = not token
+        self.client = CopilotClient(**client_options(token, home, self.workdir))
 
     async def start(self) -> None:
         await self.client.start()
         status = await self.client.get_auth_status()
         self.login = status.login or ""
         if not status.isAuthenticated:
-            raise GatewayError(401, "GitHub Copilot did not accept the token: use a fine-grained token with the Copilot Requests permission, or the GitHub CLI's sign-in, for an account with a Copilot seat.")
+            if self.signed_in_user:
+                raise GatewayError(401, "GitHub Copilot is not signed in: run forgeqe auth login copilot, which opens GitHub in your browser.")
+            raise GatewayError(401, "GitHub Copilot did not accept the token: use a fine-grained token with the Copilot Requests permission, for an account with a Copilot seat.")
 
     async def stop(self) -> None:
         try:
@@ -338,14 +355,11 @@ async def serve(out: TextIO, copilot: Any = None) -> int:
         out.write(json.dumps({"error": f"{KEY_ENV} must hold the gateway's one-time key."}) + "\n")
         return 2
     if copilot is None:
-        if not token:
-            out.write(json.dumps({"error": "No GitHub token for Copilot: run forgeqe auth login copilot."}) + "\n")
-            return 1
         if token.startswith("ghp_"):
             out.write(json.dumps({"error": "GitHub Copilot does not take classic tokens (ghp_): use a fine-grained token with the Copilot Requests permission."}) + "\n")
             return 1
         try:
-            copilot = Copilot(token)
+            copilot = Copilot(token or None)
             await copilot.start()
         except GatewayError as e:
             out.write(json.dumps({"error": e.message}) + "\n")
@@ -366,4 +380,5 @@ async def serve(out: TextIO, copilot: Any = None) -> int:
 
 
 def main(out: TextIO) -> int:
+    use_system_certificates()
     return asyncio.run(serve(out))

package/py/forgeqe_engine/systemcerts.py

@@ -0,0 +1,23 @@
+"""
+HTTPS certificates checked with the operating system's store (truststore), as pip and uv do. On a company network that
+inspects HTTPS, the company's certificate authority is trusted by Windows or macOS but not by Python's own bundle
+(certifi), and Python 3.13+ refuses such a CA whose Basic Constraints are not marked critical. With this, the engines'
+calls to the model, the Copilot SDK's runtime download and any other HTTPS request work there.
+
+Certificates are still verified, hostnames included; only who verifies them changes. FORGEQE_SYSTEM_CERTS=off leaves
+Python's own checks in place (src/network.ts).
+"""
+from __future__ import annotations
+
+import os
+
+
+def use_system_certificates() -> bool:
+    if os.environ.get("FORGEQE_SYSTEM_CERTS", "").strip().lower() in ("0", "off", "false", "no"):
+        return False
+    try:
+        import truststore
+    except ImportError:
+        return False
+    truststore.inject_into_ssl()
+    return True

package/py/forgeqe_mobile/__main__.py

@@ -1,3 +1,7 @@
+from forgeqe_engine.systemcerts import use_system_certificates
+
 from .cli import main
 
+use_system_certificates()
+
 raise SystemExit(main())