@dianshuv/copilot-api 0.15.1 → 0.16.0

package/README.md

@@ -16,7 +16,7 @@
 - **Stream repetition detection**: Detects when models get stuck in repetitive output loops using KMP-based pattern matching and logs a warning.
 - **Stale request reaping**: Automatically force-fails requests that exceed a configurable maximum age (default 600s) to prevent resource leaks.
 - **PostHog analytics**: Optional PostHog Cloud integration (`--posthog-key`) sends per-request token usage events for long-term trend analysis. Free tier (1M events/month) is more than sufficient for individual use.
-- **GitHub Copilot CLI emulation**: All upstream requests to GitHub — device-flow `login`, Copilot token exchange, and model calls — carry the official GitHub Copilot CLI's (`@github/copilot`) identity: its `copilot-integration-id` (`copilot-developer-cli`), `editor-version`/`user-agent` (`copilot/<version>`), `x-github-api-version`, and a persistent `x-client-machine-id` (stored at `~/.local/share/copilot-api/machine_id`). The `login` flow uses the CLI's own OAuth app, so **new** logins request the `read:user`, `read:org`, `repo`, and `gist` scopes; existing tokens keep working without re-authentication.
+- **GitHub Copilot CLI emulation**: All upstream requests to GitHub — device-flow `login`, `/copilot_internal/user` bootstrap, and CAPI model/chat calls — carry the official GitHub Copilot CLI's (`@github/copilot`) identity: its `copilot-integration-id` (`copilot-developer-cli`), `editor-version`/`user-agent` (`copilot/<version>`), `x-github-api-version`, and a persistent `x-client-machine-id` (stored at `~/.local/share/copilot-api/machine_id`). The CAPI Bearer is the GitHub OAuth token itself — the CLI does not perform a separate token exchange. The `login` flow uses the CLI's own OAuth app, so **new** logins request the `read:user`, `read:org`, `repo`, and `gist` scopes; existing tokens keep working without re-authentication.
 
 ## Quick Start
 
@@ -63,6 +63,7 @@ make down
 | `--github-token`, `-g` | Provide GitHub token directly (or `GH_TOKEN` env) | none |
 | `--posthog-key` | PostHog API key for token usage analytics (opt-in) | none |
 | `--api-key` | Proxy API key for inbound authentication (see [Authentication](#authentication)). Empty = disabled | none |
+| `--allow-token-endpoint` | Opt-in to expose `GET /token` (echoes the raw GitHub OAuth token; requires `--api-key` too). `COPILOT_ALLOW_TOKEN_ENDPOINT=1` env twin. | false |
 
 ### Hidden Models
 
@@ -114,7 +115,7 @@ Currently hidden (grouped):
 |----------|--------|-------------|
 | `/` | GET | Server status |
 | `/usage` | GET | Copilot usage stats |
-| `/token` | GET | Current Copilot token |
+| `/token` | GET | Current CAPI Bearer (= raw GitHub OAuth token). Disabled by default; requires `--allow-token-endpoint` **and** `--api-key`, otherwise 403. |
 | `/health` | GET | Health check |
 | `/history` | GET | Request history Web UI with token analytics (enabled by default) |
 | `/history/api/*` | GET/DELETE | History API endpoints |

package/dist/main.mjs

@@ -140,6 +140,7 @@ const state = {
 	showToken: false,
 	showAllModels: false,
 	verbose: false,
+	allowTokenEndpoint: false,
 	autoTruncate: true,
 	compressToolResults: false,
 	redirectAnthropic: false,
@@ -165,7 +166,10 @@ const COPILOT_INTEGRATION_ID = "copilot-developer-cli";
 const cliVersion = (state) => state.copilotCliVersion ?? CLI_VERSION_FALLBACK;
 const editorVersion = (state) => `copilot/${cliVersion(state)}`;
 const userAgent = (state) => `copilot/${cliVersion(state)} (${process.platform} ${process.version}) term/${process.env.TERM_PROGRAM ?? "unknown"}`;
-const copilotBaseUrl = (state) => state.accountType === "individual" ? "https://api.githubcopilot.com" : `https://api.${state.accountType}.githubcopilot.com`;
+const copilotBaseUrl = (state) => {
+	if (state.copilotApiEndpoint) return state.copilotApiEndpoint;
+	return state.accountType === "individual" ? "https://api.githubcopilot.com" : `https://api.${state.accountType}.githubcopilot.com`;
+};
 function hasHeaderKey(headers, key) {
 	const lowerKey = key.toLowerCase();
 	return Object.keys(headers).some((existingKey) => {
@@ -465,14 +469,6 @@ function forwardError(c, error) {
 	} }, 500);
 }
 
-//#endregion
-//#region src/services/github/get-copilot-token.ts
-const getCopilotToken = async () => {
-	const response = await fetch(`${GITHUB_API_BASE_URL}/copilot_internal/v2/token`, { headers: githubHeaders(state) });
-	if (!response.ok) throw await HTTPError.fromResponse("Failed to get Copilot token", response);
-	return await response.json();
-};
-
 //#endregion
 //#region src/services/github/get-device-code.ts
 async function getDeviceCode() {
@@ -567,48 +563,28 @@ function isRetryable(error) {
 	return code !== void 0 && RETRYABLE_CAUSE_CODES.has(code);
 }
 const RETRY_ATTEMPTS_KEY = "__copilotRetryAttempts";
-const RETRY_AUTH_REFRESHED_KEY = "__copilotRetryAuthRefreshed";
 /**
 * Read retry metadata recorded on an error or response by fetchWithRetry.
 * Returns attempts=1 (no retry) if the value is missing or malformed.
 */
 function getRetryAttempts(target) {
-	if (typeof target !== "object" || target === null) return {
-		attempts: 1,
-		authRefreshed: false
-	};
+	if (typeof target !== "object" || target === null) return { attempts: 1 };
 	const meta = target;
-	return {
-		attempts: typeof meta[RETRY_ATTEMPTS_KEY] === "number" ? meta[RETRY_ATTEMPTS_KEY] : 1,
-		authRefreshed: meta[RETRY_AUTH_REFRESHED_KEY] === true
-	};
+	return { attempts: typeof meta[RETRY_ATTEMPTS_KEY] === "number" ? meta[RETRY_ATTEMPTS_KEY] : 1 };
 }
-async function fetchWithRetry(input, init, options) {
-	let currentInit = init;
-	let authRefreshed = false;
+async function fetchWithRetry(input, init) {
 	let networkAttempts = 0;
 	for (let attempt = 0; attempt <= RETRY_DELAYS_MS.length; attempt++) try {
 		networkAttempts++;
 		const fetchStart = performance.now();
-		const response = await fetch(input, currentInit);
+		const response = await fetch(input, init);
 		const ttfbMs = performance.now() - fetchStart;
-		if (response.status === 401 && !authRefreshed && options?.onUnauthorized) {
-			const refreshed = await tryRefreshAuth(options.onUnauthorized);
-			if (refreshed) {
-				await response.body?.cancel().catch(() => {});
-				consola.warn("Got 401 from upstream; refreshed token and retrying");
-				currentInit = refreshed;
-				authRefreshed = true;
-				attempt--;
-				continue;
-			}
-		}
 		addTiming(TIMING.UPSTREAM_TTFB, ttfbMs);
-		annotateRetryMeta(response, networkAttempts, authRefreshed);
+		annotateRetryMeta(response, networkAttempts);
 		return response;
 	} catch (error) {
 		if (attempt === RETRY_DELAYS_MS.length || !isRetryable(error)) {
-			annotateRetryMeta(error, networkAttempts, authRefreshed);
+			annotateRetryMeta(error, networkAttempts);
 			throw error;
 		}
 		const delay = RETRY_DELAYS_MS[attempt];
@@ -617,54 +593,31 @@ async function fetchWithRetry(input, init, options) {
 	}
 	throw new Error("fetchWithRetry exhausted attempts without resolution");
 }
-function annotateRetryMeta(target, attempts, authRefreshed) {
+function annotateRetryMeta(target, attempts) {
 	if (typeof target !== "object" || target === null) return;
 	try {
 		const meta = target;
 		meta[RETRY_ATTEMPTS_KEY] = attempts;
-		meta[RETRY_AUTH_REFRESHED_KEY] = authRefreshed;
 	} catch {}
 }
-async function tryRefreshAuth(onUnauthorized) {
-	try {
-		return await onUnauthorized();
-	} catch (error) {
-		consola.warn("onUnauthorized callback failed:", error instanceof Error ? error.message : error);
-		return null;
-	}
-}
-/**
-* Build an onUnauthorized callback that refreshes the Copilot token and
-* returns a new RequestInit with an updated Authorization header.
-*/
-function makeCopilotAuthRetry(refreshToken, init) {
-	return async () => {
-		const newToken = await refreshToken();
-		if (!newToken) return null;
-		const headers = new Headers(init.headers);
-		headers.set("Authorization", `Bearer ${newToken}`);
-		return {
-			...init,
-			headers
-		};
-	};
-}
 
 //#endregion
 //#region src/services/copilot/copilot-fetch.ts
 /**
 * Single transport seam for all upstream Copilot API calls.
 *
-* Wraps every request with:
-* - Network-error retry (UND_ERR_SOCKET, ECONNRESET, ENOTFOUND, connect timeouts)
-* - 401 → forceRefreshCopilotToken → retry once with the new bearer token
+* Wraps every request with network-error retry (UND_ERR_SOCKET, ECONNRESET,
+* ENOTFOUND, connect timeouts).
 *
-* Callers supply the path (e.g. "/chat/completions") and the usual RequestInit.
-* The host prefix and resilience wiring are applied here so every endpoint
-* gets the same treatment and adding a new endpoint is one call site.
+* Historically this seam also refreshed a short-lived CAPI session token on
+* 401. That session-token flow was a VSCode/JetBrains-plugin idiom; the CLI
+* we impersonate uses the GitHub OAuth token directly as the CAPI Bearer, so
+* a 401 there means the OAuth token itself is invalid — no server-side
+* refresh helps. If a future refresh_token grant is wired in, add it back
+* here as an `onUnauthorized` callback.
 */
 function copilotFetch(path, init) {
-	return fetchWithRetry(`${copilotBaseUrl(state)}${path}`, init, { onUnauthorized: makeCopilotAuthRetry(forceRefreshCopilotToken, init) });
+	return fetchWithRetry(`${copilotBaseUrl(state)}${path}`, init);
 }
 
 //#endregion
@@ -708,6 +661,14 @@ async function getCopilotCliVersion() {
 	}
 }
 
+//#endregion
+//#region src/services/github/get-copilot-usage.ts
+const getCopilotUsage = async () => {
+	const response = await fetch(`${GITHUB_API_BASE_URL}/copilot_internal/user`, { headers: githubHeaders(state) });
+	if (!response.ok) throw await HTTPError.fromResponse("Failed to get Copilot usage", response);
+	return await response.json();
+};
+
 //#endregion
 //#region src/lib/utils.ts
 const sleep = (ms) => new Promise((resolve) => {
@@ -736,6 +697,44 @@ const initCopilotIdentity = async () => {
 	state.machineId = await getOrCreateMachineId();
 	await cacheCopilotCliVersion();
 };
+/**
+* Bootstraps the CAPI session after GitHub OAuth is settled. Mirrors what the
+* real @github/copilot CLI does at startup:
+*
+* 1. GET /copilot_internal/user to learn the account's CAPI endpoint set
+*    (`endpoints.api` — the host varies by plan tier, e.g. enterprise gets
+*    `api.enterprise.githubcopilot.com`).
+* 2. Use the GitHub OAuth token directly as the CAPI Bearer. The CLI does NOT
+*    exchange the OAuth token for a separate CAPI session token — that flow
+*    (`GET /copilot_internal/v2/token`) is a VSCode/JetBrains-plugin idiom the
+*    CLI's GitHub App is not authorized for (returns 404).
+*
+* Must run after setupGitHubToken() and initCopilotIdentity(). Failure surfaces
+* to the caller; there is no CAPI to serve without endpoints or a Bearer, so
+* a missing/tampered/non-Copilot `endpoints.api` throws at boot rather than
+* silently degrading to a stale accountType-derived host or routing the raw
+* GitHub OAuth token at an arbitrary origin.
+*/
+const CAPI_HOST_PATTERN = /^api(?:\.[a-z0-9-]+)?\.githubcopilot\.com$/;
+const bootstrapCopilotSession = async () => {
+	const usage = await getCopilotUsage();
+	if (usage === null || typeof usage !== "object") throw new Error("bootstrapCopilotSession: /copilot_internal/user body was not an object.");
+	const usageObj = usage;
+	if (typeof usageObj.endpoints !== "object" || usageObj.endpoints === null) throw new Error("bootstrapCopilotSession: /copilot_internal/user returned no endpoints object.");
+	const rawApi = usageObj.endpoints.api;
+	if (typeof rawApi !== "string") throw new TypeError(`bootstrapCopilotSession: endpoints.api must be a string (got ${typeof rawApi}).`);
+	let parsed;
+	try {
+		parsed = new URL(rawApi);
+	} catch {
+		throw new Error(`bootstrapCopilotSession: endpoints.api is not a valid URL (${JSON.stringify(rawApi)}).`);
+	}
+	if (parsed.protocol !== "https:") throw new Error(`bootstrapCopilotSession: endpoints.api must use https:// (got ${parsed.protocol}).`);
+	if (parsed.port !== "") throw new Error(`bootstrapCopilotSession: endpoints.api must use the default https port (got :${parsed.port}).`);
+	if (!CAPI_HOST_PATTERN.test(parsed.hostname)) throw new Error(`bootstrapCopilotSession: endpoints.api host ${parsed.hostname} is not an api[.tier].githubcopilot.com host.`);
+	state.copilotApiEndpoint = parsed.origin;
+	state.copilotToken = state.githubToken;
+};
 
 //#endregion
 //#region src/services/github/poll-access-token.ts
@@ -771,72 +770,6 @@ async function pollAccessToken(deviceCode) {
 //#region src/lib/token.ts
 const readGithubToken = () => fs.readFile(PATHS.GITHUB_TOKEN_PATH, "utf8");
 const writeGithubToken = (token) => fs.writeFile(PATHS.GITHUB_TOKEN_PATH, token);
-let copilotTokenRefreshTimer = null;
-/**
-* Refresh the Copilot token with exponential backoff retry.
-* Returns the new token on success, or null if all retries fail.
-*/
-async function refreshCopilotTokenWithRetry(maxRetries = 3) {
-	let lastError = null;
-	for (let attempt = 0; attempt < maxRetries; attempt++) try {
-		const { token } = await getCopilotToken();
-		return token;
-	} catch (error) {
-		lastError = error;
-		const delay = Math.min(1e3 * 2 ** attempt, 3e4);
-		consola.warn(`Token refresh attempt ${attempt + 1}/${maxRetries} failed, retrying in ${delay}ms`);
-		await new Promise((resolve) => setTimeout(resolve, delay));
-	}
-	consola.error("All token refresh attempts failed:", lastError);
-	return null;
-}
-/**
-* Force-refresh the Copilot token on demand (e.g. after a 401 response).
-* Updates state.copilotToken on success and returns the new token, or null
-* if refresh failed. Coalesces concurrent callers so multiple in-flight 401s
-* only trigger one refresh.
-*/
-let refreshInFlight = null;
-async function forceRefreshCopilotToken() {
-	if (refreshInFlight) return refreshInFlight;
-	refreshInFlight = refreshCopilotTokenWithRetry().then((token) => {
-		if (token) state.copilotToken = token;
-		return token;
-	}).finally(() => {
-		refreshInFlight = null;
-	});
-	return refreshInFlight;
-}
-/**
-* Clear any existing token refresh timer.
-* Call this before setting up a new timer or during cleanup.
-*/
-function clearCopilotTokenRefresh() {
-	if (copilotTokenRefreshTimer) {
-		clearInterval(copilotTokenRefreshTimer);
-		copilotTokenRefreshTimer = null;
-	}
-}
-const setupCopilotToken = async () => {
-	const { token, refresh_in } = await getCopilotToken();
-	state.copilotToken = token;
-	consola.debug("GitHub Copilot Token fetched successfully!");
-	if (state.showToken) consola.info("Copilot token:", token);
-	const refreshInterval = Math.max((refresh_in - 60) * 1e3, 60 * 1e3);
-	clearCopilotTokenRefresh();
-	copilotTokenRefreshTimer = setInterval(() => {
-		consola.debug("Refreshing Copilot token");
-		refreshCopilotTokenWithRetry().then((newToken) => {
-			if (newToken) {
-				state.copilotToken = newToken;
-				consola.debug("Copilot token refreshed");
-				if (state.showToken) consola.info("Refreshed Copilot token:", newToken);
-			} else consola.error("Failed to refresh Copilot token after retries, using existing token");
-		}).catch((error) => {
-			consola.error("Unexpected error during token refresh:", error);
-		});
-	}, refreshInterval);
-};
 async function setupGitHubToken(options) {
 	try {
 		const githubToken = await readGithubToken();
@@ -869,14 +802,6 @@ async function logUser() {
 	consola.info(`Logged in as ${user.login}`);
 }
 
-//#endregion
-//#region src/services/github/get-copilot-usage.ts
-const getCopilotUsage = async () => {
-	const response = await fetch(`${GITHUB_API_BASE_URL}/copilot_internal/user`, { headers: githubHeaders(state) });
-	if (!response.ok) throw await HTTPError.fromResponse("Failed to get Copilot usage", response);
-	return await response.json();
-};
-
 //#endregion
 //#region src/debug.ts
 async function getPackageVersion() {
@@ -1002,8 +927,7 @@ const debugModels = defineCommand({
 			state.githubToken = args["github-token"];
 			consola.info("Using provided GitHub token");
 		} else await setupGitHubToken();
-		const { token } = await getCopilotToken();
-		state.copilotToken = token;
+		await bootstrapCopilotSession();
 		consola.info("Fetching models from Copilot API...");
 		const models = await getModels();
 		console.log(JSON.stringify(models, null, 2));
@@ -1086,7 +1010,7 @@ const logout = defineCommand({
 
 //#endregion
 //#region package.json
-var version = "0.15.1";
+var version = "0.16.0";
 
 //#endregion
 //#region src/lib/event-loop-lag.ts
@@ -1739,7 +1663,6 @@ async function gracefulShutdown(signal, deps) {
 	const tracker = deps?.tracker;
 	const server = deps?.server ?? serverInstance;
 	const rateLimiter = deps?.rateLimiter !== void 0 ? deps.rateLimiter : getAdaptiveRateLimiter();
-	const stopRefresh = deps?.stopTokenRefreshFn ?? (() => {});
 	const closeWsClients = deps?.closeAllClientsFn ?? closeAllClients;
 	const getWsCount = deps?.getClientCountFn ?? getClientCount;
 	const gracefulWaitMs = deps?.gracefulWaitMs ?? state.shutdownGracefulWait * 1e3;
@@ -1756,7 +1679,6 @@ async function gracefulShutdown(signal, deps) {
 	} catch {}
 	stopMemoryPressureMonitor();
 	stopEventLoopLagMonitor();
-	stopRefresh();
 	const wsClients = getWsCount();
 	if (wsClients > 0) {
 		closeWsClients();
@@ -9604,6 +9526,8 @@ responsesRoutes.post("/", async (c) => {
 const tokenRoute = new Hono();
 tokenRoute.get("/", (c) => {
 	try {
+		if (!state.allowTokenEndpoint) return c.json({ error: "/token disabled. Pass --allow-token-endpoint (or COPILOT_ALLOW_TOKEN_ENDPOINT=1) to expose the raw GitHub OAuth token; the fallback is to read ~/.local/share/copilot-api/github_token directly." }, 403);
+		if (!state.proxyApiKeyDigest) return c.json({ error: "/token requires --api-key even when --allow-token-endpoint is set: the endpoint returns the raw GitHub OAuth token (repo,gist,read:user,read:org). Set --api-key or COPILOT_API_KEY to enable." }, 403);
 		return c.json({ token: state.copilotToken });
 	} catch (error) {
 		return forwardError(c, error);
@@ -9626,6 +9550,11 @@ usageRoute.get("/", async (c) => {
 //#region src/server.ts
 const server = new Hono();
 server.use(tuiLogger());
+server.use("/token", async (c, next) => {
+	await next();
+	c.header("Access-Control-Allow-Origin", "null");
+	c.header("Access-Control-Allow-Credentials", "false");
+});
 server.use(cors());
 server.use(authGate());
 server.get("/", (c) => c.text("Server running"));
@@ -9684,6 +9613,8 @@ function formatModelInfo(model) {
 async function runServer(options) {
 	consola.info(`copilot-api v${version}`);
 	configureProxyApiKey(options.apiKey);
+	state.allowTokenEndpoint = options.allowTokenEndpoint;
+	if (options.allowTokenEndpoint) consola.warn("/token endpoint enabled — will echo the raw GitHub OAuth token (repo,gist,read:user,read:org) to callers presenting --api-key. Only use on trusted single-operator hosts.");
 	if (options.verbose) {
 		consola.level = 5;
 		consola.info("Verbose logging enabled");
@@ -9715,7 +9646,7 @@ async function runServer(options) {
 		state.githubToken = options.githubToken;
 		consola.info("Using provided GitHub token");
 	} else await setupGitHubToken();
-	await setupCopilotToken();
+	await bootstrapCopilotSession();
 	try {
 		await cacheModels();
 	} catch (error) {
@@ -9800,6 +9731,11 @@ const start = defineCommand({
 		"api-key": {
 			type: "string",
 			description: "Proxy API key for inbound authentication. When set (non-empty after trimming), all endpoints except / and /health require this key via 'Authorization: Bearer <key>'. Omitted or empty = auth disabled (default, all requests pass through)."
+		},
+		"allow-token-endpoint": {
+			type: "boolean",
+			default: false,
+			description: "Enable the /token endpoint (default: disabled). When enabled AND --api-key is set, /token echoes the raw GitHub OAuth token (repo,gist,read:user,read:org) to authenticated callers. Never combine with --host 0.0.0.0 on untrusted networks — the token has full repo/gist write access on the operator's GitHub account. Fallback: read ~/.local/share/copilot-api/github_token directly."
 		}
 	},
 	run({ args }) {
@@ -9816,7 +9752,8 @@ const start = defineCommand({
 			githubToken: args["github-token"] || process.env.GH_TOKEN,
 			posthogKey: args["posthog-key"],
 			apiKey: resolvedApiKey.key,
-			apiKeySource: resolvedApiKey.source
+			apiKeySource: resolvedApiKey.source,
+			allowTokenEndpoint: args["allow-token-endpoint"] || process.env.COPILOT_ALLOW_TOKEN_ENDPOINT === "1" || process.env.COPILOT_ALLOW_TOKEN_ENDPOINT === "true"
 		});
 	}
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dianshuv/copilot-api",
-  "version": "0.15.1",
+  "version": "0.16.0",
   "description": "Turn GitHub Copilot into OpenAI/Anthropic API compatible server. Usable with Claude Code!",
   "author": "dianshuv",
   "type": "module",