@dianshuv/copilot-api 0.15.1 → 0.17.0

package/README.md

@@ -16,7 +16,7 @@
 - **Stream repetition detection**: Detects when models get stuck in repetitive output loops using KMP-based pattern matching and logs a warning.
 - **Stale request reaping**: Automatically force-fails requests that exceed a configurable maximum age (default 600s) to prevent resource leaks.
 - **PostHog analytics**: Optional PostHog Cloud integration (`--posthog-key`) sends per-request token usage events for long-term trend analysis. Free tier (1M events/month) is more than sufficient for individual use.
-- **GitHub Copilot CLI emulation**: All upstream requests to GitHub — device-flow `login`, Copilot token exchange, and model calls — carry the official GitHub Copilot CLI's (`@github/copilot`) identity: its `copilot-integration-id` (`copilot-developer-cli`), `editor-version`/`user-agent` (`copilot/<version>`), `x-github-api-version`, and a persistent `x-client-machine-id` (stored at `~/.local/share/copilot-api/machine_id`). The `login` flow uses the CLI's own OAuth app, so **new** logins request the `read:user`, `read:org`, `repo`, and `gist` scopes; existing tokens keep working without re-authentication.
+- **GitHub Copilot CLI emulation**: All upstream requests to GitHub — device-flow `login`, `/copilot_internal/user` bootstrap, and CAPI model/chat calls — carry the official GitHub Copilot CLI's (`@github/copilot`) identity: its `copilot-integration-id` (`copilot-developer-cli`), `editor-version`/`user-agent` (`copilot/<version>`), `x-github-api-version`, and a persistent `x-client-machine-id` (stored at `~/.local/share/copilot-api/machine_id`). The CAPI Bearer is the GitHub OAuth token itself — the CLI does not perform a separate token exchange. The `login` flow uses the CLI's own OAuth app, so **new** logins request the `read:user`, `read:org`, `repo`, and `gist` scopes; existing tokens keep working without re-authentication.
 
 ## Quick Start
 
@@ -63,6 +63,7 @@ make down
 | `--github-token`, `-g` | Provide GitHub token directly (or `GH_TOKEN` env) | none |
 | `--posthog-key` | PostHog API key for token usage analytics (opt-in) | none |
 | `--api-key` | Proxy API key for inbound authentication (see [Authentication](#authentication)). Empty = disabled | none |
+| `--allow-token-endpoint` | Opt-in to expose `GET /token` (echoes the raw GitHub OAuth token; requires `--api-key` too). `COPILOT_ALLOW_TOKEN_ENDPOINT=1` env twin. | false |
 
 ### Hidden Models
 
@@ -114,7 +115,7 @@ Currently hidden (grouped):
 |----------|--------|-------------|
 | `/` | GET | Server status |
 | `/usage` | GET | Copilot usage stats |
-| `/token` | GET | Current Copilot token |
+| `/token` | GET | Current CAPI Bearer (= raw GitHub OAuth token). Disabled by default; requires `--allow-token-endpoint` **and** `--api-key`, otherwise 403. |
 | `/health` | GET | Health check |
 | `/history` | GET | Request history Web UI with token analytics (enabled by default) |
 | `/history/api/*` | GET/DELETE | History API endpoints |

package/dist/main.mjs

@@ -140,6 +140,7 @@ const state = {
 	showToken: false,
 	showAllModels: false,
 	verbose: false,
+	allowTokenEndpoint: false,
 	autoTruncate: true,
 	compressToolResults: false,
 	redirectAnthropic: false,
@@ -165,7 +166,10 @@ const COPILOT_INTEGRATION_ID = "copilot-developer-cli";
 const cliVersion = (state) => state.copilotCliVersion ?? CLI_VERSION_FALLBACK;
 const editorVersion = (state) => `copilot/${cliVersion(state)}`;
 const userAgent = (state) => `copilot/${cliVersion(state)} (${process.platform} ${process.version}) term/${process.env.TERM_PROGRAM ?? "unknown"}`;
-const copilotBaseUrl = (state) => state.accountType === "individual" ? "https://api.githubcopilot.com" : `https://api.${state.accountType}.githubcopilot.com`;
+const copilotBaseUrl = (state) => {
+	if (state.copilotApiEndpoint) return state.copilotApiEndpoint;
+	return state.accountType === "individual" ? "https://api.githubcopilot.com" : `https://api.${state.accountType}.githubcopilot.com`;
+};
 function hasHeaderKey(headers, key) {
 	const lowerKey = key.toLowerCase();
 	return Object.keys(headers).some((existingKey) => {
@@ -465,14 +469,6 @@ function forwardError(c, error) {
 	} }, 500);
 }
 
-//#endregion
-//#region src/services/github/get-copilot-token.ts
-const getCopilotToken = async () => {
-	const response = await fetch(`${GITHUB_API_BASE_URL}/copilot_internal/v2/token`, { headers: githubHeaders(state) });
-	if (!response.ok) throw await HTTPError.fromResponse("Failed to get Copilot token", response);
-	return await response.json();
-};
-
 //#endregion
 //#region src/services/github/get-device-code.ts
 async function getDeviceCode() {
@@ -567,48 +563,28 @@ function isRetryable(error) {
 	return code !== void 0 && RETRYABLE_CAUSE_CODES.has(code);
 }
 const RETRY_ATTEMPTS_KEY = "__copilotRetryAttempts";
-const RETRY_AUTH_REFRESHED_KEY = "__copilotRetryAuthRefreshed";
 /**
 * Read retry metadata recorded on an error or response by fetchWithRetry.
 * Returns attempts=1 (no retry) if the value is missing or malformed.
 */
 function getRetryAttempts(target) {
-	if (typeof target !== "object" || target === null) return {
-		attempts: 1,
-		authRefreshed: false
-	};
+	if (typeof target !== "object" || target === null) return { attempts: 1 };
 	const meta = target;
-	return {
-		attempts: typeof meta[RETRY_ATTEMPTS_KEY] === "number" ? meta[RETRY_ATTEMPTS_KEY] : 1,
-		authRefreshed: meta[RETRY_AUTH_REFRESHED_KEY] === true
-	};
+	return { attempts: typeof meta[RETRY_ATTEMPTS_KEY] === "number" ? meta[RETRY_ATTEMPTS_KEY] : 1 };
 }
-async function fetchWithRetry(input, init, options) {
-	let currentInit = init;
-	let authRefreshed = false;
+async function fetchWithRetry(input, init) {
 	let networkAttempts = 0;
 	for (let attempt = 0; attempt <= RETRY_DELAYS_MS.length; attempt++) try {
 		networkAttempts++;
 		const fetchStart = performance.now();
-		const response = await fetch(input, currentInit);
+		const response = await fetch(input, init);
 		const ttfbMs = performance.now() - fetchStart;
-		if (response.status === 401 && !authRefreshed && options?.onUnauthorized) {
-			const refreshed = await tryRefreshAuth(options.onUnauthorized);
-			if (refreshed) {
-				await response.body?.cancel().catch(() => {});
-				consola.warn("Got 401 from upstream; refreshed token and retrying");
-				currentInit = refreshed;
-				authRefreshed = true;
-				attempt--;
-				continue;
-			}
-		}
 		addTiming(TIMING.UPSTREAM_TTFB, ttfbMs);
-		annotateRetryMeta(response, networkAttempts, authRefreshed);
+		annotateRetryMeta(response, networkAttempts);
 		return response;
 	} catch (error) {
 		if (attempt === RETRY_DELAYS_MS.length || !isRetryable(error)) {
-			annotateRetryMeta(error, networkAttempts, authRefreshed);
+			annotateRetryMeta(error, networkAttempts);
 			throw error;
 		}
 		const delay = RETRY_DELAYS_MS[attempt];
@@ -617,54 +593,31 @@ async function fetchWithRetry(input, init, options) {
 	}
 	throw new Error("fetchWithRetry exhausted attempts without resolution");
 }
-function annotateRetryMeta(target, attempts, authRefreshed) {
+function annotateRetryMeta(target, attempts) {
 	if (typeof target !== "object" || target === null) return;
 	try {
 		const meta = target;
 		meta[RETRY_ATTEMPTS_KEY] = attempts;
-		meta[RETRY_AUTH_REFRESHED_KEY] = authRefreshed;
 	} catch {}
 }
-async function tryRefreshAuth(onUnauthorized) {
-	try {
-		return await onUnauthorized();
-	} catch (error) {
-		consola.warn("onUnauthorized callback failed:", error instanceof Error ? error.message : error);
-		return null;
-	}
-}
-/**
-* Build an onUnauthorized callback that refreshes the Copilot token and
-* returns a new RequestInit with an updated Authorization header.
-*/
-function makeCopilotAuthRetry(refreshToken, init) {
-	return async () => {
-		const newToken = await refreshToken();
-		if (!newToken) return null;
-		const headers = new Headers(init.headers);
-		headers.set("Authorization", `Bearer ${newToken}`);
-		return {
-			...init,
-			headers
-		};
-	};
-}
 
 //#endregion
 //#region src/services/copilot/copilot-fetch.ts
 /**
 * Single transport seam for all upstream Copilot API calls.
 *
-* Wraps every request with:
-* - Network-error retry (UND_ERR_SOCKET, ECONNRESET, ENOTFOUND, connect timeouts)
-* - 401 → forceRefreshCopilotToken → retry once with the new bearer token
+* Wraps every request with network-error retry (UND_ERR_SOCKET, ECONNRESET,
+* ENOTFOUND, connect timeouts).
 *
-* Callers supply the path (e.g. "/chat/completions") and the usual RequestInit.
-* The host prefix and resilience wiring are applied here so every endpoint
-* gets the same treatment and adding a new endpoint is one call site.
+* Historically this seam also refreshed a short-lived CAPI session token on
+* 401. That session-token flow was a VSCode/JetBrains-plugin idiom; the CLI
+* we impersonate uses the GitHub OAuth token directly as the CAPI Bearer, so
+* a 401 there means the OAuth token itself is invalid — no server-side
+* refresh helps. If a future refresh_token grant is wired in, add it back
+* here as an `onUnauthorized` callback.
 */
 function copilotFetch(path, init) {
-	return fetchWithRetry(`${copilotBaseUrl(state)}${path}`, init, { onUnauthorized: makeCopilotAuthRetry(forceRefreshCopilotToken, init) });
+	return fetchWithRetry(`${copilotBaseUrl(state)}${path}`, init);
 }
 
 //#endregion
@@ -708,6 +661,14 @@ async function getCopilotCliVersion() {
 	}
 }
 
+//#endregion
+//#region src/services/github/get-copilot-usage.ts
+const getCopilotUsage = async () => {
+	const response = await fetch(`${GITHUB_API_BASE_URL}/copilot_internal/user`, { headers: githubHeaders(state) });
+	if (!response.ok) throw await HTTPError.fromResponse("Failed to get Copilot usage", response);
+	return await response.json();
+};
+
 //#endregion
 //#region src/lib/utils.ts
 const sleep = (ms) => new Promise((resolve) => {
@@ -736,6 +697,44 @@ const initCopilotIdentity = async () => {
 	state.machineId = await getOrCreateMachineId();
 	await cacheCopilotCliVersion();
 };
+/**
+* Bootstraps the CAPI session after GitHub OAuth is settled. Mirrors what the
+* real @github/copilot CLI does at startup:
+*
+* 1. GET /copilot_internal/user to learn the account's CAPI endpoint set
+*    (`endpoints.api` — the host varies by plan tier, e.g. enterprise gets
+*    `api.enterprise.githubcopilot.com`).
+* 2. Use the GitHub OAuth token directly as the CAPI Bearer. The CLI does NOT
+*    exchange the OAuth token for a separate CAPI session token — that flow
+*    (`GET /copilot_internal/v2/token`) is a VSCode/JetBrains-plugin idiom the
+*    CLI's GitHub App is not authorized for (returns 404).
+*
+* Must run after setupGitHubToken() and initCopilotIdentity(). Failure surfaces
+* to the caller; there is no CAPI to serve without endpoints or a Bearer, so
+* a missing/tampered/non-Copilot `endpoints.api` throws at boot rather than
+* silently degrading to a stale accountType-derived host or routing the raw
+* GitHub OAuth token at an arbitrary origin.
+*/
+const CAPI_HOST_PATTERN = /^api(?:\.[a-z0-9-]+)?\.githubcopilot\.com$/;
+const bootstrapCopilotSession = async () => {
+	const usage = await getCopilotUsage();
+	if (usage === null || typeof usage !== "object") throw new Error("bootstrapCopilotSession: /copilot_internal/user body was not an object.");
+	const usageObj = usage;
+	if (typeof usageObj.endpoints !== "object" || usageObj.endpoints === null) throw new Error("bootstrapCopilotSession: /copilot_internal/user returned no endpoints object.");
+	const rawApi = usageObj.endpoints.api;
+	if (typeof rawApi !== "string") throw new TypeError(`bootstrapCopilotSession: endpoints.api must be a string (got ${typeof rawApi}).`);
+	let parsed;
+	try {
+		parsed = new URL(rawApi);
+	} catch {
+		throw new Error(`bootstrapCopilotSession: endpoints.api is not a valid URL (${JSON.stringify(rawApi)}).`);
+	}
+	if (parsed.protocol !== "https:") throw new Error(`bootstrapCopilotSession: endpoints.api must use https:// (got ${parsed.protocol}).`);
+	if (parsed.port !== "") throw new Error(`bootstrapCopilotSession: endpoints.api must use the default https port (got :${parsed.port}).`);
+	if (!CAPI_HOST_PATTERN.test(parsed.hostname)) throw new Error(`bootstrapCopilotSession: endpoints.api host ${parsed.hostname} is not an api[.tier].githubcopilot.com host.`);
+	state.copilotApiEndpoint = parsed.origin;
+	state.copilotToken = state.githubToken;
+};
 
 //#endregion
 //#region src/services/github/poll-access-token.ts
@@ -771,72 +770,6 @@ async function pollAccessToken(deviceCode) {
 //#region src/lib/token.ts
 const readGithubToken = () => fs.readFile(PATHS.GITHUB_TOKEN_PATH, "utf8");
 const writeGithubToken = (token) => fs.writeFile(PATHS.GITHUB_TOKEN_PATH, token);
-let copilotTokenRefreshTimer = null;
-/**
-* Refresh the Copilot token with exponential backoff retry.
-* Returns the new token on success, or null if all retries fail.
-*/
-async function refreshCopilotTokenWithRetry(maxRetries = 3) {
-	let lastError = null;
-	for (let attempt = 0; attempt < maxRetries; attempt++) try {
-		const { token } = await getCopilotToken();
-		return token;
-	} catch (error) {
-		lastError = error;
-		const delay = Math.min(1e3 * 2 ** attempt, 3e4);
-		consola.warn(`Token refresh attempt ${attempt + 1}/${maxRetries} failed, retrying in ${delay}ms`);
-		await new Promise((resolve) => setTimeout(resolve, delay));
-	}
-	consola.error("All token refresh attempts failed:", lastError);
-	return null;
-}
-/**
-* Force-refresh the Copilot token on demand (e.g. after a 401 response).
-* Updates state.copilotToken on success and returns the new token, or null
-* if refresh failed. Coalesces concurrent callers so multiple in-flight 401s
-* only trigger one refresh.
-*/
-let refreshInFlight = null;
-async function forceRefreshCopilotToken() {
-	if (refreshInFlight) return refreshInFlight;
-	refreshInFlight = refreshCopilotTokenWithRetry().then((token) => {
-		if (token) state.copilotToken = token;
-		return token;
-	}).finally(() => {
-		refreshInFlight = null;
-	});
-	return refreshInFlight;
-}
-/**
-* Clear any existing token refresh timer.
-* Call this before setting up a new timer or during cleanup.
-*/
-function clearCopilotTokenRefresh() {
-	if (copilotTokenRefreshTimer) {
-		clearInterval(copilotTokenRefreshTimer);
-		copilotTokenRefreshTimer = null;
-	}
-}
-const setupCopilotToken = async () => {
-	const { token, refresh_in } = await getCopilotToken();
-	state.copilotToken = token;
-	consola.debug("GitHub Copilot Token fetched successfully!");
-	if (state.showToken) consola.info("Copilot token:", token);
-	const refreshInterval = Math.max((refresh_in - 60) * 1e3, 60 * 1e3);
-	clearCopilotTokenRefresh();
-	copilotTokenRefreshTimer = setInterval(() => {
-		consola.debug("Refreshing Copilot token");
-		refreshCopilotTokenWithRetry().then((newToken) => {
-			if (newToken) {
-				state.copilotToken = newToken;
-				consola.debug("Copilot token refreshed");
-				if (state.showToken) consola.info("Refreshed Copilot token:", newToken);
-			} else consola.error("Failed to refresh Copilot token after retries, using existing token");
-		}).catch((error) => {
-			consola.error("Unexpected error during token refresh:", error);
-		});
-	}, refreshInterval);
-};
 async function setupGitHubToken(options) {
 	try {
 		const githubToken = await readGithubToken();
@@ -869,14 +802,6 @@ async function logUser() {
 	consola.info(`Logged in as ${user.login}`);
 }
 
-//#endregion
-//#region src/services/github/get-copilot-usage.ts
-const getCopilotUsage = async () => {
-	const response = await fetch(`${GITHUB_API_BASE_URL}/copilot_internal/user`, { headers: githubHeaders(state) });
-	if (!response.ok) throw await HTTPError.fromResponse("Failed to get Copilot usage", response);
-	return await response.json();
-};
-
 //#endregion
 //#region src/debug.ts
 async function getPackageVersion() {
@@ -1002,8 +927,7 @@ const debugModels = defineCommand({
 			state.githubToken = args["github-token"];
 			consola.info("Using provided GitHub token");
 		} else await setupGitHubToken();
-		const { token } = await getCopilotToken();
-		state.copilotToken = token;
+		await bootstrapCopilotSession();
 		consola.info("Fetching models from Copilot API...");
 		const models = await getModels();
 		console.log(JSON.stringify(models, null, 2));
@@ -1086,7 +1010,7 @@ const logout = defineCommand({
 
 //#endregion
 //#region package.json
-var version = "0.15.1";
+var version = "0.17.0";
 
 //#endregion
 //#region src/lib/event-loop-lag.ts
@@ -1739,7 +1663,6 @@ async function gracefulShutdown(signal, deps) {
 	const tracker = deps?.tracker;
 	const server = deps?.server ?? serverInstance;
 	const rateLimiter = deps?.rateLimiter !== void 0 ? deps.rateLimiter : getAdaptiveRateLimiter();
-	const stopRefresh = deps?.stopTokenRefreshFn ?? (() => {});
 	const closeWsClients = deps?.closeAllClientsFn ?? closeAllClients;
 	const getWsCount = deps?.getClientCountFn ?? getClientCount;
 	const gracefulWaitMs = deps?.gracefulWaitMs ?? state.shutdownGracefulWait * 1e3;
@@ -1756,7 +1679,6 @@ async function gracefulShutdown(signal, deps) {
 	} catch {}
 	stopMemoryPressureMonitor();
 	stopEventLoopLagMonitor();
-	stopRefresh();
 	const wsClients = getWsCount();
 	if (wsClients > 0) {
 		closeWsClients();
@@ -2793,6 +2715,20 @@ function formatTokens(input, output) {
 	return `${formatNumber(input)}/${formatNumber(output)}`;
 }
 /**
+* Cache-hit segment for the complete line, e.g. `cache=90%` (or
+* `cache=90% (1.6K/1.8K)` under --verbose). Returns undefined when there is no
+* usable denominator or the request had zero cache hits, so non-cached and
+* non-LLM requests stay terse (minimize-noise). `total` is the full prompt size
+* normalized across API families; see completeTracking / the per-path extraction.
+*/
+function formatCacheHitRate(cached, total) {
+	if (total === void 0 || total <= 0) return void 0;
+	if (cached === void 0 || cached <= 0) return void 0;
+	const pct = Math.round(cached / total * 100);
+	if (consola.level >= 5) return `cache=${pct}% (${formatNumber(cached)}/${formatNumber(total)})`;
+	return `cache=${pct}%`;
+}
+/**
 * Console renderer that shows request lifecycle with apt-get style footer
 *
 * Log format:
@@ -2894,7 +2830,7 @@ var ConsoleRenderer = class {
 	* Format a complete log line with colored parts
 	*/
 	formatLogLine(parts) {
-		const { prefix, time, method, path, model, status, duration, tokens, queueWait, phases, extra, isError, isDim } = parts;
+		const { prefix, time, method, path, model, status, duration, tokens, cache, queueWait, phases, extra, isError, isDim } = parts;
 		if (isDim) {
 			const modelPart = model ? ` ${model}` : "";
 			const extraPart = extra ? ` ${extra}` : "";
@@ -2908,6 +2844,7 @@ var ConsoleRenderer = class {
 		if (duration) result += ` ${pc.yellow(duration)}`;
 		if (queueWait) result += ` ${pc.dim(`(queued ${queueWait})`)}`;
 		if (tokens) result += ` ${pc.blue(tokens)}`;
+		if (cache) result += ` ${pc.dim(cache)}`;
 		if (phases) result += ` ${pc.dim(phases)}`;
 		if (extra) result += isError ? pc.red(extra) : extra;
 		return result;
@@ -2979,6 +2916,7 @@ var ConsoleRenderer = class {
 		const status = request.statusCode ?? 0;
 		const isError = request.status === "error" || status >= 400;
 		const tokens = request.model ? formatTokens(request.inputTokens, request.outputTokens) : void 0;
+		const cache = formatCacheHitRate(request.cachedInputTokens, request.totalInputTokens);
 		const queueWait = request.queueWaitMs && request.queueWaitMs > 100 ? formatDuration(request.queueWaitMs) : void 0;
 		const message = this.formatLogLine({
 			prefix: isError ? "[FAIL]" : "[ OK ]",
@@ -2990,6 +2928,7 @@ var ConsoleRenderer = class {
 			duration: formatDuration(request.durationMs ?? 0),
 			queueWait,
 			tokens,
+			cache,
 			phases: this.formatPhases(request),
 			extra: isError && request.error ? `: ${request.error}` : void 0,
 			isError,
@@ -3058,6 +2997,8 @@ var RequestTracker = class {
 		if (update.inputTokens !== void 0) request.inputTokens = update.inputTokens;
 		if (update.outputTokens !== void 0) request.outputTokens = update.outputTokens;
 		if (update.reasoningTokens !== void 0) request.reasoningTokens = update.reasoningTokens;
+		if (update.cachedInputTokens !== void 0) request.cachedInputTokens = update.cachedInputTokens;
+		if (update.totalInputTokens !== void 0) request.totalInputTokens = update.totalInputTokens;
 		if (update.error !== void 0) request.error = update.error;
 		if (update.queuePosition !== void 0) request.queuePosition = update.queuePosition;
 		if (update.queueWaitMs !== void 0) request.queueWaitMs = update.queueWaitMs;
@@ -4225,13 +4166,15 @@ function updateTrackerStatus(trackingId, status) {
 	requestTracker.updateRequest(trackingId, { status });
 }
 /** Complete TUI tracking and send PostHog analytics */
-function completeTracking(trackingId, inputTokens, outputTokens, queueWaitMs, reasoningTokens, analytics, timings) {
+function completeTracking(trackingId, inputTokens, outputTokens, queueWaitMs, reasoningTokens, analytics, timings, cache) {
 	if (!trackingId) return;
 	requestTracker.updateRequest(trackingId, {
 		inputTokens,
 		outputTokens,
 		queueWaitMs,
 		reasoningTokens,
+		cachedInputTokens: cache?.cachedInputTokens,
+		totalInputTokens: cache?.totalInputTokens,
 		...timingsToUpdate(timings)
 	});
 	requestTracker.completeRequest(trackingId, 200, {
@@ -4343,6 +4286,9 @@ function formatClientTruncationMarker(result) {
 function getReasoningTokensFromOpenAIUsage(usage) {
 	return usage?.completion_tokens_details?.reasoning_tokens;
 }
+function getCachedTokensFromOpenAIUsage(usage) {
+	return usage?.prompt_tokens_details?.cached_tokens;
+}
 async function handleCompletion$1(c) {
 	const rawPayload = await c.req.json();
 	consola.debug("Request payload:", JSON.stringify(rawPayload).slice(-400));
@@ -4461,7 +4407,9 @@ function handleNonStreamingResponse$1(c, originalResponse, ctx, payload) {
 		inputTokens: usage.prompt_tokens,
 		outputTokens: usage.completion_tokens,
 		queueWaitMs: ctx.queueWaitMs,
-		reasoningTokens
+		reasoningTokens,
+		cachedInputTokens: getCachedTokensFromOpenAIUsage(usage),
+		totalInputTokens: usage.prompt_tokens
 	});
 	captureRequest({
 		model: response.model,
@@ -4502,6 +4450,7 @@ function createStreamAccumulator() {
 		model: "",
 		inputTokens: 0,
 		outputTokens: 0,
+		cachedTokens: 0,
 		reasoningTokens: 0,
 		finishReason: "",
 		content: "",
@@ -4545,7 +4494,10 @@ async function handleStreamingResponse$1(opts) {
 			durationMs: Date.now() - ctx.startTime,
 			stopReason: acc.finishReason || void 0,
 			toolCount: payload.tools?.length ?? 0
-		}, ctx.timings);
+		}, ctx.timings, {
+			cachedInputTokens: acc.cachedTokens,
+			totalInputTokens: acc.inputTokens
+		});
 	} catch (error) {
 		if (isAbortError(error)) {
 			consola.debug("[ChatCompletions] client disconnected mid-stream; upstream aborted");
@@ -4614,6 +4566,7 @@ function accumulateParsedChunk(parsed, acc, checkRepetition) {
 	if (parsed.usage) {
 		acc.inputTokens = parsed.usage.prompt_tokens;
 		acc.outputTokens = parsed.usage.completion_tokens;
+		acc.cachedTokens = parsed.usage.prompt_tokens_details?.cached_tokens ?? 0;
 		acc.reasoningTokens = getReasoningTokensFromOpenAIUsage(parsed.usage) ?? 0;
 	}
 	const choice = parsed.choices?.[0];
@@ -7227,6 +7180,8 @@ function createAnthropicStreamAccumulator() {
 		model: "",
 		inputTokens: 0,
 		outputTokens: 0,
+		cacheReadInputTokens: 0,
+		cacheCreationInputTokens: 0,
 		stopReason: "",
 		content: "",
 		toolCalls: [],
@@ -7236,6 +7191,9 @@ function createAnthropicStreamAccumulator() {
 }
 function processAnthropicEvent(event, acc) {
 	switch (event.type) {
+		case "message_start":
+			handleMessageStart(event.message.usage, acc);
+			break;
 		case "content_block_delta":
 			handleContentBlockDelta(event.delta, acc);
 			break;
@@ -7271,11 +7229,20 @@ function handleContentBlockStop(acc) {
 		acc.currentToolCall = null;
 	}
 }
+function applyPromptSideUsage(usage, acc) {
+	if (usage.input_tokens !== void 0) acc.inputTokens = usage.input_tokens;
+	if (usage.cache_read_input_tokens !== void 0) acc.cacheReadInputTokens = usage.cache_read_input_tokens;
+	if (usage.cache_creation_input_tokens !== void 0) acc.cacheCreationInputTokens = usage.cache_creation_input_tokens;
+}
+function handleMessageStart(usage, acc) {
+	if (!usage) return;
+	applyPromptSideUsage(usage, acc);
+}
 function handleMessageDelta(delta, usage, acc) {
 	if (delta.stop_reason) acc.stopReason = delta.stop_reason;
 	if (usage) {
-		acc.inputTokens = usage.input_tokens ?? 0;
 		acc.outputTokens = usage.output_tokens;
+		applyPromptSideUsage(usage, acc);
 	}
 }
 function recordAnthropicStreamingResponse(acc, fallbackModel, ctx) {
@@ -8478,11 +8445,17 @@ function handleDirectAnthropicNonStreamingResponse(c, response, ctx, truncateRes
 		},
 		toolCalls: extractToolCallsFromContent(response.content)
 	}, Date.now() - ctx.startTime);
-	if (ctx.trackingId) requestTracker.updateRequest(ctx.trackingId, {
-		inputTokens: response.usage.input_tokens,
-		outputTokens: response.usage.output_tokens,
-		queueWaitMs: ctx.queueWaitMs
-	});
+	if (ctx.trackingId) {
+		const cacheRead = response.usage.cache_read_input_tokens ?? 0;
+		const cacheCreation = response.usage.cache_creation_input_tokens ?? 0;
+		requestTracker.updateRequest(ctx.trackingId, {
+			inputTokens: response.usage.input_tokens,
+			outputTokens: response.usage.output_tokens,
+			queueWaitMs: ctx.queueWaitMs,
+			cachedInputTokens: cacheRead,
+			totalInputTokens: response.usage.input_tokens + cacheRead + cacheCreation
+		});
+	}
 	captureRequest({
 		model: response.model,
 		inputTokens: response.usage.input_tokens,
@@ -8576,7 +8549,10 @@ async function handleDirectAnthropicStreamingResponse(opts) {
 			durationMs: Date.now() - ctx.startTime,
 			stopReason: acc.stopReason || void 0,
 			toolCount: anthropicPayload.tools?.length ?? 0
-		}, ctx.timings);
+		}, ctx.timings, {
+			cachedInputTokens: acc.cacheReadInputTokens,
+			totalInputTokens: acc.inputTokens + acc.cacheReadInputTokens + acc.cacheCreationInputTokens
+		});
 	} catch (error) {
 		if (isAbortError(error)) {
 			consola.debug("[Anthropic] client disconnected mid-stream; upstream aborted");
@@ -8791,11 +8767,17 @@ function handleNonStreamingResponse(opts) {
 		},
 		toolCalls: extractToolCallsFromContent(anthropicResponse.content)
 	}, Date.now() - ctx.startTime);
-	if (ctx.trackingId) requestTracker.updateRequest(ctx.trackingId, {
-		inputTokens: anthropicResponse.usage.input_tokens,
-		outputTokens: anthropicResponse.usage.output_tokens,
-		queueWaitMs: ctx.queueWaitMs
-	});
+	if (ctx.trackingId) {
+		const cacheRead = anthropicResponse.usage.cache_read_input_tokens ?? 0;
+		const cacheCreation = anthropicResponse.usage.cache_creation_input_tokens ?? 0;
+		requestTracker.updateRequest(ctx.trackingId, {
+			inputTokens: anthropicResponse.usage.input_tokens,
+			outputTokens: anthropicResponse.usage.output_tokens,
+			queueWaitMs: ctx.queueWaitMs,
+			cachedInputTokens: cacheRead,
+			totalInputTokens: anthropicResponse.usage.input_tokens + cacheRead + cacheCreation
+		});
+	}
 	captureRequest({
 		model: anthropicResponse.model,
 		inputTokens: anthropicResponse.usage.input_tokens,
@@ -8840,7 +8822,10 @@ async function handleStreamingResponse(opts) {
 			durationMs: Date.now() - ctx.startTime,
 			stopReason: acc.stopReason || void 0,
 			toolCount: anthropicPayload.tools?.length ?? 0
-		}, ctx.timings);
+		}, ctx.timings, {
+			cachedInputTokens: acc.cacheReadInputTokens,
+			totalInputTokens: acc.inputTokens + acc.cacheReadInputTokens + acc.cacheCreationInputTokens
+		});
 	} catch (error) {
 		if (isAbortError(error)) {
 			consola.debug("[Translated] client disconnected mid-stream; upstream aborted");
@@ -9473,7 +9458,10 @@ const handleResponses = async (c) => {
 							stream: true,
 							durationMs: Date.now() - startTime,
 							toolCount: tools.length
-						}, ctx.timings);
+						}, ctx.timings, {
+							cachedInputTokens: usage?.input_tokens_details?.cached_tokens ?? 0,
+							totalInputTokens: usage?.input_tokens ?? 0
+						});
 					} else if (streamErrorMessage) {
 						recordResponse(historyId, {
 							success: false,
@@ -9524,7 +9512,10 @@ const handleResponses = async (c) => {
 			stream: false,
 			durationMs: Date.now() - startTime,
 			toolCount: tools.length
-		}, ctx.timings);
+		}, ctx.timings, {
+			cachedInputTokens: usage?.input_tokens_details?.cached_tokens ?? 0,
+			totalInputTokens: usage?.input_tokens ?? 0
+		});
 		consola.debug("Forwarding native Responses result:", JSON.stringify(result).slice(-400));
 		return c.json(echoResponseBody(result, ctx));
 	} catch (error) {
@@ -9604,6 +9595,8 @@ responsesRoutes.post("/", async (c) => {
 const tokenRoute = new Hono();
 tokenRoute.get("/", (c) => {
 	try {
+		if (!state.allowTokenEndpoint) return c.json({ error: "/token disabled. Pass --allow-token-endpoint (or COPILOT_ALLOW_TOKEN_ENDPOINT=1) to expose the raw GitHub OAuth token; the fallback is to read ~/.local/share/copilot-api/github_token directly." }, 403);
+		if (!state.proxyApiKeyDigest) return c.json({ error: "/token requires --api-key even when --allow-token-endpoint is set: the endpoint returns the raw GitHub OAuth token (repo,gist,read:user,read:org). Set --api-key or COPILOT_API_KEY to enable." }, 403);
 		return c.json({ token: state.copilotToken });
 	} catch (error) {
 		return forwardError(c, error);
@@ -9626,6 +9619,11 @@ usageRoute.get("/", async (c) => {
 //#region src/server.ts
 const server = new Hono();
 server.use(tuiLogger());
+server.use("/token", async (c, next) => {
+	await next();
+	c.header("Access-Control-Allow-Origin", "null");
+	c.header("Access-Control-Allow-Credentials", "false");
+});
 server.use(cors());
 server.use(authGate());
 server.get("/", (c) => c.text("Server running"));
@@ -9684,6 +9682,8 @@ function formatModelInfo(model) {
 async function runServer(options) {
 	consola.info(`copilot-api v${version}`);
 	configureProxyApiKey(options.apiKey);
+	state.allowTokenEndpoint = options.allowTokenEndpoint;
+	if (options.allowTokenEndpoint) consola.warn("/token endpoint enabled — will echo the raw GitHub OAuth token (repo,gist,read:user,read:org) to callers presenting --api-key. Only use on trusted single-operator hosts.");
 	if (options.verbose) {
 		consola.level = 5;
 		consola.info("Verbose logging enabled");
@@ -9715,7 +9715,7 @@ async function runServer(options) {
 		state.githubToken = options.githubToken;
 		consola.info("Using provided GitHub token");
 	} else await setupGitHubToken();
-	await setupCopilotToken();
+	await bootstrapCopilotSession();
 	try {
 		await cacheModels();
 	} catch (error) {
@@ -9800,6 +9800,11 @@ const start = defineCommand({
 		"api-key": {
 			type: "string",
 			description: "Proxy API key for inbound authentication. When set (non-empty after trimming), all endpoints except / and /health require this key via 'Authorization: Bearer <key>'. Omitted or empty = auth disabled (default, all requests pass through)."
+		},
+		"allow-token-endpoint": {
+			type: "boolean",
+			default: false,
+			description: "Enable the /token endpoint (default: disabled). When enabled AND --api-key is set, /token echoes the raw GitHub OAuth token (repo,gist,read:user,read:org) to authenticated callers. Never combine with --host 0.0.0.0 on untrusted networks — the token has full repo/gist write access on the operator's GitHub account. Fallback: read ~/.local/share/copilot-api/github_token directly."
 		}
 	},
 	run({ args }) {
@@ -9816,7 +9821,8 @@ const start = defineCommand({
 			githubToken: args["github-token"] || process.env.GH_TOKEN,
 			posthogKey: args["posthog-key"],
 			apiKey: resolvedApiKey.key,
-			apiKeySource: resolvedApiKey.source
+			apiKeySource: resolvedApiKey.source,
+			allowTokenEndpoint: args["allow-token-endpoint"] || process.env.COPILOT_ALLOW_TOKEN_ENDPOINT === "1" || process.env.COPILOT_ALLOW_TOKEN_ENDPOINT === "true"
 		});
 	}
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dianshuv/copilot-api",
-  "version": "0.15.1",
+  "version": "0.17.0",
   "description": "Turn GitHub Copilot into OpenAI/Anthropic API compatible server. Usable with Claude Code!",
   "author": "dianshuv",
   "type": "module",