@dianshuv/copilot-api 0.21.6 → 0.21.7

package/README.md

@@ -31,6 +31,19 @@ npm install -g @dianshuv/copilot-api
 copilot-api start
 ```
 
+### GitHub Enterprise Cloud with data residency
+
+Set the tenant hostname for both login and server startup. Omit
+`COPILOT_GH_HOST` to use `github.com`.
+
+```sh
+COPILOT_GH_HOST=example.ghe.com npx @dianshuv/copilot-api login
+COPILOT_GH_HOST=example.ghe.com npx @dianshuv/copilot-api start
+```
+
+Only `github.com` and `*.ghe.com` hosts are accepted. OAuth uses the tenant web
+host, GitHub REST calls use `api.<tenant>.ghe.com`, and the Copilot API endpoint
+is discovered from the authenticated tenant.
 
 ## Development
 

package/dist/main.mjs

@@ -135,6 +135,7 @@ function initProxyFromEnv() {
 //#endregion
 //#region src/lib/state.ts
 const state = {
+	githubHost: "github.com",
 	accountType: "individual",
 	manualApprove: false,
 	showToken: false,
@@ -193,7 +194,26 @@ function copilotHeaders(state, visionOrOptions) {
 	if (options.vision) headers["copilot-vision-request"] = "true";
 	return headers;
 }
-const GITHUB_API_BASE_URL = "https://api.github.com";
+const DEFAULT_GITHUB_HOST = "github.com";
+const GHE_TENANT_HOST_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.ghe\.com$/;
+function resolveGitHubHost(copilotGitHubHost) {
+	const configuredHost = copilotGitHubHost?.trim() || DEFAULT_GITHUB_HOST;
+	let hostUrl = configuredHost;
+	if (!configuredHost.includes("://")) hostUrl = `https://${configuredHost}`;
+	let parsed;
+	try {
+		parsed = new URL(hostUrl);
+	} catch {
+		throw new Error("GitHub host must be github.com or a .ghe.com tenant hostname.");
+	}
+	if (parsed.protocol !== "https:") throw new Error("GitHub host must use HTTPS.");
+	if (parsed.username || parsed.password || parsed.port || parsed.pathname !== "/" || parsed.search || parsed.hash) throw new Error("GitHub host must be a hostname without a path.");
+	const hostname = parsed.hostname.toLowerCase();
+	if (hostname !== DEFAULT_GITHUB_HOST && !GHE_TENANT_HOST_PATTERN.test(hostname)) throw new Error("GitHub host must be github.com or a .ghe.com tenant.");
+	return hostname;
+}
+const githubBaseUrl = (state) => `https://${state.githubHost}`;
+const githubApiBaseUrl = (state) => state.githubHost === "github.com" ? "https://api.github.com" : `https://api.${state.githubHost}`;
 const githubHeaders = (state) => ({
 	accept: standardHeaders().accept,
 	authorization: `Bearer ${state.githubToken}`,
@@ -203,7 +223,6 @@ const githubOAuthHeaders = (state) => ({
 	...standardHeaders(),
 	"user-agent": userAgent(state)
 });
-const GITHUB_BASE_URL = "https://github.com";
 const GITHUB_CLIENT_ID = "Ov23ctDVkRmgkPke0Mmm";
 const GITHUB_APP_SCOPES = [
 	"read:user",
@@ -471,7 +490,7 @@ function forwardError(c, error) {
 //#endregion
 //#region src/services/github/get-device-code.ts
 async function getDeviceCode() {
-	const response = await fetch(`${GITHUB_BASE_URL}/login/device/code`, {
+	const response = await fetch(`${githubBaseUrl(state)}/login/device/code`, {
 		method: "POST",
 		headers: githubOAuthHeaders(state),
 		body: JSON.stringify({
@@ -486,7 +505,7 @@ async function getDeviceCode() {
 //#endregion
 //#region src/services/github/get-user.ts
 async function getGitHubUser() {
-	const response = await fetch(`${GITHUB_API_BASE_URL}/user`, { headers: githubHeaders(state) });
+	const response = await fetch(`${githubApiBaseUrl(state)}/user`, { headers: githubHeaders(state) });
 	if (!response.ok) throw await HTTPError.fromResponse("Failed to get GitHub user", response);
 	return await response.json();
 }
@@ -663,7 +682,7 @@ async function getCopilotCliVersion() {
 //#endregion
 //#region src/services/github/get-copilot-usage.ts
 const getCopilotUsage = async () => {
-	const response = await fetch(`${GITHUB_API_BASE_URL}/copilot_internal/user`, { headers: githubHeaders(state) });
+	const response = await fetch(`${githubApiBaseUrl(state)}/copilot_internal/user`, { headers: githubHeaders(state) });
 	if (!response.ok) throw await HTTPError.fromResponse("Failed to get Copilot usage", response);
 	return await response.json();
 };
@@ -715,6 +734,11 @@ const initCopilotIdentity = async () => {
 * GitHub OAuth token at an arbitrary origin.
 */
 const CAPI_HOST_PATTERN = /^api(?:\.[a-z0-9-]+)?\.githubcopilot\.com$/;
+function isTrustedCopilotApiHost(hostname) {
+	if (CAPI_HOST_PATTERN.test(hostname)) return true;
+	if (!state.githubHost.endsWith(".ghe.com")) return false;
+	return hostname === state.githubHost || hostname.endsWith(`.${state.githubHost}`);
+}
 const bootstrapCopilotSession = async () => {
 	const usage = await getCopilotUsage();
 	if (usage === null || typeof usage !== "object") throw new Error("bootstrapCopilotSession: /copilot_internal/user body was not an object.");
@@ -730,7 +754,7 @@ const bootstrapCopilotSession = async () => {
 	}
 	if (parsed.protocol !== "https:") throw new Error(`bootstrapCopilotSession: endpoints.api must use https:// (got ${parsed.protocol}).`);
 	if (parsed.port !== "") throw new Error(`bootstrapCopilotSession: endpoints.api must use the default https port (got :${parsed.port}).`);
-	if (!CAPI_HOST_PATTERN.test(parsed.hostname)) throw new Error(`bootstrapCopilotSession: endpoints.api host ${parsed.hostname} is not an api[.tier].githubcopilot.com host.`);
+	if (!isTrustedCopilotApiHost(parsed.hostname)) throw new Error(`bootstrapCopilotSession: endpoints.api host ${parsed.hostname} is not a trusted Copilot API host for ${state.githubHost}.`);
 	state.copilotApiEndpoint = parsed.origin;
 	state.copilotToken = state.githubToken;
 };
@@ -742,7 +766,7 @@ async function pollAccessToken(deviceCode) {
 	consola.debug(`Polling access token with interval of ${sleepDuration}ms`);
 	const expiresAt = Date.now() + deviceCode.expires_in * 1e3;
 	while (Date.now() < expiresAt) {
-		const response = await fetch(`${GITHUB_BASE_URL}/login/oauth/access_token`, {
+		const response = await fetch(`${githubBaseUrl(state)}/login/oauth/access_token`, {
 			method: "POST",
 			headers: githubOAuthHeaders(state),
 			body: JSON.stringify({
@@ -997,7 +1021,7 @@ async function runLogout() {
 		}
 	}
 	consola.warn("This only removes the local token file. The OAuth App authorization is still active on GitHub and the token remains valid until revoked.");
-	consola.info(`To fully revoke access, visit https://github.com/settings/connections/applications/${GITHUB_CLIENT_ID} and click "Revoke access".`);
+	consola.info(`To fully revoke access, visit ${githubBaseUrl(state)}/settings/connections/applications/${GITHUB_CLIENT_ID} and click "Revoke access".`);
 }
 const logout = defineCommand({
 	meta: {
@@ -1011,7 +1035,7 @@ const logout = defineCommand({
 
 //#endregion
 //#region package.json
-var version = "0.21.6";
+var version = "0.21.7";
 
 //#endregion
 //#region src/lib/event-loop-lag.ts
@@ -9472,6 +9496,7 @@ const start = defineCommand({
 //#endregion
 //#region src/main.ts
 consola.options.formatOptions.date = false;
+state.githubHost = resolveGitHubHost(process.env.COPILOT_GH_HOST);
 await runMain(defineCommand({
 	meta: {
 		name: "copilot-api",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dianshuv/copilot-api",
-  "version": "0.21.6",
+  "version": "0.21.7",
   "description": "Turn GitHub Copilot into OpenAI/Anthropic API compatible server. Usable with Claude Code!",
   "author": "dianshuv",
   "type": "module",