@gnahz77/opencode-copilot-multi-auth 0.1.0 → 0.1.1

package/dist/index.js

@@ -0,0 +1,307 @@
+import { CLIENT_ID, OAUTH_POLLING_SAFETY_MARGIN_MS, OAUTH_SCOPES, ROUTING_ACCOUNT_KEY_HEADER, ROUTING_SOURCE_HEADER, } from "./constants.js";
+import { buildHeaders, fetchEntitlement, fetchWithSelectedAccount, getBaseURL, getUrls, lookupGitHubIdentity, resolveSelectedPoolAccount, } from "./auth.js";
+import { buildPoolBackedModels, normalizeExistingModels, resolveProviderModels } from "./models.js";
+import { deriveAccountKey, getPoolPath, readPool, resolveWinnerAccount, upsertAccount, writePool, } from "./pool.js";
+import { getHeader, getConversationMetadata, getRequestedRawModelId, normalizeDomain, resolveClaudeThinkingBudget, } from "./utils.js";
+export { getPoolPath, readPool, writePool, deriveAccountKey, lookupGitHubIdentity, upsertAccount, resolveWinnerAccount };
+export const CopilotAuthPlugin = async (input) => {
+    return {
+        provider: {
+            id: "github-copilot",
+            models: async (provider, ctx) => {
+                try {
+                    const pool = readPool();
+                    if (pool.accounts.length > 0) {
+                        return await buildPoolBackedModels(provider.models, pool);
+                    }
+                    const oauthAuth = ctx.auth && ctx.auth.type === "oauth" ? ctx.auth : undefined;
+                    return await resolveProviderModels(provider.models, oauthAuth);
+                }
+                catch (error) {
+                    console.warn("[opencode-copilot-cli-auth] Failed to sync live Copilot models.", error instanceof Error ? error.message : String(error));
+                    return normalizeExistingModels(provider.models);
+                }
+            },
+        },
+        auth: {
+            provider: "github-copilot",
+            loader: async (getAuth) => {
+                const info = await getAuth();
+                let poolFirstEnabled = null;
+                try {
+                    const currentPool = readPool();
+                    poolFirstEnabled = currentPool.accounts.find((account) => account?.enabled !== false) ?? null;
+                    if (currentPool.accounts.length === 0 && info && info.type === "oauth") {
+                        // Best-effort migration bridge for legacy single-account auth.
+                        // We intentionally avoid identity lookup here because loader runs on hot paths,
+                        // and we do not have a stable userId without making a network request.
+                        // The next successful OAuth authorize callback performs canonical persistence.
+                    }
+                }
+                catch {
+                    // intentional: pool read/parse errors fall back to legacy singleton auth
+                }
+                const baseSource = poolFirstEnabled?.auth?.type === "oauth"
+                    ? poolFirstEnabled.auth
+                    : info && info.type === "oauth"
+                        ? info
+                        : null;
+                if (!baseSource)
+                    return {};
+                const baseURL = poolFirstEnabled?.baseUrl ?? await getBaseURL(baseSource);
+                return {
+                    ...(baseURL && { baseURL }),
+                    apiKey: "",
+                    async fetch(inputRequest, init) {
+                        const pool = readPool();
+                        const accountKey = getHeader(init?.headers, ROUTING_ACCOUNT_KEY_HEADER);
+                        const requestedRawModelId = getRequestedRawModelId(init);
+                        if (pool.accounts.length > 0) {
+                            const selectedAccount = resolveSelectedPoolAccount(pool, accountKey, requestedRawModelId);
+                            if (selectedAccount?.auth?.type === "oauth") {
+                                return fetchWithSelectedAccount(inputRequest, init, selectedAccount);
+                            }
+                        }
+                        const auth = await getAuth();
+                        if (!auth || auth.type !== "oauth") {
+                            return fetch(inputRequest, init);
+                        }
+                        const { isVision, isAgent } = getConversationMetadata(init);
+                        const headers = buildHeaders(init, auth, isVision, isAgent);
+                        return fetch(inputRequest, {
+                            ...init,
+                            headers,
+                        });
+                    },
+                };
+            },
+            methods: [
+                {
+                    type: "oauth",
+                    label: "Login with GitHub Copilot CLI",
+                    prompts: [
+                        {
+                            type: "select",
+                            key: "deploymentType",
+                            message: "Select GitHub deployment type",
+                            options: [
+                                {
+                                    label: "GitHub.com (Add)",
+                                    value: "github.com",
+                                    hint: "Public",
+                                },
+                                {
+                                    label: "GitHub Enterprise (Add)",
+                                    value: "enterprise",
+                                    hint: "Data residency or self-hosted",
+                                },
+                            ],
+                        },
+                        {
+                            type: "text",
+                            key: "enterpriseUrl",
+                            message: "Enter your GitHub Enterprise URL or domain",
+                            placeholder: "github.com or https://github.com (default: github.com)",
+                            condition: (inputs) => inputs.deploymentType === "enterprise",
+                            validate: (value) => {
+                                if (!value || !String(value).trim()) {
+                                    return undefined;
+                                }
+                                try {
+                                    const url = value.includes("://")
+                                        ? new URL(value)
+                                        : new URL(`https://${value}`);
+                                    if (!url.hostname) {
+                                        return "Please enter a valid URL or domain";
+                                    }
+                                    return undefined;
+                                }
+                                catch {
+                                    return "Please enter a valid URL";
+                                }
+                            },
+                        },
+                    ],
+                    async authorize(inputs = {}) {
+                        const deploymentType = inputs.deploymentType || "github.com";
+                        let domain = "github.com";
+                        let actualProvider = "github-copilot";
+                        if (deploymentType === "enterprise") {
+                            domain = normalizeDomain(inputs.enterpriseUrl);
+                            actualProvider = "github-copilot-enterprise";
+                        }
+                        const urls = getUrls(domain);
+                        const deviceResponse = await fetch(urls.DEVICE_CODE_URL, {
+                            method: "POST",
+                            headers: {
+                                Accept: "application/json",
+                                "Content-Type": "application/json",
+                                "User-Agent": "opencode-copilot-cli-auth/0.0.16",
+                            },
+                            body: JSON.stringify({
+                                client_id: CLIENT_ID,
+                                scope: OAUTH_SCOPES,
+                            }),
+                        });
+                        if (!deviceResponse.ok) {
+                            throw new Error("[opencode-copilot-cli-auth] Failed to initiate device authorization");
+                        }
+                        const deviceData = await deviceResponse.json();
+                        return {
+                            url: deviceData.verification_uri,
+                            instructions: `Enter code: ${deviceData.user_code}`,
+                            method: "auto",
+                            callback: async () => {
+                                while (true) {
+                                    const response = await fetch(urls.ACCESS_TOKEN_URL, {
+                                        method: "POST",
+                                        headers: {
+                                            Accept: "application/json",
+                                            "Content-Type": "application/json",
+                                            "User-Agent": "opencode-copilot-cli-auth/0.0.16",
+                                        },
+                                        body: JSON.stringify({
+                                            client_id: CLIENT_ID,
+                                            device_code: deviceData.device_code,
+                                            grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                                        }),
+                                    });
+                                    if (!response.ok)
+                                        return { type: "failed" };
+                                    const data = await response.json();
+                                    if (data.access_token) {
+                                        const entitlement = await fetchEntitlement({
+                                            refresh: data.access_token,
+                                            enterpriseUrl: actualProvider === "github-copilot-enterprise"
+                                                ? domain
+                                                : undefined,
+                                        });
+                                        const result = {
+                                            type: "success",
+                                            refresh: data.access_token,
+                                            access: data.access_token,
+                                            expires: 0,
+                                            baseUrl: entitlement?.endpoints?.api,
+                                        };
+                                        if (actualProvider === "github-copilot-enterprise") {
+                                            result.provider = "github-copilot-enterprise";
+                                            result.enterpriseUrl = domain;
+                                        }
+                                        try {
+                                            const identity = await lookupGitHubIdentity(data.access_token, actualProvider === "github-copilot-enterprise" ? domain : undefined);
+                                            const deployment = actualProvider === "github-copilot-enterprise" ? domain : "github.com";
+                                            const key = deriveAccountKey(deployment, identity.userId);
+                                            const pool = readPool();
+                                            const updatedPool = upsertAccount(pool, {
+                                                key,
+                                                deployment,
+                                                domain: deployment,
+                                                identity,
+                                                enterpriseUrl: actualProvider === "github-copilot-enterprise" ? domain : null,
+                                                baseUrl: result.baseUrl ?? null,
+                                                auth: {
+                                                    type: "oauth",
+                                                    refresh: data.access_token,
+                                                    access: data.access_token,
+                                                    expires: 0,
+                                                    baseUrl: result.baseUrl ?? null,
+                                                    ...(result.provider && { provider: result.provider }),
+                                                    ...(result.enterpriseUrl && { enterpriseUrl: result.enterpriseUrl }),
+                                                },
+                                            });
+                                            writePool(updatedPool);
+                                        }
+                                        catch (persistError) {
+                                            console.warn("[opencode-copilot-cli-auth] Failed to persist account to pool:", persistError instanceof Error ? persistError.message : String(persistError));
+                                        }
+                                        return result;
+                                    }
+                                    if (data.error === "authorization_pending") {
+                                        await new Promise((resolve) => setTimeout(resolve, deviceData.interval * 1000
+                                            + OAUTH_POLLING_SAFETY_MARGIN_MS));
+                                        continue;
+                                    }
+                                    if (data.error === "slow_down") {
+                                        const nextInterval = (typeof data.interval === "number" && data.interval > 0
+                                            ? data.interval
+                                            : deviceData.interval + 5) * 1000;
+                                        await new Promise((resolve) => setTimeout(resolve, nextInterval + OAUTH_POLLING_SAFETY_MARGIN_MS));
+                                        continue;
+                                    }
+                                    if (data.error)
+                                        return { type: "failed" };
+                                    await new Promise((resolve) => setTimeout(resolve, deviceData.interval * 1000
+                                        + OAUTH_POLLING_SAFETY_MARGIN_MS));
+                                }
+                            },
+                        };
+                    },
+                },
+            ],
+        },
+        "chat.params": async (input, output) => {
+            if (input.model.providerID !== "github-copilot")
+                return;
+            if (input.model.api?.npm !== "@ai-sdk/github-copilot")
+                return;
+            if (!input.model.id.includes("claude"))
+                return;
+            const messageWithVariant = input.message;
+            const thinkingBudget = resolveClaudeThinkingBudget(input.model, messageWithVariant.variant);
+            if (thinkingBudget === undefined)
+                return;
+            output.options.thinking_budget = thinkingBudget;
+        },
+        "chat.headers": async (incoming, output) => {
+            if (!incoming.model.providerID.includes("github-copilot"))
+                return;
+            const sdk = input.client;
+            if (sdk?.session?.message && sdk?.session?.get) {
+                const parts = await sdk.session
+                    .message({
+                    path: {
+                        id: incoming.message.sessionID,
+                        messageID: incoming.message.id,
+                    },
+                    query: {
+                        directory: input.directory,
+                    },
+                    throwOnError: true,
+                })
+                    .catch(() => undefined);
+                if (parts?.data?.parts?.some((part) => part.type === "compaction")) {
+                    output.headers["x-initiator"] = "agent";
+                }
+                else {
+                    const session = await sdk.session
+                        .get({
+                        path: {
+                            id: incoming.sessionID,
+                        },
+                        query: {
+                            directory: input.directory,
+                        },
+                        throwOnError: true,
+                    })
+                        .catch(() => undefined);
+                    if (session?.data?.parentID) {
+                        output.headers["x-initiator"] = "agent";
+                    }
+                }
+            }
+            try {
+                const pool = readPool();
+                if (pool.accounts.length > 0) {
+                    const winner = resolveWinnerAccount(incoming.model.id, pool);
+                    if (winner) {
+                        output.headers[ROUTING_ACCOUNT_KEY_HEADER] = winner.key;
+                        output.headers[ROUTING_SOURCE_HEADER] = "model-resolution";
+                    }
+                }
+            }
+            catch {
+                // intentional: routing header injection is best-effort; missing header falls back to request-time model resolution
+            }
+        },
+    };
+};

package/dist/models.d.ts

@@ -0,0 +1,134 @@
+import type { Model as SDKModel } from "@opencode-ai/sdk/v2";
+import type { AccountPool, AuthInput, LiveModel } from "./types.js";
+export declare function fetchModels(info: AuthInput, baseURL: string): Promise<LiveModel[]>;
+export declare function createProviderModel(existing: SDKModel | undefined, live: LiveModel, baseURL: string): SDKModel;
+export declare function buildProviderModels(existingModels: Record<string, SDKModel> | undefined, liveModels: LiveModel[], baseURL: string): {
+    [k: string]: SDKModel;
+};
+export declare function normalizeExistingModels(existingModels: Record<string, SDKModel> | undefined, baseURL?: string): {
+    [k: string]: {
+        cost: {
+            input: number;
+            output: number;
+            cache: {
+                read: number;
+                write: number;
+            };
+        };
+        api: {
+            url: string;
+            npm: string;
+            id: string;
+        };
+        id: string;
+        providerID: string;
+        name: string;
+        family?: string;
+        capabilities: {
+            temperature: boolean;
+            reasoning: boolean;
+            attachment: boolean;
+            toolcall: boolean;
+            input: {
+                text: boolean;
+                audio: boolean;
+                image: boolean;
+                video: boolean;
+                pdf: boolean;
+            };
+            output: {
+                text: boolean;
+                audio: boolean;
+                image: boolean;
+                video: boolean;
+                pdf: boolean;
+            };
+            interleaved: boolean | {
+                field: "reasoning_content" | "reasoning_details";
+            };
+        };
+        limit: {
+            context: number;
+            input?: number;
+            output: number;
+        };
+        status: "alpha" | "beta" | "deprecated" | "active";
+        options: {
+            [key: string]: unknown;
+        };
+        headers: {
+            [key: string]: string;
+        };
+        release_date: string;
+        variants?: {
+            [key: string]: {
+                [key: string]: unknown;
+            };
+        };
+    };
+};
+export declare function resolveProviderModels(existingModels: Record<string, SDKModel> | undefined, auth: AuthInput | null | undefined): Promise<{
+    [k: string]: {
+        cost: {
+            input: number;
+            output: number;
+            cache: {
+                read: number;
+                write: number;
+            };
+        };
+        api: {
+            url: string;
+            npm: string;
+            id: string;
+        };
+        id: string;
+        providerID: string;
+        name: string;
+        family?: string;
+        capabilities: {
+            temperature: boolean;
+            reasoning: boolean;
+            attachment: boolean;
+            toolcall: boolean;
+            input: {
+                text: boolean;
+                audio: boolean;
+                image: boolean;
+                video: boolean;
+                pdf: boolean;
+            };
+            output: {
+                text: boolean;
+                audio: boolean;
+                image: boolean;
+                video: boolean;
+                pdf: boolean;
+            };
+            interleaved: boolean | {
+                field: "reasoning_content" | "reasoning_details";
+            };
+        };
+        limit: {
+            context: number;
+            input?: number;
+            output: number;
+        };
+        status: "alpha" | "beta" | "deprecated" | "active";
+        options: {
+            [key: string]: unknown;
+        };
+        headers: {
+            [key: string]: string;
+        };
+        release_date: string;
+        variants?: {
+            [key: string]: {
+                [key: string]: unknown;
+            };
+        };
+    };
+}>;
+export declare function buildPoolBackedModels(existingModels: Record<string, SDKModel> | undefined, pool: AccountPool): Promise<{
+    [k: string]: SDKModel;
+}>;

package/dist/models.js

@@ -0,0 +1,147 @@
+import { getBaseURL } from "./auth.js";
+import { resolveWinnerAccount } from "./pool.js";
+import { getReleaseDate, isPickerModel, zeroCost } from "./utils.js";
+export async function fetchModels(info, baseURL) {
+    const response = await fetch(`${baseURL}/models`, {
+        headers: {
+            Authorization: `Bearer ${info.refresh}`,
+            "Copilot-Integration-Id": "copilot-developer-cli",
+            "Openai-Intent": "model-access",
+            "User-Agent": "opencode-copilot-cli-auth/0.0.16",
+            "X-GitHub-Api-Version": "2025-05-01",
+            "X-Interaction-Type": "model-access",
+            "X-Request-Id": crypto.randomUUID(),
+        },
+    });
+    if (!response.ok) {
+        throw new Error(`[opencode-copilot-cli-auth] Model fetch failed: ${response.status}`);
+    }
+    const data = await response.json();
+    return Array.isArray(data?.data) ? data.data : [];
+}
+export function createProviderModel(existing, live, baseURL) {
+    const limits = live.capabilities?.limits ?? {};
+    const supports = live.capabilities?.supports ?? {};
+    const vision = !!supports.vision || !!limits.vision;
+    const reasoning = existing?.capabilities?.reasoning
+        ?? (!!supports.adaptive_thinking
+            || typeof supports.max_thinking_budget === "number"
+            || Array.isArray(supports.reasoning_effort));
+    return {
+        ...structuredClone(existing ?? {}),
+        id: live.id,
+        providerID: existing?.providerID ?? "github-copilot",
+        api: {
+            ...(existing?.api ?? {}),
+            id: live.id,
+            url: baseURL,
+            npm: "@ai-sdk/github-copilot",
+        },
+        name: live.name ?? existing?.name ?? live.id,
+        family: live.capabilities?.family ?? existing?.family ?? "",
+        cost: zeroCost(),
+        limit: {
+            context: limits.max_context_window_tokens
+                ?? existing?.limit?.context
+                ?? 0,
+            input: limits.max_prompt_tokens
+                ?? existing?.limit?.input
+                ?? limits.max_context_window_tokens,
+            output: limits.max_output_tokens
+                ?? limits.max_non_streaming_output_tokens
+                ?? existing?.limit?.output
+                ?? 0,
+        },
+        capabilities: {
+            temperature: existing?.capabilities?.temperature ?? true,
+            reasoning,
+            attachment: existing?.capabilities?.attachment ?? vision,
+            toolcall: !!supports.tool_calls,
+            input: {
+                text: existing?.capabilities?.input?.text ?? true,
+                audio: existing?.capabilities?.input?.audio ?? false,
+                image: existing?.capabilities?.input?.image ?? vision,
+                video: existing?.capabilities?.input?.video ?? false,
+                pdf: existing?.capabilities?.input?.pdf ?? false,
+            },
+            output: {
+                text: existing?.capabilities?.output?.text ?? true,
+                audio: existing?.capabilities?.output?.audio ?? false,
+                image: existing?.capabilities?.output?.image ?? false,
+                video: existing?.capabilities?.output?.video ?? false,
+                pdf: existing?.capabilities?.output?.pdf ?? false,
+            },
+            interleaved: existing?.capabilities?.interleaved ?? false,
+        },
+        options: existing?.options ?? {},
+        headers: existing?.headers ?? {},
+        release_date: getReleaseDate(live.id, live.version, existing?.release_date ?? ""),
+        variants: existing?.variants ?? {},
+        status: "active",
+    };
+}
+export function buildProviderModels(existingModels, liveModels, baseURL) {
+    const existingById = new Map(Object.values(existingModels ?? {}).map((model) => [model?.api?.id ?? model?.id, model]));
+    return Object.fromEntries(liveModels
+        .filter(isPickerModel)
+        .map((model) => [
+        model.id,
+        createProviderModel(existingById.get(model.id), model, baseURL),
+    ]));
+}
+export function normalizeExistingModels(existingModels, baseURL) {
+    return Object.fromEntries(Object.entries(existingModels ?? {}).map(([id, model]) => [
+        id,
+        {
+            ...structuredClone(model),
+            cost: zeroCost(),
+            api: {
+                ...model.api,
+                url: baseURL ?? model.api?.url,
+                npm: "@ai-sdk/github-copilot",
+            },
+        },
+    ]));
+}
+export async function resolveProviderModels(existingModels, auth) {
+    const baseURL = auth ? await getBaseURL(auth) : undefined;
+    if (!auth || auth.type !== "oauth" || !baseURL) {
+        return normalizeExistingModels(existingModels, baseURL);
+    }
+    const liveModels = await fetchModels(auth, baseURL);
+    return buildProviderModels(existingModels, liveModels, baseURL);
+}
+export async function buildPoolBackedModels(existingModels, pool) {
+    const enabledAccounts = (Array.isArray(pool?.accounts) ? pool.accounts : [])
+        .filter((account) => account?.enabled !== false);
+    if (enabledAccounts.length === 0) {
+        return {};
+    }
+    const candidatesByModel = new Map();
+    for (const account of enabledAccounts) {
+        try {
+            const baseURL = account.baseUrl ?? await getBaseURL(account.auth);
+            const liveModels = await fetchModels(account.auth, baseURL);
+            for (const liveModel of liveModels.filter(isPickerModel)) {
+                const winner = resolveWinnerAccount(liveModel.id, pool);
+                if (winner?.key === account.key) {
+                    candidatesByModel.set(liveModel.id, {
+                        account,
+                        liveModel,
+                        baseURL,
+                    });
+                }
+            }
+        }
+        catch (error) {
+            console.warn(`[opencode-copilot-cli-auth] Skipping account ${account?.key ?? "unknown"} during model sync:`, error instanceof Error ? error.message : String(error));
+        }
+    }
+    const existingById = new Map(Object.values(existingModels ?? {}).map((model) => [model?.api?.id ?? model?.id, model]));
+    return Object.fromEntries([...candidatesByModel.entries()]
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([rawModelId, { liveModel, baseURL }]) => [
+        rawModelId,
+        createProviderModel(existingById.get(rawModelId), liveModel, baseURL),
+    ]));
+}

package/dist/pool.d.ts

@@ -0,0 +1,8 @@
+import type { AccountPool, PoolAccount, UpsertAccountData } from "./types.js";
+export declare function getPoolPath(): string;
+export declare function validatePoolSchema(pool: unknown, context: string): AccountPool;
+export declare function readPool(): AccountPool;
+export declare function writePool(pool: AccountPool): void;
+export declare function deriveAccountKey(deployment: string, userId: number): string;
+export declare function upsertAccount(pool: AccountPool, accountData: UpsertAccountData): AccountPool;
+export declare function resolveWinnerAccount(rawModelId: string, pool: AccountPool): PoolAccount;