@inventec/dsh-copilot-auth 1.0.2 → 1.1.1

package/src/catalog-overlay.json

@@ -0,0 +1,115 @@
+{
+  "anthropic-messages": {
+    "claude-fable-5.1": {
+      "id": "claude-fable-5.1",
+      "name": "Claude Fable 5.1",
+      "api": "anthropic-messages",
+      "provider": "github-copilot",
+      "baseUrl": "https://api.individual.githubcopilot.com",
+      "reasoning": true,
+      "input": [
+        "text",
+        "image"
+      ],
+      "cost": {
+        "input": 10,
+        "output": 50,
+        "cacheRead": 0.25,
+        "cacheWrite": 12.5
+      },
+      "contextWindow": 1000000,
+      "maxTokens": 128000,
+      "headers": {
+        "User-Agent": "GitHubCopilotChat/0.35.0",
+        "Editor-Version": "vscode/1.107.0",
+        "Editor-Plugin-Version": "copilot-chat/0.35.0",
+        "Copilot-Integration-Id": "vscode-chat"
+      },
+      "thinkingLevelMap": {
+        "off": null,
+        "xhigh": "xhigh",
+        "max": "max"
+      },
+      "compat": {
+        "forceAdaptiveThinking": true
+      }
+    }
+  },
+  "openai-completions": {
+    "gemini-3.8-flash": {
+      "id": "gemini-3.8-flash",
+      "name": "Gemini 3.8 Flash",
+      "api": "openai-completions",
+      "provider": "github-copilot",
+      "baseUrl": "https://api.individual.githubcopilot.com",
+      "reasoning": true,
+      "input": [
+        "text",
+        "image"
+      ],
+      "cost": {
+        "input": 0.75,
+        "output": 3.75,
+        "cacheRead": 0.075,
+        "cacheWrite": 0
+      },
+      "contextWindow": 1000000,
+      "maxTokens": 64000,
+      "headers": {
+        "User-Agent": "GitHubCopilotChat/0.35.0",
+        "Editor-Version": "vscode/1.107.0",
+        "Editor-Plugin-Version": "copilot-chat/0.35.0",
+        "Copilot-Integration-Id": "vscode-chat"
+      },
+      "compat": {
+        "supportsStore": false,
+        "supportsDeveloperRole": false,
+        "supportsReasoningEffort": false
+      }
+    },
+    "gpt-6-astra": {
+      "id": "gpt-6-astra",
+      "name": "GPT-6 Astra",
+      "api": "openai-completions",
+      "provider": "github-copilot",
+      "baseUrl": "https://api.individual.githubcopilot.com",
+      "reasoning": true,
+      "input": [
+        "text",
+        "image"
+      ],
+      "cost": {
+        "input": 10,
+        "output": 50,
+        "cacheRead": 1,
+        "cacheWrite": 12.5,
+        "tiers": [
+          {
+            "inputTokensAbove": 272000,
+            "input": 20,
+            "output": 75,
+            "cacheRead": 2,
+            "cacheWrite": 25
+          }
+        ]
+      },
+      "contextWindow": 1050000,
+      "maxTokens": 128000,
+      "headers": {
+        "User-Agent": "GitHubCopilotChat/0.35.0",
+        "Editor-Version": "vscode/1.107.0",
+        "Editor-Plugin-Version": "copilot-chat/0.35.0",
+        "Copilot-Integration-Id": "vscode-chat"
+      },
+      "compat": {
+        "supportsStore": false,
+        "supportsDeveloperRole": false,
+        "supportsReasoningEffort": false
+      },
+      "thinkingLevelMap": {
+        "xhigh": "xhigh",
+        "max": "max"
+      }
+    }
+  }
+}

package/src/catalog.mjs

@@ -0,0 +1,156 @@
+// catalog.mjs — 数据核心：tgz 严格解析、条目校验、只增不更新合并、diff、digest、
+// pi-ai 安装定位。合并语义「只增不更新」（ADR 0001）：已有 id 的元数据永不覆盖。
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { gunzipSync } from "node:zlib";
+
+// github-copilot 目录的三种 wire 协议（白名单，目录外协议拒绝）。
+export const SUPPORTED_APIS = ["anthropic-messages", "openai-completions", "openai-responses"];
+
+const TGZ_ENTRY_PATH = "package/dist/providers/data/github-copilot.json";
+
+// 严格 ustar 解析：checksum 逐块校验、尺寸越界即截断、目录/pax 条目跳过内容、
+// 其余类型拒绝。返回 [{ name, type, content }]。
+function parseTar(tar) {
+  const entries = [];
+  let offset = 0;
+  while (offset + 512 <= tar.length) {
+    const header = tar.subarray(offset, offset + 512);
+    if (header.every((b) => b === 0)) break; // 结束零块
+    const magic = header.subarray(257, 262).toString("latin1");
+    if (magic !== "ustar") throw new Error(`not a ustar archive (magic=${JSON.stringify(magic)})`);
+    const stored = Number.parseInt(header.subarray(148, 156).toString("latin1").trim() || "0", 8);
+    let sum = 0;
+    for (let i = 0; i < 512; i++) sum += i >= 148 && i < 156 ? 32 : header[i];
+    if (sum !== stored) throw new Error("tar checksum mismatch");
+    const name = header.subarray(0, 100).toString("latin1").replace(/\0.*$/s, "");
+    const sizeField = header.subarray(124, 136).toString("latin1").replace(/\0.*$/s, "").trim();
+    const size = Number.parseInt(sizeField || "0", 8);
+    if (!Number.isFinite(size) || size < 0) throw new Error(`bad tar size field for ${name}`);
+    const type = String.fromCharCode(header[156]);
+    offset += 512;
+    if (offset + size > tar.length) throw new Error(`truncated tar (entry ${name})`);
+    const content = tar.subarray(offset, offset + size);
+    offset += Math.ceil(size / 512) * 512;
+    if (type === "0" || type === "\0") entries.push({ name, type, content });
+    else if (type === "5" || type === "x" || type === "g") continue; // 目录 / pax：跳过
+    else throw new Error(`unsupported tar entry type ${JSON.stringify(type)} for ${name}`);
+  }
+  return entries;
+}
+
+// 从 pi-ai tgz 中精确提取 github-copilot.json。路径精确匹配（前缀不误判）、
+// 重复条目抛错；maxBytes 经 gunzipSync maxOutputLength 落地（防 gzip bomb）。
+export function extractTgzEntry(buf, { maxBytes } = {}) {
+  let tar;
+  try {
+    tar = gunzipSync(buf, maxBytes ? { maxOutputLength: maxBytes } : {});
+  } catch (err) {
+    if (err instanceof RangeError || /maxOutputLength|too large/i.test(String(err?.message))) {
+      throw new Error(`catalog archive too large (decompressed cap ${maxBytes} bytes)`);
+    }
+    throw err;
+  }
+  const matches = parseTar(tar).filter((e) => e.name === TGZ_ENTRY_PATH);
+  if (matches.length === 0) throw new Error(`entry not found: ${TGZ_ENTRY_PATH}`);
+  if (matches.length > 1) throw new Error(`duplicate entry: ${TGZ_ENTRY_PATH}`);
+  return matches[0].content;
+}
+
+// 单条目校验：true 合法；否则返回原因字符串。唯一调用点是 mergeCatalog（Y2-7）。
+export function validateCatalog(api, id, entry) {
+  if (!SUPPORTED_APIS.includes(api)) return `unsupported api: ${api}`;
+  if (!entry || typeof entry !== "object" || Array.isArray(entry)) return "entry is not an object";
+  if (entry.id !== id) return `id mismatch: key=${id} entry.id=${entry.id}`;
+  if (entry.api !== api) return `api mismatch: section=${api} entry.api=${entry.api}`;
+  if (entry.provider !== "github-copilot") return `unexpected provider: ${entry.provider}`;
+  for (const field of ["contextWindow", "maxTokens"]) {
+    if (typeof entry[field] !== "number" || !Number.isFinite(entry[field]) || entry[field] <= 0) {
+      return `${field} must be a positive number`;
+    }
+  }
+  return true;
+}
+
+// 只增不更新合并。added = 展示数组 [{id, api}]；addedOverlay = catalog-shaped
+// 增量（供 journal/自愈，仅含本次合法新增）；skipped = 非法条目 [{api, id, reason}]；
+// 已有 id（任一层）静默跳过——不覆盖、不进 added/skipped。
+export function mergeCatalog(local, remote) {
+  const merged = {};
+  for (const [api, section] of Object.entries(local ?? {})) merged[api] = { ...(section ?? {}) };
+  const have = new Set(Object.values(merged).flatMap((s) => Object.keys(s)));
+  const added = [];
+  const skipped = [];
+  const addedOverlay = {};
+  for (const [api, section] of Object.entries(remote ?? {})) {
+    for (const [id, entry] of Object.entries(section ?? {})) {
+      if (have.has(id)) continue; // 只增不更新
+      const why = validateCatalog(api, id, entry);
+      if (why !== true) {
+        skipped.push({ api, id, reason: why });
+        continue;
+      }
+      (merged[api] ??= {})[id] = entry;
+      (addedOverlay[api] ??= {})[id] = entry;
+      added.push({ id, api });
+      have.add(id);
+    }
+  }
+  return { merged, added, addedOverlay, skipped };
+}
+
+// R3：removed 以 target 为准，不以 available 为准——available 但目录不可解析的
+// 当前模型必须进 removed（settings 校验拒绝目录外 id，保留必报错）。
+export function diffModels(currentIds, availableIds, catalogIds) {
+  const target = [...new Set(availableIds)].filter((id) => catalogIds.has(id));
+  const targetSet = new Set(target);
+  const current = [...new Set(currentIds)];
+  return {
+    target,
+    added: target.filter((id) => !current.includes(id)),
+    removed: current.filter((id) => !targetSet.has(id)),
+    kept: current.filter((id) => targetSet.has(id)),
+  };
+}
+
+// canonical JSON：递归键排序；保留 undefined 与缺失键、空数组与空对象的区别
+// （字段级定制变化必须使 settings digest 漂移，R3-2）。
+function canonicalize(v) {
+  if (v === undefined) return "undefined";
+  if (v === null || typeof v !== "object") return JSON.stringify(v) ?? "undefined";
+  if (Array.isArray(v)) return `[${v.map(canonicalize).join(",")}]`;
+  return `{${Object.keys(v)
+    .sort()
+    .map((k) => `${JSON.stringify(k)}:${canonicalize(v[k])}`)
+    .join(",")}}`;
+}
+
+export function digest(x) {
+  const h = createHash("sha256");
+  if (Buffer.isBuffer(x)) h.update(x);
+  else if (typeof x === "string") h.update(x);
+  else h.update(canonicalize(x), "utf8");
+  return h.digest("hex");
+}
+
+// 从进程入口（或注入的 startPath）逐级向上定位 pi-ai 安装根；catalog 文件与
+// version 取自同一解析根的 package.json（防版本与被写文件不属同一副本，R3-8）。
+export function findPiAiInstallation({ startPath } = {}) {
+  try {
+    let dir = startPath ?? dirname(realpathSync(process.argv?.[1] ?? ""));
+    for (let depth = 0; depth < 8; depth++) {
+      const root = join(dir, "node_modules", "@earendil-works", "pi-ai");
+      const catalogFile = join(root, "dist", "providers", "data", "github-copilot.json");
+      const packageJsonFile = join(root, "package.json");
+      if (existsSync(catalogFile) && existsSync(packageJsonFile)) {
+        const pkg = JSON.parse(readFileSync(packageJsonFile, "utf8"));
+        return { catalogFile, packageJsonFile, version: pkg.version };
+      }
+      const parent = dirname(dir);
+      if (parent === dir) return null;
+      dir = parent;
+    }
+  } catch { /* 安装树结构变化 → null（调用方降级） */ }
+  return null;
+}

package/src/copilot-models.mjs

@@ -0,0 +1,113 @@
+// copilot-models.mjs — GitHub Copilot 可用性适配（只读 GET /models）。
+// ⚠️ 显式耦合 pi-ai 0.84.4：COPILOT_HEADERS / COPILOT_API_VERSION / normalizeDomain /
+// getGitHubCopilotBaseUrl / parseGitHubCopilotModelCatalog 的语义逐行抄录自
+// @earendil-works/pi-ai@0.84.4 dist/auth/oauth/github-copilot.js。
+// 不实现 token 获取/刷新/policy 修改；语义漂移或任何失败一律由调用方回退凭证缓存
+// （payload.availableModelIds）。pi-ai 升级后本文件必须对照新版源码复核。
+
+// ↓↓↓ 以下常量抄录自 pi-ai 0.84.4 dist/auth/oauth/github-copilot.js（勿改值）
+const COPILOT_HEADERS = {
+  "User-Agent": "GitHubCopilotChat/0.35.0",
+  "Editor-Version": "vscode/1.107.0",
+  "Editor-Plugin-Version": "copilot-chat/0.35.0",
+  "Copilot-Integration-Id": "vscode-chat",
+};
+const COPILOT_API_VERSION = "2026-06-01";
+// ↑↑↑ 抄录结束
+
+const INDIVIDUAL_DEFAULT_BASE_URL = "https://api.individual.githubcopilot.com";
+
+// 抄录语义：trim → 空 → null；含 :// 直接 new URL，否则补 https://；取 hostname；异常 → null
+function normalizeDomain(input) {
+  const trimmed = String(input ?? "").trim();
+  if (!trimmed) return null;
+  try {
+    const url = trimmed.includes("://") ? new URL(trimmed) : new URL(`https://${trimmed}`);
+    return url.hostname;
+  } catch {
+    return null;
+  }
+}
+
+// 抄录语义：token 形如 tid=...;exp=...;proxy-ep=proxy.individual.githubcopilot.com;...
+// proxy.xxx → api.xxx
+function getBaseUrlFromToken(token) {
+  const match = String(token ?? "").match(/proxy-ep=([^;]+)/);
+  if (!match) return null;
+  const proxyHost = match[1];
+  const apiHost = proxyHost.replace(/^proxy\./, "api.");
+  return `https://${apiHost}`;
+}
+
+// 抄录语义：token proxy-ep 优先 → enterprise copilot-api.<domain> → individual 缺省
+export function copilotBaseUrl(access, enterpriseUrl) {
+  const enterpriseDomain = normalizeDomain(enterpriseUrl);
+  if (access) {
+    const urlFromToken = getBaseUrlFromToken(access);
+    if (urlFromToken) return urlFromToken;
+  }
+  if (enterpriseDomain) return `https://copilot-api.${enterpriseDomain}`;
+  return INDIVIDUAL_DEFAULT_BASE_URL;
+}
+
+function asRecord(value) {
+  return value && typeof value === "object" ? value : undefined;
+}
+
+// 抄录语义（仅 availableModelIds 部分；policyModelIds 涉及 policy 修改，本适配不实现）：
+// tool_calls === false 前置排除；pickerEnabled === true && policyState !== "disabled"
+// 为主集；仅当 individual 端点且主集为空时回退 policyState === "enabled"。
+function parseAvailableModelIds(raw, allowPolicyFallback) {
+  const data = asRecord(raw)?.data;
+  if (!Array.isArray(data)) {
+    throw new Error("Invalid Copilot models response");
+  }
+  const accountModels = data.flatMap((rawItem) => {
+    const item = asRecord(rawItem);
+    const id = item?.id;
+    if (!item || typeof id !== "string") return [];
+    const capabilities = asRecord(item.capabilities);
+    const supports = asRecord(capabilities?.supports);
+    if (supports?.tool_calls === false) return [];
+    return [
+      {
+        id,
+        pickerEnabled: item.model_picker_enabled === true,
+        policyState: asRecord(item.policy)?.state,
+      },
+    ];
+  });
+  const pickerModelIds = accountModels
+    .filter((model) => model.pickerEnabled && model.policyState !== "disabled")
+    .map((model) => model.id);
+  return pickerModelIds.length > 0 || !allowPolicyFallback
+    ? pickerModelIds
+    : accountModels.filter((model) => model.policyState === "enabled").map((model) => model.id);
+}
+
+// 现场拉取账号可用模型。credential 为 GrantRecord payload：
+// { access, enterpriseUrl?, availableModelIds? }。5s 超时、不重试（对齐 0.84.4
+// token 刷新路径 maxRetries: 0 的行为）；任何失败抛错，由调用方回退凭证缓存。
+export async function fetchLiveAvailableModelIds({ credential, fetchImpl } = {}) {
+  const access = credential?.access;
+  if (!access || typeof fetchImpl !== "function") {
+    throw new Error("credential.access and fetchImpl required");
+  }
+  const baseUrl = copilotBaseUrl(access, credential.enterpriseUrl);
+  // 0.84.4 注释：部分 Individual 账号 picker 标志全 false 但 policy 显式 enabled，
+  // 回退严格限定在 individual 端点。
+  const allowPolicyFallback = baseUrl === INDIVIDUAL_DEFAULT_BASE_URL;
+  const response = await fetchImpl(`${baseUrl}/models`, {
+    headers: {
+      Accept: "application/json",
+      Authorization: `Bearer ${access}`,
+      ...COPILOT_HEADERS,
+      "X-GitHub-Api-Version": COPILOT_API_VERSION,
+    },
+    signal: AbortSignal.timeout(5000),
+  });
+  if (!response.ok) {
+    throw new Error(`${response.status} ${response.statusText}: GET ${baseUrl}/models`);
+  }
+  return parseAvailableModelIds(await response.json(), allowPolicyFallback);
+}