@mastra/code-sdk 0.0.0-mastracode-cloud-20260706153555

package/dist/auth/providers/github-copilot.d.ts

@@ -0,0 +1,100 @@
+/**
+ * GitHub Copilot OAuth flow
+ *
+ * Inspired by:
+ *   - pi-mono: https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/github-copilot.ts
+ *   - opencode: https://github.com/anomalyco/opencode/blob/dev/packages/opencode/src/plugin/github-copilot/copilot.ts
+ *
+ * Storage layout in AuthStorage:
+ *   - `refresh` holds the long-lived GitHub OAuth access token (used to mint Copilot tokens).
+ *   - `access`  holds the short-lived Copilot bearer token (~30 minutes).
+ *   - `expires` is the Copilot bearer expiry (ms epoch, with a 5-minute safety buffer).
+ *   - `enterpriseUrl` is the GitHub Enterprise hostname, or undefined for github.com.
+ */
+import type { OAuthCredentials, OAuthProviderInterface } from '../types.js';
+export type GitHubCopilotCredentials = OAuthCredentials & {
+    enterpriseUrl?: string;
+};
+export declare const COPILOT_USER_AGENT = "GitHubCopilotChat/0.35.0";
+/** Headers that Copilot endpoints expect from a VS Code-like client. */
+export declare const COPILOT_HEADERS: {
+    readonly 'User-Agent': "GitHubCopilotChat/0.35.0";
+    readonly 'Editor-Version': "vscode/1.107.0";
+    readonly 'Editor-Plugin-Version': "copilot-chat/0.35.0";
+    readonly 'Copilot-Integration-Id': "vscode-chat";
+};
+/**
+ * Normalize a user-entered Enterprise URL/domain into a hostname (e.g. `company.ghe.com`).
+ * Returns null for an empty input or an unparseable URL.
+ */
+export declare function normalizeDomain(input: string): string | null;
+/**
+ * Resolve the Copilot API base URL.
+ * Prefers the `proxy-ep` parsed from the bearer token, then falls back to enterprise/individual defaults.
+ */
+export declare function getGitHubCopilotBaseUrl(token?: string, enterpriseDomain?: string): string;
+/**
+ * Refresh the short-lived Copilot bearer token using the long-lived GitHub OAuth token.
+ *
+ * `refreshToken` here is the GitHub OAuth access token; the Copilot endpoint returns a
+ * fresh bearer token (`token`) and absolute expiry (`expires_at`, seconds since epoch).
+ */
+export declare function refreshGitHubCopilotToken(refreshToken: string, enterpriseDomain?: string, signal?: AbortSignal): Promise<GitHubCopilotCredentials>;
+/**
+ * Login with GitHub Copilot OAuth (device-code flow).
+ *
+ * Prompts for an optional GitHub Enterprise URL/domain, performs the device-code flow,
+ * then exchanges the GitHub OAuth token for a Copilot bearer token.
+ */
+export declare function loginGitHubCopilot(options: {
+    onAuth: (url: string, instructions?: string) => void;
+    onPrompt: (prompt: {
+        message: string;
+        placeholder?: string;
+        allowEmpty?: boolean;
+    }) => Promise<string>;
+    onProgress?: (message: string) => void;
+    signal?: AbortSignal;
+}): Promise<GitHubCopilotCredentials>;
+/**
+ * Filtered, normalized entry from the Copilot `/models` API.
+ *
+ * The full API payload includes a lot of capability metadata; we only keep the bits
+ * we need to expose models in `listAvailableModels()` and route requests sensibly.
+ */
+export type CopilotModelEntry = {
+    /** Stable model id (e.g. `claude-sonnet-4.5`, `gpt-4.1`). */
+    id: string;
+    /** Human-readable display name (e.g. `Claude Sonnet 4.5`). */
+    name: string;
+    /** Vendor field from the API (e.g. `Anthropic`, `OpenAI`). */
+    vendor: string;
+    /**
+     * Endpoints the model exposes (e.g. `/chat/completions`, `/responses`, `/v1/messages`).
+     * Empty when the API didn't return `supported_endpoints` for this entry.
+     */
+    supportedEndpoints: string[];
+    /** True when `supported_endpoints` includes `/v1/messages` (Anthropic-shaped Copilot model). */
+    isAnthropicShaped: boolean;
+    /** True when `capabilities.supports.vision` is true. */
+    supportsVision: boolean;
+    /** True when the model supports tool calling. */
+    supportsToolCalls: boolean;
+};
+/**
+ * Fetch the Copilot model list available to the current subscription.
+ *
+ * Hits `${baseURL}/models` with the Copilot bearer token, filters to
+ * `model_picker_enabled === true && policy.state !== 'disabled'`, and returns
+ * a normalized list. Mirrors opencode's filtering rules.
+ *
+ * Inspired by:
+ *   - opencode: https://github.com/anomalyco/opencode/blob/dev/packages/opencode/src/plugin/github-copilot/models.ts
+ */
+export declare function fetchCopilotModels(opts: {
+    baseUrl: string;
+    bearerToken: string;
+    signal?: AbortSignal;
+}): Promise<CopilotModelEntry[]>;
+export declare const githubCopilotOAuthProvider: OAuthProviderInterface;
+//# sourceMappingURL=github-copilot.d.ts.map

package/dist/auth/providers/github-copilot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-copilot.d.ts","sourceRoot":"","sources":["../../../src/auth/providers/github-copilot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAuB,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAEjG,MAAM,MAAM,wBAAwB,GAAG,gBAAgB,GAAG;IACxD,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAMF,eAAO,MAAM,kBAAkB,6BAA6B,CAAC;AAE7D,wEAAwE;AACxE,eAAO,MAAM,eAAe;;;;;CAKlB,CAAC;AAyBX;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS5D;AA0BD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAOzF;AA0JD;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,YAAY,EAAE,MAAM,EACpB,gBAAgB,CAAC,EAAE,MAAM,EACzB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,wBAAwB,CAAC,CAsCnC;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACrD,QAAQ,EAAE,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACvG,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA+BpC;AAED;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,6DAA6D;IAC7D,EAAE,EAAE,MAAM,CAAC;IACX,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,gGAAgG;IAChG,iBAAiB,EAAE,OAAO,CAAC;IAC3B,wDAAwD;IACxD,cAAc,EAAE,OAAO,CAAC;IACxB,iDAAiD;IACjD,iBAAiB,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CA8D/B;AAED,eAAO,MAAM,0BAA0B,EAAE,sBAqBxC,CAAC"}

package/dist/auth/providers/github-copilot.js

@@ -0,0 +1,302 @@
+const decode = (s) => atob(s);
+const CLIENT_ID = decode("SXYxLmI1MDdhMDhjODdlY2ZlOTg=");
+const COPILOT_USER_AGENT = "GitHubCopilotChat/0.35.0";
+const COPILOT_HEADERS = {
+  "User-Agent": COPILOT_USER_AGENT,
+  "Editor-Version": "vscode/1.107.0",
+  "Editor-Plugin-Version": "copilot-chat/0.35.0",
+  "Copilot-Integration-Id": "vscode-chat"
+};
+const INITIAL_POLL_INTERVAL_MULTIPLIER = 1.2;
+const SLOW_DOWN_POLL_INTERVAL_MULTIPLIER = 1.4;
+function normalizeDomain(input) {
+  const trimmed = input.trim();
+  if (!trimmed) return null;
+  try {
+    const url = trimmed.includes("://") ? new URL(trimmed) : new URL(`https://${trimmed}`);
+    return url.hostname || null;
+  } catch {
+    return null;
+  }
+}
+function getUrls(domain) {
+  return {
+    deviceCodeUrl: `https://${domain}/login/device/code`,
+    accessTokenUrl: `https://${domain}/login/oauth/access_token`,
+    copilotTokenUrl: `https://api.${domain}/copilot_internal/v2/token`
+  };
+}
+function getBaseUrlFromToken(token) {
+  const match = token.match(/proxy-ep=([^;]+)/);
+  if (!match) return null;
+  const proxyHost = match[1];
+  const apiHost = proxyHost.replace(/^proxy\./, "api.");
+  return `https://${apiHost}`;
+}
+function getGitHubCopilotBaseUrl(token, enterpriseDomain) {
+  if (token) {
+    const fromToken = getBaseUrlFromToken(token);
+    if (fromToken) return fromToken;
+  }
+  if (enterpriseDomain) return `https://copilot-api.${enterpriseDomain}`;
+  return "https://api.individual.githubcopilot.com";
+}
+async function fetchJson(url, init, signal) {
+  const response = await fetch(url, signal ? { ...init, signal } : init);
+  if (!response.ok) {
+    const text = await response.text().catch(() => "");
+    throw new Error(`${response.status} ${response.statusText}: ${text}`);
+  }
+  return response.json();
+}
+async function startDeviceFlow(domain, signal) {
+  const urls = getUrls(domain);
+  const data = await fetchJson(
+    urls.deviceCodeUrl,
+    {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/x-www-form-urlencoded",
+        "User-Agent": COPILOT_USER_AGENT
+      },
+      body: new URLSearchParams({
+        client_id: CLIENT_ID,
+        scope: "read:user"
+      })
+    },
+    signal
+  );
+  if (!data || typeof data !== "object") {
+    throw new Error("Invalid device code response");
+  }
+  const obj = data;
+  const deviceCode = obj.device_code;
+  const userCode = obj.user_code;
+  const verificationUri = obj.verification_uri;
+  const interval = obj.interval;
+  const expiresIn = obj.expires_in;
+  if (typeof deviceCode !== "string" || typeof userCode !== "string" || typeof verificationUri !== "string" || typeof interval !== "number" || typeof expiresIn !== "number") {
+    throw new Error("Invalid device code response fields");
+  }
+  return {
+    device_code: deviceCode,
+    user_code: userCode,
+    verification_uri: verificationUri,
+    interval,
+    expires_in: expiresIn
+  };
+}
+function abortableSleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(new Error("Login cancelled"));
+      return;
+    }
+    let timeout;
+    const onAbort = () => {
+      clearTimeout(timeout);
+      reject(new Error("Login cancelled"));
+    };
+    timeout = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+async function pollForGitHubAccessToken(domain, deviceCode, intervalSeconds, expiresIn, signal) {
+  const urls = getUrls(domain);
+  const deadline = Date.now() + expiresIn * 1e3;
+  let intervalMs = Math.max(1e3, Math.floor(intervalSeconds * 1e3));
+  let intervalMultiplier = INITIAL_POLL_INTERVAL_MULTIPLIER;
+  let slowDownResponses = 0;
+  while (Date.now() < deadline) {
+    if (signal?.aborted) {
+      throw new Error("Login cancelled");
+    }
+    const remainingMs = deadline - Date.now();
+    const waitMs = Math.min(Math.ceil(intervalMs * intervalMultiplier), remainingMs);
+    await abortableSleep(waitMs, signal);
+    const raw = await fetchJson(
+      urls.accessTokenUrl,
+      {
+        method: "POST",
+        headers: {
+          Accept: "application/json",
+          "Content-Type": "application/x-www-form-urlencoded",
+          "User-Agent": COPILOT_USER_AGENT
+        },
+        body: new URLSearchParams({
+          client_id: CLIENT_ID,
+          device_code: deviceCode,
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+        })
+      },
+      signal
+    );
+    if (raw && typeof raw === "object" && typeof raw.access_token === "string") {
+      return raw.access_token;
+    }
+    if (raw && typeof raw === "object" && typeof raw.error === "string") {
+      const { error, error_description: description, interval } = raw;
+      if (error === "authorization_pending") {
+        continue;
+      }
+      if (error === "slow_down") {
+        slowDownResponses += 1;
+        intervalMs = typeof interval === "number" && interval > 0 ? interval * 1e3 : Math.max(1e3, intervalMs + 5e3);
+        intervalMultiplier = SLOW_DOWN_POLL_INTERVAL_MULTIPLIER;
+        continue;
+      }
+      const descriptionSuffix = description ? `: ${description}` : "";
+      throw new Error(`Device flow failed: ${error}${descriptionSuffix}`);
+    }
+  }
+  if (slowDownResponses > 0) {
+    throw new Error(
+      "Device flow timed out after one or more slow_down responses. This is often caused by clock drift in WSL or VM environments. Please sync or restart the VM clock and try again."
+    );
+  }
+  throw new Error("Device flow timed out");
+}
+async function refreshGitHubCopilotToken(refreshToken, enterpriseDomain, signal) {
+  const domain = enterpriseDomain || "github.com";
+  const urls = getUrls(domain);
+  const raw = await fetchJson(
+    urls.copilotTokenUrl,
+    {
+      headers: {
+        Accept: "application/json",
+        Authorization: `Bearer ${refreshToken}`,
+        ...COPILOT_HEADERS
+      }
+    },
+    signal
+  );
+  if (!raw || typeof raw !== "object") {
+    throw new Error("Invalid Copilot token response");
+  }
+  const obj = raw;
+  const token = obj.token;
+  const expiresAt = obj.expires_at;
+  if (typeof token !== "string" || typeof expiresAt !== "number") {
+    throw new Error("Invalid Copilot token response fields");
+  }
+  const credentials = {
+    refresh: refreshToken,
+    access: token,
+    // expires_at is seconds; subtract 5 minutes so we refresh before actual expiry.
+    expires: expiresAt * 1e3 - 5 * 60 * 1e3
+  };
+  if (enterpriseDomain) {
+    credentials.enterpriseUrl = enterpriseDomain;
+  }
+  return credentials;
+}
+async function loginGitHubCopilot(options) {
+  const input = await options.onPrompt({
+    message: "GitHub Enterprise URL/domain (blank for github.com)",
+    placeholder: "company.ghe.com",
+    allowEmpty: true
+  });
+  if (options.signal?.aborted) {
+    throw new Error("Login cancelled");
+  }
+  const trimmed = input.trim();
+  const enterpriseDomain = normalizeDomain(input);
+  if (trimmed && !enterpriseDomain) {
+    throw new Error("Invalid GitHub Enterprise URL/domain");
+  }
+  const domain = enterpriseDomain || "github.com";
+  const device = await startDeviceFlow(domain, options.signal);
+  options.onAuth(device.verification_uri, `Enter code: ${device.user_code}`);
+  const githubAccessToken = await pollForGitHubAccessToken(
+    domain,
+    device.device_code,
+    device.interval,
+    device.expires_in,
+    options.signal
+  );
+  options.onProgress?.("Fetching Copilot token...");
+  return refreshGitHubCopilotToken(githubAccessToken, enterpriseDomain ?? void 0, options.signal);
+}
+async function fetchCopilotModels(opts) {
+  const url = `${opts.baseUrl.replace(/\/$/, "")}/models`;
+  const response = await fetch(url, {
+    headers: {
+      Accept: "application/json",
+      Authorization: `Bearer ${opts.bearerToken}`,
+      ...COPILOT_HEADERS
+    },
+    signal: opts.signal
+  });
+  if (!response.ok) {
+    const text = await response.text().catch(() => "");
+    throw new Error(`Failed to fetch Copilot models: ${response.status} ${response.statusText}: ${text}`);
+  }
+  const json = await response.json().catch(() => null);
+  if (!json || typeof json !== "object" || !Array.isArray(json.data)) {
+    throw new Error("Invalid Copilot models response: missing `data` array");
+  }
+  const data = json.data;
+  const result = [];
+  for (const item of data) {
+    if (!item || typeof item !== "object") continue;
+    const obj = item;
+    if (obj.model_picker_enabled !== true) continue;
+    const policy = obj.policy;
+    if (policy && policy.state === "disabled") continue;
+    const id = obj.id;
+    if (typeof id !== "string" || !id) continue;
+    const name = typeof obj.name === "string" ? obj.name : id;
+    const vendor = typeof obj.vendor === "string" ? obj.vendor : "";
+    const capabilities = obj.capabilities;
+    const supports = capabilities?.supports;
+    const supportsVision = supports?.vision === true;
+    const supportsToolCalls = supports?.tool_calls === true;
+    const rawEndpoints = obj.supported_endpoints;
+    const supportedEndpoints = Array.isArray(rawEndpoints) ? rawEndpoints.filter((e) => typeof e === "string") : [];
+    const isAnthropicShaped = supportedEndpoints.includes("/v1/messages");
+    result.push({
+      id,
+      name,
+      vendor,
+      supportedEndpoints,
+      isAnthropicShaped,
+      supportsVision,
+      supportsToolCalls
+    });
+  }
+  return result;
+}
+const githubCopilotOAuthProvider = {
+  id: "github-copilot",
+  name: "GitHub Copilot",
+  async login(callbacks) {
+    return loginGitHubCopilot({
+      onAuth: (url, instructions) => callbacks.onAuth({ url, instructions }),
+      onPrompt: callbacks.onPrompt,
+      onProgress: callbacks.onProgress,
+      signal: callbacks.signal
+    });
+  },
+  async refreshToken(credentials) {
+    const creds = credentials;
+    return refreshGitHubCopilotToken(creds.refresh, creds.enterpriseUrl);
+  },
+  getApiKey(credentials) {
+    return credentials.access;
+  }
+};
+export {
+  COPILOT_HEADERS,
+  COPILOT_USER_AGENT,
+  fetchCopilotModels,
+  getGitHubCopilotBaseUrl,
+  githubCopilotOAuthProvider,
+  loginGitHubCopilot,
+  normalizeDomain,
+  refreshGitHubCopilotToken
+};
+//# sourceMappingURL=github-copilot.js.map

package/dist/auth/providers/github-copilot.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/auth/providers/github-copilot.ts"],"sourcesContent":["/**\n * GitHub Copilot OAuth flow\n *\n * Inspired by:\n *   - pi-mono: https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/github-copilot.ts\n *   - opencode: https://github.com/anomalyco/opencode/blob/dev/packages/opencode/src/plugin/github-copilot/copilot.ts\n *\n * Storage layout in AuthStorage:\n *   - `refresh` holds the long-lived GitHub OAuth access token (used to mint Copilot tokens).\n *   - `access`  holds the short-lived Copilot bearer token (~30 minutes).\n *   - `expires` is the Copilot bearer expiry (ms epoch, with a 5-minute safety buffer).\n *   - `enterpriseUrl` is the GitHub Enterprise hostname, or undefined for github.com.\n */\n\nimport type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from '../types.js';\n\nexport type GitHubCopilotCredentials = OAuthCredentials & {\n  enterpriseUrl?: string;\n};\n\nconst decode = (s: string): string => atob(s);\n// Copilot's public client ID, encoded to mirror the upstream references.\nconst CLIENT_ID = decode('SXYxLmI1MDdhMDhjODdlY2ZlOTg=');\n\nexport const COPILOT_USER_AGENT = 'GitHubCopilotChat/0.35.0';\n\n/** Headers that Copilot endpoints expect from a VS Code-like client. */\nexport const COPILOT_HEADERS = {\n  'User-Agent': COPILOT_USER_AGENT,\n  'Editor-Version': 'vscode/1.107.0',\n  'Editor-Plugin-Version': 'copilot-chat/0.35.0',\n  'Copilot-Integration-Id': 'vscode-chat',\n} as const;\n\nconst INITIAL_POLL_INTERVAL_MULTIPLIER = 1.2;\nconst SLOW_DOWN_POLL_INTERVAL_MULTIPLIER = 1.4;\n\ntype DeviceCodeResponse = {\n  device_code: string;\n  user_code: string;\n  verification_uri: string;\n  interval: number;\n  expires_in: number;\n};\n\ntype DeviceTokenSuccessResponse = {\n  access_token: string;\n  token_type?: string;\n  scope?: string;\n};\n\ntype DeviceTokenErrorResponse = {\n  error: string;\n  error_description?: string;\n  interval?: number;\n};\n\n/**\n * Normalize a user-entered Enterprise URL/domain into a hostname (e.g. `company.ghe.com`).\n * Returns null for an empty input or an unparseable URL.\n */\nexport function normalizeDomain(input: string): string | null {\n  const trimmed = input.trim();\n  if (!trimmed) return null;\n  try {\n    const url = trimmed.includes('://') ? new URL(trimmed) : new URL(`https://${trimmed}`);\n    return url.hostname || null;\n  } catch {\n    return null;\n  }\n}\n\nfunction getUrls(domain: string): {\n  deviceCodeUrl: string;\n  accessTokenUrl: string;\n  copilotTokenUrl: string;\n} {\n  return {\n    deviceCodeUrl: `https://${domain}/login/device/code`,\n    accessTokenUrl: `https://${domain}/login/oauth/access_token`,\n    copilotTokenUrl: `https://api.${domain}/copilot_internal/v2/token`,\n  };\n}\n\n/**\n * Parse the `proxy-ep` segment from a Copilot bearer token and convert to its API base URL.\n * Token shape: `tid=...;exp=...;proxy-ep=proxy.individual.githubcopilot.com;...`\n */\nfunction getBaseUrlFromToken(token: string): string | null {\n  const match = token.match(/proxy-ep=([^;]+)/);\n  if (!match) return null;\n  const proxyHost = match[1]!;\n  const apiHost = proxyHost.replace(/^proxy\\./, 'api.');\n  return `https://${apiHost}`;\n}\n\n/**\n * Resolve the Copilot API base URL.\n * Prefers the `proxy-ep` parsed from the bearer token, then falls back to enterprise/individual defaults.\n */\nexport function getGitHubCopilotBaseUrl(token?: string, enterpriseDomain?: string): string {\n  if (token) {\n    const fromToken = getBaseUrlFromToken(token);\n    if (fromToken) return fromToken;\n  }\n  if (enterpriseDomain) return `https://copilot-api.${enterpriseDomain}`;\n  return 'https://api.individual.githubcopilot.com';\n}\n\nasync function fetchJson(url: string, init: RequestInit, signal?: AbortSignal): Promise<unknown> {\n  const response = await fetch(url, signal ? { ...init, signal } : init);\n  if (!response.ok) {\n    const text = await response.text().catch(() => '');\n    throw new Error(`${response.status} ${response.statusText}: ${text}`);\n  }\n  return response.json();\n}\n\nasync function startDeviceFlow(domain: string, signal?: AbortSignal): Promise<DeviceCodeResponse> {\n  const urls = getUrls(domain);\n  const data = await fetchJson(\n    urls.deviceCodeUrl,\n    {\n      method: 'POST',\n      headers: {\n        Accept: 'application/json',\n        'Content-Type': 'application/x-www-form-urlencoded',\n        'User-Agent': COPILOT_USER_AGENT,\n      },\n      body: new URLSearchParams({\n        client_id: CLIENT_ID,\n        scope: 'read:user',\n      }),\n    },\n    signal,\n  );\n\n  if (!data || typeof data !== 'object') {\n    throw new Error('Invalid device code response');\n  }\n\n  const obj = data as Record<string, unknown>;\n  const deviceCode = obj.device_code;\n  const userCode = obj.user_code;\n  const verificationUri = obj.verification_uri;\n  const interval = obj.interval;\n  const expiresIn = obj.expires_in;\n\n  if (\n    typeof deviceCode !== 'string' ||\n    typeof userCode !== 'string' ||\n    typeof verificationUri !== 'string' ||\n    typeof interval !== 'number' ||\n    typeof expiresIn !== 'number'\n  ) {\n    throw new Error('Invalid device code response fields');\n  }\n\n  return {\n    device_code: deviceCode,\n    user_code: userCode,\n    verification_uri: verificationUri,\n    interval,\n    expires_in: expiresIn,\n  };\n}\n\n/** Sleep that can be interrupted by an AbortSignal. */\nfunction abortableSleep(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise((resolve, reject) => {\n    if (signal?.aborted) {\n      reject(new Error('Login cancelled'));\n      return;\n    }\n\n    let timeout: ReturnType<typeof setTimeout>;\n    const onAbort = () => {\n      clearTimeout(timeout);\n      reject(new Error('Login cancelled'));\n    };\n\n    timeout = setTimeout(() => {\n      signal?.removeEventListener('abort', onAbort);\n      resolve();\n    }, ms);\n\n    signal?.addEventListener('abort', onAbort, { once: true });\n  });\n}\n\nasync function pollForGitHubAccessToken(\n  domain: string,\n  deviceCode: string,\n  intervalSeconds: number,\n  expiresIn: number,\n  signal?: AbortSignal,\n): Promise<string> {\n  const urls = getUrls(domain);\n  const deadline = Date.now() + expiresIn * 1000;\n  let intervalMs = Math.max(1000, Math.floor(intervalSeconds * 1000));\n  let intervalMultiplier = INITIAL_POLL_INTERVAL_MULTIPLIER;\n  let slowDownResponses = 0;\n\n  while (Date.now() < deadline) {\n    if (signal?.aborted) {\n      throw new Error('Login cancelled');\n    }\n\n    const remainingMs = deadline - Date.now();\n    const waitMs = Math.min(Math.ceil(intervalMs * intervalMultiplier), remainingMs);\n    await abortableSleep(waitMs, signal);\n\n    const raw = await fetchJson(\n      urls.accessTokenUrl,\n      {\n        method: 'POST',\n        headers: {\n          Accept: 'application/json',\n          'Content-Type': 'application/x-www-form-urlencoded',\n          'User-Agent': COPILOT_USER_AGENT,\n        },\n        body: new URLSearchParams({\n          client_id: CLIENT_ID,\n          device_code: deviceCode,\n          grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n        }),\n      },\n      signal,\n    );\n\n    if (raw && typeof raw === 'object' && typeof (raw as DeviceTokenSuccessResponse).access_token === 'string') {\n      return (raw as DeviceTokenSuccessResponse).access_token;\n    }\n\n    if (raw && typeof raw === 'object' && typeof (raw as DeviceTokenErrorResponse).error === 'string') {\n      const { error, error_description: description, interval } = raw as DeviceTokenErrorResponse;\n      if (error === 'authorization_pending') {\n        continue;\n      }\n\n      if (error === 'slow_down') {\n        slowDownResponses += 1;\n        intervalMs = typeof interval === 'number' && interval > 0 ? interval * 1000 : Math.max(1000, intervalMs + 5000);\n        intervalMultiplier = SLOW_DOWN_POLL_INTERVAL_MULTIPLIER;\n        continue;\n      }\n\n      const descriptionSuffix = description ? `: ${description}` : '';\n      throw new Error(`Device flow failed: ${error}${descriptionSuffix}`);\n    }\n  }\n\n  if (slowDownResponses > 0) {\n    throw new Error(\n      'Device flow timed out after one or more slow_down responses. This is often caused by clock drift in WSL or VM environments. Please sync or restart the VM clock and try again.',\n    );\n  }\n\n  throw new Error('Device flow timed out');\n}\n\n/**\n * Refresh the short-lived Copilot bearer token using the long-lived GitHub OAuth token.\n *\n * `refreshToken` here is the GitHub OAuth access token; the Copilot endpoint returns a\n * fresh bearer token (`token`) and absolute expiry (`expires_at`, seconds since epoch).\n */\nexport async function refreshGitHubCopilotToken(\n  refreshToken: string,\n  enterpriseDomain?: string,\n  signal?: AbortSignal,\n): Promise<GitHubCopilotCredentials> {\n  const domain = enterpriseDomain || 'github.com';\n  const urls = getUrls(domain);\n\n  const raw = await fetchJson(\n    urls.copilotTokenUrl,\n    {\n      headers: {\n        Accept: 'application/json',\n        Authorization: `Bearer ${refreshToken}`,\n        ...COPILOT_HEADERS,\n      },\n    },\n    signal,\n  );\n\n  if (!raw || typeof raw !== 'object') {\n    throw new Error('Invalid Copilot token response');\n  }\n\n  const obj = raw as Record<string, unknown>;\n  const token = obj.token;\n  const expiresAt = obj.expires_at;\n\n  if (typeof token !== 'string' || typeof expiresAt !== 'number') {\n    throw new Error('Invalid Copilot token response fields');\n  }\n\n  const credentials: GitHubCopilotCredentials = {\n    refresh: refreshToken,\n    access: token,\n    // expires_at is seconds; subtract 5 minutes so we refresh before actual expiry.\n    expires: expiresAt * 1000 - 5 * 60 * 1000,\n  };\n  if (enterpriseDomain) {\n    credentials.enterpriseUrl = enterpriseDomain;\n  }\n  return credentials;\n}\n\n/**\n * Login with GitHub Copilot OAuth (device-code flow).\n *\n * Prompts for an optional GitHub Enterprise URL/domain, performs the device-code flow,\n * then exchanges the GitHub OAuth token for a Copilot bearer token.\n */\nexport async function loginGitHubCopilot(options: {\n  onAuth: (url: string, instructions?: string) => void;\n  onPrompt: (prompt: { message: string; placeholder?: string; allowEmpty?: boolean }) => Promise<string>;\n  onProgress?: (message: string) => void;\n  signal?: AbortSignal;\n}): Promise<GitHubCopilotCredentials> {\n  const input = await options.onPrompt({\n    message: 'GitHub Enterprise URL/domain (blank for github.com)',\n    placeholder: 'company.ghe.com',\n    allowEmpty: true,\n  });\n\n  if (options.signal?.aborted) {\n    throw new Error('Login cancelled');\n  }\n\n  const trimmed = input.trim();\n  const enterpriseDomain = normalizeDomain(input);\n  if (trimmed && !enterpriseDomain) {\n    throw new Error('Invalid GitHub Enterprise URL/domain');\n  }\n  const domain = enterpriseDomain || 'github.com';\n\n  const device = await startDeviceFlow(domain, options.signal);\n  options.onAuth(device.verification_uri, `Enter code: ${device.user_code}`);\n\n  const githubAccessToken = await pollForGitHubAccessToken(\n    domain,\n    device.device_code,\n    device.interval,\n    device.expires_in,\n    options.signal,\n  );\n\n  options.onProgress?.('Fetching Copilot token...');\n  return refreshGitHubCopilotToken(githubAccessToken, enterpriseDomain ?? undefined, options.signal);\n}\n\n/**\n * Filtered, normalized entry from the Copilot `/models` API.\n *\n * The full API payload includes a lot of capability metadata; we only keep the bits\n * we need to expose models in `listAvailableModels()` and route requests sensibly.\n */\nexport type CopilotModelEntry = {\n  /** Stable model id (e.g. `claude-sonnet-4.5`, `gpt-4.1`). */\n  id: string;\n  /** Human-readable display name (e.g. `Claude Sonnet 4.5`). */\n  name: string;\n  /** Vendor field from the API (e.g. `Anthropic`, `OpenAI`). */\n  vendor: string;\n  /**\n   * Endpoints the model exposes (e.g. `/chat/completions`, `/responses`, `/v1/messages`).\n   * Empty when the API didn't return `supported_endpoints` for this entry.\n   */\n  supportedEndpoints: string[];\n  /** True when `supported_endpoints` includes `/v1/messages` (Anthropic-shaped Copilot model). */\n  isAnthropicShaped: boolean;\n  /** True when `capabilities.supports.vision` is true. */\n  supportsVision: boolean;\n  /** True when the model supports tool calling. */\n  supportsToolCalls: boolean;\n};\n\n/**\n * Fetch the Copilot model list available to the current subscription.\n *\n * Hits `${baseURL}/models` with the Copilot bearer token, filters to\n * `model_picker_enabled === true && policy.state !== 'disabled'`, and returns\n * a normalized list. Mirrors opencode's filtering rules.\n *\n * Inspired by:\n *   - opencode: https://github.com/anomalyco/opencode/blob/dev/packages/opencode/src/plugin/github-copilot/models.ts\n */\nexport async function fetchCopilotModels(opts: {\n  baseUrl: string;\n  bearerToken: string;\n  signal?: AbortSignal;\n}): Promise<CopilotModelEntry[]> {\n  const url = `${opts.baseUrl.replace(/\\/$/, '')}/models`;\n  const response = await fetch(url, {\n    headers: {\n      Accept: 'application/json',\n      Authorization: `Bearer ${opts.bearerToken}`,\n      ...COPILOT_HEADERS,\n    },\n    signal: opts.signal,\n  });\n\n  if (!response.ok) {\n    const text = await response.text().catch(() => '');\n    throw new Error(`Failed to fetch Copilot models: ${response.status} ${response.statusText}: ${text}`);\n  }\n\n  const json = await response.json().catch(() => null);\n  if (!json || typeof json !== 'object' || !Array.isArray((json as { data?: unknown }).data)) {\n    throw new Error('Invalid Copilot models response: missing `data` array');\n  }\n\n  const data = (json as { data: unknown[] }).data;\n  const result: CopilotModelEntry[] = [];\n\n  for (const item of data) {\n    if (!item || typeof item !== 'object') continue;\n    const obj = item as Record<string, unknown>;\n\n    if (obj.model_picker_enabled !== true) continue;\n\n    const policy = obj.policy as Record<string, unknown> | undefined;\n    if (policy && policy.state === 'disabled') continue;\n\n    const id = obj.id;\n    if (typeof id !== 'string' || !id) continue;\n\n    const name = typeof obj.name === 'string' ? obj.name : id;\n    const vendor = typeof obj.vendor === 'string' ? obj.vendor : '';\n\n    const capabilities = obj.capabilities as Record<string, unknown> | undefined;\n    const supports = capabilities?.supports as Record<string, unknown> | undefined;\n    const supportsVision = supports?.vision === true;\n    const supportsToolCalls = supports?.tool_calls === true;\n\n    const rawEndpoints = obj.supported_endpoints;\n    const supportedEndpoints = Array.isArray(rawEndpoints)\n      ? rawEndpoints.filter((e): e is string => typeof e === 'string')\n      : [];\n    const isAnthropicShaped = supportedEndpoints.includes('/v1/messages');\n\n    result.push({\n      id,\n      name,\n      vendor,\n      supportedEndpoints,\n      isAnthropicShaped,\n      supportsVision,\n      supportsToolCalls,\n    });\n  }\n\n  return result;\n}\n\nexport const githubCopilotOAuthProvider: OAuthProviderInterface = {\n  id: 'github-copilot',\n  name: 'GitHub Copilot',\n\n  async login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n    return loginGitHubCopilot({\n      onAuth: (url, instructions) => callbacks.onAuth({ url, instructions }),\n      onPrompt: callbacks.onPrompt,\n      onProgress: callbacks.onProgress,\n      signal: callbacks.signal,\n    });\n  },\n\n  async refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n    const creds = credentials as GitHubCopilotCredentials;\n    return refreshGitHubCopilotToken(creds.refresh, creds.enterpriseUrl);\n  },\n\n  getApiKey(credentials: OAuthCredentials): string {\n    return credentials.access;\n  },\n};\n"],"mappings":"AAoBA,MAAM,SAAS,CAAC,MAAsB,KAAK,CAAC;AAE5C,MAAM,YAAY,OAAO,8BAA8B;AAEhD,MAAM,qBAAqB;AAG3B,MAAM,kBAAkB;AAAA,EAC7B,cAAc;AAAA,EACd,kBAAkB;AAAA,EAClB,yBAAyB;AAAA,EACzB,0BAA0B;AAC5B;AAEA,MAAM,mCAAmC;AACzC,MAAM,qCAAqC;AA0BpC,SAAS,gBAAgB,OAA8B;AAC5D,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI;AACF,UAAM,MAAM,QAAQ,SAAS,KAAK,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI,IAAI,WAAW,OAAO,EAAE;AACrF,WAAO,IAAI,YAAY;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,QAAQ,QAIf;AACA,SAAO;AAAA,IACL,eAAe,WAAW,MAAM;AAAA,IAChC,gBAAgB,WAAW,MAAM;AAAA,IACjC,iBAAiB,eAAe,MAAM;AAAA,EACxC;AACF;AAMA,SAAS,oBAAoB,OAA8B;AACzD,QAAM,QAAQ,MAAM,MAAM,kBAAkB;AAC5C,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,YAAY,MAAM,CAAC;AACzB,QAAM,UAAU,UAAU,QAAQ,YAAY,MAAM;AACpD,SAAO,WAAW,OAAO;AAC3B;AAMO,SAAS,wBAAwB,OAAgB,kBAAmC;AACzF,MAAI,OAAO;AACT,UAAM,YAAY,oBAAoB,KAAK;AAC3C,QAAI,UAAW,QAAO;AAAA,EACxB;AACA,MAAI,iBAAkB,QAAO,uBAAuB,gBAAgB;AACpE,SAAO;AACT;AAEA,eAAe,UAAU,KAAa,MAAmB,QAAwC;AAC/F,QAAM,WAAW,MAAM,MAAM,KAAK,SAAS,EAAE,GAAG,MAAM,OAAO,IAAI,IAAI;AACrE,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,OAAO,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,EAAE;AACjD,UAAM,IAAI,MAAM,GAAG,SAAS,MAAM,IAAI,SAAS,UAAU,KAAK,IAAI,EAAE;AAAA,EACtE;AACA,SAAO,SAAS,KAAK;AACvB;AAEA,eAAe,gBAAgB,QAAgB,QAAmD;AAChG,QAAM,OAAO,QAAQ,MAAM;AAC3B,QAAM,OAAO,MAAM;AAAA,IACjB,KAAK;AAAA,IACL;AAAA,MACE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,QAAQ;AAAA,QACR,gBAAgB;AAAA,QAChB,cAAc;AAAA,MAChB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,WAAW;AAAA,QACX,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,IACA;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;AACrC,UAAM,IAAI,MAAM,8BAA8B;AAAA,EAChD;AAEA,QAAM,MAAM;AACZ,QAAM,aAAa,IAAI;AACvB,QAAM,WAAW,IAAI;AACrB,QAAM,kBAAkB,IAAI;AAC5B,QAAM,WAAW,IAAI;AACrB,QAAM,YAAY,IAAI;AAEtB,MACE,OAAO,eAAe,YACtB,OAAO,aAAa,YACpB,OAAO,oBAAoB,YAC3B,OAAO,aAAa,YACpB,OAAO,cAAc,UACrB;AACA,UAAM,IAAI,MAAM,qCAAqC;AAAA,EACvD;AAEA,SAAO;AAAA,IACL,aAAa;AAAA,IACb,WAAW;AAAA,IACX,kBAAkB;AAAA,IAClB;AAAA,IACA,YAAY;AAAA,EACd;AACF;AAGA,SAAS,eAAe,IAAY,QAAqC;AACvE,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,QAAI,QAAQ,SAAS;AACnB,aAAO,IAAI,MAAM,iBAAiB,CAAC;AACnC;AAAA,IACF;AAEA,QAAI;AACJ,UAAM,UAAU,MAAM;AACpB,mBAAa,OAAO;AACpB,aAAO,IAAI,MAAM,iBAAiB,CAAC;AAAA,IACrC;AAEA,cAAU,WAAW,MAAM;AACzB,cAAQ,oBAAoB,SAAS,OAAO;AAC5C,cAAQ;AAAA,IACV,GAAG,EAAE;AAEL,YAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAAA,EAC3D,CAAC;AACH;AAEA,eAAe,yBACb,QACA,YACA,iBACA,WACA,QACiB;AACjB,QAAM,OAAO,QAAQ,MAAM;AAC3B,QAAM,WAAW,KAAK,IAAI,IAAI,YAAY;AAC1C,MAAI,aAAa,KAAK,IAAI,KAAM,KAAK,MAAM,kBAAkB,GAAI,CAAC;AAClE,MAAI,qBAAqB;AACzB,MAAI,oBAAoB;AAExB,SAAO,KAAK,IAAI,IAAI,UAAU;AAC5B,QAAI,QAAQ,SAAS;AACnB,YAAM,IAAI,MAAM,iBAAiB;AAAA,IACnC;AAEA,UAAM,cAAc,WAAW,KAAK,IAAI;AACxC,UAAM,SAAS,KAAK,IAAI,KAAK,KAAK,aAAa,kBAAkB,GAAG,WAAW;AAC/E,UAAM,eAAe,QAAQ,MAAM;AAEnC,UAAM,MAAM,MAAM;AAAA,MAChB,KAAK;AAAA,MACL;AAAA,QACE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,gBAAgB;AAAA,UAChB,cAAc;AAAA,QAChB;AAAA,QACA,MAAM,IAAI,gBAAgB;AAAA,UACxB,WAAW;AAAA,UACX,aAAa;AAAA,UACb,YAAY;AAAA,QACd,CAAC;AAAA,MACH;AAAA,MACA;AAAA,IACF;AAEA,QAAI,OAAO,OAAO,QAAQ,YAAY,OAAQ,IAAmC,iBAAiB,UAAU;AAC1G,aAAQ,IAAmC;AAAA,IAC7C;AAEA,QAAI,OAAO,OAAO,QAAQ,YAAY,OAAQ,IAAiC,UAAU,UAAU;AACjG,YAAM,EAAE,OAAO,mBAAmB,aAAa,SAAS,IAAI;AAC5D,UAAI,UAAU,yBAAyB;AACrC;AAAA,MACF;AAEA,UAAI,UAAU,aAAa;AACzB,6BAAqB;AACrB,qBAAa,OAAO,aAAa,YAAY,WAAW,IAAI,WAAW,MAAO,KAAK,IAAI,KAAM,aAAa,GAAI;AAC9G,6BAAqB;AACrB;AAAA,MACF;AAEA,YAAM,oBAAoB,cAAc,KAAK,WAAW,KAAK;AAC7D,YAAM,IAAI,MAAM,uBAAuB,KAAK,GAAG,iBAAiB,EAAE;AAAA,IACpE;AAAA,EACF;AAEA,MAAI,oBAAoB,GAAG;AACzB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,IAAI,MAAM,uBAAuB;AACzC;AAQA,eAAsB,0BACpB,cACA,kBACA,QACmC;AACnC,QAAM,SAAS,oBAAoB;AACnC,QAAM,OAAO,QAAQ,MAAM;AAE3B,QAAM,MAAM,MAAM;AAAA,IAChB,KAAK;AAAA,IACL;AAAA,MACE,SAAS;AAAA,QACP,QAAQ;AAAA,QACR,eAAe,UAAU,YAAY;AAAA,QACrC,GAAG;AAAA,MACL;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAEA,MAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AACnC,UAAM,IAAI,MAAM,gCAAgC;AAAA,EAClD;AAEA,QAAM,MAAM;AACZ,QAAM,QAAQ,IAAI;AAClB,QAAM,YAAY,IAAI;AAEtB,MAAI,OAAO,UAAU,YAAY,OAAO,cAAc,UAAU;AAC9D,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AAEA,QAAM,cAAwC;AAAA,IAC5C,SAAS;AAAA,IACT,QAAQ;AAAA;AAAA,IAER,SAAS,YAAY,MAAO,IAAI,KAAK;AAAA,EACvC;AACA,MAAI,kBAAkB;AACpB,gBAAY,gBAAgB;AAAA,EAC9B;AACA,SAAO;AACT;AAQA,eAAsB,mBAAmB,SAKH;AACpC,QAAM,QAAQ,MAAM,QAAQ,SAAS;AAAA,IACnC,SAAS;AAAA,IACT,aAAa;AAAA,IACb,YAAY;AAAA,EACd,CAAC;AAED,MAAI,QAAQ,QAAQ,SAAS;AAC3B,UAAM,IAAI,MAAM,iBAAiB;AAAA,EACnC;AAEA,QAAM,UAAU,MAAM,KAAK;AAC3B,QAAM,mBAAmB,gBAAgB,KAAK;AAC9C,MAAI,WAAW,CAAC,kBAAkB;AAChC,UAAM,IAAI,MAAM,sCAAsC;AAAA,EACxD;AACA,QAAM,SAAS,oBAAoB;AAEnC,QAAM,SAAS,MAAM,gBAAgB,QAAQ,QAAQ,MAAM;AAC3D,UAAQ,OAAO,OAAO,kBAAkB,eAAe,OAAO,SAAS,EAAE;AAEzE,QAAM,oBAAoB,MAAM;AAAA,IAC9B;AAAA,IACA,OAAO;AAAA,IACP,OAAO;AAAA,IACP,OAAO;AAAA,IACP,QAAQ;AAAA,EACV;AAEA,UAAQ,aAAa,2BAA2B;AAChD,SAAO,0BAA0B,mBAAmB,oBAAoB,QAAW,QAAQ,MAAM;AACnG;AAsCA,eAAsB,mBAAmB,MAIR;AAC/B,QAAM,MAAM,GAAG,KAAK,QAAQ,QAAQ,OAAO,EAAE,CAAC;AAC9C,QAAM,WAAW,MAAM,MAAM,KAAK;AAAA,IAChC,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,eAAe,UAAU,KAAK,WAAW;AAAA,MACzC,GAAG;AAAA,IACL;AAAA,IACA,QAAQ,KAAK;AAAA,EACf,CAAC;AAED,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,OAAO,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,EAAE;AACjD,UAAM,IAAI,MAAM,mCAAmC,SAAS,MAAM,IAAI,SAAS,UAAU,KAAK,IAAI,EAAE;AAAA,EACtG;AAEA,QAAM,OAAO,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AACnD,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAS,KAA4B,IAAI,GAAG;AAC1F,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AAEA,QAAM,OAAQ,KAA6B;AAC3C,QAAM,SAA8B,CAAC;AAErC,aAAW,QAAQ,MAAM;AACvB,QAAI,CAAC,QAAQ,OAAO,SAAS,SAAU;AACvC,UAAM,MAAM;AAEZ,QAAI,IAAI,yBAAyB,KAAM;AAEvC,UAAM,SAAS,IAAI;AACnB,QAAI,UAAU,OAAO,UAAU,WAAY;AAE3C,UAAM,KAAK,IAAI;AACf,QAAI,OAAO,OAAO,YAAY,CAAC,GAAI;AAEnC,UAAM,OAAO,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO;AACvD,UAAM,SAAS,OAAO,IAAI,WAAW,WAAW,IAAI,SAAS;AAE7D,UAAM,eAAe,IAAI;AACzB,UAAM,WAAW,cAAc;AAC/B,UAAM,iBAAiB,UAAU,WAAW;AAC5C,UAAM,oBAAoB,UAAU,eAAe;AAEnD,UAAM,eAAe,IAAI;AACzB,UAAM,qBAAqB,MAAM,QAAQ,YAAY,IACjD,aAAa,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,IAC7D,CAAC;AACL,UAAM,oBAAoB,mBAAmB,SAAS,cAAc;AAEpE,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAEO,MAAM,6BAAqD;AAAA,EAChE,IAAI;AAAA,EACJ,MAAM;AAAA,EAEN,MAAM,MAAM,WAA2D;AACrE,WAAO,mBAAmB;AAAA,MACxB,QAAQ,CAAC,KAAK,iBAAiB,UAAU,OAAO,EAAE,KAAK,aAAa,CAAC;AAAA,MACrE,UAAU,UAAU;AAAA,MACpB,YAAY,UAAU;AAAA,MACtB,QAAQ,UAAU;AAAA,IACpB,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,aAAa,aAA0D;AAC3E,UAAM,QAAQ;AACd,WAAO,0BAA0B,MAAM,SAAS,MAAM,aAAa;AAAA,EACrE;AAAA,EAEA,UAAU,aAAuC;AAC/C,WAAO,YAAY;AAAA,EACrB;AACF;","names":[]}

package/dist/auth/providers/openai-codex.d.ts

@@ -0,0 +1,95 @@
+/**
+ * OpenAI Codex (ChatGPT OAuth) flow
+ *
+ * Inspired by pi-mono's OAuth implementation:
+ * https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/openai-codex.ts
+ *
+ * NOTE: This module uses Node.js crypto and http for the OAuth callback.
+ * It is only intended for CLI use, not browser environments.
+ */
+import type { AuthMode, OAuthCredentials, OAuthPrompt, OAuthProviderInterface } from '../types.js';
+export declare const OPENAI_CODEX_AUTH_MODES: ReadonlyArray<AuthMode>;
+declare const JWT_CLAIM_PATH = "https://api.openai.com/auth";
+type JwtPayload = {
+    chatgpt_account_id?: string;
+    [JWT_CLAIM_PATH]?: {
+        chatgpt_account_id?: string;
+    };
+    [key: string]: unknown;
+};
+declare function decodeJwt(token: string): JwtPayload | null;
+declare function extractAccountIdFromClaims(payload: JwtPayload | null | undefined): string | null;
+declare function getAccountId(tokens: {
+    idToken?: string;
+    access: string;
+}, fallback?: string): string | undefined;
+declare function requireAccountId(tokens: {
+    idToken?: string;
+    access: string;
+}, fallback?: string): string;
+declare function createAuthorizationFlow(redirectUri: string, state: string, originator?: string): Promise<{
+    verifier: string;
+    url: string;
+}>;
+type OAuthServerInfo = {
+    redirectUri: string;
+    warning?: string;
+    close: () => void;
+    cancelWait: () => void;
+    waitForCode: () => Promise<{
+        code: string;
+    } | null>;
+};
+type CallbackPorts = {
+    defaultPort: number;
+    fallbackPort: number;
+};
+declare function startLocalOAuthServer(state: string, ports?: CallbackPorts): Promise<OAuthServerInfo>;
+declare function loginOpenAICodexDevice(options: {
+    onAuth: (info: {
+        url: string;
+        instructions?: string;
+    }) => void;
+    onProgress?: (message: string) => void;
+    signal?: AbortSignal;
+    sleep?: (ms: number) => Promise<void>;
+}): Promise<OAuthCredentials>;
+/**
+ * Login with OpenAI Codex OAuth
+ *
+ * @param options.onAuth - Called with URL and instructions when auth starts
+ * @param options.onPrompt - Called to prompt user for manual code paste (fallback if no onManualCodeInput)
+ * @param options.onProgress - Optional progress messages
+ * @param options.onManualCodeInput - Optional promise that resolves with user-pasted code.
+ *                                    Races with browser callback - whichever completes first wins.
+ *                                    Useful for showing paste input immediately alongside browser flow.
+ * @param options.originator - OAuth originator parameter (defaults to "mastracode")
+ */
+export declare function loginOpenAICodex(options: {
+    onAuth: (info: {
+        url: string;
+        instructions?: string;
+    }) => void;
+    onPrompt: (prompt: OAuthPrompt) => Promise<string>;
+    onProgress?: (message: string) => void;
+    onManualCodeInput?: () => Promise<string>;
+    signal?: AbortSignal;
+    originator?: string;
+    mode?: 'browser' | 'device';
+}): Promise<OAuthCredentials>;
+export declare const __testing: {
+    createAuthorizationFlow: typeof createAuthorizationFlow;
+    decodeJwt: typeof decodeJwt;
+    extractAccountIdFromClaims: typeof extractAccountIdFromClaims;
+    getAccountId: typeof getAccountId;
+    loginOpenAICodexDevice: typeof loginOpenAICodexDevice;
+    requireAccountId: typeof requireAccountId;
+    startLocalOAuthServer: typeof startLocalOAuthServer;
+};
+/**
+ * Refresh OpenAI Codex OAuth token
+ */
+export declare function refreshOpenAICodexToken(refreshToken: string, previousAccountId?: string): Promise<OAuthCredentials>;
+export declare const openaiCodexOAuthProvider: OAuthProviderInterface;
+export {};
+//# sourceMappingURL=openai-codex.d.ts.map

package/dist/auth/providers/openai-codex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai-codex.d.ts","sourceRoot":"","sources":["../../../src/auth/providers/openai-codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA4BH,OAAO,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAuB,WAAW,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAExH,eAAO,MAAM,uBAAuB,EAAE,aAAa,CAAC,QAAQ,CAW3D,CAAC;AAeF,QAAA,MAAM,cAAc,gCAAgC,CAAC;AAwBrD,KAAK,UAAU,GAAG;IAChB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,CAAC,cAAc,CAAC,CAAC,EAAE;QACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAwCF,iBAAS,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAcnD;AAED,iBAAS,0BAA0B,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAIzF;AAED,iBAAS,YAAY,CAAC,MAAM,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQzG;AAED,iBAAS,gBAAgB,CAAC,MAAM,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAMjG;AAiFD,iBAAe,uBAAuB,CACpC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,UAAU,GAAE,MAAqB,GAChC,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAgB5C;AAED,KAAK,eAAe,GAAG;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,UAAU,EAAE,MAAM,IAAI,CAAC;IACvB,WAAW,EAAE,MAAM,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CACrD,CAAC;AAEF,KAAK,aAAa,GAAG;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAkDF,iBAAe,qBAAqB,CAClC,KAAK,EAAE,MAAM,EACb,KAAK,GAAE,aAAoC,GAC1C,OAAO,CAAC,eAAe,CAAC,CA4E1B;AAED,iBAAe,sBAAsB,CAAC,OAAO,EAAE;IAC7C,MAAM,EAAE,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/D,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgG5B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,MAAM,EAAE,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/D,QAAQ,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;CAC7B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA0H5B;AAED,eAAO,MAAM,SAAS;;;;;;;;CAQrB,CAAC;AAEF;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,MAAM,EACpB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,gBAAgB,CAAC,CAc3B;AAED,eAAO,MAAM,wBAAwB,EAAE,sBAyBtC,CAAC"}