@melaya/runner 1.1.26 → 1.1.28

package/dist/assistantHost.py

@@ -426,6 +426,39 @@ def _log(msg: str) -> None:
         pass
 
 
+# Failures the user can act on, told apart from the ones only we can. The runner
+# already writes a full traceback to stderr; this builds the ONE line that reaches
+# the panel, so it has to carry the exception type when the message is empty and
+# stay readable when it is not.
+_FRIENDLY_TURN_ERRORS = (
+    ("timeout", "The model did not respond in time. Try again, or pick a different model."),
+    ("timed out", "The model did not respond in time. Try again, or pick a different model."),
+    ("connection", "Could not reach the model provider from this machine. Check the network and try again."),
+    ("resolve", "Could not reach the model provider from this machine. Check the network and try again."),
+    ("refused", "The model provider refused the connection from this machine."),
+    ("ssl", "The connection to the model provider could not be secured on this machine."),
+)
+
+
+def _turn_error_message(exc: BaseException) -> str:
+    """One line for the panel. Falls back to the exception TYPE, never to nothing."""
+    raw = str(exc).strip()
+    name = type(exc).__name__
+    probe = (raw or name).lower()
+    for needle, friendly in _FRIENDLY_TURN_ERRORS:
+        if needle in probe:
+            detail = ": " + raw[:200] if raw else ""
+            return friendly + " (" + name + detail + ")"
+    if raw:
+        return raw[:500]
+    # Empty message: the type is all there is, and it is genuinely useful -
+    # TimeoutError and ConnectionResetError point at different fixes.
+    return (
+        "The assistant turn failed with " + name + " and no further detail. "
+        "The full traceback is in the runner log."
+    )
+
+
 def _extract_text(result) -> str:
     """Pull the final assistant text out of an agentscope reply Msg."""
     if result is None:
@@ -907,7 +940,14 @@ def _run_turn(agent, turn_id: str, message: str, browser_turn: bool = False) ->
     except Exception as exc:
         _log("turn error:\n" + traceback.format_exc())
         _stream["turnId"] = ""
-        _emit(turn_id, "error", message=str(exc) or "assistant turn failed")
+        # NEVER surface a bare "assistant turn failed". That fallback fired only
+        # when str(exc) was EMPTY - exactly the case where the exception TYPE is
+        # the sole remaining clue, and it was being discarded. Several of the
+        # likeliest failures here stringify to nothing at all (asyncio.TimeoutError,
+        # httpx.ReadTimeout, ConnectionResetError), so the panel showed a message
+        # that named neither what broke nor where. Reported 2026-09-03: two turns
+        # in a row with no cause anywhere on screen.
+        _emit(turn_id, "error", message=_turn_error_message(exc))
         _emit(turn_id, "done")
         return
 
@@ -921,7 +961,10 @@ def _run_turn(agent, turn_id: str, message: str, browser_turn: bool = False) ->
     if result is _WALLCLOCK:
         _stream["turnId"] = ""
         _log("browser turn wall-clock budget exceeded")
-        _emit(turn_id, "error", message="browser_turn_wallclock_exceeded")
+        _emit(turn_id, "error", message=(
+            "This browser task ran past its time budget and was stopped. "
+            "Ask again with a narrower step, or split it into two."
+        ))
         _emit(turn_id, "done")
         return
 
@@ -988,7 +1031,7 @@ def main() -> int:
         agent = _build_agent()
     except Exception as exc:
         _log("boot failed:\n" + traceback.format_exc())
-        _emit("", "error", message=f"assistant host failed to start: {exc}")
+        _emit("", "error", message="The assistant could not start on this runner. " + _turn_error_message(exc))
         return 1
     # Capture the freshly-built BASE system prompt (before any static context is
     # folded in) so each turn can deterministically rebuild base + persona.

package/dist/cli.js

@@ -17,14 +17,6 @@ import { Command } from "commander";
 import chalk from "chalk";
 import { connect } from "./connection.js";
 import { detectModels } from "./detect.js";
-const program = new Command()
-    .name("melaya-runner")
-    .description("Run Melaya AI pipelines locally with your own models")
-    .requiredOption("--token <token>", "Runner token from the Melaya platform")
-    .option("--server <url>", "Server URL", "wss://api.melaya.org")
-    .option("--verbose", "Show detailed logs", false)
-    .parse(process.argv);
-const opts = program.opts();
 // Logo colors: cyan → blue → indigo gradient (matching melaya.org)
 const c1 = chalk.hex("#22D3EE").bold;
 const c2 = chalk.hex("#10B0F0").bold;
@@ -40,7 +32,7 @@ import { dirname, join } from "path";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const { version } = JSON.parse(readFileSync(join(__dirname, "..", "package.json"), "utf-8"));
 const BANNER = `
-  ${c1("███╗   ███╗")} ${c2("███████╗")} ${c3("██╗")}      ${c4("█████╗")}  ${c5("██╗   ██╗")} ${c6("█████╗")}
+  ${c1("███╗   ███╗")} ${c2("███████╗")} ${c3("██╗")}       ${c4("█████╗")}  ${c5("██╗   ██╗")}  ${c6("█████╗")}
   ${c1("████╗ ████║")} ${c2("██╔════╝")} ${c3("██║")}      ${c4("██╔══██╗")} ${c5("╚██╗ ██╔╝")} ${c6("██╔══██╗")}
   ${c1("██╔████╔██║")} ${c2("█████╗")}   ${c3("██║")}      ${c4("███████║")}  ${c5("╚████╔╝")}  ${c6("███████║")}
   ${c1("██║╚██╔╝██║")} ${c2("██╔══╝")}   ${c3("██║")}      ${c4("██╔══██║")}   ${c5("╚██╔╝")}   ${c6("██╔══██║")}
@@ -51,6 +43,14 @@ const BANNER = `
   ${br("─────────────────────────────────────────────────────")}
 `;
 async function main() {
+    const program = new Command()
+        .name("melaya-runner")
+        .description("Run Melaya AI pipelines locally with your own models")
+        .requiredOption("--token <token>", "Runner token from the Melaya platform")
+        .option("--server <url>", "Server URL", "wss://api.melaya.org")
+        .option("--verbose", "Show detailed logs", false)
+        .parse(process.argv);
+    const opts = program.opts();
     console.log(BANNER);
     // Detect Python
     const python = await findPython();
@@ -63,8 +63,8 @@ async function main() {
     // Detect local models
     const models = await detectModels();
     if (models.length === 0) {
-        console.log(chalk.yellow("  ⚠ No local models detected (LM Studio / Ollama not running, Claude Code not logged in)"));
-        console.log(chalk.gray("    Start LM Studio or Ollama (or log in to Claude Code), then restart the runner"));
+        console.log(chalk.yellow("  ⚠ No local models detected (LM Studio / Ollama not running; Claude Code / Codex / GitHub Copilot not logged in)"));
+        console.log(chalk.gray("    Start LM Studio or Ollama, log in to Claude Code / Codex, or run `melaya-runner copilot login`, then restart the runner"));
     }
     else {
         for (const m of models) {
@@ -93,7 +93,17 @@ async function findPython() {
     }
     return null;
 }
-main().catch((e) => {
+// `melaya-runner copilot login` — GitHub Copilot device-flow sign-in, cached
+// locally. Handled before the runner arg-parse so it needs no --token.
+async function bootstrap() {
+    if (process.argv[2] === "copilot") {
+        const { copilotLogin } = await import("./copilotLogin.js");
+        await copilotLogin();
+        return;
+    }
+    await main();
+}
+bootstrap().catch((e) => {
     console.error(chalk.red(`\n  Fatal: ${e.message}\n`));
     process.exit(1);
 });

package/dist/connection.js

@@ -1478,7 +1478,7 @@ export async function connect(opts) {
     socket.on("runner:assistant_turn", async (payload) => {
         const s = activeAssistants.get(String(payload.sessionId || ""));
         if (!s) {
-            socket.emit("runner:assistant_event", { sessionId: payload.sessionId, turnId: payload.turnId, kind: "error", message: "session_not_found" });
+            socket.emit("runner:assistant_event", { sessionId: payload.sessionId, turnId: payload.turnId, kind: "error", message: "The assistant session on your runner is gone (it most likely restarted). Send the message again to start a fresh one." });
             return;
         }
         // Generation gate (defense-in-depth): refuse to serve a turn stamped with a
@@ -1487,7 +1487,7 @@ export async function connect(opts) {
         // triggers the server's clean re-boot path. Backward-compatible: a turn with
         // no generation (older server) is served as before.
         if (payload.generation != null && Number(payload.generation) !== s.generation) {
-            socket.emit("runner:assistant_event", { sessionId: payload.sessionId, turnId: payload.turnId, kind: "error", message: "session_not_found" });
+            socket.emit("runner:assistant_event", { sessionId: payload.sessionId, turnId: payload.turnId, kind: "error", message: "The assistant session on your runner is gone (it most likely restarted). Send the message again to start a fresh one." });
             return;
         }
         s.lastActivity = Date.now();

package/dist/copilotLogin.d.ts

@@ -0,0 +1 @@
+export declare function copilotLogin(): Promise<void>;

package/dist/copilotLogin.js

@@ -0,0 +1,90 @@
+/**
+ * GitHub Copilot device-flow login for the runner.
+ *
+ * github_copilot is a runner CLI provider (like claude_code/codex): the runtime
+ * reads a GitHub OAuth token from disk on THIS machine. The standalone
+ * `@github/copilot` CLI stores its token via MSAL (encrypted, unreadable), so
+ * for users who don't already have a readable token (editor plugin apps.json /
+ * gh), this command runs GitHub's device flow ONCE and caches the durable
+ * `gho_` token at ~/.melaya-runner/github_copilot.json — the same file the
+ * runtime (model.py::_read_github_copilot_token) and detect.ts read.
+ *
+ * Nothing here touches the Melaya cloud: the token is minted against GitHub and
+ * stored locally. Run: `npx @melaya/runner copilot login`.
+ */
+import { writeFile, mkdir } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+import chalk from "chalk";
+const CLIENT_ID = "Iv1.b507a08c87ecfe98"; // the well-known Copilot (copilot.vim) device-flow client id
+const UA = "GithubCopilot/1.155.0";
+export async function copilotLogin() {
+    console.log(chalk.cyan("\n  GitHub Copilot — device sign-in\n"));
+    // 1) Request a device code.
+    const startRes = await fetch("https://github.com/login/device/code", {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json", "User-Agent": UA },
+        body: new URLSearchParams({ client_id: CLIENT_ID, scope: "read:user" }),
+    });
+    if (!startRes.ok) {
+        console.log(chalk.red(`  ✗ Could not start GitHub device flow (HTTP ${startRes.status}).`));
+        process.exit(1);
+    }
+    const dev = (await startRes.json());
+    const interval = Math.max(1, Number(dev.interval) || 5);
+    const deadline = Date.now() + Math.max(60, Number(dev.expires_in) || 900) * 1000;
+    console.log(`  1. Open:  ${chalk.underline(dev.verification_uri || "https://github.com/login/device")}`);
+    console.log(`  2. Enter: ${chalk.bold.yellow(dev.user_code)}`);
+    console.log(chalk.gray("\n  Waiting for you to authorize…\n"));
+    // 2) Poll for the token.
+    let token = "";
+    while (Date.now() < deadline) {
+        await new Promise((r) => setTimeout(r, interval * 1000));
+        const pollRes = await fetch("https://github.com/login/oauth/access_token", {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json", "User-Agent": UA },
+            body: new URLSearchParams({
+                client_id: CLIENT_ID,
+                device_code: dev.device_code,
+                grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+            }),
+        });
+        const data = (await pollRes.json().catch(() => ({})));
+        if (data.access_token) {
+            token = data.access_token;
+            break;
+        }
+        if (data.error && data.error !== "authorization_pending" && data.error !== "slow_down") {
+            console.log(chalk.red(`  ✗ ${data.error === "expired_token" ? "The code expired — run the command again." : data.error === "access_denied" ? "Sign-in was denied." : `Sign-in failed (${data.error}).`}`));
+            process.exit(1);
+        }
+    }
+    if (!token) {
+        console.log(chalk.red("  ✗ Timed out waiting for authorization. Run the command again."));
+        process.exit(1);
+    }
+    // 3) Confirm the token actually has a Copilot seat (exchange), then cache it.
+    let login = "";
+    try {
+        const ex = await fetch("https://api.github.com/copilot_internal/v2/token", {
+            headers: { Authorization: `token ${token}`, "User-Agent": UA, "Editor-Version": "vscode/1.95.0", "Editor-Plugin-Version": "copilot-chat/0.22.0" },
+        });
+        if (!ex.ok) {
+            console.log(chalk.red(`  ✗ Signed in, but this GitHub account has no active Copilot subscription (HTTP ${ex.status}).`));
+            process.exit(1);
+        }
+    }
+    catch { /* transient — still cache; the runtime re-exchanges */ }
+    try {
+        const who = await fetch("https://api.github.com/user", { headers: { Authorization: `token ${token}`, "User-Agent": UA, Accept: "application/vnd.github+json" } });
+        if (who.ok)
+            login = String((await who.json()).login || "");
+    }
+    catch { /* optional */ }
+    const dir = join(homedir(), ".melaya-runner");
+    await mkdir(dir, { recursive: true });
+    const file = join(dir, "github_copilot.json");
+    await writeFile(file, JSON.stringify({ oauth_token: token, user: login, host: "github.com" }, null, 2), { mode: 0o600 });
+    console.log(chalk.green(`\n  ✓ GitHub Copilot connected${login ? ` as ${login}` : ""}.`));
+    console.log(chalk.gray(`    Token cached at ${file} (this machine only). Restart the runner to pick it up.\n`));
+}

package/dist/detect.d.ts

@@ -1,5 +1,5 @@
 export interface DetectedModel {
-    provider: "lmstudio" | "ollama" | "claude_code" | "codex";
+    provider: "lmstudio" | "ollama" | "claude_code" | "codex" | "github_copilot";
     name: string;
 }
 export declare function detectModels(): Promise<DetectedModel[]>;

package/dist/detect.js

@@ -8,6 +8,7 @@ import { readFile } from "fs/promises";
 import { homedir } from "os";
 import { join } from "path";
 const execFileAsync = promisify(execFile);
+const COPILOT_MODELS_FALLBACK = ["gpt-4o", "gpt-4.1", "o3-mini", "claude-3.5-sonnet", "gemini-2.0-flash"];
 /** Fallbacks used ONLY when live discovery fails (offline runner, transient
  *  error, missing cache). The REAL lists are fetched dynamically below so a new
  *  claude/codex release is available on Melaya automatically — no code change,
@@ -136,6 +137,94 @@ async function detectCodex() {
     catch { /* malformed creds → treat as logged out */ }
     return []; // not logged in → don't advertise models
 }
+/** Read the user's GitHub OAuth token for Copilot from a readable source on
+ *  THIS machine, in priority order. The standalone `@github/copilot` CLI stores
+ *  its token via MSAL (encrypted, unreadable), so we read the editor-plugin
+ *  token, the gh CLI token, or a token cached by the runner's own device-flow
+ *  login (`melaya-runner copilot login` → ~/.melaya-runner/github_copilot.json).
+ *  Mirrors model.py::_read_github_copilot_token — keep the source list in sync. */
+async function readGithubCopilotToken() {
+    // 1) Editor plugins (copilot.vim / JetBrains / Neovim): plaintext oauth_token.
+    for (const rel of [
+        join(homedir(), ".config", "github-copilot", "apps.json"),
+        join(homedir(), ".config", "github-copilot", "hosts.json"),
+    ]) {
+        try {
+            const j = JSON.parse(await readFile(rel, "utf8"));
+            for (const v of Object.values(j)) {
+                if (v?.oauth_token)
+                    return v.oauth_token;
+            }
+        }
+        catch { /* absent → next source */ }
+    }
+    // 2) Runner-cached token from our own device-flow login.
+    try {
+        const j = JSON.parse(await readFile(join(homedir(), ".melaya-runner", "github_copilot.json"), "utf8"));
+        if (j?.oauth_token)
+            return j.oauth_token;
+    }
+    catch { /* not logged in via runner */ }
+    // 3) gh CLI env token (broad-scope PAT/OAuth; works for the exchange).
+    if (process.env.GH_TOKEN)
+        return process.env.GH_TOKEN;
+    if (process.env.GITHUB_TOKEN)
+        return process.env.GITHUB_TOKEN;
+    return "";
+}
+/** GitHub Copilot as a runner CLI provider: when a readable GitHub OAuth token
+ *  is present on THIS machine, exchange it for a short-lived Copilot token and
+ *  list the models the subscription serves, so the picker shows TRUE local
+ *  availability (copilot pipelines execute HERE, same as claude_code/codex). */
+async function detectGithubCopilot() {
+    const gh = await readGithubCopilotToken();
+    if (!gh)
+        return [];
+    try {
+        const ex = await fetch("https://api.github.com/copilot_internal/v2/token", {
+            headers: {
+                Authorization: `token ${gh}`,
+                "User-Agent": "GithubCopilot/1.155.0",
+                "Editor-Version": "vscode/1.95.0",
+                "Editor-Plugin-Version": "copilot-chat/0.22.0",
+            },
+            signal: AbortSignal.timeout(6000),
+        });
+        if (!ex.ok)
+            return []; // no Copilot seat / revoked → don't advertise
+        const exd = (await ex.json());
+        if (!exd.token)
+            return [];
+        const base = (exd.endpoints?.api || "https://api.githubcopilot.com").replace(/\/+$/, "");
+        try {
+            const r = await fetch(`${base}/models`, {
+                headers: {
+                    Authorization: `Bearer ${exd.token}`,
+                    "Copilot-Integration-Id": "vscode-chat",
+                    "Editor-Version": "vscode/1.95.0",
+                    "Editor-Plugin-Version": "copilot-chat/0.22.0",
+                },
+                signal: AbortSignal.timeout(6000),
+            });
+            if (r.ok) {
+                const d = (await r.json());
+                // Keep ONLY real chat models the agent runtime can drive (tool calling
+                // is required), and drop Copilot-internal routing/search/compaction ids
+                // and embedding models that the /models list also advertises.
+                const ids = (d.data ?? [])
+                    .filter((m) => m?.capabilities?.type === "chat" && m?.capabilities?.supports?.tool_calls === true)
+                    .map((m) => m?.id ?? "")
+                    .filter((s) => s && !/^copilot-search|^exec-agent|^trajectory-compaction|-free-auto$|-flash-(picker|secondary|tertiary)$|embedding/i.test(s));
+                if (ids.length)
+                    return ids.map((name) => ({ provider: "github_copilot", name }));
+            }
+        }
+        catch { /* models list failed → fallback below */ }
+        return COPILOT_MODELS_FALLBACK.map((name) => ({ provider: "github_copilot", name }));
+    }
+    catch { /* offline / transient → not advertised */ }
+    return [];
+}
 export async function detectModels() {
     const models = [];
     // LM Studio — OpenAI-compatible at :1234
@@ -164,5 +253,7 @@ export async function detectModels() {
     models.push(...await detectClaudeCode());
     // OpenAI Codex CLI — subscription auth on THIS machine
     models.push(...await detectCodex());
+    // GitHub Copilot — GitHub OAuth token readable on THIS machine
+    models.push(...await detectGithubCopilot());
     return models;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@melaya/runner",
-  "version": "1.1.26",
+  "version": "1.1.28",
   "description": "Run Melaya AI pipelines locally with your own LM Studio or Ollama models",
   "license": "UNLICENSED",
   "private": false,