@melaya/runner 1.1.27 → 1.1.29

package/dist/assistantHost.py

@@ -889,7 +889,32 @@ def _register_stream_hooks(agent) -> None:
     _log(f"stream hooks registered (delta={ok_a} tool={ok_b})")
 
 
-def _run_turn(agent, turn_id: str, message: str, browser_turn: bool = False) -> None:
+def _build_user_msg(message: str, images=None):
+    """Build the user Msg. With images (base64 blocks from the turn frame) and a
+    vision-capable model, this is a multimodal Msg ([text?] + image blocks in the
+    Anthropic-style `source.base64` shape agentscope formats per provider). Any
+    problem building the blocks falls back to a plain text Msg so a turn NEVER
+    breaks on a text-only model / older agentscope."""
+    from agentscope.message import Msg
+    if not images:
+        return Msg("user", message, "user")
+    try:
+        blocks = []
+        if message:
+            blocks.append({"type": "text", "text": message})
+        for im in images:
+            data = str((im or {}).get("data") or "")
+            mt = str((im or {}).get("media_type") or "")
+            if data and mt:
+                blocks.append({"type": "image", "source": {"type": "base64", "media_type": mt, "data": data}})
+        if len(blocks) > (1 if message else 0):
+            return Msg("user", blocks, "user")
+    except Exception:
+        pass
+    return Msg("user", message, "user")
+
+
+def _run_turn(agent, turn_id: str, message: str, browser_turn: bool = False, images=None) -> None:
     import asyncio
     from agentscope.message import Msg
 
@@ -916,7 +941,7 @@ def _run_turn(agent, turn_id: str, message: str, browser_turn: bool = False) ->
     # unwinds the agent loop wherever it is awaiting — including mid phone-command
     # HTTP wait — so the run stops promptly instead of finishing the step first.
     async def _go():
-        task = asyncio.ensure_future(agent(Msg("user", message, "user")))
+        task = asyncio.ensure_future(agent(_build_user_msg(message, images)))
         while not task.done():
             if _stream.get("cancel"):
                 task.cancel()
@@ -1108,6 +1133,10 @@ def main() -> int:
             continue
         turn_id = str(req.get("turnId") or "")
         message = str(req.get("message") or "")
+        # Vision: base64 image blocks for THIS turn (validated server-side). Used
+        # to build a multimodal Msg when the model supports it; text-only otherwise.
+        _images = req.get("images")
+        images = _images if isinstance(_images, list) and _images else None
         # Per-turn autonomy mode: the TS side carries an updated `hitl_mode`
         # on runner:assistant_turn so a mid-session flip takes effect next
         # turn. Absent ⇒ keep the current (spawn / previous-turn) mode. The
@@ -1123,7 +1152,7 @@ def main() -> int:
         # instructions into the system prompt before running the turn (parity with
         # the cloud path; handles set / edit / clear mid-conversation).
         _apply_static_context(agent, base_sys_prompt, req.get("static_context"))
-        if not message:
+        if not message and not images:
             _emit(turn_id, "done")
             continue
         # P2-6: nudge the live memory budget down if a prior turn's OOM downgraded
@@ -1135,7 +1164,7 @@ def main() -> int:
         # ever survives in the warm host environment.
         browser_turn = _apply_browser_turn_grant(req)
         try:
-            _run_turn(agent, turn_id, message, browser_turn=browser_turn)
+            _run_turn(agent, turn_id, message, browser_turn=browser_turn, images=images)
         finally:
             _purge_browser_turn_grant()
         _emit_usage(agent, turn_id)

package/dist/cli.js

@@ -17,14 +17,6 @@ import { Command } from "commander";
 import chalk from "chalk";
 import { connect } from "./connection.js";
 import { detectModels } from "./detect.js";
-const program = new Command()
-    .name("melaya-runner")
-    .description("Run Melaya AI pipelines locally with your own models")
-    .requiredOption("--token <token>", "Runner token from the Melaya platform")
-    .option("--server <url>", "Server URL", "wss://api.melaya.org")
-    .option("--verbose", "Show detailed logs", false)
-    .parse(process.argv);
-const opts = program.opts();
 // Logo colors: cyan → blue → indigo gradient (matching melaya.org)
 const c1 = chalk.hex("#22D3EE").bold;
 const c2 = chalk.hex("#10B0F0").bold;
@@ -40,7 +32,7 @@ import { dirname, join } from "path";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const { version } = JSON.parse(readFileSync(join(__dirname, "..", "package.json"), "utf-8"));
 const BANNER = `
-  ${c1("███╗   ███╗")} ${c2("███████╗")} ${c3("██╗")}      ${c4("█████╗")}  ${c5("██╗   ██╗")} ${c6("█████╗")}
+  ${c1("███╗   ███╗")} ${c2("███████╗")} ${c3("██╗")}       ${c4("█████╗")}  ${c5("██╗   ██╗")}  ${c6("█████╗")}
   ${c1("████╗ ████║")} ${c2("██╔════╝")} ${c3("██║")}      ${c4("██╔══██╗")} ${c5("╚██╗ ██╔╝")} ${c6("██╔══██╗")}
   ${c1("██╔████╔██║")} ${c2("█████╗")}   ${c3("██║")}      ${c4("███████║")}  ${c5("╚████╔╝")}  ${c6("███████║")}
   ${c1("██║╚██╔╝██║")} ${c2("██╔══╝")}   ${c3("██║")}      ${c4("██╔══██║")}   ${c5("╚██╔╝")}   ${c6("██╔══██║")}
@@ -51,6 +43,14 @@ const BANNER = `
   ${br("─────────────────────────────────────────────────────")}
 `;
 async function main() {
+    const program = new Command()
+        .name("melaya-runner")
+        .description("Run Melaya AI pipelines locally with your own models")
+        .requiredOption("--token <token>", "Runner token from the Melaya platform")
+        .option("--server <url>", "Server URL", "wss://api.melaya.org")
+        .option("--verbose", "Show detailed logs", false)
+        .parse(process.argv);
+    const opts = program.opts();
     console.log(BANNER);
     // Detect Python
     const python = await findPython();
@@ -63,8 +63,8 @@ async function main() {
     // Detect local models
     const models = await detectModels();
     if (models.length === 0) {
-        console.log(chalk.yellow("  ⚠ No local models detected (LM Studio / Ollama not running, Claude Code not logged in)"));
-        console.log(chalk.gray("    Start LM Studio or Ollama (or log in to Claude Code), then restart the runner"));
+        console.log(chalk.yellow("  ⚠ No local models detected (LM Studio / Ollama not running; Claude Code / Codex / GitHub Copilot not logged in)"));
+        console.log(chalk.gray("    Start LM Studio or Ollama, log in to Claude Code / Codex, or run `melaya-runner copilot login`, then restart the runner"));
     }
     else {
         for (const m of models) {
@@ -93,7 +93,17 @@ async function findPython() {
     }
     return null;
 }
-main().catch((e) => {
+// `melaya-runner copilot login` — GitHub Copilot device-flow sign-in, cached
+// locally. Handled before the runner arg-parse so it needs no --token.
+async function bootstrap() {
+    if (process.argv[2] === "copilot") {
+        const { copilotLogin } = await import("./copilotLogin.js");
+        await copilotLogin();
+        return;
+    }
+    await main();
+}
+bootstrap().catch((e) => {
     console.error(chalk.red(`\n  Fatal: ${e.message}\n`));
     process.exit(1);
 });

package/dist/copilotLogin.d.ts

@@ -0,0 +1 @@
+export declare function copilotLogin(): Promise<void>;

package/dist/copilotLogin.js

@@ -0,0 +1,90 @@
+/**
+ * GitHub Copilot device-flow login for the runner.
+ *
+ * github_copilot is a runner CLI provider (like claude_code/codex): the runtime
+ * reads a GitHub OAuth token from disk on THIS machine. The standalone
+ * `@github/copilot` CLI stores its token via MSAL (encrypted, unreadable), so
+ * for users who don't already have a readable token (editor plugin apps.json /
+ * gh), this command runs GitHub's device flow ONCE and caches the durable
+ * `gho_` token at ~/.melaya-runner/github_copilot.json — the same file the
+ * runtime (model.py::_read_github_copilot_token) and detect.ts read.
+ *
+ * Nothing here touches the Melaya cloud: the token is minted against GitHub and
+ * stored locally. Run: `npx @melaya/runner copilot login`.
+ */
+import { writeFile, mkdir } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+import chalk from "chalk";
+const CLIENT_ID = "Iv1.b507a08c87ecfe98"; // the well-known Copilot (copilot.vim) device-flow client id
+const UA = "GithubCopilot/1.155.0";
+export async function copilotLogin() {
+    console.log(chalk.cyan("\n  GitHub Copilot — device sign-in\n"));
+    // 1) Request a device code.
+    const startRes = await fetch("https://github.com/login/device/code", {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json", "User-Agent": UA },
+        body: new URLSearchParams({ client_id: CLIENT_ID, scope: "read:user" }),
+    });
+    if (!startRes.ok) {
+        console.log(chalk.red(`  ✗ Could not start GitHub device flow (HTTP ${startRes.status}).`));
+        process.exit(1);
+    }
+    const dev = (await startRes.json());
+    const interval = Math.max(1, Number(dev.interval) || 5);
+    const deadline = Date.now() + Math.max(60, Number(dev.expires_in) || 900) * 1000;
+    console.log(`  1. Open:  ${chalk.underline(dev.verification_uri || "https://github.com/login/device")}`);
+    console.log(`  2. Enter: ${chalk.bold.yellow(dev.user_code)}`);
+    console.log(chalk.gray("\n  Waiting for you to authorize…\n"));
+    // 2) Poll for the token.
+    let token = "";
+    while (Date.now() < deadline) {
+        await new Promise((r) => setTimeout(r, interval * 1000));
+        const pollRes = await fetch("https://github.com/login/oauth/access_token", {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json", "User-Agent": UA },
+            body: new URLSearchParams({
+                client_id: CLIENT_ID,
+                device_code: dev.device_code,
+                grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+            }),
+        });
+        const data = (await pollRes.json().catch(() => ({})));
+        if (data.access_token) {
+            token = data.access_token;
+            break;
+        }
+        if (data.error && data.error !== "authorization_pending" && data.error !== "slow_down") {
+            console.log(chalk.red(`  ✗ ${data.error === "expired_token" ? "The code expired — run the command again." : data.error === "access_denied" ? "Sign-in was denied." : `Sign-in failed (${data.error}).`}`));
+            process.exit(1);
+        }
+    }
+    if (!token) {
+        console.log(chalk.red("  ✗ Timed out waiting for authorization. Run the command again."));
+        process.exit(1);
+    }
+    // 3) Confirm the token actually has a Copilot seat (exchange), then cache it.
+    let login = "";
+    try {
+        const ex = await fetch("https://api.github.com/copilot_internal/v2/token", {
+            headers: { Authorization: `token ${token}`, "User-Agent": UA, "Editor-Version": "vscode/1.95.0", "Editor-Plugin-Version": "copilot-chat/0.22.0" },
+        });
+        if (!ex.ok) {
+            console.log(chalk.red(`  ✗ Signed in, but this GitHub account has no active Copilot subscription (HTTP ${ex.status}).`));
+            process.exit(1);
+        }
+    }
+    catch { /* transient — still cache; the runtime re-exchanges */ }
+    try {
+        const who = await fetch("https://api.github.com/user", { headers: { Authorization: `token ${token}`, "User-Agent": UA, Accept: "application/vnd.github+json" } });
+        if (who.ok)
+            login = String((await who.json()).login || "");
+    }
+    catch { /* optional */ }
+    const dir = join(homedir(), ".melaya-runner");
+    await mkdir(dir, { recursive: true });
+    const file = join(dir, "github_copilot.json");
+    await writeFile(file, JSON.stringify({ oauth_token: token, user: login, host: "github.com" }, null, 2), { mode: 0o600 });
+    console.log(chalk.green(`\n  ✓ GitHub Copilot connected${login ? ` as ${login}` : ""}.`));
+    console.log(chalk.gray(`    Token cached at ${file} (this machine only). Restart the runner to pick it up.\n`));
+}

package/dist/detect.d.ts

@@ -1,5 +1,5 @@
 export interface DetectedModel {
-    provider: "lmstudio" | "ollama" | "claude_code" | "codex";
+    provider: "lmstudio" | "ollama" | "claude_code" | "codex" | "github_copilot";
     name: string;
 }
 export declare function detectModels(): Promise<DetectedModel[]>;

package/dist/detect.js

@@ -8,6 +8,9 @@ import { readFile } from "fs/promises";
 import { homedir } from "os";
 import { join } from "path";
 const execFileAsync = promisify(execFile);
+// Fallback ONLY when the live /models fetch fails. Must be ENABLED-by-default
+// Copilot models (policy!=disabled) — Claude/Gemini default to disabled and 400.
+const COPILOT_MODELS_FALLBACK = ["gpt-4.1", "gpt-4o", "gpt-5-mini"];
 /** Fallbacks used ONLY when live discovery fails (offline runner, transient
  *  error, missing cache). The REAL lists are fetched dynamically below so a new
  *  claude/codex release is available on Melaya automatically — no code change,
@@ -136,6 +139,101 @@ async function detectCodex() {
     catch { /* malformed creds → treat as logged out */ }
     return []; // not logged in → don't advertise models
 }
+/** Read the user's GitHub OAuth token for Copilot from a readable source on
+ *  THIS machine, in priority order. The standalone `@github/copilot` CLI stores
+ *  its token via MSAL (encrypted, unreadable), so we read the editor-plugin
+ *  token, the gh CLI token, or a token cached by the runner's own device-flow
+ *  login (`melaya-runner copilot login` → ~/.melaya-runner/github_copilot.json).
+ *  Mirrors model.py::_read_github_copilot_token — keep the source list in sync. */
+async function readGithubCopilotToken() {
+    // 1) Editor plugins (copilot.vim / JetBrains / Neovim): plaintext oauth_token.
+    for (const rel of [
+        join(homedir(), ".config", "github-copilot", "apps.json"),
+        join(homedir(), ".config", "github-copilot", "hosts.json"),
+    ]) {
+        try {
+            const j = JSON.parse(await readFile(rel, "utf8"));
+            for (const v of Object.values(j)) {
+                if (v?.oauth_token)
+                    return v.oauth_token;
+            }
+        }
+        catch { /* absent → next source */ }
+    }
+    // 2) Runner-cached token from our own device-flow login.
+    try {
+        const j = JSON.parse(await readFile(join(homedir(), ".melaya-runner", "github_copilot.json"), "utf8"));
+        if (j?.oauth_token)
+            return j.oauth_token;
+    }
+    catch { /* not logged in via runner */ }
+    // 3) gh CLI env token (broad-scope PAT/OAuth; works for the exchange).
+    if (process.env.GH_TOKEN)
+        return process.env.GH_TOKEN;
+    if (process.env.GITHUB_TOKEN)
+        return process.env.GITHUB_TOKEN;
+    return "";
+}
+/** GitHub Copilot as a runner CLI provider: when a readable GitHub OAuth token
+ *  is present on THIS machine, exchange it for a short-lived Copilot token and
+ *  list the models the subscription serves, so the picker shows TRUE local
+ *  availability (copilot pipelines execute HERE, same as claude_code/codex). */
+async function detectGithubCopilot() {
+    const gh = await readGithubCopilotToken();
+    if (!gh)
+        return [];
+    try {
+        const ex = await fetch("https://api.github.com/copilot_internal/v2/token", {
+            headers: {
+                Authorization: `token ${gh}`,
+                "User-Agent": "GithubCopilot/1.155.0",
+                "Editor-Version": "vscode/1.95.0",
+                "Editor-Plugin-Version": "copilot-chat/0.22.0",
+            },
+            signal: AbortSignal.timeout(6000),
+        });
+        if (!ex.ok)
+            return []; // no Copilot seat / revoked → don't advertise
+        const exd = (await ex.json());
+        if (!exd.token)
+            return [];
+        const base = (exd.endpoints?.api || "https://api.githubcopilot.com").replace(/\/+$/, "");
+        try {
+            const r = await fetch(`${base}/models`, {
+                headers: {
+                    Authorization: `Bearer ${exd.token}`,
+                    "Copilot-Integration-Id": "vscode-chat",
+                    "Editor-Version": "vscode/1.95.0",
+                    "Editor-Plugin-Version": "copilot-chat/0.22.0",
+                },
+                signal: AbortSignal.timeout(6000),
+            });
+            if (r.ok) {
+                const d = (await r.json());
+                // Keep ONLY real chat models the agent runtime can DRIVE + CALL:
+                //  - tool calling required (agent loop),
+                //  - `policy.state !== "disabled"` — Copilot's /models over-reports:
+                //    Gemini/Claude/kimi/gpt-5.4-5.6 default to policy=disabled and a
+                //    chat/completions call to one 400s `model_not_supported` until the
+                //    user enables it at github.com/settings/copilot/features. `enabled`
+                //    and absent-policy (base gpt-4o/4.1) are callable. Enabling a model
+                //    there flips it to `enabled` and it auto-appears on the next detect.
+                //  - drop Copilot-internal routing/search/compaction/embedding ids.
+                const ids = (d.data ?? [])
+                    .filter((m) => m?.capabilities?.type === "chat" && m?.capabilities?.supports?.tool_calls === true)
+                    .filter((m) => (m?.policy?.state ?? "enabled") !== "disabled")
+                    .map((m) => m?.id ?? "")
+                    .filter((s) => s && !/^copilot-search|^exec-agent|^trajectory-compaction|-free-auto$|-flash-(picker|secondary|tertiary)$|embedding/i.test(s));
+                if (ids.length)
+                    return ids.map((name) => ({ provider: "github_copilot", name }));
+            }
+        }
+        catch { /* models list failed → fallback below */ }
+        return COPILOT_MODELS_FALLBACK.map((name) => ({ provider: "github_copilot", name }));
+    }
+    catch { /* offline / transient → not advertised */ }
+    return [];
+}
 export async function detectModels() {
     const models = [];
     // LM Studio — OpenAI-compatible at :1234
@@ -164,5 +262,7 @@ export async function detectModels() {
     models.push(...await detectClaudeCode());
     // OpenAI Codex CLI — subscription auth on THIS machine
     models.push(...await detectCodex());
+    // GitHub Copilot — GitHub OAuth token readable on THIS machine
+    models.push(...await detectGithubCopilot());
     return models;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@melaya/runner",
-  "version": "1.1.27",
+  "version": "1.1.29",
   "description": "Run Melaya AI pipelines locally with your own LM Studio or Ollama models",
   "license": "UNLICENSED",
   "private": false,