@mrciphersmith/keryx 0.2.100 → 0.2.102

package/dist/cli.js

@@ -298,6 +298,91 @@ var init_provider_config = __esm(() => {
   ];
 });
 
+// src/lib/oauth/catalog.ts
+function extraRequestHeaders(provider) {
+  if (provider === "github-copilot") {
+    return GITHUB_COPILOT_REQUEST_HEADERS;
+  }
+  return;
+}
+function authCatalogEntry(provider) {
+  return PROVIDER_AUTH_CATALOG.find((entry) => entry.provider === provider);
+}
+function catalogMethods(provider) {
+  return authCatalogEntry(provider)?.methods ?? ["api-key"];
+}
+function catalogAllows(provider, method) {
+  return catalogMethods(provider).includes(method);
+}
+function catalogRefusal(provider) {
+  return authCatalogEntry(provider)?.refusal;
+}
+function deviceCodeMethodLabel(provider) {
+  if (provider === "grok")
+    return "SuperGrok Subscription";
+  if (provider === "github-copilot")
+    return "Login with GitHub Copilot";
+  if (provider === "openai")
+    return "ChatGPT Plus/Pro (headless)";
+  return "Device authorization";
+}
+var XAI_GROK_DEVICE, GITHUB_COPILOT_REQUEST_HEADERS, GITHUB_COPILOT_OAUTH_CLIENT_ID = "Iv1.b507a08c87ecfe98", GITHUB_COPILOT_DEVICE, PROVIDER_AUTH_CATALOG;
+var init_catalog = __esm(() => {
+  XAI_GROK_DEVICE = {
+    deviceAuthorizationEndpoint: "https://auth.x.ai/oauth2/device/code",
+    tokenEndpoint: "https://auth.x.ai/oauth2/token",
+    clientId: "b1a00492-073a-47ea-816f-4c329264a828",
+    scope: "openid profile email offline_access grok-cli:access api:access",
+    extraForm: { referrer: "keryx" },
+    headers: { "User-Agent": "keryx" }
+  };
+  GITHUB_COPILOT_REQUEST_HEADERS = {
+    Accept: "application/json",
+    "User-Agent": "GitHubCopilotChat/0.26.7",
+    "Editor-Version": "vscode/1.99.3",
+    "Editor-Plugin-Version": "copilot-chat/0.26.7",
+    "Copilot-Integration-Id": "vscode-chat"
+  };
+  GITHUB_COPILOT_DEVICE = {
+    deviceAuthorizationEndpoint: "https://github.com/login/device/code",
+    tokenEndpoint: "https://github.com/login/oauth/access_token",
+    clientId: GITHUB_COPILOT_OAUTH_CLIENT_ID,
+    scope: "read:user",
+    headers: GITHUB_COPILOT_REQUEST_HEADERS,
+    afterToken: "github-copilot"
+  };
+  PROVIDER_AUTH_CATALOG = [
+    {
+      provider: "grok",
+      label: "xAI (Grok)",
+      methods: ["device-code", "api-key"],
+      device: XAI_GROK_DEVICE
+    },
+    {
+      provider: "openai",
+      label: "OpenAI",
+      methods: ["oauth-pkce-loopback", "device-code", "api-key"]
+    },
+    {
+      provider: "github-copilot",
+      label: "GitHub Copilot",
+      methods: ["device-code"],
+      device: GITHUB_COPILOT_DEVICE
+    },
+    { provider: "anthropic", label: "Anthropic", methods: ["api-key"], refusal: "Anthropic does not permit third-party Claude Pro/Max login. Use an API key from the Anthropic Console." },
+    { provider: "gemini", label: "Google Gemini", methods: ["api-key"], refusal: "Gemini Google-account login is for Gemini CLI. In keryx use GEMINI_API_KEY from Google AI Studio." },
+    { provider: "deepseek", label: "DeepSeek", methods: ["api-key"], refusal: "DeepSeek has no consumer OAuth grant. Use DEEPSEEK_API_KEY." },
+    { provider: "openrouter", label: "OpenRouter", methods: ["api-key"] },
+    { provider: "zai", label: "Z.AI (GLM)", methods: ["api-key"] },
+    { provider: "zai-coding", label: "Z.AI GLM Coding Plan", methods: ["api-key"] },
+    { provider: "cerebras", label: "Cerebras", methods: ["api-key"] },
+    { provider: "groq", label: "Groq", methods: ["api-key"] },
+    { provider: "moonshot", label: "Moonshot (Kimi)", methods: ["api-key"] },
+    { provider: "ollama", label: "Ollama", methods: ["none"] },
+    { provider: "rapid-mlx", label: "Rapid-MLX (Local)", methods: ["none"] }
+  ];
+});
+
 // src/lib/shell-config.ts
 import { existsSync as existsSync2 } from "fs";
 import path3 from "path";
@@ -641,8 +726,13 @@ async function fetchOpenAiCompatModelsDetailed(fetchFn, provider, apiKey, opts)
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
     const init = { signal: controller.signal };
+    const extraHeaders = extraRequestHeaders(provider.name);
+    const headers = extraHeaders === undefined ? {} : { ...extraHeaders };
     if (apiKey !== undefined && apiKey.length > 0) {
-      init.headers = { authorization: `Bearer ${apiKey}` };
+      headers.authorization = `Bearer ${apiKey}`;
+    }
+    if (Object.keys(headers).length > 0) {
+      init.headers = headers;
     }
     const res = await fetchFn(url, init);
     if (!res.ok) {
@@ -890,6 +980,7 @@ with a stated reason and exits 0 \u2014 that is a normal configuration, not an e
 var DEFAULT_MODELS_PATH = "/v1/models", OPENAI_COMPAT_PROVIDERS, MODELS_FETCH_TIMEOUT_MS = 1e4, MODELS_ERROR_BODY_LIMIT = 4096, BALANCE_FETCH_TIMEOUT_MS = 8000;
 var init_providers = __esm(() => {
   init_provider_config();
+  init_catalog();
   init_grants();
   init_shell_config();
   init_args();
@@ -998,6 +1089,8 @@ var init_providers = __esm(() => {
       label: "GitHub Copilot",
       baseUrl: "https://api.githubcopilot.com",
       envKey: "GITHUB_COPILOT_TOKEN",
+      chatPath: "/chat/completions",
+      modelsPath: "/models",
       models: ["gpt-4o", "gpt-4.1", "gpt-4o-mini"],
       note: "Copilot \xB7 device login"
     }
@@ -8310,6 +8403,7 @@ function makeProvider(name, _model, opts) {
     if (needsKey && (apiKey === undefined || apiKey.length === 0)) {
       return new FakeProvider([]);
     }
+    const extraHeaders = extraRequestHeaders(name);
     const grant = {
       network: true,
       ...compat.streamUsage === true ? { streamUsage: true } : {},
@@ -8317,7 +8411,8 @@ function makeProvider(name, _model, opts) {
       ...compat.allowLoopback === true ? { allowLoopback: true } : {},
       ...compat.allowPrivateLan === true ? { allowPrivateLan: true } : {},
       ...compat.chatPath !== undefined ? { chatPath: compat.chatPath } : {},
-      ...apiKey !== undefined ? { apiKey } : {}
+      ...apiKey !== undefined ? { apiKey } : {},
+      ...extraHeaders !== undefined ? { headers: extraHeaders } : {}
     };
     return new OpenAiCompatEngine({ fetch: opts.fetch, grant }, { ...OLLAMA_COMPAT_IDENTITY, providerLabel: compat.label });
   }
@@ -8326,6 +8421,7 @@ function makeProvider(name, _model, opts) {
 var OLLAMA_COMPAT_IDENTITY;
 var init_make_provider = __esm(() => {
   init_providers();
+  init_catalog();
   init_anthropic_provider();
   init_openai_compat_provider();
   init_fake_provider();
@@ -40876,78 +40972,6 @@ async function startStdioTransport(server) {
   await server.connect(transport);
 }
 
-// src/lib/oauth/catalog.ts
-function authCatalogEntry(provider) {
-  return PROVIDER_AUTH_CATALOG.find((entry) => entry.provider === provider);
-}
-function catalogMethods(provider) {
-  return authCatalogEntry(provider)?.methods ?? ["api-key"];
-}
-function catalogAllows(provider, method) {
-  return catalogMethods(provider).includes(method);
-}
-function catalogRefusal(provider) {
-  return authCatalogEntry(provider)?.refusal;
-}
-function deviceCodeMethodLabel(provider) {
-  if (provider === "grok")
-    return "SuperGrok Subscription";
-  if (provider === "github-copilot")
-    return "Login with GitHub Copilot";
-  if (provider === "openai")
-    return "ChatGPT Plus/Pro (headless)";
-  return "Device authorization";
-}
-var XAI_GROK_DEVICE, GITHUB_COPILOT_DEVICE, PROVIDER_AUTH_CATALOG;
-var init_catalog = __esm(() => {
-  XAI_GROK_DEVICE = {
-    deviceAuthorizationEndpoint: "https://auth.x.ai/oauth2/device/code",
-    tokenEndpoint: "https://auth.x.ai/oauth2/token",
-    clientId: "b1a00492-073a-47ea-816f-4c329264a828",
-    scope: "openid profile email offline_access grok-cli:access api:access",
-    extraForm: { referrer: "keryx" },
-    headers: { "User-Agent": "keryx" }
-  };
-  GITHUB_COPILOT_DEVICE = {
-    deviceAuthorizationEndpoint: "https://github.com/login/device/code",
-    tokenEndpoint: "https://github.com/login/oauth/access_token",
-    clientId: "Ov23li8tweQw6odWQebz",
-    scope: "read:user",
-    headers: { Accept: "application/json", "User-Agent": "keryx" },
-    afterToken: "github-copilot"
-  };
-  PROVIDER_AUTH_CATALOG = [
-    {
-      provider: "grok",
-      label: "xAI (Grok)",
-      methods: ["device-code", "api-key"],
-      device: XAI_GROK_DEVICE
-    },
-    {
-      provider: "openai",
-      label: "OpenAI",
-      methods: ["oauth-pkce-loopback", "device-code", "api-key"]
-    },
-    {
-      provider: "github-copilot",
-      label: "GitHub Copilot",
-      methods: ["device-code"],
-      device: GITHUB_COPILOT_DEVICE
-    },
-    { provider: "anthropic", label: "Anthropic", methods: ["api-key"], refusal: "Anthropic does not permit third-party Claude Pro/Max login. Use an API key from the Anthropic Console." },
-    { provider: "gemini", label: "Google Gemini", methods: ["api-key"], refusal: "Gemini Google-account login is for Gemini CLI. In keryx use GEMINI_API_KEY from Google AI Studio." },
-    { provider: "deepseek", label: "DeepSeek", methods: ["api-key"], refusal: "DeepSeek has no consumer OAuth grant. Use DEEPSEEK_API_KEY." },
-    { provider: "openrouter", label: "OpenRouter", methods: ["api-key"] },
-    { provider: "zai", label: "Z.AI (GLM)", methods: ["api-key"] },
-    { provider: "zai-coding", label: "Z.AI GLM Coding Plan", methods: ["api-key"] },
-    { provider: "cerebras", label: "Cerebras", methods: ["api-key"] },
-    { provider: "groq", label: "Groq", methods: ["api-key"] },
-    { provider: "moonshot", label: "Moonshot (Kimi)", methods: ["api-key"] },
-    { provider: "ollama", label: "Ollama", methods: ["none"] },
-    { provider: "rapid-mlx", label: "Rapid-MLX (Local)", methods: ["none"] }
-  ];
-});
-
 // src/lib/oauth/device-code.ts
 function requestInit(base, signal) {
   return signal === undefined ? base : { ...base, signal };
@@ -41115,38 +41139,94 @@ var init_device_code = __esm(() => {
 });
 
 // src/lib/oauth/copilot.ts
+function copilotApiBaseFromExchange(raw) {
+  if (typeof raw !== "string" || raw.length === 0) {
+    return;
+  }
+  try {
+    const url = new URL(raw);
+    if (url.protocol !== "https:" || url.username.length > 0 || url.password.length > 0) {
+      return;
+    }
+    const host = url.hostname;
+    if (host !== "api.githubcopilot.com" && !host.endsWith(".githubcopilot.com")) {
+      return;
+    }
+    return `https://${host}${url.port.length > 0 ? `:${url.port}` : ""}`;
+  } catch {
+    return;
+  }
+}
+function expiresInSecondsFrom(rec, now) {
+  if (typeof rec.expires_at === "string") {
+    const expires = Date.parse(rec.expires_at);
+    if (Number.isFinite(expires)) {
+      return Math.max(1, Math.floor((expires - now) / 1000));
+    }
+  }
+  if (typeof rec.expires_at === "number" && Number.isFinite(rec.expires_at)) {
+    const expiresMs = rec.expires_at < 1000000000000 ? rec.expires_at * 1000 : rec.expires_at;
+    return Math.max(1, Math.floor((expiresMs - now) / 1000));
+  }
+  if (typeof rec.refresh_in === "number" && Number.isFinite(rec.refresh_in) && rec.refresh_in > 0) {
+    return Math.floor(rec.refresh_in);
+  }
+  return;
+}
+function describeExchangeFailure(status, json, body) {
+  if (typeof json === "object" && json !== null) {
+    const rec = json;
+    if (rec.error_details?.copilot_access_denied === true) {
+      return `GitHub Copilot token exchange failed (HTTP ${status}): Copilot access denied \u2014 check the GitHub Copilot subscription on this account`;
+    }
+    if (typeof rec.message === "string" && rec.message.length > 0) {
+      return `GitHub Copilot token exchange failed (HTTP ${status}): ${rec.message}`;
+    }
+  }
+  if (/zscaler|blocked because it does not comply/i.test(body)) {
+    return `GitHub Copilot token exchange failed (HTTP ${status}): request was blocked by a gateway or proxy`;
+  }
+  return `GitHub Copilot token exchange failed (HTTP ${status})`;
+}
 async function exchangeGithubTokenForCopilot(githubToken, http) {
   const init = {
     method: "GET",
     headers: {
-      Authorization: `token ${githubToken}`,
-      Accept: "application/json",
-      "User-Agent": "keryx"
+      ...GITHUB_COPILOT_REQUEST_HEADERS,
+      Authorization: `token ${githubToken}`
     }
   };
   if (http.signal !== undefined) {
     init.signal = http.signal;
   }
   const response = await http.fetch(COPILOT_TOKEN_URL, init);
-  const json = await response.json().catch(() => ({}));
+  const body = await response.text().catch(() => "");
+  let json = {};
+  if (body.length > 0) {
+    try {
+      json = JSON.parse(body);
+    } catch {
+      json = {};
+    }
+  }
   if (!response.ok || typeof json !== "object" || json === null) {
-    throw new DeviceCodeError("failed", `GitHub Copilot token exchange failed (HTTP ${response.status})`);
+    throw new DeviceCodeError("failed", describeExchangeFailure(response.status, json, body));
   }
   const rec = json;
   if (typeof rec.token !== "string" || rec.token.length === 0) {
     throw new DeviceCodeError("failed", "GitHub Copilot token exchange returned no token");
   }
-  let expiresInSeconds;
-  if (typeof rec.expires_at === "string") {
-    const expires = Date.parse(rec.expires_at);
-    if (Number.isFinite(expires)) {
-      expiresInSeconds = Math.max(1, Math.floor((expires - Date.now()) / 1000));
-    }
-  }
-  return { accessToken: rec.token, ...expiresInSeconds !== undefined ? { expiresInSeconds } : {} };
+  const expiresInSeconds = expiresInSecondsFrom(rec, Date.now());
+  const apiBaseUrl = copilotApiBaseFromExchange(rec.endpoints?.api);
+  return {
+    accessToken: rec.token,
+    ...expiresInSeconds !== undefined ? { expiresInSeconds } : {},
+    ...apiBaseUrl !== undefined ? { apiBaseUrl } : {}
+  };
 }
 var COPILOT_TOKEN_URL = "https://api.github.com/copilot_internal/v2/token";
 var init_copilot = __esm(() => {
+  init_catalog();
   init_device_code();
 });
 
@@ -41266,6 +41346,9 @@ async function loginRfc8628(input) {
   }, http);
   if (endpoints.afterToken === "github-copilot") {
     const copilot = await exchangeGithubTokenForCopilot(tokens.accessToken, http);
+    if (copilot.apiBaseUrl !== undefined) {
+      saveProviderBaseUrl("github-copilot", copilot.apiBaseUrl, input.dir);
+    }
     return {
       accessToken: copilot.accessToken,
       refreshToken: tokens.accessToken,
@@ -41315,6 +41398,9 @@ async function refreshProviderGrant(provider, http, dir) {
   const endpoints = provider === "github-copilot" ? GITHUB_COPILOT_DEVICE : XAI_GROK_DEVICE;
   if (provider === "github-copilot") {
     const copilot = await exchangeGithubTokenForCopilot(grant.refresh, http);
+    if (copilot.apiBaseUrl !== undefined) {
+      saveProviderBaseUrl("github-copilot", copilot.apiBaseUrl, dir);
+    }
     const next = grantFromTokens("device-code", {
       accessToken: copilot.accessToken,
       refreshToken: grant.refresh,
@@ -41369,6 +41455,7 @@ function logoutProvider(provider, dir) {
 }
 var SESSION_REFRESHED_GRANTS;
 var init_login = __esm(() => {
+  init_shell_config();
   init_catalog();
   init_copilot();
   init_device_code();
@@ -48173,7 +48260,7 @@ import path47 from "path";
 // package.json
 var package_default = {
   name: "@mrciphersmith/keryx",
-  version: "0.2.100",
+  version: "0.2.102",
   description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   private: false,
   publishConfig: {
@@ -94966,7 +95053,7 @@ function pickAuthMethodStep(otui, r, providerLabel, methods) {
     });
   });
 }
-function runDeviceLoginInTui(otui, r, provider) {
+function runDeviceLoginInTui(otui, r, provider, dir) {
   return new Promise((resolve) => {
     const box = overlayBox(otui, r, "device-login");
     r.root.add(box);
@@ -94994,6 +95081,7 @@ function runDeviceLoginInTui(otui, r, provider) {
       provider,
       fetch: (input, init) => globalThis.fetch(input, init),
       signal: controller.signal,
+      ...dir !== undefined ? { dir } : {},
       onChallenge: (challenge) => {
         status.content = otui.t`${otui.bold(challenge.userCode)}\n${otui.dim(challenge.verificationUri)}\n${otui.dim("Open that URL on any device and enter the code. Waiting for authorization\u2026")}`;
         openVerificationUrl(challenge.verificationUriComplete ?? challenge.verificationUri);
@@ -95110,12 +95198,14 @@ function selectProviderModelInTui(otui, r, detected, options = {}) {
           }
           continue;
         }
-        let selectedBaseUrl = options.onlyConnected || prov.baseUrl === undefined ? prov.baseUrl : await promptBaseUrlStep(otui, r, prov.label ?? prov.name, prov.baseUrl);
-        if (!options.onlyConnected && prov.baseUrl !== undefined && selectedBaseUrl === undefined) {
+        const lockDiscoveredHost = prov.name === "github-copilot";
+        let selectedBaseUrl = options.onlyConnected || prov.baseUrl === undefined || lockDiscoveredHost ? prov.baseUrl : await promptBaseUrlStep(otui, r, prov.label ?? prov.name, prov.baseUrl);
+        if (!options.onlyConnected && !lockDiscoveredHost && prov.baseUrl !== undefined && selectedBaseUrl === undefined) {
           continue;
         }
-        if (!options.onlyConnected && selectedBaseUrl !== undefined)
+        if (!options.onlyConnected && !lockDiscoveredHost && selectedBaseUrl !== undefined) {
           saveProviderBaseUrl(prov.name, selectedBaseUrl, options.configDir);
+        }
         let selectedProvider = selectedBaseUrl === undefined ? prov : { ...prov, baseUrl: selectedBaseUrl };
         const envKey = prov.envKey;
         const label = prov.label ?? prov.name;
@@ -95143,7 +95233,15 @@ function selectProviderModelInTui(otui, r, detected, options = {}) {
             }
           }
           if (method === "device-code") {
-            return await runDeviceLoginInTui(otui, r, prov.name) ? "ok" : "back";
+            if (!await runDeviceLoginInTui(otui, r, prov.name, options.configDir)) {
+              return "back";
+            }
+            const saved = loadShellConfig(options.configDir).baseUrls?.[prov.name];
+            if (typeof saved === "string" && saved.length > 0) {
+              selectedBaseUrl = saved;
+              selectedProvider = { ...prov, baseUrl: saved };
+            }
+            return "ok";
           }
           const kr = await promptApiKeyStep(otui, r, {
             label,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrciphersmith/keryx",
-  "version": "0.2.100",
+  "version": "0.2.102",
   "description": "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   "private": false,
   "publishConfig": {