@oh-my-pi/pi-ai 17.0.7 → 17.0.9

package/src/registry/oauth/__tests__/xai-oauth.test.ts

@@ -1,19 +1,35 @@
 import { afterEach, describe, expect, it, vi } from "bun:test";
-import { isXAIAccessTokenExpiring, loginXAIOAuth, refreshXAIOAuthToken, validateXAIEndpoint } from "../xai-oauth";
+import {
+	buildXAICliBillingUrl,
+	extractXAIAccessTokenSubject,
+	fetchXAIOAuthIdentity,
+	getXAICliBillingHeaders,
+	isXAIAccessTokenExpiring,
+	loginXAIOAuth,
+	parseXAIAccessTokenPayload,
+	refreshXAIOAuthToken,
+	validateXAIBillingEndpoint,
+	validateXAIEndpoint,
+} from "../xai-oauth";
 
 afterEach(() => {
 	vi.restoreAllMocks();
 });
 
 function jwtWithExp(exp: number): string {
+	return jwtWithPayload({ exp });
+}
+
+function jwtWithPayload(payload: Record<string, unknown>): string {
 	const header = Buffer.from(JSON.stringify({ alg: "HS256", typ: "JWT" })).toString("base64url");
-	const payload = Buffer.from(JSON.stringify({ exp })).toString("base64url");
-	return `${header}.${payload}.sig`;
+	const encodedPayload = Buffer.from(JSON.stringify(payload)).toString("base64url");
+	return `${header}.${encodedPayload}.sig`;
 }
 
 const DISCOVERY_URL = "https://auth.x.ai/.well-known/openid-configuration";
 const DEVICE_CODE_URL = "https://auth.x.ai/oauth2/device/code";
 const TOKEN_ENDPOINT = "https://auth.x.ai/oauth2/token";
+const USERINFO_URL = "https://auth.x.ai/oauth2/userinfo";
 const CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
 const SCOPE = "openid profile email offline_access grok-cli:access api:access";
 
@@ -43,7 +59,10 @@ function jsonResponse(body: unknown, status: number = 200): Response {
 	});
 }
 
-function createDeviceFlowFetch(tokenResponses: readonly TokenResponse[]) {
+function createDeviceFlowFetch(
+	tokenResponses: readonly TokenResponse[],
+	userinfoResponse: TokenResponse = { body: {} },
+) {
 	const requests: RecordedRequest[] = [];
 	let tokenResponseIndex = 0;
 	const fetchMock = vi.fn(async (input: string | URL | Request, init?: RequestInit) => {
@@ -64,6 +83,9 @@ function createDeviceFlowFetch(tokenResponses: readonly TokenResponse[]) {
 			}
 			return jsonResponse(tokenResponse.body, tokenResponse.status);
 		}
+		if (url === USERINFO_URL) {
+			return jsonResponse(userinfoResponse.body, userinfoResponse.status);
+		}
 		throw new Error(`Unexpected xAI OAuth request: ${url}`);
 	});
 
@@ -101,6 +123,109 @@ describe("isXAIAccessTokenExpiring", () => {
 	});
 });
 
+describe("xAI OAuth helpers", () => {
+	it("parses JWT payloads and extracts subjects", () => {
+		const token = jwtWithPayload({ sub: " subject-123 ", exp: 1_900_000_000 });
+
+		expect(parseXAIAccessTokenPayload(token)).toEqual({ sub: " subject-123 ", exp: 1_900_000_000 });
+		expect(extractXAIAccessTokenSubject(token)).toBe("subject-123");
+		expect(parseXAIAccessTokenPayload("not-a-jwt")).toBeNull();
+		expect(extractXAIAccessTokenSubject("not-a-jwt")).toBeUndefined();
+	});
+
+	it("builds the billing URL and CLI-aligned headers", () => {
+		expect(buildXAICliBillingUrl()).toBe("https://cli-chat-proxy.grok.com/v1/billing?format=credits");
+		expect(buildXAICliBillingUrl("tokens")).toBe("https://cli-chat-proxy.grok.com/v1/billing?format=tokens");
+		expect(getXAICliBillingHeaders({ accessToken: "access-token" })).toEqual({
+			Authorization: "Bearer access-token",
+			Accept: "application/json",
+			"X-XAI-Token-Auth": "xai-grok-cli",
+		});
+	});
+
+	it("pins SuperGrok billing URLs to https grok.com hosts", () => {
+		expect(validateXAIBillingEndpoint("https://cli-chat-proxy.grok.com/v1/billing")).toBe(
+			"https://cli-chat-proxy.grok.com/v1/billing",
+		);
+		expect(() => validateXAIBillingEndpoint("https://auth.x.ai/v1/billing")).toThrow(/Invalid xAI billing_url/);
+		expect(() => validateXAIBillingEndpoint("http://cli-chat-proxy.grok.com/v1/billing")).toThrow(
+			/Invalid xAI billing_url/,
+		);
+		expect(() => validateXAIBillingEndpoint("https://evil.com/v1/billing")).toThrow(/Invalid xAI billing_url/);
+	});
+
+	it("normalizes OIDC userinfo identity", async () => {
+		const requests: RecordedRequest[] = [];
+		const fetchMock = vi.fn(async (input: string | URL | Request, init?: RequestInit) => {
+			requests.push({
+				url: typeof input === "string" ? input : input instanceof Request ? input.url : input.toString(),
+				init,
+			});
+			return jsonResponse({ sub: "profile-sub", email: "User@Example.com", name: "User" });
+		});
+
+		await expect(fetchXAIOAuthIdentity("access-token", fetchMock as unknown as typeof fetch)).resolves.toEqual({
+			accountId: "profile-sub",
+			email: "user@example.com",
+			name: "User",
+		});
+		expect(requests[0]?.url).toBe(USERINFO_URL);
+		expect(new Headers(requests[0]?.init?.headers)).toEqual(
+			new Headers({ Authorization: "Bearer access-token", Accept: "application/json" }),
+		);
+		expect(requests[0]?.init?.redirect).toBe("error");
+	});
+
+	it("combines caller cancellation with the 15-second userinfo timeout", async () => {
+		const timeoutControllers: AbortController[] = [];
+		const timeoutSpy = vi.spyOn(AbortSignal, "timeout").mockImplementation(timeoutMs => {
+			expect(timeoutMs).toBe(15_000);
+			const controller = new AbortController();
+			timeoutControllers.push(controller);
+			return controller.signal;
+		});
+		const requests: RecordedRequest[] = [];
+		const fetchMock = vi.fn(async (input: string | URL | Request, init?: RequestInit) => {
+			requests.push({
+				url: typeof input === "string" ? input : input instanceof Request ? input.url : input.toString(),
+				init,
+			});
+			const { promise, reject } = Promise.withResolvers<Response>();
+			const requestSignal = init?.signal;
+			if (!requestSignal) {
+				reject(new Error("expected userinfo request signal"));
+			} else if (requestSignal.aborted) {
+				reject(requestSignal.reason);
+			} else {
+				requestSignal.addEventListener("abort", () => reject(requestSignal.reason), { once: true });
+			}
+			return promise;
+		});
+
+		const callerController = new AbortController();
+		const callerCancelled = fetchXAIOAuthIdentity(
+			"access-token",
+			fetchMock as unknown as typeof fetch,
+			callerController.signal,
+		);
+		callerController.abort();
+		await expect(callerCancelled).resolves.toBeNull();
+		expect(requests[0]?.init?.signal).not.toBe(callerController.signal);
+
+		expect(timeoutSpy).toHaveBeenCalledWith(15_000);
+		const timeoutCancelled = fetchXAIOAuthIdentity(
+			"access-token",
+			fetchMock as unknown as typeof fetch,
+			new AbortController().signal,
+		);
+		const timeoutController = timeoutControllers[1];
+		expect(timeoutController).toBeDefined();
+		timeoutController?.abort();
+		await expect(timeoutCancelled).resolves.toBeNull();
+		expect(requests[1]?.init?.signal).not.toBe(timeoutController?.signal);
+	});
+});
+
 describe("validateXAIEndpoint", () => {
 	it("rejects non-HTTPS URLs", () => {
 		expect(() => validateXAIEndpoint("http://x.ai/token", "token_endpoint")).toThrow(/Invalid xAI token_endpoint/);
@@ -131,6 +256,35 @@ describe("refreshXAIOAuthToken", () => {
 		);
 		expect(fetchMock).not.toHaveBeenCalled();
 	});
+
+	it("persists refreshed OAuth identity from OIDC userinfo", async () => {
+		const accessToken = jwtWithPayload({ sub: "jwt-sub" });
+		const requests: RecordedRequest[] = [];
+		const fetchMock = vi.fn(async (input: string | URL | Request, init?: RequestInit) => {
+			const url = typeof input === "string" ? input : input instanceof Request ? input.url : input.toString();
+			requests.push({ url, init });
+			if (url === DISCOVERY_URL) return jsonResponse({ token_endpoint: TOKEN_ENDPOINT });
+			if (url === TOKEN_ENDPOINT) {
+				return jsonResponse({
+					access_token: accessToken,
+					expires_in: 3600,
+				});
+			}
+			if (url === USERINFO_URL) return jsonResponse({ sub: "profile-sub", email: "User@Example.com" });
+			throw new Error(`Unexpected xAI OAuth request: ${url}`);
+		});
+
+		await expect(
+			refreshXAIOAuthToken("old-refresh-token", fetchMock as unknown as typeof fetch),
+		).resolves.toMatchObject({
+			access: accessToken,
+			refresh: "old-refresh-token",
+			accountId: "profile-sub",
+			email: "user@example.com",
+		});
+		expect(requests.map(request => request.url)).toEqual([DISCOVERY_URL, TOKEN_ENDPOINT, USERINFO_URL]);
+		expect(requests.find(request => request.url === TOKEN_ENDPOINT)?.init?.redirect).toBe("error");
+	});
 });
 
 describe("loginXAIOAuth", () => {
@@ -165,7 +319,12 @@ describe("loginXAIOAuth", () => {
 			onManualCodeInput,
 		});
 
-		expect(requests.map(request => request.url)).toEqual([DISCOVERY_URL, DEVICE_CODE_URL, TOKEN_ENDPOINT]);
+		expect(requests.map(request => request.url)).toEqual([
+			DISCOVERY_URL,
+			DEVICE_CODE_URL,
+			TOKEN_ENDPOINT,
+			USERINFO_URL,
+		]);
 
 		const discoveryRequest = requests[0];
 		expect(discoveryRequest?.init?.method).toBe("GET");
@@ -230,6 +389,7 @@ describe("loginXAIOAuth", () => {
 
 		const tokenRequests = requests.filter(request => request.url === TOKEN_ENDPOINT);
 		expect(tokenRequests).toHaveLength(3);
+		expect(tokenRequests.every(request => request.init?.redirect === "error")).toBe(true);
 		expect(tokenRequests.map(request => Object.fromEntries(requestForm(request)))).toEqual([
 			{
 				grant_type: "urn:ietf:params:oauth:grant-type:device_code",
@@ -252,6 +412,54 @@ describe("loginXAIOAuth", () => {
 		expect(credentials.refresh).toBe("eventual-refresh-token");
 	});
 
+	it("retains the JWT subject and succeeds when OIDC userinfo fails", async () => {
+		const accessToken = jwtWithPayload({ sub: "jwt-sub" });
+		const controller = new AbortController();
+		const { fetchMock, requests } = createDeviceFlowFetch(
+			[
+				{
+					body: {
+						access_token: accessToken,
+						refresh_token: "refresh-token",
+						expires_in: 3600,
+					},
+				},
+			],
+			{ body: { error: "userinfo unavailable" }, status: 503 },
+		);
+
+		const credentials = await loginXAIOAuth({ fetch: fetchMock, signal: controller.signal });
+
+		expect(credentials).toMatchObject({
+			access: accessToken,
+			refresh: "refresh-token",
+			accountId: "jwt-sub",
+		});
+		expect(requests.at(-1)?.url).toBe(USERINFO_URL);
+		expect(requests.at(-1)?.init?.signal).not.toBe(controller.signal);
+	});
+
+	it("keeps the JWT subject when userinfo returns only an email", async () => {
+		const accessToken = jwtWithPayload({ sub: "jwt-sub" });
+		const { fetchMock } = createDeviceFlowFetch(
+			[
+				{
+					body: {
+						access_token: accessToken,
+						refresh_token: "refresh-token",
+						expires_in: 3600,
+					},
+				},
+			],
+			{ body: { email: "User@Example.com" } },
+		);
+
+		await expect(loginXAIOAuth({ fetch: fetchMock })).resolves.toMatchObject({
+			accountId: "jwt-sub",
+			email: "user@example.com",
+		});
+	});
+
 	it("rejects a token response that omits access_token", async () => {
 		const { fetchMock, requests } = createDeviceFlowFetch([
 			{

package/src/registry/oauth/xai-oauth.ts

@@ -15,8 +15,12 @@ import type { OAuthController, OAuthCredentials } from "./types";
 const XAI_OAUTH_ISSUER = "https://auth.x.ai";
 const XAI_OAUTH_DISCOVERY_URL = `${XAI_OAUTH_ISSUER}/.well-known/openid-configuration`;
 const XAI_OAUTH_DEVICE_CODE_URL = `${XAI_OAUTH_ISSUER}/oauth2/device/code`;
+const XAI_OAUTH_USERINFO_URL = `${XAI_OAUTH_ISSUER}/oauth2/userinfo`;
 const XAI_OAUTH_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
 const XAI_OAUTH_SCOPE = "openid profile email offline_access grok-cli:access api:access";
+const XAI_CLI_BILLING_BASE_URL = "https://cli-chat-proxy.grok.com";
+const XAI_CLI_BILLING_PATH = "/v1/billing";
+const XAI_CLI_BILLING_FORMAT = "credits";
 
 // Mirrors the 5-min skew used by anthropic.ts:160 — keeps every provider on the
 // same conservative client-side expiry window.
@@ -51,6 +55,15 @@ function isRecord(value: unknown): value is Record<string, unknown> {
  * @throws Error with message `Invalid xAI <field>: <url>` when the URL fails
  *         either scheme or host validation.
  */
+function isXaiAuthHostname(host: string): boolean {
+	return host === "x.ai" || host.endsWith(".x.ai");
+}
+
+/** SuperGrok CLI billing proxy host (`cli-chat-proxy.grok.com`), not the OIDC issuer. */
+function isXaiBillingHostname(host: string): boolean {
+	return host === "grok.com" || host.endsWith(".grok.com");
+}
+
 export function validateXAIEndpoint(url: string, field: string): string {
 	let parsed: URL;
 	try {
@@ -62,7 +75,28 @@ export function validateXAIEndpoint(url: string, field: string): string {
 		throw new AIError.OAuthError(`Invalid xAI ${field}: ${url}`, { kind: "validation", provider: "xai" });
 	}
 	const host = parsed.hostname.toLowerCase();
-	if (!host || (host !== "x.ai" && !host.endsWith(".x.ai"))) {
+	if (!host || !isXaiAuthHostname(host)) {
+		throw new AIError.OAuthError(`Invalid xAI ${field}: ${url}`, { kind: "validation", provider: "xai" });
+	}
+	return url;
+}
+
+/**
+ * Pin SuperGrok billing URLs to HTTPS `grok.com` / `*.grok.com`.
+ * The CLI billing proxy is intentionally not on `*.x.ai`.
+ */
+export function validateXAIBillingEndpoint(url: string, field: string = "billing_url"): string {
+	let parsed: URL;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new AIError.OAuthError(`Invalid xAI ${field}: ${url}`, { kind: "validation", provider: "xai" });
+	}
+	if (parsed.protocol !== "https:") {
+		throw new AIError.OAuthError(`Invalid xAI ${field}: ${url}`, { kind: "validation", provider: "xai" });
+	}
+	const host = parsed.hostname.toLowerCase();
+	if (!host || !isXaiBillingHostname(host)) {
 		throw new AIError.OAuthError(`Invalid xAI ${field}: ${url}`, { kind: "validation", provider: "xai" });
 	}
 	return url;
@@ -124,6 +158,22 @@ async function xaiOAuthDiscovery(
 	return { token_endpoint: tokenEndpoint };
 }
 
+/** Decode an xAI access-token JWT payload without verifying its signature. */
+export function parseXAIAccessTokenPayload(jwt: string): Record<string, unknown> | null {
+	try {
+		if (typeof jwt !== "string" || !jwt.includes(".")) return null;
+		const parts = jwt.split(".");
+		if (parts.length < 2) return null;
+		const payloadPart = parts[1];
+		if (!payloadPart) return null;
+		const decoded = Buffer.from(payloadPart, "base64url").toString("utf8");
+		const payload = JSON.parse(decoded) as unknown;
+		return isRecord(payload) && !Array.isArray(payload) ? payload : null;
+	} catch {
+		return null;
+	}
+}
+
 /**
  * Check whether a JWT access token is at or past its `exp` claim (with an
  * optional refresh-skew margin).
@@ -132,25 +182,100 @@ async function xaiOAuthDiscovery(
  * not token validation.
  */
 export function isXAIAccessTokenExpiring(jwt: string, skewSeconds: number = 0): boolean {
+	const payload = parseXAIAccessTokenPayload(jwt);
+	if (!payload) return false;
+	const exp = payload.exp;
+	if (typeof exp !== "number" || !Number.isFinite(exp)) return false;
+	const now = Math.floor(Date.now() / 1000);
+	const skew = Math.max(0, Math.floor(skewSeconds));
+	return exp <= now + skew;
+}
+
+/** Extract the stable xAI subject UUID from an access token. */
+export function extractXAIAccessTokenSubject(jwt: string): string | undefined {
+	const sub = parseXAIAccessTokenPayload(jwt)?.sub;
+	return typeof sub === "string" && sub.trim() ? sub.trim() : undefined;
+}
+
+export interface XAIOAuthIdentity {
+	accountId?: string;
+	email?: string;
+	name?: string;
+}
+
+/** Fetch optional OIDC userinfo for a valid xAI access token. */
+export async function fetchXAIOAuthIdentity(
+	accessToken: string,
+	fetchOverride?: FetchImpl,
+	signal?: AbortSignal,
+): Promise<XAIOAuthIdentity | null> {
+	const token = accessToken.trim();
+	if (!token) return null;
+	const fetchImpl = fetchOverride ?? fetch;
 	try {
-		if (typeof jwt !== "string" || !jwt.includes(".")) return false;
-		const parts = jwt.split(".");
-		if (parts.length < 2) return false;
-		const payloadPart = parts[1];
-		if (!payloadPart) return false;
-		const decoded = Buffer.from(payloadPart, "base64url").toString("utf8");
-		const payload: unknown = JSON.parse(decoded);
-		if (!isRecord(payload)) return false;
-		const exp = payload.exp;
-		if (typeof exp !== "number" || !Number.isFinite(exp)) return false;
-		const now = Math.floor(Date.now() / 1000);
-		const skew = Math.max(0, Math.floor(skewSeconds));
-		return exp <= now + skew;
+		const response = await fetchImpl(XAI_OAUTH_USERINFO_URL, {
+			method: "GET",
+			headers: {
+				Authorization: `Bearer ${token}`,
+				Accept: "application/json",
+			},
+			redirect: "error",
+			signal: signal
+				? AbortSignal.any([signal, AbortSignal.timeout(DISCOVERY_TIMEOUT_MS)])
+				: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS),
+		});
+		if (!response.ok) return null;
+		const payload = (await response.json()) as unknown;
+		if (!isRecord(payload) || Array.isArray(payload)) return null;
+		const sub = typeof payload.sub === "string" && payload.sub.trim() ? payload.sub.trim() : undefined;
+		const email = typeof payload.email === "string" && payload.email.trim() ? payload.email.trim() : undefined;
+		const name = typeof payload.name === "string" && payload.name.trim() ? payload.name.trim() : undefined;
+		if (!sub && !email && !name) return null;
+		return {
+			...(sub ? { accountId: sub } : {}),
+			...(email ? { email: email.toLowerCase() } : {}),
+			...(name ? { name } : {}),
+		};
 	} catch {
-		return false;
+		return null;
 	}
 }
 
+async function withXAIOAuthIdentity(
+	credentials: OAuthCredentials,
+	fetchOverride?: FetchImpl,
+	signal?: AbortSignal,
+): Promise<OAuthCredentials> {
+	const identity = await fetchXAIOAuthIdentity(credentials.access, fetchOverride, signal);
+	const accountId = identity?.accountId ?? credentials.accountId ?? extractXAIAccessTokenSubject(credentials.access);
+	const email = identity?.email ?? credentials.email;
+	return {
+		...credentials,
+		...(accountId ? { accountId } : {}),
+		...(email ? { email } : {}),
+	};
+}
+
+/** Build the SuperGrok CLI billing URL. */
+export function buildXAICliBillingUrl(format: string = XAI_CLI_BILLING_FORMAT): string {
+	const url = new URL(XAI_CLI_BILLING_PATH, XAI_CLI_BILLING_BASE_URL);
+	url.searchParams.set("format", format);
+	return validateXAIBillingEndpoint(url.toString());
+}
+
+/**
+ * Headers for SuperGrok CLI billing (`cli-chat-proxy.grok.com`).
+ * Official Grok CLI also sends `X-XAI-Token-Auth: xai-grok-cli` on this host;
+ * include it so billing stays on the same product gate as chat inference.
+ */
+export function getXAICliBillingHeaders(options: { accessToken: string }): Record<string, string> {
+	return {
+		Authorization: `Bearer ${options.accessToken}`,
+		Accept: "application/json",
+		"X-XAI-Token-Auth": "xai-grok-cli",
+	};
+}
+
 function parseXAIDeviceAuthorization(payload: unknown): XAIDeviceAuthorization {
 	if (!isRecord(payload)) {
 		throw new AIError.OAuthError("xAI device-code response was not a JSON object.", {
@@ -304,6 +429,7 @@ async function pollXAIDeviceToken(
 				client_id: XAI_OAUTH_CLIENT_ID,
 				device_code: deviceCode,
 			}),
+			redirect: "error",
 			signal: signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal,
 		});
 	} catch (error) {
@@ -364,12 +490,13 @@ export async function loginXAIOAuth(ctrl: OAuthController): Promise<OAuthCredent
 	});
 	ctrl.onProgress?.("Waiting for xAI device authorization...");
 
-	return pollOAuthDeviceCodeFlow({
+	const credentials = await pollOAuthDeviceCodeFlow({
 		poll: () => pollXAIDeviceToken(discovery.token_endpoint, device.deviceCode, fetchImpl, ctrl.signal),
 		intervalSeconds: device.intervalSeconds,
 		expiresInSeconds: device.expiresInSeconds,
 		signal: ctrl.signal,
 	});
+	return withXAIOAuthIdentity(credentials, fetchImpl, ctrl.signal);
 }
 
 /**
@@ -400,6 +527,7 @@ export async function refreshXAIOAuthToken(refreshToken: string, fetchOverride?:
 			Accept: "application/json",
 		},
 		body,
+		redirect: "error",
 		signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS),
 	});
 
@@ -426,5 +554,6 @@ export async function refreshXAIOAuthToken(refreshToken: string, fetchOverride?:
 			{ kind: "validation", provider: "xai", cause: error },
 		);
 	}
-	return parseXAITokenResponse(payload, "xAI token refresh response", refreshToken);
+	const credentials = parseXAITokenResponse(payload, "xAI token refresh response", refreshToken);
+	return withXAIOAuthIdentity(credentials, fetchImpl);
 }

package/src/types.ts

@@ -141,13 +141,17 @@ function isOpenAIServiceTierApi(api: Api | undefined): boolean {
 	return api === "openai-completions" || api === "openai-responses" || api === "openai-codex-responses";
 }
 
-function hasDedicatedServiceTierControl(provider: Provider | undefined): boolean {
-	return provider === "fireworks";
+function excludesInferredOpenAIServiceTier(provider: Provider | undefined): boolean {
+	// Fireworks has its own priority-only control. GitHub Copilot proxies OpenAI
+	// models but rejects OpenAI's `service_tier` request field.
+	return provider === "fireworks" || provider === "github-copilot";
 }
 
 function isOpenAIServiceTierModel(model: ServiceTierModel): boolean {
 	return (
-		!hasDedicatedServiceTierControl(model.provider) && isOpenAIServiceTierApi(model.api) && isOpenAIModelId(model.id)
+		!excludesInferredOpenAIServiceTier(model.provider) &&
+		isOpenAIServiceTierApi(model.api) &&
+		isOpenAIModelId(model.id)
 	);
 }
 
@@ -159,7 +163,8 @@ function isOpenAIServiceTierModel(model: ServiceTierModel): boolean {
  * `openai/`); Claude on Bedrock/Vertex (api `anthropic-messages`) is the
  * anthropic family even though its provider is `amazon-bedrock`/`google-vertex`.
  * Custom OpenAI-compatible relays that serve OpenAI model ids are OpenAI family
- * too unless that provider owns a separate tier control such as Fireworks.
+ * too unless the provider owns a separate tier control (Fireworks) or rejects
+ * OpenAI's service-tier field (GitHub Copilot).
  */
 export function serviceTierFamily(model: ServiceTierModel): ServiceTierFamily | undefined {
 	const provider = model.provider;