@openclaw/copilot 2026.5.28

package/dist/doctor-contract-api.js

@@ -0,0 +1,30 @@
+//#region extensions/copilot/doctor-contract-api.ts
+const legacyConfigRules = [];
+function normalizeCompatibilityConfig({ cfg }) {
+	return {
+		config: cfg,
+		changes: []
+	};
+}
+/**
+* Session-state ownership claim for the copilot agent runtime.
+*
+* - id / label: Identify the extension in doctor output.
+* - providerIds: The subscription Copilot providers (kept in sync
+*   with `SUPPORTED_PROVIDERS` in attempt.ts).
+* - runtimeIds: Our harness id (matches harness.ts `id` field).
+* - cliSessionKeys: Session keys this harness writes; doctor uses
+*   this when pruning stale CLI session state.
+* - authProfilePrefixes: Conventional prefix for any auth profile
+*   created/consumed by this extension.
+*/
+const sessionRouteStateOwners = [{
+	id: "copilot",
+	label: "GitHub Copilot agent runtime",
+	providerIds: ["github-copilot"],
+	runtimeIds: ["copilot"],
+	cliSessionKeys: ["copilot"],
+	authProfilePrefixes: ["github-copilot:"]
+}];
+//#endregion
+export { legacyConfigRules, normalizeCompatibilityConfig, sessionRouteStateOwners };

package/dist/harness-Blgz_qk3.js

@@ -0,0 +1,473 @@
+import { createHash } from "node:crypto";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { mkdir, writeFile } from "node:fs/promises";
+//#region extensions/copilot/src/auth-bridge.ts
+/**
+* Pure functional auth resolver for the copilot agent runtime.
+*
+* Scope:
+*
+*   - Consumes the resolved auth signals that core's harness contract
+*     already carries on `EmbeddedRunAttemptParams` (=
+*     `AgentHarnessAttemptParams`): `resolvedApiKey`, `authProfileId`,
+*     `authProfileIdSource`. Core resolves these from the agent's
+*     `AuthProfileStore` via `provider-usage.auth.ts:resolveProviderAuths`
+*     before invoking the harness, so the harness does not re-perform
+*     the lookup (and could not, due to the package boundary in
+*     `tsconfig.package-boundary.base.json`).
+*   - Reads optional explicit overrides from the harness attempt params
+*     (`auth.useLoggedInUser`, `auth.gitHubToken`) for direct CLI / test
+*     use cases.
+*   - Falls back to OPENCLAW_GITHUB_TOKEN, COPILOT_GITHUB_TOKEN,
+*     GH_TOKEN, or GITHUB_TOKEN env vars (in that precedence) when
+*     no contract-resolved token is given; synthesises a stable,
+*     non-reversible pool fingerprint so token rotation busts the
+*     client pool cleanly.
+*   - Computes a per-agent `copilotHome` default
+*     (`<openClawHome>/.openclaw/agents/<agentId>/copilot`, or
+*     `<agentDir>/copilot` when an agent directory is supplied) that
+*     respects `OPENCLAW_HOME` for the home directory root.
+*   - Defaults to `useLoggedInUser` when no token signal is available.
+*
+* Precedence (highest to lowest):
+*   1. `auth.useLoggedInUser === true` (explicit user opt-in)
+*   2. `auth.gitHubToken` (explicit override; requires
+*      `profileId` + `profileVersion`)
+*   3. `resolvedApiKey` + `authProfileId` from the contract (core's
+*      AuthProfileStore-resolved token — the production main path for
+*      a configured `github-copilot` auth profile)
+*   4. OPENCLAW_GITHUB_TOKEN, then COPILOT_GITHUB_TOKEN, then
+*      GH_TOKEN, then GITHUB_TOKEN env vars (mirrors the
+*      shipped `github-copilot` provider precedence so headless
+*      users who already follow the documented
+*      COPILOT_GITHUB_TOKEN / GH_TOKEN setup get the token they
+*      configured rather than silently falling through to the
+*      logged-in CLI user.)
+*   5. `useLoggedInUser` (default)
+*/
+const COPILOT_TOKEN_PROFILE_ERROR = "[copilot-attempt] gitHubToken auth requires profileId+profileVersion (pool keying safety; per Q5/Q1 decisions)";
+const COPILOT_DEFAULT_AGENT_ID = "copilot";
+/**
+* Resolve copilot auth + copilotHome.
+*
+* Synchronous because we intentionally do not perform any I/O or
+* cross-package credential lookups here (see file header for rationale).
+*
+* Throws if `gitHubToken` is supplied via `params.auth.gitHubToken`
+* WITHOUT both `profileId` and `profileVersion` (the existing invariant
+* from attempt.ts; preserves pool-key safety per Q5/Q1).
+*/
+function resolveCopilotAuth(input) {
+	const env = input.env ?? process.env;
+	const homeDir = input.homeDir ?? homedir;
+	const agentId = sanitizeAgentId(input.agentId);
+	const copilotHome = resolveCopilotHome({
+		explicit: readString(input.copilotHome),
+		agentDir: readString(input.agentDir),
+		workspaceDir: readString(input.workspaceDir),
+		agentId,
+		env,
+		homeDir
+	});
+	const explicitToken = readString(input.auth?.gitHubToken);
+	const explicitProfileId = readString(input.auth?.profileId) ?? readString(input.authProfileId);
+	const explicitProfileVersion = readString(input.auth?.profileVersion) ?? readString(input.profileVersion);
+	if (input.auth?.useLoggedInUser === true) return {
+		authMode: "useLoggedInUser",
+		copilotHome,
+		agentId
+	};
+	if (explicitToken) {
+		if (!explicitProfileId || !explicitProfileVersion) throw new Error(COPILOT_TOKEN_PROFILE_ERROR);
+		return {
+			authMode: "gitHubToken",
+			gitHubToken: explicitToken,
+			authProfileId: explicitProfileId,
+			authProfileVersion: explicitProfileVersion,
+			copilotHome,
+			agentId
+		};
+	}
+	const contractToken = readString(input.resolvedApiKey);
+	if (contractToken) return {
+		authMode: "gitHubToken",
+		gitHubToken: contractToken,
+		authProfileId: readString(input.authProfileId) ?? "pi:resolved",
+		authProfileVersion: tokenFingerprint(contractToken),
+		copilotHome,
+		agentId
+	};
+	const envFallback = readEnvTokenFallback(env);
+	if (envFallback) return {
+		authMode: "gitHubToken",
+		gitHubToken: envFallback.token,
+		authProfileId: envFallback.profileId,
+		authProfileVersion: envFallback.profileVersion,
+		copilotHome,
+		agentId
+	};
+	return {
+		authMode: "useLoggedInUser",
+		copilotHome,
+		agentId
+	};
+}
+/**
+* Validate + sanitise an agent id for use in filesystem paths and pool
+* keys.
+*
+* Mirrors the shape constraints documented by core's `normalizeAgentId`
+* / `isValidAgentId` in `src/routing/session-key.ts` (alnum + `-_`,
+* starts with alnum, lowercase, <=64 chars). We re-implement here
+* because the package boundary prevents importing from `src/`. Any
+* caller that passes an invalid id falls back to the shared default
+* (`COPILOT_DEFAULT_AGENT_ID`) rather than throwing - the harness's
+* job is to keep running with a safe default, not to validate config.
+*/
+function sanitizeAgentId(value) {
+	const trimmed = (value ?? "").trim().toLowerCase();
+	if (!trimmed) return COPILOT_DEFAULT_AGENT_ID;
+	if (!/^[a-z0-9][a-z0-9_-]{0,63}$/.test(trimmed)) return COPILOT_DEFAULT_AGENT_ID;
+	return trimmed;
+}
+function resolveCopilotHome(args) {
+	if (args.explicit) return resolve(args.explicit);
+	if (args.agentDir) return resolve(join(args.agentDir, "copilot"));
+	const openClawHome = readString(args.env.OPENCLAW_HOME);
+	return resolve(join(openClawHome ? resolve(openClawHome) : safeHomeDir(args.homeDir), ".openclaw", "agents", args.agentId, "copilot"));
+}
+function safeHomeDir(homeDir) {
+	try {
+		const value = homeDir();
+		if (typeof value === "string" && value.length > 0) return value;
+	} catch {}
+	return process.cwd();
+}
+function readEnvTokenFallback(env) {
+	const candidates = [
+		{
+			name: "OPENCLAW_GITHUB_TOKEN",
+			value: readString(env.OPENCLAW_GITHUB_TOKEN)
+		},
+		{
+			name: "COPILOT_GITHUB_TOKEN",
+			value: readString(env.COPILOT_GITHUB_TOKEN)
+		},
+		{
+			name: "GH_TOKEN",
+			value: readString(env.GH_TOKEN)
+		},
+		{
+			name: "GITHUB_TOKEN",
+			value: readString(env.GITHUB_TOKEN)
+		}
+	];
+	for (const { name, value } of candidates) if (value) return {
+		token: value,
+		profileId: `env:${name}`,
+		profileVersion: tokenFingerprint(value)
+	};
+}
+/**
+* Non-reversible 12-hex-char fingerprint of a token, prefixed with
+* `sha256:` for forward-compat. Used as the pool-key profileVersion when
+* a token comes from env: rotation -> different fingerprint -> pool
+* entry invalidated cleanly. 48 bits of entropy is sufficient
+* collision resistance for a per-agent client pool; never log the
+* fingerprint alongside an account id.
+*/
+function tokenFingerprint(token) {
+	return `sha256:${createHash("sha256").update(token).digest("hex").slice(0, 12)}`;
+}
+function readString(value) {
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+//#endregion
+//#region extensions/copilot/src/compaction-bridge.ts
+/**
+* Shape an `InfiniteSessionConfig` for `SessionConfig.infiniteSessions`.
+* Returns `undefined` when no fields were supplied so callers can
+* spread conditionally and let the SDK apply its own defaults
+* (`enabled: true`, background 0.80, buffer 0.95). Any explicitly-set
+* value (including `enabled: false` to disable infinite sessions) is
+* preserved.
+*/
+function createInfiniteSessionConfig(options) {
+	if (!options) return;
+	const result = {};
+	if (options.enabled !== void 0) result.enabled = options.enabled;
+	if (options.backgroundCompactionThreshold !== void 0) result.backgroundCompactionThreshold = options.backgroundCompactionThreshold;
+	if (options.bufferExhaustionThreshold !== void 0) result.bufferExhaustionThreshold = options.bufferExhaustionThreshold;
+	return Object.keys(result).length > 0 ? result : void 0;
+}
+function compactJsonValue(input) {
+	const out = {};
+	for (const [key, value] of Object.entries(input)) if (value !== void 0) out[key] = value;
+	return out;
+}
+/**
+* Write an OpenClaw-shaped compaction marker JSON file under
+* `<workspaceDir>/<subdir>/openclaw-compaction-<sessionId>-<ts>.json`.
+*
+* Returns the resolved file path and the marker payload that was
+* written. Throws if the workspaceDir or sessionId is missing/empty
+* (the caller should not invoke this without those — the harness
+* `compact()` must validate first).
+*/
+async function writeOpenClawCompactionMarker(input, options = {}) {
+	if (!input.workspaceDir || typeof input.workspaceDir !== "string") throw new Error("[copilot:compaction-bridge] workspaceDir is required to write a marker");
+	if (!input.sessionId || typeof input.sessionId !== "string") throw new Error("[copilot:compaction-bridge] sessionId is required to write a marker");
+	const now = options.now ?? Date.now;
+	const fs = options.fs ?? {
+		mkdir,
+		writeFile
+	};
+	const subdir = options.subdir ?? "files";
+	const ts = now();
+	const filename = `openclaw-compaction-${ts}-${input.sessionId.replace(/[^a-zA-Z0-9._-]/g, "_")}.json`;
+	const dirPath = join(input.workspaceDir, subdir);
+	const filePath = join(dirPath, filename);
+	const marker = compactJsonValue({
+		version: 1,
+		source: "copilot-harness",
+		sessionId: input.sessionId,
+		ts,
+		compacted: false,
+		trigger: input.trigger,
+		force: input.force,
+		sdkSessionId: input.sdkSessionId,
+		currentTokenCount: input.currentTokenCount,
+		reason: input.reason
+	});
+	await fs.mkdir(dirPath, { recursive: true });
+	await fs.writeFile(filePath, `${JSON.stringify(marker, null, 2)}\n`, "utf8");
+	return {
+		path: filePath,
+		marker
+	};
+}
+//#endregion
+//#region extensions/copilot/harness.ts
+const COPILOT_PROVIDER_IDS = new Set(["github-copilot"]);
+function normalizeBinding(value) {
+	if (!value || value.schemaVersion !== 1 || typeof value.sdkSessionId !== "string" || value.sdkSessionId.trim() === "" || typeof value.compatKey !== "string" || value.compatKey.trim() === "" || typeof value.updatedAt !== "number" || !Number.isFinite(value.updatedAt)) return;
+	return {
+		schemaVersion: 1,
+		sdkSessionId: value.sdkSessionId.trim(),
+		compatKey: value.compatKey,
+		updatedAt: value.updatedAt
+	};
+}
+function lookupStoredBinding(store, key) {
+	try {
+		return normalizeBinding(store?.lookup(key));
+	} catch {
+		try {
+			store?.delete(key);
+		} catch {}
+		return;
+	}
+}
+function registerStoredBinding(store, key, binding) {
+	try {
+		store?.register(key, binding);
+		return true;
+	} catch {
+		try {
+			store?.delete(key);
+		} catch {}
+		return false;
+	}
+}
+function deleteStoredBinding(store, key) {
+	try {
+		store?.delete(key);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function computeSessionCompatKey(params) {
+	const p = params;
+	const modelObj = p.model && typeof p.model === "object" ? p.model : { id: typeof p.model === "string" ? p.model : void 0 };
+	let authParts;
+	let resolvedAgentId = "";
+	let resolvedCopilotHome = "";
+	try {
+		const resolved = resolveCopilotAuth({
+			agentId: typeof p.agentId === "string" ? p.agentId : void 0,
+			agentDir: typeof p.agentDir === "string" ? p.agentDir : void 0,
+			workspaceDir: typeof p.workspaceDir === "string" ? p.workspaceDir : void 0,
+			copilotHome: typeof p.copilotHome === "string" ? p.copilotHome : void 0,
+			auth: p.auth,
+			resolvedApiKey: typeof p.resolvedApiKey === "string" ? p.resolvedApiKey : void 0,
+			authProfileId: typeof p.authProfileId === "string" ? p.authProfileId : void 0,
+			profileVersion: typeof p.profileVersion === "string" ? p.profileVersion : void 0
+		});
+		resolvedAgentId = resolved.agentId;
+		resolvedCopilotHome = resolved.copilotHome;
+		authParts = [
+			`auth.mode=${resolved.authMode}`,
+			`auth.profileId=${resolved.authProfileId ?? ""}`,
+			`auth.profileVersion=${resolved.authProfileVersion ?? ""}`
+		];
+	} catch {
+		authParts = ["auth=unresolvable"];
+	}
+	return [
+		`provider=${modelObj.provider ?? ""}`,
+		`model=${modelObj.id ?? ""}`,
+		`api=${modelObj.api ?? ""}`,
+		`cwd=${p.cwd ?? p.workspaceDir ?? ""}`,
+		`agentId=${resolvedAgentId}`,
+		`agentDir=${p.agentDir ?? ""}`,
+		`copilotHome=${p.copilotHome ?? ""}`,
+		`resolvedCopilotHome=${resolvedCopilotHome}`,
+		...authParts
+	].join("|");
+}
+function createCopilotAgentHarness(options) {
+	let poolPromise;
+	let createdPool;
+	let disposed = false;
+	let disposePromise;
+	const inFlight = /* @__PURE__ */ new Set();
+	const trackedSessions = /* @__PURE__ */ new Map();
+	const resetBlockedStoredSessions = /* @__PURE__ */ new Set();
+	async function getPool() {
+		if (options?.pool) return options.pool;
+		if (!poolPromise) poolPromise = (async () => {
+			const { createCopilotClientPool } = await import("./runtime-C2rPhifm.js");
+			createdPool = createCopilotClientPool(options?.poolOptions);
+			return createdPool;
+		})();
+		return poolPromise;
+	}
+	return {
+		id: options?.id ?? "copilot",
+		label: options?.label ?? "GitHub Copilot agent runtime",
+		supports(ctx) {
+			if (String(ctx.requestedRuntime ?? "").trim().toLowerCase() !== "copilot") return {
+				supported: false,
+				reason: "copilot is opt-in only"
+			};
+			const provider = ctx.provider.trim().toLowerCase();
+			if (!COPILOT_PROVIDER_IDS.has(provider)) return {
+				supported: false,
+				reason: `provider is not one of: ${[...COPILOT_PROVIDER_IDS].toSorted().join(", ")}`
+			};
+			return {
+				supported: true,
+				priority: 100
+			};
+		},
+		async runAttempt(params) {
+			const attemptPromise = (async () => {
+				if (disposed) throw new Error("[copilot] harness has been disposed; cannot start new attempts");
+				const { runCopilotAttempt } = await import("./attempt-DMegR4ua.js");
+				if (disposed) throw new Error("[copilot] harness was disposed while starting an attempt");
+				const pool = await getPool();
+				if (disposed) throw new Error("[copilot] harness was disposed while starting an attempt");
+				const openclawSessionId = typeof params.sessionId === "string" ? params.sessionId : void 0;
+				const currentCompatKey = computeSessionCompatKey(params);
+				const tracked = openclawSessionId ? trackedSessions.get(openclawSessionId) : void 0;
+				const stored = openclawSessionId ? resetBlockedStoredSessions.has(openclawSessionId) ? void 0 : lookupStoredBinding(options?.sessionStore, openclawSessionId) : void 0;
+				const resumableSessionId = tracked && tracked.compatKey === currentCompatKey ? tracked.sdkSessionId : !tracked && stored && stored.compatKey === currentCompatKey ? stored.sdkSessionId : void 0;
+				return runCopilotAttempt(resumableSessionId ? {
+					...params,
+					initialReplayState: {
+						...params.initialReplayState,
+						sdkSessionId: resumableSessionId
+					}
+				} : params, {
+					pool,
+					onSessionEstablished: openclawSessionId ? ({ sdkSessionId, pooledClient }) => {
+						trackedSessions.set(openclawSessionId, {
+							sdkSessionId,
+							client: pooledClient.client,
+							compatKey: currentCompatKey
+						});
+						if (registerStoredBinding(options?.sessionStore, openclawSessionId, {
+							schemaVersion: 1,
+							sdkSessionId,
+							compatKey: currentCompatKey,
+							updatedAt: Date.now()
+						})) resetBlockedStoredSessions.delete(openclawSessionId);
+					} : void 0
+				});
+			})();
+			inFlight.add(attemptPromise);
+			try {
+				return await attemptPromise;
+			} finally {
+				inFlight.delete(attemptPromise);
+			}
+		},
+		async reset(params) {
+			const openclawSessionId = typeof params.sessionId === "string" ? params.sessionId : void 0;
+			if (!openclawSessionId) return;
+			const tracked = trackedSessions.get(openclawSessionId);
+			if (deleteStoredBinding(options?.sessionStore, openclawSessionId)) resetBlockedStoredSessions.delete(openclawSessionId);
+			else resetBlockedStoredSessions.add(openclawSessionId);
+			if (!tracked) return;
+			trackedSessions.delete(openclawSessionId);
+			try {
+				await tracked.client.deleteSession(tracked.sdkSessionId);
+			} catch {}
+		},
+		async compact(params) {
+			const openclawSessionId = typeof params.sessionId === "string" ? params.sessionId : void 0;
+			const workspaceDir = typeof params.workspaceDir === "string" ? params.workspaceDir : void 0;
+			if (!openclawSessionId || !workspaceDir) return {
+				ok: false,
+				compacted: false,
+				reason: "missing-required-params"
+			};
+			const tracked = trackedSessions.get(openclawSessionId);
+			const reason = params.force ? "force-requested-but-sdk-has-no-synchronous-compact-api" : "deferred-to-sdk-infinite-sessions";
+			try {
+				await writeOpenClawCompactionMarker({
+					sessionId: openclawSessionId,
+					workspaceDir,
+					trigger: params.trigger,
+					currentTokenCount: params.currentTokenCount,
+					sdkSessionId: tracked?.sdkSessionId,
+					force: params.force,
+					reason
+				});
+			} catch (err) {
+				return {
+					ok: false,
+					compacted: false,
+					reason: "marker-write-failed",
+					failure: {
+						reason: "marker-write-failed",
+						rawError: err instanceof Error ? err.message : String(err)
+					}
+				};
+			}
+			return {
+				ok: true,
+				compacted: false,
+				reason
+			};
+		},
+		async dispose() {
+			if (disposePromise) return disposePromise;
+			disposed = true;
+			disposePromise = (async () => {
+				if (inFlight.size > 0) await Promise.allSettled(inFlight);
+				trackedSessions.clear();
+				resetBlockedStoredSessions.clear();
+				if (createdPool) {
+					const errors = await createdPool.dispose();
+					if (errors.length > 0) throw new AggregateError(errors, "[copilot] pool disposal errors");
+				}
+			})();
+			return disposePromise;
+		}
+	};
+}
+//#endregion
+export { createInfiniteSessionConfig as n, resolveCopilotAuth as r, createCopilotAgentHarness as t };

package/dist/harness.js

@@ -0,0 +1,2 @@
+import { t as createCopilotAgentHarness } from "./harness-Blgz_qk3.js";
+export { createCopilotAgentHarness };

package/dist/index.js

@@ -0,0 +1,33 @@
+import { t as createCopilotAgentHarness } from "./harness-Blgz_qk3.js";
+import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
+//#region extensions/copilot/index.ts
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readPoolOptions(pluginConfig) {
+	if (!isRecord(pluginConfig)) return;
+	const pool = pluginConfig.pool;
+	if (!isRecord(pool)) return;
+	const idleTtlMs = pool.idleTtlMs;
+	if (typeof idleTtlMs !== "number" || !Number.isFinite(idleTtlMs) || idleTtlMs < 1) return;
+	return { idleTtlMs };
+}
+var copilot_default = definePluginEntry({
+	id: "copilot",
+	name: "GitHub Copilot agent runtime",
+	description: "Registers the GitHub Copilot agent runtime.",
+	register(api) {
+		const poolOptions = readPoolOptions(api.pluginConfig);
+		const sessionStore = api.runtime.state.openSyncKeyedStore({
+			namespace: "sdk-sessions",
+			maxEntries: 5e3,
+			defaultTtlMs: 2160 * 60 * 60 * 1e3
+		});
+		api.registerAgentHarness(createCopilotAgentHarness({
+			...poolOptions ? { poolOptions } : {},
+			sessionStore
+		}));
+	}
+});
+//#endregion
+export { copilot_default as default };