@openclaw/copilot 2026.6.11 → 2026.7.1-beta.2

package/README.md

@@ -10,10 +10,11 @@ openclaw plugins install @openclaw/copilot
 
 Restart the Gateway after installing or updating the plugin.
 
-The harness claims the canonical subscription `github-copilot` provider and
-is opt-in only — selection requires explicit `agentRuntime.id: "copilot"`
-on a model or provider entry; `auto` never picks it. PI remains the default
-embedded runtime.
+The harness claims the canonical subscription `github-copilot` provider plus
+custom BYOK provider entries that the Copilot SDK can represent. Manifest-owned
+native provider ids stay with their owning runtimes. The harness is opt-in only:
+selection requires explicit `agentRuntime.id: "copilot"` on a model or provider
+entry; `auto` never picks it. PI remains the default embedded runtime.
 
 See [GitHub Copilot agent runtime](../../docs/plugins/copilot.md) for
 configuration, the doctor contract, transcript mirroring, compaction, side

package/dist/{attempt-ArBh6GPT.js → attempt-DIieBZcc.js}

@@ -1,5 +1,5 @@
-import { n as resolveCopilotAuth } from "./harness-D-3KWchY.js";
-import { applyEmbeddedAttemptToolsAllow, awaitAgentEndSideEffects, buildAgentHarnessUserInputAnswers, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, clearActiveEmbeddedRun, deliverAgentHarnessUserInputPrompt, detectAndLoadAgentHarnessPromptImages, embeddedAgentLog, extractToolErrorMessage, getPluginToolMeta, isSubagentSessionKey, isToolResultError, resolveAgentHarnessBeforePromptBuildResult, resolveAttemptFsWorkspaceOnly, resolveAttemptSpawnWorkspaceDir, resolveBootstrapContextForRun, resolveCompactionTimeoutMs, resolveEmbeddedAttemptToolConstructionPlan, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, resolveUserPath, runAgentEndSideEffects, runAgentHarnessAfterCompactionHook, runAgentHarnessAfterToolCallHook, runAgentHarnessBeforeCompactionHook, runAgentHarnessBeforeMessageWriteHook, runAgentHarnessLlmInputHook, runAgentHarnessLlmOutputHook, sanitizeToolResult, setActiveEmbeddedRun } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { a as resolveCopilotAuth, i as createCopilotByokAuth, n as resolveCopilotProvider, r as createCopilotByokProxy } from "./harness-B9xB4LpE.js";
+import { applyEmbeddedAttemptToolsAllow, awaitAgentEndSideEffects, buildAgentHarnessUserInputAnswers, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, clearActiveEmbeddedRun, deliverAgentHarnessUserInputPrompt, detectAndLoadAgentHarnessPromptImages, embeddedAgentLog, extractToolErrorMessage, getModelProviderRequestTransport, getPluginToolMeta, isSubagentSessionKey, isToolResultError, resolveAgentHarnessBeforePromptBuildResult, resolveAttemptFsWorkspaceOnly, resolveAttemptSpawnWorkspaceDir, resolveBootstrapContextForRun, resolveCompactionTimeoutMs, resolveEmbeddedAttemptToolConstructionPlan, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, resolveUserPath, runAgentEndSideEffects, runAgentHarnessAfterCompactionHook, runAgentHarnessAfterToolCallHook, runAgentHarnessBeforeCompactionHook, runAgentHarnessBeforeMessageWriteHook, runAgentHarnessLlmInputHook, runAgentHarnessLlmOutputHook, sanitizeToolResult, setActiveEmbeddedRun } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { createHash } from "node:crypto";
 import path from "node:path";
 import fsp from "node:fs/promises";
@@ -242,6 +242,7 @@ function attachEventBridge(session, options) {
 	let detached = false;
 	const unsubscribeFns = [];
 	registerListener(session, unsubscribeFns, "assistant.message_delta", (event) => {
+		if (!isRootSessionEvent(event)) return;
 		const messageId = readString$2(event.data.messageId) ?? "assistant-message";
 		const delta = event.data.deltaContent;
 		if (!delta) return;
@@ -264,6 +265,7 @@ function attachEventBridge(session, options) {
 		deltaChain.catch(() => void 0);
 	});
 	registerListener(session, unsubscribeFns, "assistant.reasoning_delta", (event) => {
+		if (!isRootSessionEvent(event)) return;
 		const reasoningId = readString$2(event.data.reasoningId) ?? "assistant-reasoning";
 		const delta = event.data.deltaContent;
 		if (!delta) return;
@@ -274,20 +276,22 @@ function attachEventBridge(session, options) {
 		reasoningById.set(reasoningId, `${reasoningById.get(reasoningId) ?? ""}${delta}`);
 	});
 	registerListener(session, unsubscribeFns, "assistant.message", (event) => {
+		if (!isRootSessionEvent(event)) return;
 		lastAssistantEvent = event;
 		const entry = ensureMessageAccumulator(messagesById, messageOrder, event.data.messageId);
 		if (typeof event.data.content === "string" && event.data.content.length >= entry.text.length) entry.text = event.data.content;
 	});
 	registerListener(session, unsubscribeFns, "assistant.usage", (event) => {
+		if (!isRootSessionEvent(event)) return;
 		usage = normalizeCopilotUsage(event.data);
 	});
 	registerListener(session, unsubscribeFns, "tool.execution_start", (event) => {
-		startedCount += 1;
+		if (isRootSessionEvent(event)) startedCount += 1;
 		toolNamesByCallId.set(event.data.toolCallId, event.data.toolName);
 		toolMetas.push({ toolName: event.data.toolName });
 	});
 	registerListener(session, unsubscribeFns, "tool.execution_complete", (event) => {
-		completedCount += 1;
+		if (isRootSessionEvent(event)) completedCount += 1;
 		const toolName = toolNamesByCallId.get(event.data.toolCallId);
 		const meta = event.data.success ? event.data.result?.detailedContent ?? event.data.result?.content : event.data.error?.message;
 		if (toolName) toolMetas.push({
@@ -324,6 +328,22 @@ function attachEventBridge(session, options) {
 			}
 		});
 	});
+	registerListener(session, unsubscribeFns, "exit_plan_mode.completed", (event) => {
+		enqueueAgentEvent({
+			stream: "plan",
+			data: {
+				phase: "update",
+				title: "Plan decision",
+				source: "copilot-sdk",
+				requestId: event.data.requestId,
+				...event.data.approved !== void 0 ? { approved: event.data.approved } : {},
+				...event.data.autoApproveEdits !== void 0 ? { autoApproveEdits: event.data.autoApproveEdits } : {},
+				...event.data.feedback ? { feedback: event.data.feedback } : {},
+				...event.data.selectedAction ? { selectedAction: event.data.selectedAction } : {},
+				...event.agentId ? { agentId: event.agentId } : {}
+			}
+		});
+	});
 	registerListener(session, unsubscribeFns, "subagent.started", (event) => {
 		forwardNativeSubagentEvent(event);
 	});
@@ -520,9 +540,12 @@ function finalizeAssistantTexts(messageOrder, messagesById, event) {
 function isAssistantMessageEvent(event) {
 	return event?.type === "assistant.message";
 }
-function isRootCompactionEvent(event) {
+function isRootSessionEvent(event) {
 	return event.agentId === void 0;
 }
+function isRootCompactionEvent(event) {
+	return isRootSessionEvent(event);
+}
 function joinReasoning(order, reasoningById) {
 	return order.map((reasoningId) => reasoningById.get(reasoningId) ?? "").join("");
 }
@@ -964,7 +987,7 @@ function supportsModelTools(modelProvider) {
 	return SUPPORTED_TOOL_PROVIDERS.has(modelProvider);
 }
 async function createCopilotToolBridge(input) {
-	if (!supportsModelTools(input.modelProvider)) return {
+	if (!input.allowModelTools && !supportsModelTools(input.modelProvider)) return {
 		sdkTools: [],
 		sourceTools: []
 	};
@@ -1671,7 +1694,6 @@ function readResolvedWorkspacePath(value) {
 }
 //#endregion
 //#region extensions/copilot/src/attempt.ts
-const SUPPORTED_PROVIDERS = new Set(["github-copilot"]);
 const BACKGROUND_COMPACTION_CANCEL_TIMEOUT_MS = 5e3;
 const COPILOT_ASK_USER_AVAILABLE_TOOLS = ["builtin:ask_user"];
 async function runCopilotAgentEndHook(params, hookParams) {
@@ -1735,6 +1757,7 @@ function deferBackgroundCompactionCleanup(params) {
 				await params.session.disconnect();
 			} catch {}
 			params.cleanupToolBridge?.();
+			await params.cleanupByokProxy?.();
 			if (outcome !== "completed" && params.sdkSessionId) try {
 				await params.handle.client.deleteSession(params.sdkSessionId);
 			} catch {}
@@ -1812,13 +1835,21 @@ async function runCopilotAttempt(params, deps) {
 		sdkSessionId: void 0,
 		sessionIdUsed: input.sessionId
 	}));
-	if (!SUPPORTED_PROVIDERS.has(modelRef.provider)) return finishAttempt(createResult(input, {
-		messagesSnapshot: messages,
-		now,
-		promptError: createPromptError("model_not_supported", `[copilot-attempt] provider ${modelRef.provider} is not supported at MVP (subscription Copilot models only; BYOK arrives via byok-mapping-skeleton)`),
-		sdkSessionId: void 0,
-		sessionIdUsed: input.sessionId
-	}));
+	try {
+		resolveCopilotProvider({
+			model: modelRef,
+			resolvedApiKey: readString(params.resolvedApiKey),
+			authProfileId: readString(params.authProfileId)
+		});
+	} catch (error) {
+		return finishAttempt(createResult(input, {
+			messagesSnapshot: messages,
+			now,
+			promptError: createPromptError("model_not_supported", toError(error).message, error),
+			sdkSessionId: void 0,
+			sessionIdUsed: input.sessionId
+		}));
+	}
 	let abortRequested = false;
 	let aborted = false;
 	let externalAbort = false;
@@ -1913,11 +1944,26 @@ async function runCopilotAttempt(params, deps) {
 		resolvedWorkspace: resolvedWorkspaceForSandbox
 	}) : void 0;
 	const poolAcquire = resolvePoolAcquire(input);
+	let byokProxy;
+	try {
+		byokProxy = await createCopilotByokProxy(poolAcquire.provider);
+	} catch (error) {
+		return finishAttempt(createResult(input, {
+			messagesSnapshot: messages,
+			now,
+			promptError: createPromptError("model_not_supported", toError(error).message, error),
+			sdkSessionId: void 0,
+			sessionIdUsed: input.sessionId
+		}));
+	}
+	const cleanupByokProxy = byokProxy?.close;
+	const sessionProvider = byokProxy?.provider ?? poolAcquire.provider;
 	const sessionRef = { current: void 0 };
 	try {
 		let sdkTools;
 		try {
 			const toolBridge = await createToolBridge({
+				allowModelTools: poolAcquire.provider.mode === "byok",
 				modelProvider: modelRef.provider,
 				modelId: modelRef.id,
 				agentId: readString(params.agentId) ?? "copilot",
@@ -1974,6 +2020,7 @@ async function runCopilotAttempt(params, deps) {
 			developerInstructions: originalDeveloperInstructions,
 			messages,
 			ctx: hookContext,
+			bootstrapContextRunKind: input.bootstrapContextRunKind,
 			..."beforeAgentStartResult" in input ? { beforeAgentStartResult: input.beforeAgentStartResult } : {}
 		});
 		const attemptInput = promptBuild.prompt === input.prompt ? input : {
@@ -2003,7 +2050,8 @@ async function runCopilotAttempt(params, deps) {
 			signal: params.abortSignal
 		});
 		userInputBridgeRef = userInputBridge;
-		const sessionConfig = createSessionConfig(attemptInput, modelRef.id, sdkTools, poolAcquire.auth, promptBuild.developerInstructions || void 0, effectiveWorkspaceDir, effectiveCwd, userInputBridge.onUserInputRequest, hasNativePromptHook ? { onUserPromptSubmitted: ({ additionalContext, prompt }) => emitLlmInput(prompt, additionalContext) } : void 0);
+		const sessionConfig = createSessionConfig(attemptInput, modelRef.id, sdkTools, poolAcquire.auth, sessionProvider, promptBuild.developerInstructions || void 0, effectiveWorkspaceDir, effectiveCwd, userInputBridge.onUserInputRequest, hasNativePromptHook ? { onUserPromptSubmitted: ({ additionalContext, prompt }) => emitLlmInput(prompt, additionalContext) } : void 0);
+		const compactionSessionConfig = byokProxy ? createSessionConfig(attemptInput, modelRef.id, sdkTools, poolAcquire.auth, poolAcquire.provider, promptBuild.developerInstructions || void 0, effectiveWorkspaceDir, effectiveCwd, userInputBridge.onUserInputRequest, hasNativePromptHook ? { onUserPromptSubmitted: ({ additionalContext, prompt }) => emitLlmInput(prompt, additionalContext) } : void 0) : sessionConfig;
 		const replayDecision = decideReplayAction({
 			sdkSessionId: input.initialReplayState?.sdkSessionId,
 			replayInvalid: input.initialReplayState?.replayInvalid
@@ -2026,6 +2074,7 @@ async function runCopilotAttempt(params, deps) {
 		sessionIdUsed = sdkSessionId ?? input.sessionId;
 		if (sdkSessionId && deps.onSessionEstablished) try {
 			deps.onSessionEstablished({
+				compactionSessionConfig,
 				sdkSessionId,
 				pooledClient: handle,
 				sessionConfig
@@ -2078,6 +2127,7 @@ async function runCopilotAttempt(params, deps) {
 		const messageOptions = await createMessageOptions(attemptInput, {
 			effectiveCwd,
 			effectiveWorkspaceDir,
+			provider: poolAcquire.provider,
 			sandbox,
 			workspaceOnly: effectiveFsWorkspaceOnly
 		});
@@ -2121,6 +2171,7 @@ async function runCopilotAttempt(params, deps) {
 				awaitSessionIdle: !bridge.hasObservedSessionIdle(),
 				bridge,
 				cleanupToolBridge,
+				cleanupByokProxy,
 				finalizeNativeSubagents: () => nativeSubagentTaskMirror?.finalizeActiveRuns(),
 				handle,
 				pool: deps.pool,
@@ -2144,6 +2195,7 @@ async function runCopilotAttempt(params, deps) {
 			await bridge?.awaitAgentEventChain();
 			nativeSubagentTaskMirror?.finalizeActiveRuns();
 			cleanupToolBridge?.();
+			await cleanupByokProxy?.();
 			bridge?.detach();
 			params.abortSignal?.removeEventListener("abort", onAbort);
 			if (session) try {
@@ -2299,7 +2351,7 @@ function createPromptError(code, message, cause) {
 	if (cause !== void 0) error.cause = cause;
 	return error;
 }
-function createSessionConfig(params, sdkModelId, sdkTools, resolvedAuth, systemMessageContent, effectiveWorkspaceDir, effectiveCwd, onUserInputRequest, hooksBridgeOptions) {
+function createSessionConfig(params, sdkModelId, sdkTools, resolvedAuth, resolvedProvider, systemMessageContent, effectiveWorkspaceDir, effectiveCwd, onUserInputRequest, hooksBridgeOptions) {
 	const permissionPolicy = params.permissionPolicy ?? rejectAllPolicy;
 	const hooks = createHooksBridge(params.hooksConfig, hooksBridgeOptions);
 	const infiniteSessions = createInfiniteSessionConfig(params.infiniteSessionConfig);
@@ -2307,6 +2359,7 @@ function createSessionConfig(params, sdkModelId, sdkTools, resolvedAuth, systemM
 		model: sdkModelId,
 		onPermissionRequest: createPermissionBridge(permissionPolicy),
 		onUserInputRequest,
+		...resolvedProvider.provider ? { provider: resolvedProvider.provider } : {},
 		...hooks ? { hooks } : {},
 		...typeof params.enableSessionTelemetry === "boolean" ? { enableSessionTelemetry: params.enableSessionTelemetry } : {},
 		...infiniteSessions ? { infiniteSessions } : {},
@@ -2327,10 +2380,16 @@ function buildCopilotAvailableTools(sdkTools) {
 }
 async function createMessageOptions(params, context) {
 	const attachments = createPromptImageAttachments(await resolvePromptImages(params, context));
-	return attachments.length > 0 ? {
+	const requestHeaders = resolveProviderRequestHeaders(context.provider);
+	return {
 		prompt: params.prompt,
-		attachments
-	} : { prompt: params.prompt };
+		...attachments.length > 0 ? { attachments } : {},
+		...requestHeaders ? { requestHeaders } : {}
+	};
+}
+function resolveProviderRequestHeaders(provider) {
+	const headers = provider.provider?.headers;
+	return headers && Object.keys(headers).length > 0 ? { ...headers } : void 0;
 }
 function createPromptImageAttachments(images) {
 	return images.flatMap((image, index) => {
@@ -2373,7 +2432,7 @@ function createSystemMessageContent(params, workspaceBootstrapInstructions) {
 	if (bootstrap) sections.push(bootstrap);
 	const extraSystemPrompt = readString(params.extraSystemPrompt)?.trim();
 	if (extraSystemPrompt && !isRawCopilotModelRun(params)) {
-		const contextHeader = params.promptMode === "minimal" ? "## Subagent Context" : "## Group Chat Context";
+		const contextHeader = params.promptMode === "minimal" ? "## Subagent Context" : "## Conversation Context";
 		sections.push(`${contextHeader}\n${extraSystemPrompt}`);
 	}
 	return sections.length > 0 ? sections.join("\n\n") : void 0;
@@ -2416,19 +2475,47 @@ function readResolvedAttemptPath(value) {
 	return resolveUserPath(raw);
 }
 function resolveModelRef(params) {
-	const rawModel = params.model;
-	if (rawModel && typeof rawModel === "object") return {
-		api: readString(rawModel.api),
-		id: readString(rawModel.id) ?? readString(params.modelId) ?? "unknown-model",
-		provider: readString(rawModel.provider) ?? readString(params.provider) ?? "unknown-provider"
-	};
+	const rawModel = params.runtimeModel ?? params.model;
+	if (rawModel && typeof rawModel === "object") {
+		const model = rawModel;
+		const requestTransport = getModelProviderRequestTransport(rawModel);
+		const rawRequest = model.request;
+		return {
+			api: readString(model.api),
+			id: readString(model.id) ?? readString(params.modelId) ?? "unknown-model",
+			provider: readString(model.provider) ?? readString(params.provider) ?? "unknown-provider",
+			baseUrl: readString(model.baseUrl),
+			azureApiVersion: readString(model.azureApiVersion ?? model.params?.azureApiVersion),
+			headers: model.headers,
+			authHeader: model.authHeader,
+			requestAuthMode: readString(requestTransport?.auth?.mode ?? rawRequest?.auth?.mode),
+			requestProxy: requestTransport?.proxy ?? rawRequest?.proxy,
+			requestTls: requestTransport?.tls ?? rawRequest?.tls,
+			requestAllowPrivateNetwork: requestTransport?.allowPrivateNetwork ?? rawRequest?.allowPrivateNetwork,
+			contextTokens: model.contextTokens,
+			contextWindow: model.contextWindow,
+			maxTokens: model.maxTokens
+		};
+	}
 	return {
 		id: readString(typeof rawModel === "string" ? rawModel : void 0) ?? readString(params.modelId) ?? "unknown-model",
 		provider: readString(params.provider) ?? "unknown-provider"
 	};
 }
 function resolvePoolAcquire(params) {
-	const resolved = resolveCopilotAuth({
+	const provider = resolveCopilotProvider({
+		model: resolveModelRef(params),
+		resolvedApiKey: readString(params.resolvedApiKey),
+		authProfileId: readString(params.authProfileId)
+	});
+	const auth = provider.mode === "byok" ? createCopilotByokAuth({
+		agentId: readString(params.agentId),
+		agentDir: readString(params.agentDir),
+		workspaceDir: readString(params.workspaceDir),
+		copilotHome: readString(params.copilotHome),
+		authProfileId: provider.authProfileId,
+		authProfileVersion: provider.authProfileVersion
+	}) : resolveCopilotAuth({
 		agentId: readString(params.agentId),
 		agentDir: readString(params.agentDir),
 		workspaceDir: readString(params.workspaceDir),
@@ -2440,20 +2527,21 @@ function resolvePoolAcquire(params) {
 	});
 	return {
 		key: {
-			agentId: resolved.agentId,
-			authMode: resolved.authMode,
-			...resolved.authMode === "gitHubToken" ? {
-				authProfileId: resolved.authProfileId,
-				authProfileVersion: resolved.authProfileVersion
+			agentId: auth.agentId,
+			authMode: auth.authMode,
+			...auth.authMode === "gitHubToken" || auth.authMode === "byok" ? {
+				authProfileId: auth.authProfileId,
+				authProfileVersion: auth.authProfileVersion
 			} : {},
-			copilotHome: resolved.copilotHome
+			copilotHome: auth.copilotHome
 		},
 		options: {
-			copilotHome: resolved.copilotHome,
-			gitHubToken: resolved.authMode === "gitHubToken" ? resolved.gitHubToken : void 0,
-			useLoggedInUser: resolved.authMode === "useLoggedInUser"
+			copilotHome: auth.copilotHome,
+			...auth.authMode === "gitHubToken" && auth.gitHubToken ? { gitHubToken: auth.gitHubToken } : {},
+			useLoggedInUser: auth.authMode === "useLoggedInUser"
 		},
-		auth: resolved
+		auth,
+		provider
 	};
 }
 function toError(error) {

package/dist/{harness-D-3KWchY.js → harness-B9xB4LpE.js}

@@ -1,7 +1,12 @@
-import { buildAgentHookContextChannelFields, compactWithSafetyTimeout, resolveCompactionTimeoutMs, runAgentHarnessAfterCompactionHook, runAgentHarnessBeforeCompactionHook } from "openclaw/plugin-sdk/agent-harness-runtime";
-import { createHash } from "node:crypto";
+import { buildAgentHookContextChannelFields, compactWithSafetyTimeout, getModelProviderRequestTransport, resolveCompactionTimeoutMs, runAgentHarnessAfterCompactionHook, runAgentHarnessBeforeCompactionHook } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { createHash, randomBytes } from "node:crypto";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
+import { createServer } from "node:http";
+import { Readable } from "node:stream";
+import { finished } from "node:stream/promises";
+import { fetchWithSsrFGuard, isBlockedHostnameOrIp } from "openclaw/plugin-sdk/ssrf-runtime";
+import { isNonSecretApiKeyMarker } from "openclaw/plugin-sdk/provider-auth";
 //#region extensions/copilot/src/auth-bridge.ts
 /**
 * Pure functional auth resolver for the copilot agent runtime.
@@ -48,6 +53,22 @@ import { join, resolve } from "node:path";
 */
 const COPILOT_TOKEN_PROFILE_ERROR = "[copilot-attempt] gitHubToken auth requires profileId+profileVersion (pool keying safety; per Q5/Q1 decisions)";
 const COPILOT_DEFAULT_AGENT_ID = "copilot";
+function createCopilotByokAuth(input) {
+	return {
+		...resolveCopilotAuth({
+			agentId: input.agentId,
+			agentDir: input.agentDir,
+			workspaceDir: input.workspaceDir,
+			copilotHome: input.copilotHome,
+			env: input.env,
+			homeDir: input.homeDir,
+			auth: { useLoggedInUser: true }
+		}),
+		authMode: "byok",
+		authProfileId: input.authProfileId?.trim() || "byok:resolved",
+		authProfileVersion: input.authProfileVersion?.trim() || "byok:unfingerprinted"
+	};
+}
 /**
 * Resolve copilot auth + copilotHome.
 *
@@ -63,16 +84,16 @@ function resolveCopilotAuth(input) {
 	const homeDir = input.homeDir ?? homedir;
 	const agentId = sanitizeAgentId(input.agentId);
 	const copilotHome = resolveCopilotHome({
-		explicit: readString(input.copilotHome),
-		agentDir: readString(input.agentDir),
-		workspaceDir: readString(input.workspaceDir),
+		explicit: readString$1(input.copilotHome),
+		agentDir: readString$1(input.agentDir),
+		workspaceDir: readString$1(input.workspaceDir),
 		agentId,
 		env,
 		homeDir
 	});
-	const explicitToken = readString(input.auth?.gitHubToken);
-	const explicitProfileId = readString(input.auth?.profileId) ?? readString(input.authProfileId);
-	const explicitProfileVersion = readString(input.auth?.profileVersion) ?? readString(input.profileVersion);
+	const explicitToken = readString$1(input.auth?.gitHubToken);
+	const explicitProfileId = readString$1(input.auth?.profileId) ?? readString$1(input.authProfileId);
+	const explicitProfileVersion = readString$1(input.auth?.profileVersion) ?? readString$1(input.profileVersion);
 	if (input.auth?.useLoggedInUser === true) return {
 		authMode: "useLoggedInUser",
 		copilotHome,
@@ -89,11 +110,11 @@ function resolveCopilotAuth(input) {
 			agentId
 		};
 	}
-	const contractToken = readString(input.resolvedApiKey);
+	const contractToken = readString$1(input.resolvedApiKey);
 	if (contractToken) return {
 		authMode: "gitHubToken",
 		gitHubToken: contractToken,
-		authProfileId: readString(input.authProfileId) ?? "pi:resolved",
+		authProfileId: readString$1(input.authProfileId) ?? "pi:resolved",
 		authProfileVersion: tokenFingerprint(contractToken),
 		copilotHome,
 		agentId
@@ -134,7 +155,7 @@ function sanitizeAgentId(value) {
 function resolveCopilotHome(args) {
 	if (args.explicit) return resolve(args.explicit);
 	if (args.agentDir) return resolve(join(args.agentDir, "copilot"));
-	const openClawHome = readString(args.env.OPENCLAW_HOME);
+	const openClawHome = readString$1(args.env.OPENCLAW_HOME);
 	return resolve(join(openClawHome ? resolve(openClawHome) : safeHomeDir(args.homeDir), ".openclaw", "agents", args.agentId, "copilot"));
 }
 function safeHomeDir(homeDir) {
@@ -148,19 +169,19 @@ function readEnvTokenFallback(env) {
 	const candidates = [
 		{
 			name: "OPENCLAW_GITHUB_TOKEN",
-			value: readString(env.OPENCLAW_GITHUB_TOKEN)
+			value: readString$1(env.OPENCLAW_GITHUB_TOKEN)
 		},
 		{
 			name: "COPILOT_GITHUB_TOKEN",
-			value: readString(env.COPILOT_GITHUB_TOKEN)
+			value: readString$1(env.COPILOT_GITHUB_TOKEN)
 		},
 		{
 			name: "GH_TOKEN",
-			value: readString(env.GH_TOKEN)
+			value: readString$1(env.GH_TOKEN)
 		},
 		{
 			name: "GITHUB_TOKEN",
-			value: readString(env.GITHUB_TOKEN)
+			value: readString$1(env.GITHUB_TOKEN)
 		}
 	];
 	for (const { name, value } of candidates) if (value) return {
@@ -180,15 +201,382 @@ function readEnvTokenFallback(env) {
 function tokenFingerprint(token) {
 	return `sha256:${createHash("sha256").update(token).digest("hex").slice(0, 12)}`;
 }
-function readString(value) {
+function readString$1(value) {
 	return typeof value === "string" && value.length > 0 ? value : void 0;
 }
 //#endregion
+//#region extensions/copilot/src/byok-proxy.ts
+const LOOPBACK_HOST = "127.0.0.1";
+async function createCopilotByokProxy(resolvedProvider) {
+	if (resolvedProvider.mode !== "byok") return;
+	const providerConfig = resolvedProvider.provider;
+	if (!providerConfig?.baseUrl) throw new Error("[copilot-attempt] BYOK requires a provider baseUrl");
+	const targetBaseUrl = new URL(providerConfig.baseUrl);
+	const nonce = randomBytes(12).toString("hex");
+	const targetPathPrefix = trimTrailingSlash(targetBaseUrl.pathname);
+	const proxyPathPrefix = `/${nonce}${targetPathPrefix}`;
+	const acceptsAzureSdkPaths = providerConfig.type === "azure";
+	const activeFetches = /* @__PURE__ */ new Set();
+	const server = createServer((req, res) => {
+		handleProxyRequest(req, res, {
+			acceptsAzureSdkPaths,
+			activeFetches,
+			proxyPathPrefix,
+			targetBaseUrl,
+			targetPathPrefix
+		});
+	});
+	await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(0, LOOPBACK_HOST, () => {
+			server.off("error", reject);
+			resolve();
+		});
+	});
+	const address = server.address();
+	if (!address || typeof address === "string") {
+		server.close();
+		throw new Error("[copilot-attempt] failed to start BYOK network proxy");
+	}
+	const proxyBaseUrl = `http://${LOOPBACK_HOST}:${address.port}${proxyPathPrefix}`;
+	const sdkBaseUrl = acceptsAzureSdkPaths ? `http://${LOOPBACK_HOST}:${address.port}` : proxyBaseUrl;
+	return {
+		provider: {
+			...resolvedProvider,
+			provider: {
+				...providerConfig,
+				baseUrl: sdkBaseUrl
+			}
+		},
+		close: async () => {
+			for (const controller of activeFetches) controller.abort();
+			await new Promise((resolve) => {
+				server.close(() => resolve());
+			});
+		}
+	};
+}
+async function handleProxyRequest(req, res, params) {
+	let guarded;
+	const upstreamAbort = new AbortController();
+	params.activeFetches.add(upstreamAbort);
+	const abortUpstream = () => upstreamAbort.abort();
+	req.on("aborted", abortUpstream);
+	res.on("close", () => {
+		if (!res.writableEnded) abortUpstream();
+	});
+	try {
+		const url = resolveTargetUrl(req, params);
+		if (!url) {
+			res.writeHead(404);
+			res.end("Not found");
+			return;
+		}
+		const body = req.method === "GET" || req.method === "HEAD" ? void 0 : await readBody(req);
+		guarded = await fetchWithSsrFGuard({
+			url: url.toString(),
+			init: {
+				method: req.method,
+				headers: normalizeProxyRequestHeaders(req.headers),
+				signal: upstreamAbort.signal,
+				...body ? { body: toFetchBody(body) } : {}
+			},
+			auditContext: "copilot-byok-provider",
+			requireHttps: true
+		});
+		res.writeHead(guarded.response.status, guarded.response.statusText, normalizeProxyResponseHeaders(guarded.response.headers));
+		if (!guarded.response.body) {
+			res.end();
+			return;
+		}
+		await finished(Readable.fromWeb(guarded.response.body).pipe(res));
+	} catch (error) {
+		if (res.destroyed || res.writableEnded) return;
+		if (res.headersSent) {
+			res.destroy(error instanceof Error ? error : void 0);
+			return;
+		}
+		res.writeHead(502);
+		res.end(error instanceof Error ? error.message : "BYOK provider proxy failed");
+	} finally {
+		req.off("aborted", abortUpstream);
+		params.activeFetches.delete(upstreamAbort);
+		await guarded?.release().catch(() => void 0);
+	}
+}
+function resolveTargetUrl(req, params) {
+	const incomingUrl = new URL(req.url ?? "/", `http://${LOOPBACK_HOST}`);
+	if (incomingUrl.pathname !== params.proxyPathPrefix && !incomingUrl.pathname.startsWith(`${params.proxyPathPrefix}/`)) return params.acceptsAzureSdkPaths && isAzureSdkProxyPath(incomingUrl.pathname) ? resolveDirectTargetUrl(incomingUrl, params.targetBaseUrl) : void 0;
+	const suffix = incomingUrl.pathname.slice(params.proxyPathPrefix.length);
+	const targetUrl = new URL(params.targetBaseUrl);
+	targetUrl.pathname = `${params.targetPathPrefix}${suffix}` || "/";
+	for (const [key, value] of incomingUrl.searchParams) targetUrl.searchParams.append(key, value);
+	return targetUrl;
+}
+function resolveDirectTargetUrl(incomingUrl, targetBaseUrl) {
+	const targetUrl = new URL(targetBaseUrl);
+	targetUrl.pathname = incomingUrl.pathname;
+	for (const [key, value] of incomingUrl.searchParams) targetUrl.searchParams.append(key, value);
+	return targetUrl;
+}
+function isAzureSdkProxyPath(pathname) {
+	return pathname === "/openai" || pathname.startsWith("/openai/");
+}
+async function readBody(req) {
+	const chunks = [];
+	for await (const chunk of req) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+	return chunks.length > 0 ? Buffer.concat(chunks) : void 0;
+}
+function toFetchBody(body) {
+	const copy = new Uint8Array(body.byteLength);
+	copy.set(body);
+	return copy;
+}
+function normalizeProxyRequestHeaders(headers) {
+	const out = {};
+	for (const [key, value] of Object.entries(headers)) {
+		if (isHopByHopHeader(key) || key.toLowerCase() === "accept-encoding") continue;
+		const normalized = normalizeHeaderValue(value);
+		if (normalized !== void 0) out[key] = normalized;
+	}
+	out["accept-encoding"] = "identity";
+	return out;
+}
+function normalizeProxyResponseHeaders(headers) {
+	const out = {};
+	headers.forEach((value, key) => {
+		if (!isHopByHopHeader(key) && !isContentEncodingHeader(key)) out[key] = value;
+	});
+	return out;
+}
+function normalizeHeaderValue(value) {
+	if (value === void 0) return;
+	return Array.isArray(value) ? value.join(", ") : String(value);
+}
+function isHopByHopHeader(key) {
+	switch (key.toLowerCase()) {
+		case "connection":
+		case "host":
+		case "keep-alive":
+		case "proxy-authenticate":
+		case "proxy-authorization":
+		case "te":
+		case "trailer":
+		case "transfer-encoding":
+		case "upgrade": return true;
+		default: return false;
+	}
+}
+function isContentEncodingHeader(key) {
+	switch (key.toLowerCase()) {
+		case "content-encoding":
+		case "content-length": return true;
+		default: return false;
+	}
+}
+function trimTrailingSlash(pathname) {
+	const trimmed = pathname.replace(/\/+$/, "");
+	return trimmed === "" ? "" : trimmed;
+}
+//#endregion
+//#region extensions/copilot/src/provider-bridge.ts
+const COPILOT_BYOK_PROVIDER_ERROR = "[copilot-attempt] BYOK requires an OpenAI-compatible or Anthropic model api and a non-empty baseUrl";
+const COPILOT_BYOK_TRANSPORT_POLICY_ERROR = "[copilot-attempt] BYOK does not support OpenClaw provider request proxy, TLS, or private-network policy overrides";
+const COPILOT_BYOK_ENDPOINT_POLICY_ERROR = "[copilot-attempt] BYOK endpoint is blocked by OpenClaw SSRF policy";
+const CREDENTIAL_QUERY_PARAM_NAMES = new Set([
+	"accesstoken",
+	"appsecret",
+	"auth",
+	"authtoken",
+	"apikey",
+	"authorization",
+	"clientsecret",
+	"code",
+	"credential",
+	"hooktoken",
+	"idtoken",
+	"jwt",
+	"key",
+	"pass",
+	"passwd",
+	"password",
+	"privatekey",
+	"refreshtoken",
+	"secret",
+	"session",
+	"sig",
+	"signature",
+	"token",
+	"xapikey",
+	"xaccesstoken",
+	"xamzsecuritytoken",
+	"xamzsignature",
+	"xauthtoken"
+]);
+const QUERY_PARAM_NAME_SEPARATOR_RE = /[\p{C}\p{Z}\u115F\u1160\u3164\uFFA0+]/gu;
+/**
+* Maps OpenClaw's prepared model facts into the Copilot SDK's session-level
+* provider contract. The SDK owns the wire request; OpenClaw only supplies
+* the already-resolved endpoint, model, headers, and credential.
+*/
+function resolveCopilotProvider(params) {
+	if (params.model.provider.trim().toLowerCase() === "github-copilot") return { mode: "github-copilot" };
+	const baseUrl = readString(params.model.baseUrl);
+	if (!baseUrl) throw new Error(COPILOT_BYOK_PROVIDER_ERROR);
+	assertByokEndpointAllowed(baseUrl);
+	if (hasUnsupportedTransportPolicy(params.model)) throw new Error(COPILOT_BYOK_TRANSPORT_POLICY_ERROR);
+	const api = readString(params.model.api)?.toLowerCase() ?? "openai-responses";
+	const provider = resolveProviderType(api, baseUrl, params.model.azureApiVersion);
+	const resolvedApiKey = resolveProviderCredential(params.resolvedApiKey);
+	const headers = resolveProviderHeaders(params.model.headers);
+	const requestAuthMode = readString(params.model.requestAuthMode)?.toLowerCase();
+	const usePreparedRequestAuth = requestAuthMode !== void 0 && requestAuthMode !== "provider-default";
+	return {
+		mode: "byok",
+		provider: {
+			type: provider.type,
+			...provider.wireApi ? { wireApi: provider.wireApi } : {},
+			baseUrl: provider.baseUrl,
+			modelId: params.model.id,
+			wireModel: params.model.id,
+			...resolvedApiKey && !usePreparedRequestAuth ? params.model.authHeader ? { bearerToken: resolvedApiKey } : { apiKey: resolvedApiKey } : {},
+			...headers ? { headers } : {},
+			...provider.azure ? { azure: provider.azure } : {},
+			...params.model.contextTokens ?? params.model.contextWindow ? { maxPromptTokens: params.model.contextTokens ?? params.model.contextWindow } : {},
+			...params.model.maxTokens ? { maxOutputTokens: params.model.maxTokens } : {}
+		},
+		authProfileId: params.authProfileId?.trim() || `byok:${params.model.provider}`,
+		authProfileVersion: tokenFingerprint(stableSerialize({
+			api,
+			baseUrl: provider.baseUrl,
+			azureApiVersion: provider.azure?.apiVersion,
+			headers,
+			authHeader: params.model.authHeader,
+			requestAuthMode: params.model.requestAuthMode,
+			apiKey: resolvedApiKey,
+			modelId: params.model.id,
+			maxPromptTokens: params.model.contextTokens ?? params.model.contextWindow,
+			maxOutputTokens: params.model.maxTokens
+		}))
+	};
+}
+function isCopilotByokUnsupportedProviderError(error) {
+	return error instanceof Error && (error.message === "[copilot-attempt] BYOK requires an OpenAI-compatible or Anthropic model api and a non-empty baseUrl" || error.message === "[copilot-attempt] BYOK does not support OpenClaw provider request proxy, TLS, or private-network policy overrides" || error.message === "[copilot-attempt] BYOK endpoint is blocked by OpenClaw SSRF policy");
+}
+function supportsCopilotByokProviderShape(model) {
+	if (!readString(model.baseUrl) || hasUnsupportedTransportPolicy(model)) return false;
+	try {
+		resolveProviderType(readString(model.api)?.toLowerCase() ?? "openai-responses", readString(model.baseUrl), void 0);
+		assertByokEndpointHostAllowed(readString(model.baseUrl));
+		return true;
+	} catch {
+		return false;
+	}
+}
+function hasUnsupportedTransportPolicy(model) {
+	return model.requestProxy !== void 0 || model.requestTls !== void 0 || model.requestAllowPrivateNetwork !== void 0;
+}
+function assertByokEndpointHostAllowed(baseUrl) {
+	let url;
+	try {
+		url = new URL(baseUrl);
+	} catch {
+		throw new Error(COPILOT_BYOK_PROVIDER_ERROR);
+	}
+	if (url.protocol !== "https:") throw new Error(COPILOT_BYOK_ENDPOINT_POLICY_ERROR);
+	if (url.username || url.password) throw new Error(COPILOT_BYOK_ENDPOINT_POLICY_ERROR);
+	for (const key of url.searchParams.keys()) if (CREDENTIAL_QUERY_PARAM_NAMES.has(normalizeCredentialQueryParamName(key))) throw new Error(COPILOT_BYOK_ENDPOINT_POLICY_ERROR);
+	if (isBlockedHostnameOrIp(url.hostname.toLowerCase().replace(/\.+$/, ""))) throw new Error(COPILOT_BYOK_ENDPOINT_POLICY_ERROR);
+}
+function normalizeCredentialQueryParamName(name) {
+	const stripped = name.replace(QUERY_PARAM_NAME_SEPARATOR_RE, "");
+	try {
+		return decodeURIComponent(stripped).replace(QUERY_PARAM_NAME_SEPARATOR_RE, "").toLowerCase().replace(/[-_]/g, "");
+	} catch {
+		return stripped.toLowerCase().replace(/[-_]/g, "");
+	}
+}
+function assertByokEndpointAllowed(baseUrl) {
+	assertByokEndpointHostAllowed(baseUrl);
+}
+function resolveProviderType(api, baseUrl, azureApiVersion) {
+	switch (api) {
+		case "anthropic-messages": return {
+			type: "anthropic",
+			baseUrl
+		};
+		case "azure-openai-responses": return resolveAzureProviderType(baseUrl, azureApiVersion);
+		case "openai-responses": return {
+			type: "openai",
+			wireApi: "responses",
+			baseUrl
+		};
+		case "openai-completions":
+		case "ollama": return {
+			type: "openai",
+			wireApi: "completions",
+			baseUrl
+		};
+		default: throw new Error(COPILOT_BYOK_PROVIDER_ERROR);
+	}
+}
+function resolveAzureProviderType(baseUrl, apiVersion) {
+	let url;
+	try {
+		url = new URL(baseUrl);
+	} catch {
+		throw new Error(COPILOT_BYOK_PROVIDER_ERROR);
+	}
+	if (isOpenAICompatibleAzureResponsesBaseUrl(url)) return {
+		type: "openai",
+		wireApi: "responses",
+		baseUrl
+	};
+	if (!isTraditionalAzureOpenAIHost(url.hostname)) throw new Error(COPILOT_BYOK_PROVIDER_ERROR);
+	url.pathname = "";
+	url.search = "";
+	url.hash = "";
+	const resolvedApiVersion = readString(apiVersion);
+	return {
+		type: "azure",
+		wireApi: "responses",
+		baseUrl: url.toString().replace(/\/+$/, ""),
+		...resolvedApiVersion ? { azure: { apiVersion: resolvedApiVersion } } : {}
+	};
+}
+function isTraditionalAzureOpenAIHost(hostname) {
+	return hostname.endsWith(".openai.azure.com") || hostname.endsWith(".cognitiveservices.azure.com");
+}
+function isOpenAICompatibleAzureResponsesBaseUrl(url) {
+	if (isTraditionalAzureOpenAIHost(url.hostname)) return false;
+	const hostname = url.hostname.toLowerCase();
+	if (!(hostname.endsWith(".services.ai.azure.com") || hostname.endsWith(".api.cognitive.microsoft.com"))) return false;
+	const normalizedPath = url.pathname.replace(/\/+$/, "");
+	return normalizedPath === "/openai/v1" || normalizedPath.endsWith("/openai/v1");
+}
+function stableSerialize(value) {
+	if (Array.isArray(value)) return `[${value.map(stableSerialize).join(",")}]`;
+	if (value && typeof value === "object") return `{${Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => `${JSON.stringify(key)}:${stableSerialize(entry)}`).join(",")}}`;
+	return JSON.stringify(value) ?? "null";
+}
+function readString(value) {
+	return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function resolveProviderCredential(value) {
+	const credential = readString(value);
+	return credential && !isNonSecretApiKeyMarker(credential) ? credential : void 0;
+}
+function resolveProviderHeaders(headers) {
+	if (!headers) return;
+	const resolved = Object.fromEntries(Object.entries(headers).filter(([, value]) => typeof value === "string"));
+	return Object.keys(resolved).length > 0 ? resolved : void 0;
+}
+//#endregion
 //#region extensions/copilot/harness.ts
 const COPILOT_PROVIDER_IDS = new Set(["github-copilot"]);
 function sessionAuthFields(auth) {
-	return auth.authMode === "gitHubToken" ? {
-		authMode: "gitHubToken",
+	return auth.authMode === "gitHubToken" || auth.authMode === "byok" ? {
+		authMode: auth.authMode,
 		authProfileId: auth.authProfileId,
 		authProfileVersion: auth.authProfileVersion
 	} : { authMode: "useLoggedInUser" };
@@ -196,17 +584,17 @@ function sessionAuthFields(auth) {
 function sessionAuthMatches(stored, current) {
 	if (stored.authMode !== current.authMode) return false;
 	if (stored.authMode === "useLoggedInUser") return true;
-	return current.authMode === "gitHubToken" && stored.authProfileId === current.authProfileId && stored.authProfileVersion === current.authProfileVersion;
+	return current.authMode === stored.authMode && stored.authProfileId === current.authProfileId && stored.authProfileVersion === current.authProfileVersion;
 }
 function normalizeBinding(value) {
-	if (!value || value.schemaVersion !== 2 || typeof value.sdkSessionId !== "string" || value.sdkSessionId.trim() === "" || typeof value.compatKey !== "string" || value.compatKey.trim() === "" || typeof value.compactKey !== "string" || value.compactKey.trim() === "" || value.authMode !== "gitHubToken" && value.authMode !== "useLoggedInUser" || value.authMode === "gitHubToken" && (typeof value.authProfileId !== "string" || value.authProfileId.trim() === "" || typeof value.authProfileVersion !== "string" || value.authProfileVersion.trim() === "") || typeof value.updatedAt !== "number" || !Number.isFinite(value.updatedAt)) return;
+	if (!value || value.schemaVersion !== 2 || typeof value.sdkSessionId !== "string" || value.sdkSessionId.trim() === "" || typeof value.compatKey !== "string" || value.compatKey.trim() === "" || typeof value.compactKey !== "string" || value.compactKey.trim() === "" || value.authMode !== "gitHubToken" && value.authMode !== "byok" && value.authMode !== "useLoggedInUser" || (value.authMode === "gitHubToken" || value.authMode === "byok") && (typeof value.authProfileId !== "string" || value.authProfileId.trim() === "" || typeof value.authProfileVersion !== "string" || value.authProfileVersion.trim() === "") || typeof value.updatedAt !== "number" || !Number.isFinite(value.updatedAt)) return;
 	return {
 		schemaVersion: 2,
 		sdkSessionId: value.sdkSessionId.trim(),
 		compatKey: value.compatKey,
 		compactKey: value.compactKey,
 		authMode: value.authMode,
-		...value.authMode === "gitHubToken" ? {
+		...value.authMode === "gitHubToken" || value.authMode === "byok" ? {
 			authProfileId: value.authProfileId,
 			authProfileVersion: value.authProfileVersion
 		} : {},
@@ -290,23 +678,61 @@ function readAgentIdFromSessionKey(sessionKey) {
 }
 function computeSessionKey(params, options) {
 	const p = params;
-	const modelObj = p.model && typeof p.model === "object" ? p.model : { id: typeof p.model === "string" ? p.model : void 0 };
+	const modelObj = p.model && typeof p.model === "object" ? p.model : p.runtimeModel && typeof p.runtimeModel === "object" ? p.runtimeModel : { id: typeof p.model === "string" ? p.model : void 0 };
 	const provider = modelObj.provider ?? (typeof p.provider === "string" ? p.provider : "");
 	const modelId = modelObj.id ?? (typeof p.modelId === "string" ? p.modelId : void 0) ?? (typeof p.model === "string" ? p.model : "");
+	const requestTransport = p.model && typeof p.model === "object" ? getModelProviderRequestTransport(p.model) : void 0;
+	const requestAuthMode = readSessionString(requestTransport?.auth?.mode ?? modelObj.request?.auth?.mode);
+	const azureApiVersion = readSessionString(modelObj.azureApiVersion ?? modelObj.params?.azureApiVersion);
 	let authParts;
 	let resolvedAgentId = "";
 	let resolvedCopilotHome = "";
 	try {
-		const resolved = resolveCopilotAuth({
+		const resolved = !options.includeAuth ? resolveCopilotAuth({
 			agentId: typeof p.agentId === "string" ? p.agentId : readAgentIdFromSessionKey(p.sessionKey),
 			agentDir: typeof p.agentDir === "string" ? p.agentDir : void 0,
 			workspaceDir: typeof p.workspaceDir === "string" ? p.workspaceDir : void 0,
 			copilotHome: typeof p.copilotHome === "string" ? p.copilotHome : void 0,
-			auth: p.auth,
-			resolvedApiKey: typeof p.resolvedApiKey === "string" ? p.resolvedApiKey : void 0,
-			authProfileId: typeof p.authProfileId === "string" ? p.authProfileId : void 0,
-			profileVersion: typeof p.profileVersion === "string" ? p.profileVersion : void 0
-		});
+			auth: { useLoggedInUser: true }
+		}) : (() => {
+			const modelProvider = resolveCopilotProvider({
+				model: {
+					api: modelObj.api,
+					id: modelId,
+					provider,
+					baseUrl: modelObj.baseUrl,
+					azureApiVersion,
+					headers: modelObj.headers,
+					authHeader: modelObj.authHeader,
+					requestAuthMode,
+					requestProxy: requestTransport?.proxy ?? modelObj.request?.proxy,
+					requestTls: requestTransport?.tls ?? modelObj.request?.tls,
+					requestAllowPrivateNetwork: requestTransport?.allowPrivateNetwork ?? modelObj.request?.allowPrivateNetwork,
+					contextTokens: modelObj.contextTokens,
+					contextWindow: modelObj.contextWindow,
+					maxTokens: modelObj.maxTokens
+				},
+				resolvedApiKey: typeof p.resolvedApiKey === "string" ? p.resolvedApiKey : void 0,
+				authProfileId: typeof p.authProfileId === "string" ? p.authProfileId : void 0
+			});
+			return modelProvider.mode === "byok" ? createCopilotByokAuth({
+				agentId: typeof p.agentId === "string" ? p.agentId : readAgentIdFromSessionKey(p.sessionKey),
+				agentDir: typeof p.agentDir === "string" ? p.agentDir : void 0,
+				workspaceDir: typeof p.workspaceDir === "string" ? p.workspaceDir : void 0,
+				copilotHome: typeof p.copilotHome === "string" ? p.copilotHome : void 0,
+				authProfileId: modelProvider.authProfileId,
+				authProfileVersion: modelProvider.authProfileVersion
+			}) : resolveCopilotAuth({
+				agentId: typeof p.agentId === "string" ? p.agentId : readAgentIdFromSessionKey(p.sessionKey),
+				agentDir: typeof p.agentDir === "string" ? p.agentDir : void 0,
+				workspaceDir: typeof p.workspaceDir === "string" ? p.workspaceDir : void 0,
+				copilotHome: typeof p.copilotHome === "string" ? p.copilotHome : void 0,
+				auth: p.auth,
+				resolvedApiKey: typeof p.resolvedApiKey === "string" ? p.resolvedApiKey : void 0,
+				authProfileId: typeof p.authProfileId === "string" ? p.authProfileId : void 0,
+				profileVersion: typeof p.profileVersion === "string" ? p.profileVersion : void 0
+			});
+		})();
 		resolvedAgentId = resolved.agentId;
 		resolvedCopilotHome = resolved.copilotHome;
 		authParts = [
@@ -314,6 +740,7 @@ function computeSessionKey(params, options) {
 			`auth.profileId=${resolved.authProfileId ?? ""}`,
 			`auth.profileVersion=${resolved.authProfileVersion ?? ""}`
 		];
+		if (!options.includeAuth) authParts = [];
 	} catch {
 		authParts = ["auth=unresolvable"];
 	}
@@ -321,6 +748,7 @@ function computeSessionKey(params, options) {
 		`provider=${provider}`,
 		`model=${modelId}`,
 		...options.includeApi ? [`api=${modelObj.api ?? ""}`] : [],
+		...options.includeApi ? [`baseUrlFingerprint=${fingerprintSessionValue(modelObj.baseUrl)}`] : [],
 		`cwd=${p.cwd ?? p.workspaceDir ?? ""}`,
 		`agentId=${resolvedAgentId}`,
 		`agentDir=${p.agentDir ?? ""}`,
@@ -329,6 +757,12 @@ function computeSessionKey(params, options) {
 		...options.includeAuth ? authParts : []
 	].join("|");
 }
+function readSessionString(value) {
+	return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function fingerprintSessionValue(value) {
+	return typeof value === "string" && value ? tokenFingerprint(value) : "";
+}
 function computeSessionCompatKey(params) {
 	return computeSessionKey(params, {
 		includeApi: true,
@@ -409,10 +843,29 @@ function createCopilotAgentHarness(options) {
 				reason: "copilot is opt-in only"
 			};
 			const provider = ctx.provider.trim().toLowerCase();
-			if (!COPILOT_PROVIDER_IDS.has(provider)) return {
+			if (!provider) return {
+				supported: false,
+				reason: "provider is required"
+			};
+			if (COPILOT_PROVIDER_IDS.has(provider)) return {
+				supported: true,
+				priority: 100
+			};
+			const providerOwnerPluginIds = ctx.providerOwnerPluginIds;
+			if (ctx.providerOwnerStatus !== "unowned" || !providerOwnerPluginIds || providerOwnerPluginIds.length > 0) return {
 				supported: false,
 				reason: `provider is not one of: ${[...COPILOT_PROVIDER_IDS].toSorted().join(", ")}`
 			};
+			if (!supportsCopilotByokProviderShape({
+				api: ctx.modelProvider?.api,
+				baseUrl: ctx.modelProvider?.baseUrl,
+				requestProxy: ctx.modelProvider?.request?.proxy,
+				requestTls: ctx.modelProvider?.request?.tls,
+				requestAllowPrivateNetwork: ctx.modelProvider?.request?.allowPrivateNetwork
+			})) return {
+				supported: false,
+				reason: "provider is not a supported Copilot BYOK model (requires supported api, baseUrl, and no request transport policy overrides)"
+			};
 			return {
 				supported: true,
 				priority: 100
@@ -421,11 +874,17 @@ function createCopilotAgentHarness(options) {
 		async runAttempt(params) {
 			const attemptPromise = (async () => {
 				if (disposed) throw new Error("[copilot] harness has been disposed; cannot start new attempts");
-				const { resolvePoolAcquire, runCopilotAttempt } = await import("./attempt-ArBh6GPT.js");
+				const { resolvePoolAcquire, runCopilotAttempt } = await import("./attempt-DIieBZcc.js");
 				if (disposed) throw new Error("[copilot] harness was disposed while starting an attempt");
-				const poolAcquire = resolvePoolAcquire(params);
 				const pool = await getPool();
 				if (disposed) throw new Error("[copilot] harness was disposed while starting an attempt");
+				let poolAcquire;
+				try {
+					poolAcquire = resolvePoolAcquire(params);
+				} catch (error) {
+					if (isCopilotByokUnsupportedProviderError(error)) return runCopilotAttempt(params, { pool });
+					throw error;
+				}
 				const openclawSessionId = typeof params.sessionId === "string" ? params.sessionId : void 0;
 				const currentCompatKey = computeSessionCompatKey(params);
 				const currentCompactKey = computeSessionCompactKey(params);
@@ -442,7 +901,7 @@ function createCopilotAgentHarness(options) {
 					}
 				} : params, {
 					pool,
-					onSessionEstablished: openclawSessionId ? ({ sdkSessionId, pooledClient, sessionConfig }) => {
+					onSessionEstablished: openclawSessionId ? ({ compactionSessionConfig, sdkSessionId, pooledClient, sessionConfig }) => {
 						trackedSessions.set(openclawSessionId, {
 							sdkSessionId,
 							client: pooledClient.client,
@@ -450,7 +909,7 @@ function createCopilotAgentHarness(options) {
 							compatKey: currentCompatKey,
 							compactKey: currentCompactKey,
 							poolKey: pooledClient.key,
-							sessionConfig,
+							sessionConfig: compactionSessionConfig ?? sessionConfig,
 							...sessionAuthFields(poolAcquire.auth)
 						});
 						registerStoredBinding(options?.sessionStore, openclawSessionId, {
@@ -531,9 +990,21 @@ function createCopilotAgentHarness(options) {
 			};
 			const tracked = trackedSessions.get(openclawSessionId);
 			const currentCompactKey = computeSessionCompactKey(params);
-			const { resolvePoolAcquire } = await import("./attempt-ArBh6GPT.js");
-			const resolvedPoolAcquire = resolvePoolAcquire(params);
-			const currentAuth = sessionAuthFields(resolvedPoolAcquire.auth);
+			const { resolvePoolAcquire } = await import("./attempt-DIieBZcc.js");
+			let resolvedPoolAcquire;
+			let currentAuth;
+			try {
+				resolvedPoolAcquire = resolvePoolAcquire(params);
+			} catch (error) {
+				if (isCopilotByokUnsupportedProviderError(error)) return {
+					ok: false,
+					compacted: false,
+					reason: "missing_thread_binding",
+					failure: { reason: "missing_thread_binding" }
+				};
+				throw error;
+			}
+			if (!currentAuth) currentAuth = sessionAuthFields(resolvedPoolAcquire.auth);
 			const compatibleTracked = tracked?.compactKey === currentCompactKey && sessionAuthMatches(tracked, currentAuth) ? tracked : void 0;
 			if (!compatibleTracked) return {
 				ok: false,
@@ -541,20 +1012,30 @@ function createCopilotAgentHarness(options) {
 				reason: "missing_thread_binding",
 				failure: { reason: "missing_thread_binding" }
 			};
-			const poolAcquire = compatibleTracked ? {
+			const poolAcquire = {
 				key: compatibleTracked.poolKey,
 				options: compatibleTracked.clientOptions
-			} : resolvedPoolAcquire;
+			};
 			let compactResult;
 			let handle;
 			let pool;
 			let activeSdkSession;
+			let cleanupByokProxy;
 			const hookContext = buildCopilotCompactionHookContext(params);
 			try {
 				throwIfAborted(params.abortSignal);
 				pool = await getPool();
 				handle = await pool.acquire(poolAcquire.key, poolAcquire.options);
 				const client = handle.client;
+				const byokProxy = compatibleTracked.authMode === "byok" && compatibleTracked.sessionConfig.provider ? await createCopilotByokProxy({
+					mode: "byok",
+					provider: compatibleTracked.sessionConfig.provider
+				}) : void 0;
+				cleanupByokProxy = byokProxy?.close;
+				const sessionConfig = byokProxy?.provider.provider ? {
+					...compatibleTracked.sessionConfig,
+					provider: byokProxy.provider.provider
+				} : compatibleTracked.sessionConfig;
 				await runAgentHarnessBeforeCompactionHook({
 					sessionFile: params.sessionFile,
 					ctx: hookContext
@@ -563,11 +1044,11 @@ function createCopilotAgentHarness(options) {
 					abortSignal,
 					client,
 					customInstructions: params.customInstructions,
-					gitHubToken: compatibleTracked?.clientOptions.gitHubToken ?? (resolvedPoolAcquire.auth.authMode === "gitHubToken" ? resolvedPoolAcquire.auth.gitHubToken : void 0),
+					gitHubToken: compatibleTracked?.clientOptions.gitHubToken ?? (resolvedPoolAcquire?.auth.authMode === "gitHubToken" ? resolvedPoolAcquire.auth.gitHubToken : void 0),
 					onSession: (session) => {
 						activeSdkSession = session;
 					},
-					sessionConfig: compatibleTracked.sessionConfig,
+					sessionConfig,
 					sdkSessionId: compatibleTracked.sdkSessionId
 				}), resolveCompactionTimeoutMs(params.config), {
 					abortSignal: params.abortSignal,
@@ -598,6 +1079,7 @@ function createCopilotAgentHarness(options) {
 					}
 				};
 			} finally {
+				await cleanupByokProxy?.();
 				if (pool && handle) try {
 					await pool.release(handle);
 				} catch {}
@@ -648,4 +1130,4 @@ function createCopilotAgentHarness(options) {
 	};
 }
 //#endregion
-export { resolveCopilotAuth as n, createCopilotAgentHarness as t };
+export { resolveCopilotAuth as a, createCopilotByokAuth as i, resolveCopilotProvider as n, createCopilotByokProxy as r, createCopilotAgentHarness as t };

package/dist/harness.js

@@ -1,2 +1,2 @@
-import { t as createCopilotAgentHarness } from "./harness-D-3KWchY.js";
+import { t as createCopilotAgentHarness } from "./harness-B9xB4LpE.js";
 export { createCopilotAgentHarness };

package/dist/index.js

@@ -1,9 +1,7 @@
-import { t as createCopilotAgentHarness } from "./harness-D-3KWchY.js";
+import { t as createCopilotAgentHarness } from "./harness-B9xB4LpE.js";
 import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
+import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/copilot/index.ts
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function readPoolOptions(pluginConfig) {
 	if (!isRecord(pluginConfig)) return;
 	const pool = pluginConfig.pool;
@@ -17,6 +15,7 @@ var copilot_default = definePluginEntry({
 	name: "GitHub Copilot agent runtime",
 	description: "Registers the GitHub Copilot agent runtime.",
 	register(api) {
+		if (api.registrationMode !== "full") return;
 		const poolOptions = readPoolOptions(api.pluginConfig);
 		const sessionStore = api.runtime.state.openSyncKeyedStore({
 			namespace: "sdk-sessions",

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@openclaw/copilot",
-  "version": "2026.6.11",
+  "version": "2026.7.1-beta.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@openclaw/copilot",
-      "version": "2026.6.11",
+      "version": "2026.7.1-beta.2",
       "dependencies": {
         "@github/copilot-sdk": "1.0.0-beta.9"
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/copilot",
-  "version": "2026.6.11",
+  "version": "2026.7.1-beta.2",
   "description": "OpenClaw GitHub Copilot agent runtime plugin (registers a `github-copilot` AgentHarness backed by @github/copilot-sdk over JSON-RPC to the GitHub Copilot CLI)",
   "repository": {
     "type": "git",
@@ -25,10 +25,10 @@
       "minHostVersion": ">=2026.5.28"
     },
     "compat": {
-      "pluginApi": ">=2026.6.11"
+      "pluginApi": ">=2026.7.1-beta.2"
     },
     "build": {
-      "openclawVersion": "2026.6.11",
+      "openclawVersion": "2026.7.1-beta.2",
       "bundledDist": false
     },
     "release": {
@@ -47,7 +47,7 @@
     "README.md"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.6.11"
+    "openclaw": ">=2026.7.1-beta.2"
   },
   "peerDependenciesMeta": {
     "openclaw": {