@openhoo/hoopilot 0.3.1 → 0.5.0

package/dist/cli.js

@@ -1,254 +1,324 @@
 #!/usr/bin/env bun
 
+// src/cli.ts
+import { spawn } from "child_process";
+
+// src/auth-store.ts
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { dirname, join } from "path";
+function authStorePath(env = process.env) {
+  if (env.HOOPILOT_AUTH_FILE) {
+    return env.HOOPILOT_AUTH_FILE;
+  }
+  const base = env.XDG_CONFIG_HOME ?? env.APPDATA ?? (env.HOME ? join(env.HOME, ".config") : join(process.cwd(), ".config"));
+  return join(base, "hoopilot", "auth.json");
+}
+function readStoredCopilotAuth(path = authStorePath()) {
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (!parsed || typeof parsed !== "object") {
+      return void 0;
+    }
+    const token = typeof parsed.token === "string" ? parsed.token.trim() : "";
+    if (!token) {
+      return void 0;
+    }
+    return {
+      apiBaseUrl: typeof parsed.apiBaseUrl === "string" ? parsed.apiBaseUrl : void 0,
+      createdAt: typeof parsed.createdAt === "string" ? parsed.createdAt : void 0,
+      githubDomain: typeof parsed.githubDomain === "string" ? parsed.githubDomain : void 0,
+      source: typeof parsed.source === "string" ? parsed.source : void 0,
+      token
+    };
+  } catch {
+    return void 0;
+  }
+}
+function writeStoredCopilotAuth(auth, path = authStorePath()) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(
+    path,
+    `${JSON.stringify(
+      {
+        ...auth,
+        createdAt: auth.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
+      },
+      null,
+      2
+    )}
+`,
+    { mode: 384 }
+  );
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+}
+
 // src/auth.ts
-import { execFileSync } from "child_process";
-var DEFAULT_COPILOT_API_BASE_URL = "https://api.individual.githubcopilot.com";
-var DEFAULT_TOKEN_EXCHANGE_URL = "https://api.github.com/copilot_internal/v2/token";
+var DEFAULT_COPILOT_API_BASE_URL = "https://api.githubcopilot.com";
 var REFRESH_SKEW_MS = 6e4;
+var STORED_TOKEN_TTL_MS = 10 * 6e4;
 var CopilotAuthError = class extends Error {
   constructor(message) {
     super(message);
     this.name = "CopilotAuthError";
   }
 };
-var CopilotTokenExchangeHttpError = class extends CopilotAuthError {
-};
 var CopilotAuth = class {
-  #authMode;
+  #authStorePath;
   #copilotApiBaseUrl;
-  #copilotToken;
-  #env;
-  #fetch;
-  #githubToken;
-  #githubTokenCommand;
-  #logger;
-  #tokenExchangeUrl;
   #cachedAccess;
   constructor(options = {}) {
-    this.#authMode = options.authMode ?? "auto";
+    this.#authStorePath = options.authStorePath ?? options.env?.HOOPILOT_AUTH_FILE;
     this.#copilotApiBaseUrl = trimTrailingSlash(
       options.copilotApiBaseUrl ?? options.env?.COPILOT_API_BASE_URL ?? DEFAULT_COPILOT_API_BASE_URL
     );
-    this.#copilotToken = options.copilotToken;
-    this.#env = options.env ?? process.env;
-    this.#fetch = options.fetch ?? fetch;
-    this.#githubToken = options.githubToken;
-    this.#githubTokenCommand = options.githubTokenCommand ?? "gh auth token";
-    this.#logger = options.logger;
-    this.#tokenExchangeUrl = options.tokenExchangeUrl ?? options.env?.COPILOT_TOKEN_EXCHANGE_URL ?? DEFAULT_TOKEN_EXCHANGE_URL;
   }
   async getAccess() {
     if (this.#cachedAccess && this.#cachedAccess.expiresAtMs - REFRESH_SKEW_MS > Date.now()) {
       return this.#cachedAccess;
     }
-    const directCopilotToken = this.#resolveDirectCopilotToken();
-    if (directCopilotToken) {
+    const stored = readStoredCopilotAuth(this.#authStorePath);
+    if (stored) {
       return this.#cacheAccess({
-        apiBaseUrl: this.#copilotApiBaseUrl,
-        expiresAtMs: Date.now() + 10 * 6e4,
-        source: "copilot-token",
-        token: directCopilotToken
-      });
-    }
-    if (this.#authMode === "copilot-token") {
-      throw new CopilotAuthError("COPILOT_API_TOKEN or GITHUB_COPILOT_API_TOKEN is required.");
-    }
-    const githubToken = this.#resolveGithubToken();
-    if (!githubToken) {
-      throw new CopilotAuthError(
-        "No Copilot credential found. Set COPILOT_API_TOKEN, set COPILOT_GITHUB_TOKEN from gh auth token, or sign in with gh auth login."
-      );
-    }
-    if (isPersonalAccessToken(githubToken)) {
-      throw new CopilotAuthError(
-        "GitHub personal access tokens are not supported for Copilot authentication. Use gh auth login or COPILOT_API_TOKEN."
-      );
-    }
-    try {
-      return this.#cacheAccess(await this.#exchangeGithubToken(githubToken));
-    } catch (error) {
-      if (!(error instanceof CopilotTokenExchangeHttpError)) {
-        throw error;
-      }
-      this.#logger?.warn(
-        `Copilot token exchange failed; falling back to GitHub CLI token mode: ${errorMessage(
-          error
-        )}`
-      );
-      return this.#cacheAccess({
-        apiBaseUrl: this.#copilotApiBaseUrl,
-        expiresAtMs: Date.now() + 10 * 6e4,
-        source: "direct-github-token",
-        token: githubToken
+        apiBaseUrl: trimTrailingSlash(stored.apiBaseUrl ?? this.#copilotApiBaseUrl),
+        expiresAtMs: Date.now() + STORED_TOKEN_TTL_MS,
+        source: "github-copilot-oauth",
+        token: stored.token
       });
     }
+    throw new CopilotAuthError(
+      "No GitHub Copilot OAuth credential found. Run `hoopilot login` to sign in through your browser."
+    );
   }
   #cacheAccess(access) {
     this.#cachedAccess = access;
     return access;
   }
-  async #exchangeGithubToken(githubToken) {
-    const response = await this.#fetch(this.#tokenExchangeUrl, {
-      headers: {
-        accept: "application/vnd.github+json",
-        authorization: `token ${githubToken}`,
-        "editor-plugin-version": "hoopilot/0.1.0",
-        "editor-version": "Hoopilot/0.1.0",
-        "user-agent": "hoopilot/0.1.0"
-      },
-      method: "GET"
+};
+function trimTrailingSlash(value) {
+  return value.replace(/\/+$/, "");
+}
+
+// src/github-device.ts
+import { setTimeout as sleep } from "timers/promises";
+var DEFAULT_GITHUB_COPILOT_CLIENT_ID = "Iv23lijnNxm2e9UX3CF8";
+var DEFAULT_GITHUB_DOMAIN = "github.com";
+var DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+var POLLING_SAFETY_MARGIN_MS = 3e3;
+async function githubCopilotDeviceLogin(options = {}) {
+  const env = options.env ?? process.env;
+  const fetcher = options.fetch ?? fetch;
+  const sleeper = options.sleep ?? sleep;
+  const domain = normalizeDomain(
+    options.domain ?? env.HOOPILOT_GITHUB_DOMAIN ?? DEFAULT_GITHUB_DOMAIN
+  );
+  const clientId = options.clientId ?? env.HOOPILOT_GITHUB_CLIENT_ID ?? env.COPILOT_GITHUB_CLIENT_ID ?? DEFAULT_GITHUB_COPILOT_CLIENT_ID;
+  const device = await requestDeviceCode(fetcher, domain, clientId);
+  const verificationUrl = device.verification_uri;
+  const userCode = device.user_code;
+  const deviceCode = device.device_code;
+  if (!verificationUrl || !userCode || !deviceCode) {
+    throw new Error("GitHub device authorization response is missing required fields.");
+  }
+  options.logger?.info(`First copy your one-time code: ${userCode}`);
+  options.logger?.info(`Open ${verificationUrl} in your browser to authorize Hoopilot.`);
+  await options.openBrowser?.(verificationUrl);
+  return {
+    domain,
+    token: await pollForAccessToken(fetcher, sleeper, domain, clientId, {
+      deviceCode,
+      expiresIn: positiveSeconds(device.expires_in, 900),
+      interval: positiveSeconds(device.interval, 5)
+    })
+  };
+}
+async function requestDeviceCode(fetcher, domain, clientId) {
+  const response = await fetcher(`https://${domain}/login/device/code`, {
+    body: JSON.stringify({
+      client_id: clientId,
+      scope: "read:user"
+    }),
+    headers: oauthHeaders(),
+    method: "POST"
+  });
+  if (!response.ok) {
+    throw new Error(
+      `GitHub device authorization failed with ${response.status}: ${await safeResponseText(
+        response
+      )}`
+    );
+  }
+  return await response.json();
+}
+async function pollForAccessToken(fetcher, sleeper, domain, clientId, device) {
+  let intervalMs = device.interval * 1e3 + POLLING_SAFETY_MARGIN_MS;
+  const deadline = Date.now() + device.expiresIn * 1e3;
+  while (Date.now() < deadline) {
+    await sleeper(intervalMs);
+    const response = await fetcher(`https://${domain}/login/oauth/access_token`, {
+      body: JSON.stringify({
+        client_id: clientId,
+        device_code: device.deviceCode,
+        grant_type: DEVICE_GRANT_TYPE
+      }),
+      headers: oauthHeaders(),
+      method: "POST"
     });
     if (!response.ok) {
-      throw new CopilotTokenExchangeHttpError(
-        `GitHub Copilot token exchange failed with ${response.status}: ${await safeResponseText(
+      throw new Error(
+        `GitHub device token exchange failed with ${response.status}: ${await safeResponseText(
           response
         )}`
       );
     }
-    const body = asRecord(await response.json());
-    const token = getString(body, "token");
-    if (!token) {
-      throw new CopilotAuthError("GitHub Copilot token exchange response did not include a token.");
-    }
-    return {
-      apiBaseUrl: endpointFromResponse(body) ?? this.#copilotApiBaseUrl,
-      expiresAtMs: expiresAtFromResponse(body),
-      source: "github-token",
-      token
-    };
-  }
-  #resolveDirectCopilotToken() {
-    return firstNonEmpty(
-      this.#copilotToken,
-      this.#env.COPILOT_API_TOKEN,
-      this.#env.GITHUB_COPILOT_API_TOKEN,
-      this.#env.GITHUB_COPILOT_TOKEN
-    );
-  }
-  #resolveGithubToken() {
-    return firstNonEmpty(
-      this.#githubToken,
-      this.#env.COPILOT_GITHUB_TOKEN,
-      this.#env.GITHUB_COPILOT_GITHUB_TOKEN,
-      this.#readGithubTokenCommand()
-    );
-  }
-  #readGithubTokenCommand() {
-    if (this.#githubTokenCommand === false) {
-      return void 0;
-    }
-    const parts = splitCommand(this.#githubTokenCommand);
-    const [command, ...args] = parts;
-    if (!command) {
-      return void 0;
-    }
-    try {
-      const output = execFileSync(command, args, {
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"],
-        timeout: 5e3
-      });
-      return output.trim() || void 0;
-    } catch {
-      return void 0;
+    const data = await response.json();
+    if (data.access_token) {
+      return data.access_token;
     }
-  }
-};
-function splitCommand(command) {
-  const parts = [];
-  let current = "";
-  let quote;
-  let escaping = false;
-  for (const character of command.trim()) {
-    if (escaping) {
-      current += character;
-      escaping = false;
+    if (data.error === "authorization_pending") {
       continue;
     }
-    if (character === "\\") {
-      escaping = true;
+    if (data.error === "slow_down") {
+      intervalMs = positiveSeconds(data.interval, device.interval + 5) * 1e3 + POLLING_SAFETY_MARGIN_MS;
       continue;
     }
-    if (quote) {
-      if (character === quote) {
-        quote = void 0;
-      } else {
-        current += character;
-      }
-      continue;
+    if (data.error === "expired_token") {
+      throw new Error("GitHub device login expired. Run `hoopilot login` again.");
     }
-    if (character === "'" || character === '"') {
-      quote = character;
-      continue;
+    if (data.error === "access_denied") {
+      throw new Error("GitHub device login was cancelled.");
     }
-    if (/\s/.test(character)) {
-      if (current) {
-        parts.push(current);
-        current = "";
-      }
-      continue;
+    if (data.error) {
+      throw new Error(data.error_description || `GitHub device login failed: ${data.error}`);
     }
-    current += character;
   }
-  if (current) {
-    parts.push(current);
-  }
-  return parts;
+  throw new Error("GitHub device login timed out. Run `hoopilot login` again.");
 }
-function endpointFromResponse(body) {
-  const endpoints = asRecord(body.endpoints);
-  const apiUrl = getString(endpoints, "api") ?? getString(endpoints, "proxy");
-  return apiUrl ? trimTrailingSlash(apiUrl) : void 0;
+function oauthHeaders() {
+  const headers = new Headers();
+  headers.set("accept", "application/json");
+  headers.set("content-type", "application/json");
+  headers.set("user-agent", "hoopilot");
+  return headers;
 }
-function expiresAtFromResponse(body) {
-  const expiresAt = body.expires_at;
-  if (typeof expiresAt === "number") {
-    return expiresAt < 1e10 ? expiresAt * 1e3 : expiresAt;
+function normalizeDomain(value) {
+  return value.replace(/^https?:\/\//, "").replace(/\/+$/, "");
+}
+function positiveSeconds(value, fallback) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : fallback;
+}
+async function safeResponseText(response) {
+  const text = await response.text();
+  return text.slice(0, 500);
+}
+
+// src/logger.ts
+import pino from "pino";
+import pretty from "pino-pretty";
+var DEFAULT_LOG_FORMAT = "pretty";
+var DEFAULT_LOG_LEVEL = "info";
+var LOG_FORMATS = ["json", "pretty"];
+var LOG_LEVELS = ["trace", "debug", "info", "warn", "error", "fatal", "silent"];
+var REDACT_PATHS = [
+  "apiKey",
+  "authorization",
+  "cookie",
+  "headers.authorization",
+  "headers.Authorization",
+  "headers.cookie",
+  "headers.Cookie",
+  "headers.x-api-key",
+  "headers.X-Api-Key",
+  "token",
+  "*.apiKey",
+  "*.authorization",
+  "*.cookie",
+  "*.token",
+  "*.headers.authorization",
+  "*.headers.Authorization",
+  "*.headers.cookie",
+  "*.headers.Cookie",
+  "*.headers.x-api-key",
+  "*.headers.X-Api-Key"
+];
+var noopLogger = {
+  child: () => noopLogger,
+  debug: () => {
+  },
+  error: () => {
+  },
+  fatal: () => {
+  },
+  info: () => {
+  },
+  trace: () => {
+  },
+  warn: () => {
   }
-  if (typeof expiresAt === "string") {
-    const asNumber = Number(expiresAt);
-    if (Number.isFinite(asNumber)) {
-      return asNumber < 1e10 ? asNumber * 1e3 : asNumber;
-    }
-    const parsed = Date.parse(expiresAt);
-    if (Number.isFinite(parsed)) {
-      return parsed;
-    }
+};
+function createHoopilotLogger(options = {}) {
+  const env = options.env ?? process.env;
+  const level = parseLogLevel(options.level ?? env.HOOPILOT_LOG_LEVEL);
+  const format = parseLogFormat(options.format ?? env.HOOPILOT_LOG_FORMAT);
+  const pinoOptions = {
+    base: {
+      service: "hoopilot",
+      ...options.base
+    },
+    level,
+    redact: {
+      censor: "[Redacted]",
+      paths: REDACT_PATHS
+    },
+    timestamp: pino.stdTimeFunctions.isoTime
+  };
+  if (format === "pretty") {
+    return pino(
+      pinoOptions,
+      pretty({
+        colorize: options.colorize ?? process.stderr.isTTY,
+        destination: options.stream ?? 1,
+        ignore: "pid,hostname",
+        singleLine: true,
+        translateTime: "SYS:standard"
+      })
+    );
   }
-  const refreshIn = body.refresh_in;
-  if (typeof refreshIn === "number" && Number.isFinite(refreshIn)) {
-    return Date.now() + refreshIn * 1e3;
+  if (options.stream) {
+    return pino(pinoOptions, options.stream);
   }
-  return Date.now() + 10 * 6e4;
+  return pino(pinoOptions);
 }
-function firstNonEmpty(...values) {
-  for (const value of values) {
-    const trimmed = value?.trim();
-    if (trimmed) {
-      return trimmed;
-    }
+function parseLogFormat(value) {
+  if (!value) {
+    return DEFAULT_LOG_FORMAT;
   }
-  return void 0;
-}
-function asRecord(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
-}
-function getString(record, key) {
-  const value = record[key];
-  return typeof value === "string" && value ? value : void 0;
+  if (isLogFormat(value)) {
+    return value;
+  }
+  throw new Error(`Invalid log format: ${value}. Expected one of: ${LOG_FORMATS.join(", ")}.`);
 }
-function trimTrailingSlash(value) {
-  return value.replace(/\/+$/, "");
+function parseLogLevel(value) {
+  if (!value) {
+    return DEFAULT_LOG_LEVEL;
+  }
+  if (isLogLevel(value)) {
+    return value;
+  }
+  throw new Error(`Invalid log level: ${value}. Expected one of: ${LOG_LEVELS.join(", ")}.`);
 }
-async function safeResponseText(response) {
-  const text = await response.text();
-  return text.slice(0, 500);
+function shouldCreateLogger(options) {
+  return Boolean(
+    options.logger || options.logFormat || options.logLevel || options.env?.HOOPILOT_LOG_FORMAT || options.env?.HOOPILOT_LOG_LEVEL
+  );
 }
-function isPersonalAccessToken(token) {
-  return token.startsWith("github_pat_") || token.startsWith("ghp_");
+function isLogFormat(value) {
+  return LOG_FORMATS.includes(value);
 }
-function errorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
+function isLogLevel(value) {
+  return LOG_LEVELS.includes(value);
 }
 
 // src/copilot.ts
@@ -298,6 +368,7 @@ var CopilotClient = class {
     headers.set("editor-version", "Hoopilot/0.1.0");
     headers.set("openai-intent", "conversation-panel");
     headers.set("user-agent", "hoopilot/0.1.0");
+    headers.set("x-github-api-version", "2026-06-01");
     return this.#fetch(`${access.apiBaseUrl}${path}`, {
       ...init,
       headers
@@ -323,8 +394,8 @@ function responsesRequestToChatCompletion(request) {
     metadata: request.metadata,
     model: contentToText(request.model) || DEFAULT_MODEL,
     presence_penalty: request.presence_penalty,
-    reasoning_effort: asRecord2(request.reasoning).effort,
-    response_format: asRecord2(request.text).format,
+    reasoning_effort: asRecord(request.reasoning).effort,
+    response_format: asRecord(request.text).format,
     seed: request.seed,
     stream: request.stream === true,
     temperature: request.temperature,
@@ -346,7 +417,7 @@ function completionsRequestToChatCompletion(request) {
 function chatCompletionToResponse(completion, responseId) {
   const id = responseId ?? `resp_${randomId()}`;
   const choice = firstChoice(completion);
-  const message = asRecord2(choice.message);
+  const message = asRecord(choice.message);
   const model = contentToText(completion.model) || DEFAULT_MODEL;
   const output = outputItemsFromMessage(message);
   const usage = responseUsage(completion.usage);
@@ -373,7 +444,7 @@ function chatCompletionToResponse(completion, responseId) {
 }
 function chatCompletionToCompletion(completion) {
   const choice = firstChoice(completion);
-  const message = asRecord2(choice.message);
+  const message = asRecord(choice.message);
   return removeUndefined({
     choices: [
       {
@@ -391,9 +462,9 @@ function chatCompletionToCompletion(completion) {
   });
 }
 function normalizeModelsResponse(upstream) {
-  const record = asRecord2(upstream);
+  const record = asRecord(upstream);
   const data = Array.isArray(record.data) ? record.data : Array.isArray(upstream) ? upstream : [];
-  const models = data.map((model) => asRecord2(model)).filter((model) => typeof model.id === "string").map((model) => ({
+  const models = data.map((model) => asRecord(model)).filter((model) => typeof model.id === "string").map((model) => ({
     created: model.created ?? 0,
     id: model.id,
     object: "model",
@@ -542,7 +613,7 @@ function inputToMessages(input) {
   }
   const messages = [];
   for (const item of input) {
-    const record = asRecord2(item);
+    const record = asRecord(item);
     if (record.type === "function_call_output") {
       messages.push({
         content: contentToText(record.output),
@@ -584,7 +655,7 @@ function chatMessageContent(content) {
   }
   const parts = [];
   for (const part of content) {
-    const record = asRecord2(part);
+    const record = asRecord(part);
     const type = contentToText(record.type);
     if (type === "input_text" || type === "output_text" || type === "text") {
       parts.push({ text: contentToText(record.text), type: "text" });
@@ -642,7 +713,7 @@ function chatTools(tools) {
   if (!Array.isArray(tools)) {
     return void 0;
   }
-  const converted = tools.map((tool) => asRecord2(tool)).filter((tool) => tool.type === "function").map((tool) => ({
+  const converted = tools.map((tool) => asRecord(tool)).filter((tool) => tool.type === "function").map((tool) => ({
     function: removeUndefined({
       description: tool.description,
       name: tool.name,
@@ -657,7 +728,7 @@ function chatToolChoice(toolChoice) {
   if (typeof toolChoice === "string" || toolChoice === void 0) {
     return toolChoice;
   }
-  const record = asRecord2(toolChoice);
+  const record = asRecord(toolChoice);
   if (record.type === "function" && typeof record.name === "string") {
     return { function: { name: record.name }, type: "function" };
   }
@@ -671,8 +742,8 @@ function outputItemsFromMessage(message) {
   }
   const toolCalls = Array.isArray(message.tool_calls) ? message.tool_calls : [];
   for (const toolCall of toolCalls) {
-    const record = asRecord2(toolCall);
-    const fn = asRecord2(record.function);
+    const record = asRecord(toolCall);
+    const fn = asRecord(record.function);
     output.push(
       functionCallItem({
         arguments: contentToText(fn.arguments),
@@ -713,10 +784,10 @@ function outputText(output) {
   return output.flatMap((item) => {
     const content = item.content;
     return Array.isArray(content) ? content : [];
-  }).map((part) => contentToText(asRecord2(part).text)).filter(Boolean).join("");
+  }).map((part) => contentToText(asRecord(part).text)).filter(Boolean).join("");
 }
 function responseUsage(usage) {
-  const record = asRecord2(usage);
+  const record = asRecord(usage);
   if (Object.keys(record).length === 0) {
     return null;
   }
@@ -730,7 +801,7 @@ function responseUsage(usage) {
 }
 function firstChoice(completion) {
   const choices = Array.isArray(completion.choices) ? completion.choices : [];
-  return asRecord2(choices[0]);
+  return asRecord(choices[0]);
 }
 function processChatSseLine(line, enqueue, tools, appendText) {
   const trimmed = line.trim();
@@ -746,7 +817,7 @@ function processChatSseLine(line, enqueue, tools, appendText) {
     return;
   }
   const choice = firstChoice(parsed);
-  const delta = asRecord2(choice.delta);
+  const delta = asRecord(choice.delta);
   const content = contentToText(delta.content);
   if (content) {
     appendText(content);
@@ -760,8 +831,8 @@ function processChatSseLine(line, enqueue, tools, appendText) {
   }
   const toolCalls = Array.isArray(delta.tool_calls) ? delta.tool_calls : [];
   for (const toolCall of toolCalls) {
-    const record = asRecord2(toolCall);
-    const fn = asRecord2(record.function);
+    const record = asRecord(toolCall);
+    const fn = asRecord(record.function);
     const index = typeof record.index === "number" ? record.index : tools.size;
     const existing = tools.get(index) ?? {
       arguments: "",
@@ -809,7 +880,7 @@ data: ${JSON.stringify(data)}
 }
 function parseJson(data) {
   try {
-    return asRecord2(JSON.parse(data));
+    return asRecord(JSON.parse(data));
   } catch {
     return void 0;
   }
@@ -817,7 +888,7 @@ function parseJson(data) {
 function removeUndefined(record) {
   return Object.fromEntries(Object.entries(record).filter(([, value]) => value !== void 0));
 }
-function asRecord2(value) {
+function asRecord(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
 function randomId() {
@@ -830,43 +901,111 @@ function epochSeconds() {
 // src/server.ts
 var DEFAULT_HOST = "127.0.0.1";
 var DEFAULT_PORT = 4141;
+var INVALID_JSON_MESSAGE = "Request body must be valid JSON.";
 function createHoopilotHandler(options = {}) {
   const client = new CopilotClient(options);
   const apiKey = options.apiKey ?? options.env?.HOOPILOT_API_KEY;
+  const logger = serverLogger(options);
   return async (request) => {
+    const startedAt = performance.now();
     const url = new URL(request.url);
+    const requestId = requestIdFor(request);
+    const requestLogger = logger.child({
+      method: request.method,
+      path: url.pathname,
+      requestId,
+      route: routeFor(request.method, url.pathname)
+    });
     if (request.method === "OPTIONS") {
-      return new Response(null, { headers: corsHeaders() });
+      return finishResponse(new Response(null, { headers: corsHeaders() }), {
+        logger: requestLogger,
+        requestId,
+        startedAt
+      });
     }
     if (!isAuthorized(request, apiKey)) {
-      return jsonError(401, "invalid_api_key", "Invalid or missing Hoopilot API key.");
+      requestLogger.warn({ event: "http.request.unauthorized" }, "invalid hoopilot api key");
+      return finishResponse(
+        jsonError(401, "invalid_api_key", "Invalid or missing Hoopilot API key."),
+        {
+          logger: requestLogger,
+          requestId,
+          startedAt
+        }
+      );
     }
     try {
       if (request.method === "GET" && (url.pathname === "/" || url.pathname === "/healthz")) {
-        return jsonResponse({
-          name: "hoopilot",
-          object: "health",
-          status: "ok"
-        });
+        return finishResponse(
+          jsonResponse({
+            name: "hoopilot",
+            object: "health",
+            status: "ok"
+          }),
+          { logger: requestLogger, requestId, startedAt }
+        );
       }
       if (request.method === "GET" && url.pathname === "/v1/models") {
-        return await handleModels(client, request.signal);
+        return finishResponse(await handleModels(client, request.signal, requestLogger), {
+          logger: requestLogger,
+          requestId,
+          startedAt
+        });
       }
       if (request.method === "POST" && url.pathname === "/v1/chat/completions") {
-        return await handleChatCompletions(client, request);
+        return finishResponse(await handleChatCompletions(client, request, requestLogger), {
+          logger: requestLogger,
+          requestId,
+          startedAt
+        });
       }
       if (request.method === "POST" && url.pathname === "/v1/completions") {
-        return await handleCompletions(client, request);
+        return finishResponse(await handleCompletions(client, request, requestLogger), {
+          logger: requestLogger,
+          requestId,
+          startedAt
+        });
       }
       if (request.method === "POST" && url.pathname === "/v1/responses") {
-        return await handleResponses(client, request);
+        return finishResponse(await handleResponses(client, request, requestLogger), {
+          logger: requestLogger,
+          requestId,
+          startedAt
+        });
       }
-      return jsonError(404, "not_found", `No route for ${request.method} ${url.pathname}.`);
+      return finishResponse(
+        jsonError(404, "not_found", `No route for ${request.method} ${url.pathname}.`),
+        { logger: requestLogger, requestId, startedAt }
+      );
     } catch (error) {
       if (error instanceof CopilotAuthError) {
-        return jsonError(401, "copilot_auth_error", error.message);
+        requestLogger.warn(
+          { err: errorDetails(error), event: "copilot.auth.missing" },
+          "copilot auth failed"
+        );
+        return finishResponse(jsonError(401, "copilot_auth_error", error.message), {
+          logger: requestLogger,
+          requestId,
+          startedAt
+        });
+      }
+      const message = errorMessage(error);
+      if (message === INVALID_JSON_MESSAGE) {
+        requestLogger.warn(
+          { err: errorDetails(error), event: "http.request.failed" },
+          "request body was invalid json"
+        );
+      } else {
+        requestLogger.error(
+          { err: errorDetails(error), event: "http.request.failed" },
+          "request failed"
+        );
       }
-      return jsonError(500, "internal_error", errorMessage2(error));
+      return finishResponse(jsonError(500, "internal_error", message), {
+        logger: requestLogger,
+        requestId,
+        startedAt
+      });
     }
   };
 }
@@ -895,35 +1034,53 @@ function startHoopilotServer(options = {}) {
     url: `http://${host}:${server.port}`
   };
 }
-async function handleModels(client, signal) {
+async function handleModels(client, signal, logger) {
   const upstream = await client.models(signal);
   if (!upstream.ok) {
+    if (isUpstreamAuthStatus(upstream.status)) {
+      return proxyError(upstream, logger);
+    }
+    logger.warn(
+      {
+        event: "copilot.models.fallback",
+        upstreamPath: "/models",
+        upstreamStatus: upstream.status
+      },
+      "falling back to built-in model list"
+    );
     return jsonResponse({ data: fallbackModels(), object: "list" });
   }
+  logUpstreamSuccess(logger, "/models", upstream.status);
   return jsonResponse(normalizeModelsResponse(await upstream.json()));
 }
-async function handleChatCompletions(client, request) {
+async function handleChatCompletions(client, request, logger) {
   const upstream = await client.forwardChatCompletions(await request.text(), request.signal);
+  if (!upstream.ok) {
+    return proxyError(upstream, logger);
+  }
+  logUpstreamSuccess(logger, "/chat/completions", upstream.status);
   return proxyResponse(upstream);
 }
-async function handleCompletions(client, request) {
+async function handleCompletions(client, request, logger) {
   const body = await readJson(request);
   const upstream = await client.chatCompletions(
     completionsRequestToChatCompletion(body),
     request.signal
   );
   if (!upstream.ok) {
-    return proxyError(upstream);
+    return proxyError(upstream, logger);
   }
+  logUpstreamSuccess(logger, "/chat/completions", upstream.status);
   return jsonResponse(chatCompletionToCompletion(await upstream.json()));
 }
-async function handleResponses(client, request) {
+async function handleResponses(client, request, logger) {
   const body = await readJson(request);
   const chatRequest = responsesRequestToChatCompletion(body);
   const upstream = await client.chatCompletions(chatRequest, request.signal);
   if (!upstream.ok) {
-    return proxyError(upstream);
+    return proxyError(upstream, logger);
   }
+  logUpstreamSuccess(logger, "/chat/completions", upstream.status);
   if (body.stream === true && upstream.body) {
     return new Response(
       responsesStreamFromChatStream(upstream.body, {
@@ -941,8 +1098,19 @@ async function handleResponses(client, request) {
   }
   return jsonResponse(chatCompletionToResponse(await upstream.json()));
 }
-async function proxyError(upstream) {
+async function proxyError(upstream, logger) {
   const text = await upstream.text();
+  if (isUpstreamAuthStatus(upstream.status)) {
+    logger.warn(
+      { event: "copilot.auth.rejected", upstreamStatus: upstream.status },
+      "copilot rejected credential or account access"
+    );
+    return jsonError(401, "copilot_auth_error", upstreamAuthMessage(text || upstream.statusText));
+  }
+  logger.warn(
+    { event: "copilot.request.failed", upstreamStatus: upstream.status },
+    "copilot upstream request failed"
+  );
   return jsonError(upstream.status, "copilot_error", text || upstream.statusText);
 }
 function proxyResponse(upstream) {
@@ -964,7 +1132,7 @@ async function readJson(request) {
     const value = await request.json();
     return value && typeof value === "object" && !Array.isArray(value) ? value : {};
   } catch {
-    throw new Error("Request body must be valid JSON.");
+    throw new Error(INVALID_JSON_MESSAGE);
   }
 }
 function jsonResponse(body, status = 200) {
@@ -1003,27 +1171,126 @@ function isAuthorized(request, apiKey) {
   const bearer = authorization.match(/^Bearer\s+(.+)$/i)?.[1];
   return bearer === apiKey || request.headers.get("x-api-key") === apiKey;
 }
+function isUpstreamAuthStatus(status) {
+  return status === 401 || status === 403;
+}
+function upstreamAuthMessage(message) {
+  return `GitHub Copilot rejected the credential or account access: ${message}`;
+}
 function isLoopbackHost(host) {
   return host === "localhost" || host === "127.0.0.1" || host === "::1";
 }
-function errorMessage2(error) {
+function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
+function serverLogger(options) {
+  if (options.logger) {
+    return options.logger.child({ component: "server" });
+  }
+  if (shouldCreateLogger(options)) {
+    return createHoopilotLogger({
+      env: options.env,
+      format: options.logFormat,
+      level: options.logLevel
+    }).child({ component: "server" });
+  }
+  return noopLogger;
+}
+function finishResponse(response, options) {
+  const withRequestId = responseWithRequestId(response, options.requestId);
+  logRequestCompleted(options.logger, withRequestId, options.startedAt);
+  return withRequestId;
+}
+function responseWithRequestId(response, requestId) {
+  const headers = new Headers(response.headers);
+  headers.set("x-request-id", requestId);
+  return new Response(response.body, {
+    headers,
+    status: response.status,
+    statusText: response.statusText
+  });
+}
+function logRequestCompleted(logger, response, startedAt) {
+  const fields = {
+    durationMs: Math.round((performance.now() - startedAt) * 100) / 100,
+    event: "http.request.completed",
+    status: response.status,
+    stream: isStreamingResponse(response)
+  };
+  if (response.status >= 500) {
+    logger.error(fields, "request completed with server error");
+    return;
+  }
+  if (response.status >= 400) {
+    logger.warn(fields, "request completed with client error");
+    return;
+  }
+  logger.info(fields, "request completed");
+}
+function requestIdFor(request) {
+  const existing = request.headers.get("x-request-id")?.trim();
+  return existing || crypto.randomUUID();
+}
+function routeFor(method, path) {
+  if (method === "OPTIONS") {
+    return "cors.preflight";
+  }
+  if (method === "GET" && (path === "/" || path === "/healthz")) {
+    return "health";
+  }
+  if (method === "GET" && path === "/v1/models") {
+    return "models";
+  }
+  if (method === "POST" && path === "/v1/chat/completions") {
+    return "chat_completions";
+  }
+  if (method === "POST" && path === "/v1/completions") {
+    return "completions";
+  }
+  if (method === "POST" && path === "/v1/responses") {
+    return "responses";
+  }
+  return "not_found";
+}
+function isStreamingResponse(response) {
+  return response.headers.get("content-type")?.includes("text/event-stream") ?? false;
+}
+function logUpstreamSuccess(logger, upstreamPath, status) {
+  logger.debug(
+    {
+      event: "copilot.request.completed",
+      upstreamPath,
+      upstreamStatus: status
+    },
+    "copilot upstream request completed"
+  );
+}
+function errorDetails(error) {
+  if (error instanceof Error) {
+    return {
+      message: error.message,
+      name: error.name,
+      stack: error.stack
+    };
+  }
+  return { message: String(error) };
+}
 
 // src/update.ts
-import { execFileSync as execFileSync2 } from "child_process";
+import { execFileSync } from "child_process";
+import { createHash } from "crypto";
 import {
-  chmodSync,
+  chmodSync as chmodSync2,
   copyFileSync,
   existsSync,
-  mkdirSync,
+  mkdirSync as mkdirSync2,
   realpathSync,
   renameSync,
   rmSync
 } from "fs";
 import { readFile, writeFile } from "fs/promises";
 import { homedir } from "os";
-import { dirname, join } from "path";
+import { dirname as dirname2, join as join2 } from "path";
 
 // src/update-core.ts
 var REPO_OWNER = "openhoo";
@@ -1192,16 +1459,16 @@ function checksumFor(sumsText, fileName) {
   }
   return void 0;
 }
-function resolveCacheDir(env, platform, homedir2, join2) {
+function resolveCacheDir(env, platform, homedir2, join3) {
   if (platform === "win32") {
-    const base2 = env.LOCALAPPDATA || join2(homedir2, "AppData", "Local");
-    return join2(base2, "hoopilot");
+    const base2 = env.LOCALAPPDATA || join3(homedir2, "AppData", "Local");
+    return join3(base2, "hoopilot");
   }
   if (platform === "darwin") {
-    return join2(homedir2, "Library", "Caches", "hoopilot");
+    return join3(homedir2, "Library", "Caches", "hoopilot");
   }
-  const base = env.XDG_CACHE_HOME || join2(homedir2, ".cache");
-  return join2(base, "hoopilot");
+  const base = env.XDG_CACHE_HOME || join3(homedir2, ".cache");
+  return join3(base, "hoopilot");
 }
 function latestReleaseApiUrl() {
   return `https://api.github.com/repos/${REPO}/releases/latest`;
@@ -1238,10 +1505,10 @@ function userAgent(version) {
   return `hoopilot/${version}`;
 }
 function cacheDir() {
-  return resolveCacheDir(process.env, process.platform, homedir(), join);
+  return resolveCacheDir(process.env, process.platform, homedir(), join2);
 }
 function stateFilePath() {
-  return join(cacheDir(), "update-check.json");
+  return join2(cacheDir(), "update-check.json");
 }
 async function readStateSafe() {
   try {
@@ -1252,7 +1519,7 @@ async function readStateSafe() {
 }
 async function writeStateSafe(state) {
   try {
-    mkdirSync(cacheDir(), { recursive: true });
+    mkdirSync2(cacheDir(), { recursive: true });
     await writeFile(stateFilePath(), JSON.stringify(state), "utf8");
   } catch {
   }
@@ -1286,27 +1553,44 @@ async function fetchLatest(version, etag) {
     return null;
   }
 }
-async function maybeNotifyUpdate(currentVersion, kind) {
+async function maybeNotifyUpdate(currentVersion, kind, logger) {
   if (isUpdateCheckDisabled(process.env, Boolean(process.stderr.isTTY))) {
+    logger?.debug({ event: "update.check.skipped" }, "update check skipped");
     return;
   }
   const state = await readStateSafe();
   if (state.latestVersion && isOutdated(currentVersion, state.latestVersion)) {
+    logger?.debug(
+      {
+        currentVersion,
+        event: "update.notice.cached",
+        installKind: kind,
+        latestVersion: state.latestVersion
+      },
+      "showing cached update notice"
+    );
     process.stderr.write(formatUpdateNotice(currentVersion, state.latestVersion, kind));
   }
   if (shouldRefresh(state.lastCheck, Date.now())) {
-    void refreshState(currentVersion, state.etag ?? null).catch(() => {
+    logger?.debug({ event: "update.check.refresh_queued" }, "queued update check refresh");
+    void refreshState(currentVersion, state.etag ?? null, logger).catch((error) => {
+      logger?.debug(
+        { err: errorDetails2(error), event: "update.check.refresh_failed" },
+        "update check refresh failed"
+      );
     });
   }
 }
-async function refreshState(currentVersion, etag) {
+async function refreshState(currentVersion, etag, logger) {
   const result = await fetchLatest(currentVersion, etag);
   if (!result) {
+    logger?.debug({ event: "update.check.unavailable" }, "update check unavailable");
     return;
   }
   if (result.status === 304) {
     const prev = await readStateSafe();
     await writeStateSafe({ ...prev, lastCheck: Date.now() });
+    logger?.debug({ event: "update.check.not_modified" }, "latest release unchanged");
     return;
   }
   if (result.release) {
@@ -1315,6 +1599,10 @@ async function refreshState(currentVersion, etag) {
       latestVersion: result.release.version,
       etag: result.etag
     });
+    logger?.debug(
+      { event: "update.check.updated", latestVersion: result.release.version },
+      "updated cached latest release state"
+    );
   }
 }
 function detectInstallKind() {
@@ -1335,7 +1623,7 @@ function detectMusl() {
     if (existsSync("/etc/alpine-release")) {
       return true;
     }
-    const ldd = execFileSync2("ldd", ["--version"], {
+    const ldd = execFileSync("ldd", ["--version"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
       timeout: 2e3
@@ -1354,12 +1642,10 @@ async function downloadToFile(url, dest, version) {
   if (!response.ok || !response.body) {
     throw new Error(`Download failed (${response.status}) for ${url}`);
   }
-  await Bun.write(dest, response);
+  await writeFile(dest, new Uint8Array(await response.arrayBuffer()));
 }
 async function sha256File(path) {
-  const hasher = new Bun.CryptoHasher("sha256");
-  hasher.update(await Bun.file(path).arrayBuffer());
-  return hasher.digest("hex");
+  return createHash("sha256").update(await readFile(path)).digest("hex");
 }
 async function verifyChecksum(release, assetName, file, version) {
   const sums = release.assets.find((asset) => asset.name === SHA256SUMS);
@@ -1422,7 +1708,7 @@ function swapBinary(tmpFile, exePath) {
     const code = error.code;
     if (code === "EXDEV") {
       copyFileSync(tmpFile, exePath);
-      chmodSync(exePath, 493);
+      chmodSync2(exePath, 493);
     } else if (code === "EACCES" || code === "EPERM") {
       throw new Error(
         `No permission to update ${exePath}. Re-run with sudo, or reinstall to a writable directory.`
@@ -1441,9 +1727,10 @@ function cleanupOldBinary() {
   } catch {
   }
 }
-async function runUpdate(currentVersion) {
+async function runUpdate(currentVersion, logger) {
   cleanupOldBinary();
   const kind = detectInstallKind();
+  logger?.debug({ currentVersion, event: "update.started", installKind: kind }, "update started");
   if (kind !== "binary") {
     console.log(`hoopilot ${currentVersion} was installed via npm.`);
     console.log(`Update with: ${upgradeCommandFor("npm")}`);
@@ -1456,6 +1743,10 @@ async function runUpdate(currentVersion) {
     throw new Error("Could not reach GitHub to check for the latest release.");
   }
   if (!isOutdated(currentVersion, release.version)) {
+    logger?.debug(
+      { currentVersion, event: "update.already_current", latestVersion: release.version },
+      "hoopilot is already up to date"
+    );
     console.log(`Already up to date (latest: ${release.version}).`);
     return;
   }
@@ -1467,13 +1758,22 @@ async function runUpdate(currentVersion) {
     throw new Error(`Release ${release.tag} has no asset "${assetName}". Available: ${available}.`);
   }
   console.log(`Updating ${currentVersion} \u2192 ${release.version} (${assetName})...`);
+  logger?.debug(
+    {
+      assetName,
+      currentVersion,
+      event: "update.installing",
+      latestVersion: release.version
+    },
+    "installing update"
+  );
   const exePath = realpathSync(process.execPath);
-  const tmpFile = join(dirname(exePath), `.hoopilot-update-${process.pid}.tmp`);
+  const tmpFile = join2(dirname2(exePath), `.hoopilot-update-${process.pid}.tmp`);
   try {
     await downloadToFile(asset.url, tmpFile, currentVersion);
     await verifyChecksum(release, assetName, tmpFile, currentVersion);
     if (process.platform !== "win32") {
-      chmodSync(tmpFile, 493);
+      chmodSync2(tmpFile, 493);
     }
     swapBinary(tmpFile, exePath);
   } catch (error) {
@@ -1491,20 +1791,59 @@ async function runUpdate(currentVersion) {
     }
   }
   console.log(`Updated hoopilot to ${release.version}.`);
+  logger?.debug(
+    { currentVersion, event: "update.completed", latestVersion: release.version },
+    "update completed"
+  );
   if (process.platform === "win32") {
     console.log("Restart hoopilot to run the new version.");
   }
 }
+function errorDetails2(error) {
+  if (error instanceof Error) {
+    return {
+      message: error.message,
+      name: error.name,
+      stack: error.stack
+    };
+  }
+  return { message: String(error) };
+}
 
 // src/cli.ts
+var DEFAULT_COPILOT_API_BASE_URL2 = "https://api.githubcopilot.com";
 async function main(argv = Bun.argv.slice(2)) {
   cleanupOldBinary();
   const command = argv[0];
   if (command === "update" || command === "upgrade") {
-    await runUpdate(await getVersion());
+    const args2 = withRuntimeEnv(parseArgs(argv.slice(1)));
+    if (args2.help) {
+      console.log(helpText(await getVersion()));
+      return;
+    }
+    const logger2 = createHoopilotLogger({
+      env: args2.env,
+      format: args2.logFormat,
+      level: args2.logLevel
+    }).child({ component: "cli", command });
+    await runUpdate(await getVersion(), logger2);
+    return;
+  }
+  if (command === "login") {
+    const args2 = withRuntimeEnv(parseArgs(argv.slice(1)));
+    if (args2.help) {
+      console.log(helpText(await getVersion()));
+      return;
+    }
+    args2.logger = createHoopilotLogger({
+      env: args2.env,
+      format: args2.logFormat,
+      level: args2.logLevel
+    }).child({ component: "cli", command: "login" });
+    await runLogin(args2);
     return;
   }
-  const args = parseArgs(argv);
+  const args = withRuntimeEnv(parseArgs(argv));
   if (args.help) {
     console.log(helpText(await getVersion()));
     return;
@@ -1513,12 +1852,27 @@ async function main(argv = Bun.argv.slice(2)) {
     console.log(await getVersion());
     return;
   }
+  const logger = createHoopilotLogger({
+    env: args.env,
+    format: args.logFormat,
+    level: args.logLevel
+  }).child({ component: "cli", command: "serve" });
+  args.logger = logger;
   const started = startHoopilotServer(args);
-  console.log(`hoopilot listening on ${started.url}`);
-  console.log(`OpenAI base URL: ${started.url}/v1`);
-  console.log("Use Ctrl+C to stop.");
-  if (!args.noUpdateCheck) {
-    void maybeNotifyUpdate(await getVersion(), IS_STANDALONE_BINARY ? "binary" : "npm");
+  logger.info(
+    {
+      baseUrl: `${started.url}/v1`,
+      event: "server.started",
+      url: started.url
+    },
+    "hoopilot server started"
+  );
+  if (!args.noUpdateCheck && process.env.HOOPILOT_NO_UPDATE_CHECK !== "1") {
+    void maybeNotifyUpdate(
+      await getVersion(),
+      IS_STANDALONE_BINARY ? "binary" : "npm",
+      logger.child({ component: "update" })
+    );
   }
 }
 function parseArgs(argv) {
@@ -1544,10 +1898,6 @@ function parseArgs(argv) {
       args.allowUnauthenticated = true;
       continue;
     }
-    if (arg === "--no-gh") {
-      args.githubTokenCommand = false;
-      continue;
-    }
     if (arg === "--no-update-check") {
       args.noUpdateCheck = true;
       continue;
@@ -1561,20 +1911,17 @@ function parseArgs(argv) {
       case "--api-key":
         args.apiKey = value;
         break;
-      case "--auth-mode":
-        args.authMode = parseAuthMode(value);
+      case "--auth-file":
+        args.authStorePath = value;
         break;
       case "--copilot-api-base-url":
         args.copilotApiBaseUrl = value;
         break;
-      case "--copilot-token":
-        args.copilotToken = value;
-        break;
-      case "--github-token":
-        args.githubToken = value;
+      case "--log-format":
+        args.logFormat = parseLogFormat(value);
         break;
-      case "--github-token-command":
-        args.githubTokenCommand = value;
+      case "--log-level":
+        args.logLevel = parseLogLevel(value);
         break;
       case "--host":
         args.host = value;
@@ -1592,11 +1939,92 @@ function parseArgs(argv) {
   }
   return args;
 }
-function parseAuthMode(value) {
-  if (value === "auto" || value === "copilot-token") {
-    return value;
+async function runLogin(options = {}) {
+  const logger = options.logger?.child({ component: "auth" }) ?? noopLogger;
+  logger.debug({ event: "auth.login.started" }, "starting github copilot browser login");
+  console.log("Starting GitHub Copilot browser login...");
+  const login = await githubCopilotDeviceLogin({
+    env: options.env,
+    logger: console,
+    openBrowser: openBrowserBestEffort
+  });
+  console.log("Checking GitHub Copilot access...");
+  const access = await verifyCopilotOAuthToken(login.token, options);
+  logger.debug(
+    { apiBaseUrl: access.apiBaseUrl, event: "auth.login.verified" },
+    "github copilot oauth token verified"
+  );
+  const path = options.authStorePath ?? authStorePath(options.env);
+  writeStoredCopilotAuth(
+    {
+      apiBaseUrl: access.apiBaseUrl,
+      githubDomain: login.domain,
+      source: "github-device-oauth",
+      token: login.token
+    },
+    path
+  );
+  logger.debug({ authStorePath: path, event: "auth.login.stored" }, "copilot credential stored");
+  console.log(`Copilot OAuth credential stored at ${path}`);
+  console.log("Copilot authentication ready.");
+}
+async function verifyCopilotOAuthToken(token, options = {}) {
+  const apiBaseUrl = trimTrailingSlash2(
+    options.copilotApiBaseUrl ?? options.env?.COPILOT_API_BASE_URL ?? DEFAULT_COPILOT_API_BASE_URL2
+  );
+  const fetcher = options.fetch ?? fetch;
+  const response = await fetcher(`${apiBaseUrl}/models`, {
+    headers: copilotHeaders(token),
+    method: "GET"
+  });
+  if (!response.ok) {
+    const message = `GitHub Copilot API verification failed with ${response.status}: ${await safeResponseText2(response)}`;
+    if (response.status === 401 || response.status === 403) {
+      throw new CopilotAuthError(message);
+    }
+    throw new Error(message);
   }
-  throw new Error(`Invalid auth mode: ${value}.`);
+  return {
+    apiBaseUrl,
+    expiresAtMs: Date.now() + 10 * 6e4,
+    source: "github-copilot-oauth",
+    token
+  };
+}
+function openBrowserBestEffort(url) {
+  const platform = process.platform;
+  const command = platform === "win32" ? "cmd" : platform === "darwin" ? "open" : "xdg-open";
+  const args = platform === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    const child = spawn(command, args, {
+      detached: true,
+      stdio: "ignore"
+    });
+    child.unref();
+  } catch {
+  }
+}
+function copilotHeaders(token) {
+  const headers = new Headers();
+  headers.set("accept", "application/json");
+  headers.set("authorization", `Bearer ${token}`);
+  headers.set("copilot-integration-id", "vscode-chat");
+  headers.set("editor-plugin-version", "hoopilot/0.1.0");
+  headers.set("editor-version", "Hoopilot/0.1.0");
+  headers.set("openai-intent", "conversation-panel");
+  headers.set("user-agent", "hoopilot/0.1.0");
+  headers.set("x-github-api-version", "2026-06-01");
+  return headers;
+}
+async function safeResponseText2(response) {
+  const text = await response.text();
+  return text.slice(0, 500);
+}
+function trimTrailingSlash2(value) {
+  return value.replace(/\/+$/, "");
+}
+function withRuntimeEnv(args) {
+  return { ...args, env: process.env };
 }
 function helpText(version) {
   return `hoopilot ${version}
@@ -1605,23 +2033,23 @@ OpenAI-compatible proxy for GitHub Copilot.
 
 Usage:
   hoopilot [serve] [options]
+  hoopilot login [options]
   hoopilot update
   npx @openhoo/hoopilot [options]
 
 Commands:
   serve                             Start the proxy server (default)
+  login                             Sign in through GitHub OAuth in a browser and verify Copilot access
   update, upgrade                   Update hoopilot to the latest release
 
 Options:
   -p, --port <port>                 Port to listen on. Default: 4141
       --host <host>                 Host to listen on. Default: 127.0.0.1
       --api-key <key>               Require clients to send Authorization: Bearer <key>
-      --auth-mode <mode>            auto, copilot-token
-      --github-token <token>        GitHub CLI OAuth token for a Copilot account. PATs are rejected.
-      --github-token-command <cmd>  Command used to read a GitHub token. Default: gh auth token
-      --copilot-token <token>       Short-lived Copilot API bearer token
+      --auth-file <path>            OAuth credential store path
       --copilot-api-base-url <url>  Copilot API base URL override
-      --no-gh                       Do not try gh auth token
+      --log-level <level>           trace, debug, info, warn, error, fatal, or silent
+      --log-format <format>         json or pretty. Default: pretty
       --no-update-check             Do not check GitHub for a newer release
       --allow-unauthenticated       Allow non-loopback bind without --api-key
   -h, --help                        Show help
@@ -1629,8 +2057,11 @@ Options:
 
 Environment:
   HOOPILOT_API_KEY
-  COPILOT_GITHUB_TOKEN
-  COPILOT_API_TOKEN, GITHUB_COPILOT_API_TOKEN
+  HOOPILOT_AUTH_FILE
+  HOOPILOT_GITHUB_CLIENT_ID
+  HOOPILOT_GITHUB_DOMAIN
+  HOOPILOT_LOG_FORMAT               json or pretty. Default: pretty
+  HOOPILOT_LOG_LEVEL                trace, debug, info, warn, error, fatal, or silent
   COPILOT_API_BASE_URL
   HOOPILOT_NO_UPDATE_CHECK          Set to disable update checks (also NO_UPDATE_NOTIFIER)
 `;
@@ -1643,6 +2074,7 @@ if (import.meta.main) {
 }
 export {
   main,
-  parseArgs
+  parseArgs,
+  verifyCopilotOAuthToken
 };
 //# sourceMappingURL=cli.js.map