@sriinnu/runic 1.2.0 → 2.11.1

package/Sources/RunicCore/Providers/Copilot/CopilotUsageFetcher.swift

@@ -1,291 +0,0 @@
-import Foundation
-#if canImport(FoundationNetworking)
-import FoundationNetworking
-#endif
-
-public enum CopilotUsageFetchError: LocalizedError, Sendable {
-    case unauthorized(details: String)
-    case endpointUnavailable(details: String)
-    case invalidResponse(details: String)
-    case noQuotaData
-    case allAttemptsFailed(details: [String])
-    case missingCredentials(details: String)
-
-    public var errorDescription: String? {
-        switch self {
-        case let .unauthorized(details):
-            if details.isEmpty {
-                return "GitHub Copilot token unauthorized. Sign in again."
-            }
-            return "GitHub Copilot token unauthorized. \(details)"
-        case let .endpointUnavailable(details):
-            if details.isEmpty {
-                return "GitHub Copilot usage endpoint unavailable."
-            }
-            return "GitHub Copilot usage endpoint unavailable. \(details)"
-        case let .invalidResponse(details):
-            if details.isEmpty {
-                return "GitHub Copilot returned an invalid response."
-            }
-            return "GitHub Copilot returned an invalid response. \(details)"
-        case .noQuotaData:
-            return "GitHub Copilot returned no quota snapshots."
-        case let .allAttemptsFailed(details):
-            let compact = details
-                .filter { !$0.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty }
-                .joined(separator: " | ")
-            if compact.isEmpty {
-                return "GitHub Copilot usage fetch failed after multiple attempts."
-            }
-            return "GitHub Copilot usage fetch failed after multiple attempts. \(compact)"
-        case let .missingCredentials(details):
-            if details.isEmpty {
-                return "GitHub Copilot credentials are missing."
-            }
-            return "GitHub Copilot credentials are missing. \(details)"
-        }
-    }
-}
-
-public struct CopilotUsageFetcher: Sendable {
-    private struct CopilotSessionTokenResponse: Decodable {
-        let token: String
-    }
-
-    private let token: String
-    private let tokenSourceLabel: String
-    private static let log = RunicLog.logger("copilot-usage")
-
-    public init(token: String, tokenSourceLabel: String = "settings") {
-        self.token = token
-        self.tokenSourceLabel = tokenSourceLabel
-    }
-
-    public func fetch() async throws -> UsageSnapshot {
-        guard let url = URL(string: "https://api.github.com/copilot_internal/user") else {
-            throw URLError(.badURL)
-        }
-        Self.log.debug("Starting Copilot fetch using token source \(self.tokenSourceLabel).")
-
-        var attemptNotes: [String] = []
-        let githubAuthHeaders = [
-            ("token", "token \(self.token)"),
-            ("bearer", "Bearer \(self.token)"),
-        ]
-        attemptNotes.append("auth-source=\(self.tokenSourceLabel)")
-
-        for (label, value) in githubAuthHeaders {
-            do {
-                Self.log.debug("Attempting Copilot fetch with \(label) auth.")
-                let usage = try await self.fetchUsage(url: url, authorization: value)
-                return try self.makeSnapshot(from: usage)
-            } catch let error as CopilotUsageFetchError {
-                attemptNotes.append("\(label): \(error.localizedDescription)")
-                Self.log.warning("Copilot fetch with \(label) auth failed: \(error.localizedDescription)")
-            } catch {
-                attemptNotes.append("\(label): \(error.localizedDescription)")
-                Self.log.warning("Copilot fetch with \(label) auth failed: \(error.localizedDescription)")
-            }
-        }
-
-        if let copilotSessionToken = try? await self.exchangeCopilotSessionToken() {
-            Self.log.debug("Attempting Copilot token-exchange flow.")
-            do {
-                let usage = try await self.fetchUsage(url: url, authorization: "Bearer \(copilotSessionToken)")
-                return try self.makeSnapshot(from: usage)
-            } catch let error as CopilotUsageFetchError {
-                attemptNotes.append("copilot-session: \(error.localizedDescription)")
-                Self.log.warning("Copilot session-token flow failed: \(error.localizedDescription)")
-            } catch {
-                attemptNotes.append("copilot-session: \(error.localizedDescription)")
-                Self.log.warning("Copilot session-token flow failed: \(error.localizedDescription)")
-            }
-        } else {
-            attemptNotes.append("copilot-session: token exchange failed")
-            Self.log.warning("Copilot session-token flow failed to exchange token.")
-        }
-
-        Self.log.error("Copilot fetch failed after attempts: \(attemptNotes.joined(separator: " | "))")
-        throw CopilotUsageFetchError.allAttemptsFailed(details: attemptNotes)
-    }
-
-    private func fetchUsage(url: URL, authorization: String) async throws -> CopilotUsageResponse {
-        var request = URLRequest(url: url)
-        request.setValue(authorization, forHTTPHeaderField: "Authorization")
-        self.addCommonHeaders(to: &request)
-
-        let (data, response) = try await URLSession.shared.data(for: request)
-        guard let httpResponse = response as? HTTPURLResponse else {
-            throw CopilotUsageFetchError.invalidResponse(details: "missing HTTP response")
-        }
-
-        guard httpResponse.statusCode == 200 else {
-            let body = self.errorSnippet(from: data)
-            if httpResponse.statusCode == 401 || httpResponse.statusCode == 403 {
-                throw CopilotUsageFetchError.unauthorized(details: "HTTP \(httpResponse.statusCode). \(body)")
-            }
-            if httpResponse.statusCode == 404 {
-                throw CopilotUsageFetchError.endpointUnavailable(
-                    details: "HTTP 404. Copilot usage endpoint may have changed. \(body)")
-            }
-            throw CopilotUsageFetchError.invalidResponse(
-                details: "HTTP \(httpResponse.statusCode). \(body)")
-        }
-
-        do {
-            return try JSONDecoder().decode(CopilotUsageResponse.self, from: data)
-        } catch {
-            let body = self.errorSnippet(from: data)
-            throw CopilotUsageFetchError.invalidResponse(
-                details: "decode failed: \(error.localizedDescription). \(body)")
-        }
-    }
-
-    private func exchangeCopilotSessionToken() async throws -> String {
-        guard let url = URL(string: "https://api.github.com/copilot_internal/v2/token") else {
-            throw URLError(.badURL)
-        }
-
-        var request = URLRequest(url: url)
-        request.setValue("token \(self.token)", forHTTPHeaderField: "Authorization")
-        self.addCommonHeaders(to: &request)
-
-        let (data, response) = try await URLSession.shared.data(for: request)
-        guard let httpResponse = response as? HTTPURLResponse else {
-            throw CopilotUsageFetchError.invalidResponse(details: "token exchange missing HTTP response")
-        }
-
-        guard httpResponse.statusCode == 200 else {
-            let body = self.errorSnippet(from: data)
-            if httpResponse.statusCode == 401 || httpResponse.statusCode == 403 {
-                throw CopilotUsageFetchError.unauthorized(details: "token exchange HTTP \(httpResponse.statusCode). \(body)")
-            }
-            throw CopilotUsageFetchError.invalidResponse(
-                details: "token exchange HTTP \(httpResponse.statusCode). \(body)")
-        }
-
-        let decoded = try JSONDecoder().decode(CopilotSessionTokenResponse.self, from: data)
-        let cleaned = decoded.token.trimmingCharacters(in: .whitespacesAndNewlines)
-        guard !cleaned.isEmpty else {
-            throw CopilotUsageFetchError.invalidResponse(details: "token exchange returned empty token")
-        }
-        return cleaned
-    }
-
-    private func makeSnapshot(from usage: CopilotUsageResponse) throws -> UsageSnapshot {
-        let resetDate = self.parseDate(usage.quotaResetDate)
-        let orderedSnapshots = self.orderedQuotaSnapshots(usage.quotaSnapshots)
-        guard !orderedSnapshots.isEmpty else {
-            throw CopilotUsageFetchError.noQuotaData
-        }
-        let primary = self.makeRateWindow(from: orderedSnapshots.first, resetAt: resetDate)
-        let secondary = self.makeRateWindow(
-            from: orderedSnapshots.count > 1 ? orderedSnapshots[1] : nil,
-            resetAt: resetDate)
-        let tertiary = self.makeRateWindow(
-            from: orderedSnapshots.count > 2 ? orderedSnapshots[2] : nil,
-            resetAt: resetDate)
-
-        let resolvedPrimary = primary ?? RateWindow(
-            usedPercent: 0,
-            windowMinutes: nil,
-            resetsAt: resetDate,
-            resetDescription: nil)
-
-        let plan = usage.copilotPlan?
-            .replacingOccurrences(of: "_", with: " ")
-            .capitalized
-        let organization = usage.organizationList?.first?.login ??
-            usage.organizationList?.first?.name ??
-            usage.organizationLoginList?.first
-        let identity = ProviderIdentitySnapshot(
-            providerID: .copilot,
-            accountEmail: nil,
-            accountOrganization: organization,
-            loginMethod: plan)
-        return UsageSnapshot(
-            primary: resolvedPrimary,
-            secondary: secondary,
-            tertiary: tertiary,
-            providerCost: nil,
-            updatedAt: Date(),
-            identity: identity)
-    }
-
-    private func addCommonHeaders(to request: inout URLRequest) {
-        request.setValue("application/json", forHTTPHeaderField: "Accept")
-        request.setValue("vscode/1.96.2", forHTTPHeaderField: "Editor-Version")
-        request.setValue("copilot-chat/0.26.7", forHTTPHeaderField: "Editor-Plugin-Version")
-        request.setValue("GitHubCopilotChat/0.26.7", forHTTPHeaderField: "User-Agent")
-        request.setValue("2025-04-01", forHTTPHeaderField: "X-Github-Api-Version")
-    }
-
-    private func makeRateWindow(
-        from snapshot: CopilotUsageResponse.QuotaSnapshot?,
-        resetAt: Date?) -> RateWindow?
-    {
-        guard let snapshot else { return nil }
-        guard let percentRemaining = snapshot.normalizedPercentRemaining else { return nil }
-        let usedPercent = max(0, min(100, 100 - percentRemaining))
-
-        return RateWindow(
-            usedPercent: usedPercent,
-            windowMinutes: nil,
-            resetsAt: resetAt,
-            resetDescription: nil,
-            label: self.quotaLabel(snapshot.quotaId))
-    }
-
-    private func parseDate(_ raw: String?) -> Date? {
-        guard let raw = raw?.trimmingCharacters(in: .whitespacesAndNewlines), !raw.isEmpty else { return nil }
-        if let parsed = try? Date(raw, strategy: .iso8601) {
-            return parsed
-        }
-        return ISO8601DateFormatter().date(from: raw)
-    }
-
-    private func quotaLabel(_ quotaID: String?) -> String? {
-        guard let quotaID = quotaID?.trimmingCharacters(in: .whitespacesAndNewlines), !quotaID.isEmpty else {
-            return nil
-        }
-        return quotaID
-            .replacingOccurrences(of: "_", with: " ")
-            .replacingOccurrences(of: "-", with: " ")
-    }
-
-    private func orderedQuotaSnapshots(_ snapshots: CopilotUsageResponse.QuotaSnapshots?) -> [CopilotUsageResponse.QuotaSnapshot] {
-        guard let snapshots else { return [] }
-        let candidates = [snapshots.premiumInteractions, snapshots.completions, snapshots.chat]
-        var ordered: [CopilotUsageResponse.QuotaSnapshot] = []
-        var seen: Set<String> = []
-
-        for candidate in candidates {
-            guard let candidate else { continue }
-            let fingerprint = self.quotaFingerprint(candidate)
-            guard seen.insert(fingerprint).inserted else { continue }
-            ordered.append(candidate)
-        }
-        return ordered
-    }
-
-    private func quotaFingerprint(_ snapshot: CopilotUsageResponse.QuotaSnapshot) -> String {
-        if let quotaID = snapshot.quotaId?.trimmingCharacters(in: .whitespacesAndNewlines),
-           !quotaID.isEmpty
-        {
-            return "id:\(quotaID.lowercased())"
-        }
-        return "fallback:\(snapshot.entitlement ?? -1)|\(snapshot.normalizedRemaining ?? -1)|" +
-            "\(snapshot.percentRemaining ?? -1)|\(snapshot.timestampUTC ?? "")"
-    }
-
-    private func errorSnippet(from data: Data) -> String {
-        let text = String(data: data, encoding: .utf8)?
-            .trimmingCharacters(in: .whitespacesAndNewlines) ?? "<non-utf8>"
-        if text.count <= 220 {
-            return text
-        }
-        let end = text.index(text.startIndex, offsetBy: 220)
-        return "\(text[..<end])…"
-    }
-
-}

package/Sources/RunicCore/Providers/Copilot/CopilotVSCodeTokenReader.swift

@@ -1,386 +0,0 @@
-import Foundation
-
-#if os(macOS)
-import CommonCrypto
-import LocalAuthentication
-import Security
-import SQLite3
-#if canImport(CryptoKit)
-import CryptoKit
-#endif
-
-public enum CopilotVSCodeTokenReader {
-    private struct VSCodeStoreCandidate: Sendable {
-        let databaseURL: URL
-        let safeStorageService: String
-    }
-
-    private static let githubAuthSecretKey = "secret://{\"extensionId\":\"vscode.github-authentication\",\"key\":\"github.auth\"}"
-    private static let sqliteTransient = unsafeBitCast(-1, to: sqlite3_destructor_type.self)
-    private static let pbkdf2Salt = Data("saltysalt".utf8)
-    private static let pbkdf2Iterations: UInt32 = 1003
-    private static let legacyKeyLength = kCCKeySizeAES128
-    private static let log = RunicLog.logger("copilot-vscode-token")
-
-    public static func token(
-        environment: [String: String] = ProcessInfo.processInfo.environment,
-        allowUserInteraction: Bool = false) -> String?
-    {
-        for candidate in self.candidateStores(environment: environment) {
-            guard let secretValue = self.readSecretValue(from: candidate.databaseURL) else {
-                continue
-            }
-            guard let encryptedPayload = self.normalizeEncryptedPayload(secretValue) else {
-                continue
-            }
-            guard let password = self.readSafeStoragePassword(
-                service: candidate.safeStorageService,
-                allowUserInteraction: allowUserInteraction),
-                  let legacyKey = self.deriveLegacyKey(from: password),
-                  let decryptedJSON = self.decryptSecretPayload(encryptedPayload, legacyKey: legacyKey),
-                  let token = self.extractToken(fromDecryptedJSON: decryptedJSON)
-            else {
-                continue
-            }
-            return token
-        }
-        return nil
-    }
-
-    private static func candidateStores(environment: [String: String]) -> [VSCodeStoreCandidate] {
-        let appVariants: [(appName: String, service: String)] = [
-            ("Code", "Code Safe Storage"),
-            ("Code - Insiders", "Code - Insiders Safe Storage"),
-            ("VSCodium", "VSCodium Safe Storage"),
-            ("Code - OSS", "Code - OSS Safe Storage"),
-        ]
-
-        var stores: [VSCodeStoreCandidate] = []
-        for home in self.candidateHomes(environment: environment) {
-            let appSupport = home
-                .appendingPathComponent("Library")
-                .appendingPathComponent("Application Support")
-            for variant in appVariants {
-                let globalStorage = appSupport
-                    .appendingPathComponent(variant.appName)
-                    .appendingPathComponent("User")
-                    .appendingPathComponent("globalStorage")
-
-                let dbURL = globalStorage.appendingPathComponent("state.vscdb")
-                if FileManager.default.fileExists(atPath: dbURL.path) {
-                    stores.append(VSCodeStoreCandidate(databaseURL: dbURL, safeStorageService: variant.service))
-                }
-
-                let backupURL = globalStorage.appendingPathComponent("state.vscdb.backup")
-                if FileManager.default.fileExists(atPath: backupURL.path) {
-                    stores.append(VSCodeStoreCandidate(databaseURL: backupURL, safeStorageService: variant.service))
-                }
-            }
-        }
-        return stores
-    }
-
-    private static func candidateHomes(environment: [String: String]) -> [URL] {
-        var homes: [URL] = [FileManager.default.homeDirectoryForCurrentUser]
-        if let userHome = NSHomeDirectoryForUser(NSUserName()) {
-            homes.append(URL(fileURLWithPath: userHome))
-        }
-        if let envHome = environment["HOME"]?.trimmingCharacters(in: .whitespacesAndNewlines),
-           !envHome.isEmpty
-        {
-            homes.append(URL(fileURLWithPath: envHome))
-        }
-
-        var seen = Set<String>()
-        return homes.filter { home in
-            let path = home.path
-            guard !seen.contains(path) else { return false }
-            seen.insert(path)
-            return true
-        }
-    }
-
-    private static func readSecretValue(from databaseURL: URL) -> Data? {
-        var db: OpaquePointer?
-        let openStatus = sqlite3_open_v2(databaseURL.path, &db, SQLITE_OPEN_READONLY | SQLITE_OPEN_NOMUTEX, nil)
-        guard openStatus == SQLITE_OK, let db else { return nil }
-        defer { sqlite3_close(db) }
-
-        let sql = "SELECT value FROM ItemTable WHERE key = ?1 LIMIT 1;"
-        var statement: OpaquePointer?
-        guard sqlite3_prepare_v2(db, sql, -1, &statement, nil) == SQLITE_OK, let statement else {
-            return nil
-        }
-        defer { sqlite3_finalize(statement) }
-
-        sqlite3_bind_text(statement, 1, (self.githubAuthSecretKey as NSString).utf8String, -1, self.sqliteTransient)
-
-        guard sqlite3_step(statement) == SQLITE_ROW else { return nil }
-
-        let columnType = sqlite3_column_type(statement, 0)
-        let byteCount = Int(sqlite3_column_bytes(statement, 0))
-        guard byteCount > 0 else { return nil }
-
-        switch columnType {
-        case SQLITE_TEXT:
-            guard let ptr = sqlite3_column_text(statement, 0) else { return nil }
-            return Data(bytes: ptr, count: byteCount)
-        case SQLITE_BLOB:
-            guard let ptr = sqlite3_column_blob(statement, 0) else { return nil }
-            return Data(bytes: ptr, count: byteCount)
-        default:
-            return nil
-        }
-    }
-
-    private static func normalizeEncryptedPayload(_ valueData: Data) -> Data? {
-        if valueData.count >= 3 {
-            let prefix = valueData.prefix(3)
-            if prefix == Data("v10".utf8) || prefix == Data("v11".utf8) {
-                return valueData
-            }
-        }
-
-        guard let decoded = try? JSONSerialization.jsonObject(with: valueData) as? [String: Any] else {
-            guard let text = String(data: valueData, encoding: .utf8)?
-                .trimmingCharacters(in: .whitespacesAndNewlines)
-            else {
-                return nil
-            }
-            if let base64 = Data(base64Encoded: text), !base64.isEmpty {
-                return base64
-            }
-            return nil
-        }
-
-        guard let type = decoded["type"] as? String,
-              type == "Buffer",
-              let bufferData = decoded["data"] as? [Any]
-        else {
-            return nil
-        }
-
-        var bytes: [UInt8] = []
-        bytes.reserveCapacity(bufferData.count)
-        for item in bufferData {
-            guard let number = item as? NSNumber else { return nil }
-            let value = number.intValue
-            guard (0...255).contains(value) else { return nil }
-            bytes.append(UInt8(value))
-        }
-        return bytes.isEmpty ? nil : Data(bytes)
-    }
-
-    private static func readSafeStoragePassword(service: String, allowUserInteraction: Bool) -> String? {
-        var query: [String: Any] = [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrService as String: service,
-            kSecReturnData as String: true,
-            kSecMatchLimit as String: kSecMatchLimitOne,
-        ]
-
-        if allowUserInteraction {
-            query[kSecUseAuthenticationUI as String] = "kSecUseAuthenticationUIAllow" as CFString
-        } else {
-            query[kSecUseAuthenticationUI as String] = "kSecUseAuthenticationUIFail" as CFString
-            let authContext = LAContext()
-            authContext.interactionNotAllowed = true
-            query[kSecUseAuthenticationContext as String] = authContext
-        }
-
-        var result: CFTypeRef?
-        let status = SecItemCopyMatching(query as CFDictionary, &result)
-        guard status == errSecSuccess, let data = result as? Data else {
-            return nil
-        }
-        return String(data: data, encoding: .utf8)?
-            .trimmingCharacters(in: .whitespacesAndNewlines)
-    }
-
-    private static func deriveLegacyKey(from password: String) -> Data? {
-        let passwordBytes = Array(password.utf8)
-        var key = Data(count: self.legacyKeyLength)
-        let status = key.withUnsafeMutableBytes { keyBytes in
-            CCKeyDerivationPBKDF(
-                CCPBKDFAlgorithm(kCCPBKDF2),
-                passwordBytes,
-                passwordBytes.count,
-                [UInt8](self.pbkdf2Salt),
-                self.pbkdf2Salt.count,
-                CCPseudoRandomAlgorithm(kCCPRFHmacAlgSHA1),
-                self.pbkdf2Iterations,
-                keyBytes.bindMemory(to: UInt8.self).baseAddress,
-                self.legacyKeyLength)
-        }
-        guard status == kCCSuccess else { return nil }
-        return key
-    }
-
-    private static func decryptSecretPayload(_ payload: Data, legacyKey: Data) -> String? {
-        let encryptedPayload: Data
-        if payload.count >= 3,
-           let prefix = String(data: payload.prefix(3), encoding: .utf8),
-           prefix == "v10" || prefix == "v11"
-        {
-            encryptedPayload = Data(payload.dropFirst(3))
-        } else {
-            encryptedPayload = payload
-        }
-
-        let iv = Data(repeating: 0x20, count: kCCBlockSizeAES128)
-        if let cbc = self.decryptAESCBC(payload: encryptedPayload, key: legacyKey, iv: iv),
-           let text = String(data: cbc, encoding: .utf8),
-           !text.isEmpty
-        {
-            return text
-        }
-
-        if let gcm = self.decryptAESGCM(payload: encryptedPayload, key: legacyKey),
-           let text = String(data: gcm, encoding: .utf8),
-           !text.isEmpty
-        {
-            return text
-        }
-
-        return nil
-    }
-
-    private static func decryptAESCBC(payload: Data, key: Data, iv: Data) -> Data? {
-        var outputLength: size_t = 0
-        var output = Data(count: payload.count + kCCBlockSizeAES128)
-        let outputCapacity = output.count
-        let status = output.withUnsafeMutableBytes { outputBytes in
-            payload.withUnsafeBytes { payloadBytes in
-                iv.withUnsafeBytes { ivBytes in
-                    key.withUnsafeBytes { keyBytes in
-                        CCCrypt(
-                            CCOperation(kCCDecrypt),
-                            CCAlgorithm(kCCAlgorithmAES),
-                            CCOptions(kCCOptionPKCS7Padding),
-                            keyBytes.baseAddress,
-                            key.count,
-                            ivBytes.baseAddress,
-                            payloadBytes.baseAddress,
-                            payload.count,
-                            outputBytes.baseAddress,
-                            outputCapacity,
-                            &outputLength)
-                    }
-                }
-            }
-        }
-        guard status == kCCSuccess else { return nil }
-        output.removeSubrange(outputLength..<output.count)
-        return output
-    }
-
-    private static func decryptAESGCM(payload: Data, key: Data) -> Data? {
-        #if canImport(CryptoKit)
-        guard payload.count >= 12 + 16 else { return nil }
-        do {
-            let nonce = try AES.GCM.Nonce(data: payload.prefix(12))
-            let ciphertext = payload.dropFirst(12).dropLast(16)
-            let tag = payload.suffix(16)
-            let sealedBox = try AES.GCM.SealedBox(nonce: nonce, ciphertext: ciphertext, tag: tag)
-            return try AES.GCM.open(sealedBox, using: SymmetricKey(data: key))
-        } catch {
-            self.log.debug("GCM decrypt failed: \(error.localizedDescription)")
-            return nil
-        }
-        #else
-        _ = payload
-        _ = key
-        return nil
-        #endif
-    }
-
-    private static func extractToken(fromDecryptedJSON decryptedJSON: String) -> String? {
-        guard let data = decryptedJSON.data(using: .utf8),
-              let root = try? JSONSerialization.jsonObject(with: data)
-        else {
-            return nil
-        }
-        return self.extractToken(fromJSONNode: root)
-    }
-
-    private static func extractToken(fromJSONNode node: Any) -> String? {
-        if let dictionary = node as? [String: Any] {
-            let directKeys = ["accessToken", "access_token", "oauthToken", "token"]
-            for key in directKeys {
-                if let token = self.validToken(dictionary[key] as? String) {
-                    return token
-                }
-            }
-
-            for value in dictionary.values {
-                if value is [String: Any] || value is [Any] {
-                    if let token = self.extractToken(fromJSONNode: value) {
-                        return token
-                    }
-                }
-            }
-            return nil
-        }
-
-        if let array = node as? [Any] {
-            for entry in array {
-                if let token = self.extractToken(fromJSONNode: entry) {
-                    return token
-                }
-            }
-        }
-        return nil
-    }
-
-    private static func validToken(_ raw: String?) -> String? {
-        guard let token = raw?.trimmingCharacters(in: .whitespacesAndNewlines), !token.isEmpty else {
-            return nil
-        }
-        guard !token.contains(where: \.isWhitespace), token.count >= 20 else {
-            return nil
-        }
-
-        let knownPrefixes = ["gho_", "ghp_", "ghu_", "ghs_", "github_pat_", "v1."]
-        if knownPrefixes.contains(where: token.hasPrefix) {
-            return token
-        }
-
-        if token.range(of: #"^[A-Za-z0-9._=-]{20,}$"#, options: .regularExpression) != nil {
-            return token
-        }
-        return nil
-    }
-}
-
-#else
-public enum CopilotVSCodeTokenReader {
-    public static func token(
-        environment _: [String: String] = ProcessInfo.processInfo.environment,
-        allowUserInteraction _: Bool = false) -> String?
-    {
-        nil
-    }
-}
-#endif
-
-#if DEBUG
-extension CopilotVSCodeTokenReader {
-    static func _normalizedPayloadForTesting(_ valueData: Data) -> Data? {
-        #if os(macOS)
-        self.normalizeEncryptedPayload(valueData)
-        #else
-        _ = valueData
-        return nil
-        #endif
-    }
-
-    static func _extractTokenFromDecryptedJSONForTesting(_ decryptedJSON: String) -> String? {
-        #if os(macOS)
-        self.extractToken(fromDecryptedJSON: decryptedJSON)
-        #else
-        _ = decryptedJSON
-        return nil
-        #endif
-    }
-}
-#endif