@theia/ai-copilot 1.75.0 → 1.76.0-next.10

package/src/common/copilot-auth-service.ts

@@ -21,19 +21,13 @@ export const CopilotAuthService = Symbol('CopilotAuthService');
 export const CopilotAuthServiceClient = Symbol('CopilotAuthServiceClient');
 
 /**
- * Response from GitHub's device code endpoint.
+ * The device code flow information reported by the Copilot CLI for the UI to display.
  */
 export interface DeviceCodeResponse {
     /** URL where user should enter the code (e.g., https://github.com/login/device) */
     verification_uri: string;
     /** Code to display to the user (e.g., XXXX-XXXX) */
     user_code: string;
-    /** Device code used for polling */
-    device_code: string;
-    /** Polling interval in seconds */
-    interval: number;
-    /** Expiration time in seconds */
-    expires_in: number;
 }
 
 /**
@@ -46,7 +40,10 @@ export interface CopilotAuthState {
     accountLabel?: string;
     /** GitHub Enterprise URL if using enterprise */
     enterpriseUrl?: string;
-    /** True when credentials were cleared due to a client ID migration */
+    /**
+     * True when the credentials of a previous version were found and discarded, so that the user can
+     * be told why they have to sign in again.
+     */
     migrationRequired?: boolean;
 }
 
@@ -58,41 +55,48 @@ export interface CopilotAuthServiceClient {
 }
 
 /**
- * Service for handling GitHub Copilot OAuth Device Flow authentication.
+ * Service for signing the GitHub Copilot CLI in, which serves all Copilot requests.
+ *
+ * The sign-in is a device code flow that the CLI runs and polls itself. This service starts it and
+ * reports its progress, so that it can be presented like any other device code flow.
  */
 export interface CopilotAuthService {
     /**
-     * Initiates the OAuth Device Flow.
-     * Returns device code information for the UI to display.
-     * @param enterpriseUrl Optional GitHub Enterprise domain
+     * Tells the backend where the Copilot CLI is, as configured by the user.
+     *
+     * The CLI is not shipped with the application and has to be found on the machine hosting the
+     * backend, which cannot read the preferences of the user itself.
+     * @param path Location of the CLI executable, or `undefined` to search for it
      */
-    initiateDeviceFlow(enterpriseUrl?: string): Promise<DeviceCodeResponse>;
+    setExecutablePath(path: string | undefined): Promise<void>;
 
     /**
-     * Polls for the access token after user authorizes.
-     * @param deviceCode The device code from initiateDeviceFlow
-     * @param interval Polling interval in seconds
+     * Starts the sign-in and resolves once the code the user has to enter is known.
      * @param enterpriseUrl Optional GitHub Enterprise domain
-     * @returns true if authentication succeeded, false if expired/denied
      */
-    pollForToken(deviceCode: string, interval: number, enterpriseUrl?: string): Promise<boolean>;
+    startSignIn(enterpriseUrl?: string): Promise<DeviceCodeResponse>;
 
     /**
-     * Get the current authentication state.
+     * Waits for the sign-in started by {@link startSignIn} to complete.
+     * @returns true if the sign-in succeeded, false if it was denied or expired
      */
-    getAuthState(): Promise<CopilotAuthState>;
+    waitForSignIn(): Promise<boolean>;
 
     /**
-     * Get the access token for API calls.
-     * @returns The access token or undefined if not authenticated
+     * Aborts a sign-in that is still in progress, if any.
      */
-    getAccessToken(): Promise<string | undefined>;
+    cancelSignIn(): Promise<void>;
 
     /**
-     * Sign out and clear stored credentials.
+     * Discards the stored credentials of this application.
      */
     signOut(): Promise<void>;
 
+    /**
+     * Get the current authentication state.
+     */
+    getAuthState(): Promise<CopilotAuthState>;
+
     /**
      * Set the client to receive auth state change notifications.
      */

package/src/common/copilot-language-models-manager.ts

@@ -18,18 +18,6 @@ export const COPILOT_LANGUAGE_MODELS_MANAGER_PATH = '/services/copilot/language-
 export const CopilotLanguageModelsManager = Symbol('CopilotLanguageModelsManager');
 
 export const COPILOT_PROVIDER_ID = 'copilot';
-export const COPILOT_API_BASE_URL = 'https://api.githubcopilot.com';
-
-/**
- * Returns the Copilot API base URL, taking an optional GitHub Enterprise domain into account.
- */
-export function getCopilotApiBaseUrl(enterpriseUrl?: string): string {
-    if (enterpriseUrl) {
-        const domain = enterpriseUrl.replace(/^https?:\/\//, '').replace(/\/$/, '');
-        return `https://copilot-api.${domain}`;
-    }
-    return COPILOT_API_BASE_URL;
-}
 
 export interface CopilotModelDescription {
     /**
@@ -38,17 +26,9 @@ export interface CopilotModelDescription {
      */
     id: string;
     /**
-     * The model ID as used by the Copilot API (e.g., 'gpt-4o', 'claude-3.5-sonnet').
+     * The model ID as used by the Copilot API (e.g., 'gpt-5.5', 'claude-sonnet-5').
      */
     model: string;
-    /**
-     * Indicate whether the streaming API shall be used.
-     */
-    enableStreaming: boolean;
-    /**
-     * Flag to configure whether the model supports structured output.
-     */
-    supportsStructuredOutput: boolean;
     /**
      * Maximum number of retry attempts when a request fails.
      */
@@ -64,18 +44,13 @@ export interface CopilotLanguageModelsManager {
      * Remove language models from the registry.
      */
     removeLanguageModels(...modelIds: string[]): void;
-    /**
-     * Set the GitHub Enterprise URL for Copilot API requests.
-     */
-    setEnterpriseUrl(url: string | undefined): void;
     /**
      * Refresh the status of all Copilot models (e.g., after authentication state changes).
      */
     refreshModelsStatus(): Promise<void>;
     /**
-     * Fetches the list of available model IDs from the Copilot API.
-     * Requires authentication. Returns an empty array if not authenticated
-     * or if the API call fails.
+     * Fetches the list of available model IDs from the Copilot CLI.
+     * Requires the CLI to be signed in. Returns an empty array otherwise or if the call fails.
      */
     fetchAvailableModelIds(): Promise<string[]>;
 }

package/src/common/copilot-preferences.ts

@@ -20,6 +20,7 @@ import { nls, PreferenceSchema } from '@theia/core';
 export const COPILOT_ENABLED_PREF = 'ai-features.copilot.enabled';
 export const COPILOT_MODEL_OVERRIDES_PREF = 'ai-features.copilot.modelOverrides';
 export const COPILOT_ENTERPRISE_URL_PREF = 'ai-features.copilot.enterpriseUrl';
+export const COPILOT_EXECUTABLE_PATH_PREF = 'ai-features.copilot.executablePath';
 
 export const CopilotPreferencesSchema: PreferenceSchema = {
     properties: {
@@ -28,9 +29,13 @@ export const CopilotPreferencesSchema: PreferenceSchema = {
             typeDetails: { [MODEL_PROVIDER_TYPE_DETAIL]: { label: 'GitHub Copilot' } satisfies ModelProviderTypeDetail },
             markdownDescription: nls.localize('theia/ai/copilot/enabled/mdDescription',
                 'Enable the GitHub Copilot provider. When enabled, a status bar entry '
-                + 'appears for authentication and available models are discovered from your Copilot subscription.'),
+                + 'appears for authentication and available models are discovered from your Copilot subscription.\n\n'
+                + 'Requests are routed through the official GitHub Copilot CLI, which runs as a background process on the '
+                + 'machine hosting the backend. It is given the credentials of your Copilot sign-in and nothing else, so a '
+                + 'token in the environment or an existing sign-in of the GitHub CLI is not used.'),
             title: AI_CORE_PREFERENCES_TITLE,
-            default: true
+            default: true,
+            tags: ['experimental']
         },
         [COPILOT_MODEL_OVERRIDES_PREF]: {
             type: 'array',
@@ -42,14 +47,28 @@ export const CopilotPreferencesSchema: PreferenceSchema = {
             default: [],
             items: {
                 type: 'string'
-            }
+            },
+            tags: ['experimental']
         },
         [COPILOT_ENTERPRISE_URL_PREF]: {
             type: 'string',
             markdownDescription: nls.localize('theia/ai/copilot/enterpriseUrl/mdDescription',
-                'GitHub Enterprise domain for Copilot API (e.g., `github.mycompany.com`). Leave empty for GitHub.com.'),
+                'GitHub Enterprise domain to authenticate and send requests against (e.g., `github.mycompany.com`). '
+                + 'Leave empty for GitHub.com.'),
             title: AI_CORE_PREFERENCES_TITLE,
-            default: ''
+            default: '',
+            tags: ['experimental']
+        },
+        [COPILOT_EXECUTABLE_PATH_PREF]: {
+            type: 'string',
+            markdownDescription: nls.localize('theia/ai/copilot/executablePath/mdDescription',
+                'Location of the GitHub Copilot CLI executable on the machine hosting the backend. '
+                + 'When empty (default), the CLI is searched for in the installation of the application, on the `PATH` '
+                + 'and in the global `npm` directory. Set this when the CLI is installed somewhere else.\n\n'
+                + 'The CLI is not shipped with the application, install it with `npm install -g @github/copilot`.'),
+            title: AI_CORE_PREFERENCES_TITLE,
+            default: '',
+            tags: ['experimental']
         }
     }
 };

package/src/common/index.ts

@@ -16,5 +16,4 @@
 
 export * from './copilot-language-models-manager';
 export * from './copilot-auth-service';
-export * from './copilot-oauth-config';
 export * from './copilot-preferences';

package/src/node/copilot-auth-service-impl.spec.ts

@@ -1,5 +1,5 @@
 // *****************************************************************************
-// Copyright (C) 2026 EclipseSource and others.
+// Copyright (C) 2026 EclipseSource GmbH and others.
 //
 // This program and the accompanying materials are made available under the
 // terms of the Eclipse Public License v. 2.0 which is available at
@@ -15,235 +15,150 @@
 // *****************************************************************************
 
 import { expect } from 'chai';
-import * as sinon from 'sinon';
-import { Container } from '@theia/core/shared/inversify';
-import { KeyStoreService } from '@theia/core/lib/common/key-store';
-import { CopilotOAuthConfig, DEFAULT_COPILOT_OAUTH_CONFIG } from '../common/copilot-oauth-config';
-import { CopilotAuthServiceImpl } from './copilot-auth-service-impl';
-import { ILogger } from '@theia/core/lib/common/logger';
 import { MockLogger } from '@theia/core/lib/common/test/mock-logger';
+import { CopilotAuthState } from '../common/copilot-auth-service';
+import { CopilotAuthServiceImpl } from './copilot-auth-service-impl';
 
-describe('CopilotAuthServiceImpl', () => {
-
-    let authService: CopilotAuthServiceImpl;
-    let keyStoreService: KeyStoreService;
-    let getPasswordStub: sinon.SinonStub;
-
-    beforeEach(() => {
-        const container = new Container();
-
-        getPasswordStub = sinon.stub();
-        keyStoreService = {
-            setPassword: sinon.stub().resolves() as KeyStoreService['setPassword'],
-            getPassword: getPasswordStub.resolves(undefined) as KeyStoreService['getPassword'],
-            deletePassword: sinon.stub().resolves(true) as KeyStoreService['deletePassword'],
-            findPassword: sinon.stub().resolves(undefined) as KeyStoreService['findPassword'],
-            findCredentials: sinon.stub().resolves([]) as KeyStoreService['findCredentials'],
-            keys: sinon.stub().resolves([]) as KeyStoreService['keys']
-        };
-
-        container.bind(KeyStoreService).toConstantValue(keyStoreService);
-        container.bind(CopilotOAuthConfig).toConstantValue(DEFAULT_COPILOT_OAUTH_CONFIG);
-        container.bind(CopilotAuthServiceImpl).toSelf().inSingletonScope();
-        container.bind(ILogger).to(MockLogger).inSingletonScope();
-
-        authService = container.get(CopilotAuthServiceImpl);
-    });
-
-    afterEach(() => {
-        sinon.restore();
-    });
-
-    describe('getAccessToken', () => {
-
-        it('should return undefined when no credentials are stored', async () => {
-            getPasswordStub.resolves(undefined);
-
-            const token = await authService.getAccessToken();
-            expect(token).to.be.undefined;
-        });
-
-        it('should return the stored access token directly', async () => {
-            const oauthToken = 'ghu_test_token';
-
-            getPasswordStub.resolves(JSON.stringify({
-                accessToken: oauthToken,
-                accountLabel: 'testuser'
-            }));
-
-            const token = await authService.getAccessToken();
-            expect(token).to.equal(oauthToken);
-        });
-
-        it('should return undefined when stored data is malformed', async () => {
-            getPasswordStub.resolves('not-valid-json');
+interface Stubs {
+    /** Whether the sign-in of the previous integration had to be discarded. */
+    legacyRemoved: boolean;
+    /** How long that cleanup takes, to model a slow keychain. */
+    legacyDelay: number;
+    authState: CopilotAuthState;
+    authStateCalls: number;
+    configuredPath: string | undefined;
+    deleted: number;
+}
+
+class TestableCopilotAuthServiceImpl extends CopilotAuthServiceImpl {
+
+    readonly stubs: Stubs = {
+        legacyRemoved: false,
+        legacyDelay: 0,
+        authState: { isAuthenticated: false },
+        authStateCalls: 0,
+        configuredPath: undefined,
+        deleted: 0
+    };
 
-            const token = await authService.getAccessToken();
-            expect(token).to.be.undefined;
+    constructor() {
+        super();
+        const stubs = this.stubs;
+        Object.assign(this, {
+            logger: new MockLogger(),
+            credentialStore: {
+                deleteLegacy: async () => {
+                    await new Promise(resolve => setTimeout(resolve, stubs.legacyDelay));
+                    return stubs.legacyRemoved;
+                }
+            },
+            cliLocator: { setConfiguredPath: (path: string | undefined) => { stubs.configuredPath = path; } },
+            cliAuthProvider: {
+                getAuthState: async () => {
+                    stubs.authStateCalls++;
+                    return stubs.authState;
+                },
+                signOut: async () => {
+                    stubs.deleted++;
+                    stubs.authState = { isAuthenticated: false };
+                },
+                waitForLogin: async () => true
+            }
         });
+    }
+
+    /** Runs what `@postConstruct` runs in production. */
+    start(): void {
+        this.init();
+    }
+}
+
+describe('CopilotAuthServiceImpl - migration of the previous sign-in', () => {
+
+    it('should report that a new sign-in is required, even when asked before the cleanup finished', async () => {
+        const service = new TestableCopilotAuthServiceImpl();
+        service.stubs.legacyRemoved = true;
+        // The frontend evaluates the flag once at startup, so a state cached without it loses it.
+        service.stubs.legacyDelay = 20;
+        service.start();
+        expect(await service.getAuthState()).to.deep.include({ isAuthenticated: false, migrationRequired: true });
     });
 
-    describe('getAuthState', () => {
-
-        it('should return not authenticated when no credentials are stored', async () => {
-            getPasswordStub.resolves(undefined);
-
-            const state = await authService.getAuthState();
-            expect(state.isAuthenticated).to.be.false;
-            expect(state.accountLabel).to.be.undefined;
-        });
-
-        it('should return authenticated with account label when credentials exist', async () => {
-            getPasswordStub.resolves(JSON.stringify({
-                accessToken: 'gho_test',
-                accountLabel: 'testuser',
-                enterpriseUrl: undefined
-            }));
-
-            const state = await authService.getAuthState();
-            expect(state.isAuthenticated).to.be.true;
-            expect(state.accountLabel).to.equal('testuser');
-        });
-
-        it('should return enterprise URL when stored', async () => {
-            getPasswordStub.resolves(JSON.stringify({
-                accessToken: 'gho_test',
-                accountLabel: 'testuser',
-                enterpriseUrl: 'github.mycompany.com'
-            }));
-
-            const state = await authService.getAuthState();
-            expect(state.isAuthenticated).to.be.true;
-            expect(state.enterpriseUrl).to.equal('github.mycompany.com');
-        });
-
-        it('should clear outdated non-gho_ token and flag migration', async () => {
-            getPasswordStub.resolves(JSON.stringify({
-                accessToken: 'ghu_old_token',
-                accountLabel: 'testuser'
-            }));
-
-            const state = await authService.getAuthState();
-            expect(state.isAuthenticated).to.be.false;
-            expect(state.migrationRequired).to.be.true;
-            expect((keyStoreService.deletePassword as sinon.SinonStub).calledOnce).to.be.true;
-        });
-
-        it('should cache the auth state after first retrieval', async () => {
-            getPasswordStub.resolves(JSON.stringify({
-                accessToken: 'gho_test',
-                accountLabel: 'testuser'
-            }));
-
-            const state1 = await authService.getAuthState();
-            const state2 = await authService.getAuthState();
-
-            expect(state1).to.equal(state2);
-            expect(getPasswordStub.calledOnce).to.be.true;
-        });
+    it('should not claim a migration when there was nothing to discard', async () => {
+        const service = new TestableCopilotAuthServiceImpl();
+        service.start();
+        expect(await service.getAuthState()).to.not.have.property('migrationRequired');
     });
 
-    describe('signOut', () => {
-
-        it('should clear cached auth state on sign out', async () => {
-            getPasswordStub.resolves(JSON.stringify({
-                accessToken: 'gho_test',
-                accountLabel: 'testuser'
-            }));
-
-            const stateBefore = await authService.getAuthState();
-            expect(stateBefore.isAuthenticated).to.be.true;
-
-            await authService.signOut();
-
-            // After sign out, cached state should be cleared
-            // getAuthState should now return the new state without hitting keystore cache
-            const stateAfter = await authService.getAuthState();
-            expect(stateAfter.isAuthenticated).to.be.false;
-        });
-
-        it('should fire auth state changed event on sign out', async () => {
-            const stateChanges: { isAuthenticated: boolean }[] = [];
-            authService.onAuthStateChanged(state => stateChanges.push(state));
-
-            await authService.signOut();
-
-            expect(stateChanges).to.have.lengthOf(1);
-            expect(stateChanges[0].isAuthenticated).to.be.false;
-        });
-
-        it('should delete credentials from keystore on sign out', async () => {
-            await authService.signOut();
-            expect((keyStoreService.deletePassword as sinon.SinonStub).calledOnce).to.be.true;
-        });
-
-        it('should notify client on sign out', async () => {
-            const client = { onAuthStateChanged: sinon.stub() };
-            authService.setClient(client);
-
-            await authService.signOut();
+    it('should not claim a migration for a user who is signed in', async () => {
+        const service = new TestableCopilotAuthServiceImpl();
+        service.stubs.legacyRemoved = true;
+        service.stubs.authState = { isAuthenticated: true, accountLabel: 'octocat' };
+        service.start();
+        expect(await service.getAuthState()).to.not.have.property('migrationRequired');
+    });
 
-            expect(client.onAuthStateChanged.calledOnce).to.be.true;
-            expect(client.onAuthStateChanged.firstCall.args[0].isAuthenticated).to.be.false;
-        });
+    it('should survive a keychain that cannot be read', async () => {
+        const service = new TestableCopilotAuthServiceImpl();
+        Object.assign(service, { credentialStore: { deleteLegacy: async () => { throw new Error('keychain unavailable'); } } });
+        service.start();
+        expect(await service.getAuthState()).to.deep.equal({ isAuthenticated: false });
     });
 });
 
-describe('CopilotAuthServiceImpl with custom CopilotOAuthConfig', () => {
-
-    const customConfig: CopilotOAuthConfig = {
-        clientId: 'CustomClientId',
-        userAgent: 'MyApp/1.0.0',
-        keystoreService: 'myapp-copilot',
-        keystoreAccount: 'myapp-github'
-    };
+describe('CopilotAuthServiceImpl - state', () => {
 
-    let authService: CopilotAuthServiceImpl;
-    let getPasswordStub: sinon.SinonStub;
-    let deletePasswordStub: sinon.SinonStub;
+    it('should ask the provider once and serve the cached state afterwards', async () => {
+        const service = new TestableCopilotAuthServiceImpl();
+        service.start();
+        await service.getAuthState();
+        await service.getAuthState();
+        expect(service.stubs.authStateCalls).to.equal(1);
+    });
 
-    beforeEach(() => {
-        const container = new Container();
+    it('should report the new state after a sign-in', async () => {
+        const service = new TestableCopilotAuthServiceImpl();
+        service.start();
+        await service.getAuthState();
+        service.stubs.authState = { isAuthenticated: true, accountLabel: 'octocat' };
 
-        container.bind(ILogger).to(MockLogger).inSingletonScope();
+        const reported: CopilotAuthState[] = [];
+        service.onAuthStateChanged(state => reported.push(state));
+        expect(await service.waitForSignIn()).to.be.true;
 
-        getPasswordStub = sinon.stub().resolves(undefined);
-        deletePasswordStub = sinon.stub().resolves(true);
-        const keyStoreService: KeyStoreService = {
-            setPassword: sinon.stub().resolves() as KeyStoreService['setPassword'],
-            getPassword: getPasswordStub as KeyStoreService['getPassword'],
-            deletePassword: deletePasswordStub as KeyStoreService['deletePassword'],
-            findPassword: sinon.stub().resolves(undefined) as KeyStoreService['findPassword'],
-            findCredentials: sinon.stub().resolves([]) as KeyStoreService['findCredentials'],
-            keys: sinon.stub().resolves([]) as KeyStoreService['keys']
-        };
+        expect(reported).to.deep.equal([{ isAuthenticated: true, accountLabel: 'octocat' }]);
+        expect(await service.getAuthState()).to.deep.equal({ isAuthenticated: true, accountLabel: 'octocat' });
+    });
 
-        container.bind(KeyStoreService).toConstantValue(keyStoreService);
-        container.bind(CopilotOAuthConfig).toConstantValue(customConfig);
-        container.bind(CopilotAuthServiceImpl).toSelf().inSingletonScope();
+    it('should report the new state after signing out', async () => {
+        const service = new TestableCopilotAuthServiceImpl();
+        service.stubs.authState = { isAuthenticated: true, accountLabel: 'octocat' };
+        service.start();
+        await service.getAuthState();
 
-        authService = container.get(CopilotAuthServiceImpl);
-    });
+        const reported: CopilotAuthState[] = [];
+        service.onAuthStateChanged(state => reported.push(state));
+        await service.signOut();
 
-    afterEach(() => {
-        sinon.restore();
+        expect(service.stubs.deleted).to.equal(1);
+        expect(reported).to.deep.equal([{ isAuthenticated: false }]);
     });
+});
 
-    it('should read credentials from the custom keystore service and account', async () => {
-        getPasswordStub.resolves(JSON.stringify({
-            accessToken: 'gho_custom_token',
-            accountLabel: 'customuser'
-        }));
-
-        const token = await authService.getAccessToken();
+describe('CopilotAuthServiceImpl - executable path', () => {
 
-        expect(token).to.equal('gho_custom_token');
-        expect(getPasswordStub.calledOnceWith(customConfig.keystoreService, customConfig.keystoreAccount)).to.be.true;
+    it('should hand the configured location to the lookup, which cannot read preferences itself', async () => {
+        const service = new TestableCopilotAuthServiceImpl();
+        service.start();
+        await service.setExecutablePath('/opt/copilot/copilot');
+        expect(service.stubs.configuredPath).to.equal('/opt/copilot/copilot');
     });
 
-    it('should delete credentials from the custom keystore service and account on sign out', async () => {
-        await authService.signOut();
-
-        expect(deletePasswordStub.calledOnceWith(customConfig.keystoreService, customConfig.keystoreAccount)).to.be.true;
+    it('should hand on that nothing is configured, so that the CLI is searched for', async () => {
+        const service = new TestableCopilotAuthServiceImpl();
+        service.start();
+        await service.setExecutablePath('/opt/copilot/copilot');
+        await service.setExecutablePath(undefined);
+        expect(service.stubs.configuredPath).to.be.undefined;
     });
 });