@xiaoso/dsh-tool-plus 0.1.0-beta.2 → 0.1.0-beta.4

package/lib/github-copilot-4GaMtQmg.mjs

@@ -0,0 +1,208 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { V as ProviderHttpError, c as OAuthError, h as LoginCancelledError } from "./error-B3bevhrs.mjs";
+import { r as getBundledModels } from "./models-CfT4coYT.mjs";
+import { a as getGitHubCopilotBaseUrl, c as normalizeDomain, i as discoverGitHubCopilotApiEndpoint, l as normalizeGitHubCopilotEnterpriseDomain, n as OPENCODE_HEADERS, s as isPublicGitHubHost, t as COPILOT_API_HEADERS } from "./github-copilot-B2HGSIJK.mjs";
+import { scheduler } from "node:timers/promises";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/github-copilot.ts
+/**
+* GitHub Copilot OAuth flow (opencode OAuth app)
+*/
+const CLIENT_ID = "Ov23li8tweQw6odWQebz";
+const INITIAL_POLL_INTERVAL_MULTIPLIER = 1.2;
+const SLOW_DOWN_POLL_INTERVAL_MULTIPLIER = 1.4;
+function getUrls(domain) {
+	return {
+		deviceCodeUrl: `https://${domain}/login/device/code`,
+		accessTokenUrl: `https://${domain}/login/oauth/access_token`
+	};
+}
+async function fetchJson(url, init, fetchImpl) {
+	const response = await fetchImpl(url, init);
+	if (!response.ok) {
+		const text = await response.text();
+		throw new ProviderHttpError(`${response.status} ${response.statusText}: ${text}`, response.status);
+	}
+	return response.json();
+}
+async function startDeviceFlow(domain, fetchImpl) {
+	const data = await fetchJson(getUrls(domain).deviceCodeUrl, {
+		method: "POST",
+		headers: {
+			Accept: "application/json",
+			"Content-Type": "application/json",
+			...OPENCODE_HEADERS
+		},
+		body: JSON.stringify({
+			client_id: CLIENT_ID,
+			scope: "read:user"
+		})
+	}, fetchImpl);
+	if (!data || typeof data !== "object") throw new OAuthError("Invalid device code response", {
+		kind: "validation",
+		provider: "github-copilot"
+	});
+	const deviceCode = data.device_code;
+	const userCode = data.user_code;
+	const verificationUri = data.verification_uri;
+	const interval = data.interval;
+	const expiresIn = data.expires_in;
+	if (typeof deviceCode !== "string" || typeof userCode !== "string" || typeof verificationUri !== "string" || typeof interval !== "number" || typeof expiresIn !== "number") throw new OAuthError("Invalid device code response fields", {
+		kind: "validation",
+		provider: "github-copilot"
+	});
+	return {
+		device_code: deviceCode,
+		user_code: userCode,
+		verification_uri: verificationUri,
+		interval,
+		expires_in: expiresIn
+	};
+}
+async function pollForGitHubAccessToken(domain, deviceCode, intervalSeconds, expiresIn, signal, fetchImpl, pollIntervalFloorMs = 1e3, pollIntervalScaleMs = 1e3) {
+	const urls = getUrls(domain);
+	const deadline = Date.now() + expiresIn * 1e3;
+	let intervalMs = Math.max(pollIntervalFloorMs, Math.floor(intervalSeconds * pollIntervalScaleMs));
+	let intervalMultiplier = INITIAL_POLL_INTERVAL_MULTIPLIER;
+	let slowDownResponses = 0;
+	while (Date.now() < deadline) {
+		if (signal?.aborted) throw new LoginCancelledError();
+		const remainingMs = deadline - Date.now();
+		const waitMs = Math.min(Math.ceil(intervalMs * intervalMultiplier), remainingMs);
+		try {
+			await scheduler.wait(waitMs, { signal });
+		} catch {
+			throw new LoginCancelledError();
+		}
+		const raw = await fetchJson(urls.accessTokenUrl, {
+			method: "POST",
+			headers: {
+				Accept: "application/json",
+				"Content-Type": "application/json",
+				...OPENCODE_HEADERS
+			},
+			body: JSON.stringify({
+				client_id: CLIENT_ID,
+				device_code: deviceCode,
+				grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+			})
+		}, fetchImpl);
+		if (raw && typeof raw === "object" && typeof raw.access_token === "string") return raw.access_token;
+		if (raw && typeof raw === "object" && typeof raw.error === "string") {
+			const { error, error_description: description, interval } = raw;
+			if (error === "authorization_pending") continue;
+			if (error === "slow_down") {
+				slowDownResponses += 1;
+				intervalMs = typeof interval === "number" && interval > 0 ? Math.max(pollIntervalFloorMs, interval * pollIntervalScaleMs) : Math.max(pollIntervalFloorMs, intervalMs + 5 * pollIntervalScaleMs);
+				intervalMultiplier = SLOW_DOWN_POLL_INTERVAL_MULTIPLIER;
+				continue;
+			}
+			const descriptionSuffix = description ? `: ${description}` : "";
+			throw new OAuthError(`Device flow failed: ${error}${descriptionSuffix}`, {
+				kind: "polling",
+				provider: "github-copilot"
+			});
+		}
+	}
+	if (slowDownResponses > 0) throw new OAuthError("Device flow timed out after one or more slow_down responses. This is often caused by clock drift in WSL or VM environments. Please sync or restart the VM clock and try again.", {
+		kind: "timeout",
+		provider: "github-copilot"
+	});
+	throw new OAuthError("Device flow timed out", {
+		kind: "timeout",
+		provider: "github-copilot"
+	});
+}
+/** Far-future expiry (10 years). GitHub OAuth tokens are long-lived; no JWT exchange needed. */
+const FAR_FUTURE_MS = Date.now() + 315576e6;
+/**
+* Refresh GitHub Copilot token.
+* With the opencode OAuth flow, the GitHub token is used directly — no JWT exchange needed.
+*/
+function refreshGitHubCopilotToken(refreshToken, enterpriseDomain, apiEndpoint) {
+	return {
+		refresh: refreshToken,
+		access: refreshToken,
+		expires: FAR_FUTURE_MS,
+		enterpriseUrl: enterpriseDomain,
+		apiEndpoint
+	};
+}
+/**
+* Enable a model for the user's GitHub Copilot account.
+* This is required for some models (like Claude, Grok) before they can be used.
+*/
+async function enableGitHubCopilotModel(token, modelId, fetchImpl, enterpriseDomain, apiEndpoint) {
+	const url = `${apiEndpoint ?? getGitHubCopilotBaseUrl(enterpriseDomain)}/models/${modelId}/policy`;
+	try {
+		return (await fetchImpl(url, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				Authorization: `Bearer ${token}`,
+				...COPILOT_API_HEADERS,
+				"openai-intent": "chat-policy",
+				"x-interaction-type": "chat-policy"
+			},
+			body: JSON.stringify({ state: "enabled" })
+		})).ok;
+	} catch {
+		return false;
+	}
+}
+/**
+* Enable all known GitHub Copilot models that may require policy acceptance.
+* Called after successful login to ensure all models are available.
+*/
+async function enableAllGitHubCopilotModels(token, enterpriseDomain, apiEndpoint, fetchImpl, onProgress) {
+	const wireModelIds = [...new Set(getBundledModels("github-copilot").map((model) => model.requestModelId ?? model.id))];
+	const BATCH_SIZE = 5;
+	for (let i = 0; i < wireModelIds.length; i += BATCH_SIZE) {
+		const batch = wireModelIds.slice(i, i + BATCH_SIZE);
+		await Promise.all(batch.map(async (modelId) => {
+			const success = await enableGitHubCopilotModel(token, modelId, fetchImpl, enterpriseDomain, apiEndpoint);
+			onProgress?.(modelId, success);
+		}));
+	}
+}
+/**
+* Login with GitHub Copilot OAuth (device code flow)
+*
+* @param options.onAuth - Callback with URL and optional instructions (user code)
+* @param options.onPrompt - Callback to prompt user for input
+* @param options.onProgress - Optional progress callback
+* @param options.signal - Optional AbortSignal for cancellation
+*/
+async function loginGitHubCopilot(options) {
+	const fetchImpl = options.fetch ?? fetch;
+	const input = await options.onPrompt({
+		message: "GitHub Enterprise URL/domain (blank for github.com)",
+		placeholder: "company.ghe.com",
+		allowEmpty: true
+	});
+	if (options.signal?.aborted) throw new LoginCancelledError();
+	const trimmed = input.trim();
+	const normalizedDomain = normalizeDomain(input);
+	if (trimmed && !normalizedDomain) throw new OAuthError("Invalid GitHub Enterprise URL/domain", {
+		kind: "validation",
+		provider: "github-copilot"
+	});
+	const enterpriseDomain = normalizeGitHubCopilotEnterpriseDomain(normalizedDomain ?? void 0);
+	const domain = normalizedDomain && isPublicGitHubHost(normalizedDomain) ? "github.com" : normalizedDomain ?? "github.com";
+	const device = await startDeviceFlow(domain, fetchImpl);
+	options.onAuth(device.verification_uri, `Enter code: ${device.user_code}`);
+	const githubAccessToken = await pollForGitHubAccessToken(domain, device.device_code, device.interval, device.expires_in, options.signal, fetchImpl, options.pollIntervalFloorMs, options.pollIntervalScaleMs);
+	const apiEndpoint = await discoverGitHubCopilotApiEndpoint(githubAccessToken, fetchImpl);
+	const credentials = {
+		refresh: githubAccessToken,
+		access: githubAccessToken,
+		expires: FAR_FUTURE_MS,
+		enterpriseUrl: enterpriseDomain ?? void 0,
+		apiEndpoint
+	};
+	options.onProgress?.("Enabling models...");
+	await enableAllGitHubCopilotModels(githubAccessToken, enterpriseDomain ?? void 0, apiEndpoint, fetchImpl);
+	return credentials;
+}
+//#endregion
+export { loginGitHubCopilot, refreshGitHubCopilotToken };

package/lib/github-copilot-B1yiyVRh.mjs

@@ -0,0 +1,104 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { n as isRecord } from "./type-guards-B9VVjRDK.mjs";
+import "./utils-D2YknRk4.mjs";
+const OPENCODE_HEADERS = { "User-Agent": "opencode/1.3.15" };
+/**
+* Copilot API version sent on `api.githubcopilot.com` requests (`/models`,
+* chat endpoints). Newer versions unlock tiered context metadata: `/models`
+* reports the full long-context window in `capabilities.limits` plus per-tier
+* boundaries/prices under `billing.token_prices.{default,long_context}`.
+* Without it the endpoint serves default-tier limits only (e.g. 264k instead
+* of 1M for Claude Opus). Never send this to `api.github.com` REST endpoints —
+* they validate `X-GitHub-Api-Version` against the REST version vocabulary.
+*/
+const COPILOT_API_VERSION = "2026-06-01";
+/** Headers for `api.githubcopilot.com` (capi) requests: discovery, chat, policy. */
+const COPILOT_API_HEADERS = {
+	...OPENCODE_HEADERS,
+	"X-GitHub-Api-Version": COPILOT_API_VERSION
+};
+const PUBLIC_GITHUB_HOSTS = /* @__PURE__ */ new Set([
+	"api.github.com",
+	"github.com",
+	"www.github.com"
+]);
+function isPublicGitHubHost(host) {
+	return PUBLIC_GITHUB_HOSTS.has(host.trim().toLowerCase());
+}
+/** Canonical personal-Copilot API host. */
+const PERSONAL_GITHUB_COPILOT_BASE_URL = "https://api.githubcopilot.com";
+/** `true` when the resolved base URL is the canonical personal-Copilot host. */
+function isPersonalGitHubCopilotBaseUrl(baseUrl) {
+	return baseUrl === PERSONAL_GITHUB_COPILOT_BASE_URL;
+}
+function normalizeGitHubCopilotEnterpriseDomain(input) {
+	const trimmed = input?.trim();
+	if (!trimmed) return void 0;
+	const normalized = normalizeDomain(trimmed) ?? trimmed.toLowerCase();
+	if (!normalized || isPublicGitHubHost(normalized)) return void 0;
+	return normalized;
+}
+function normalizeGitHubCopilotApiEndpoint(input) {
+	const trimmed = input?.trim();
+	if (!trimmed?.startsWith("https://")) return void 0;
+	try {
+		const url = new URL(trimmed);
+		if (url.protocol !== "https:" || !url.hostname) return void 0;
+		return trimmed.replace(/\/+$/, "");
+	} catch {
+		return;
+	}
+}
+/**
+* Resolve the plan-specific Copilot API endpoint advertised for a GitHub token.
+* Login and raw environment-token discovery share this best-effort probe. Pass
+* a `signal` to bound it against the same discovery deadline as `/models`; a
+* stalled probe otherwise blocks discovery indefinitely.
+*/
+async function discoverGitHubCopilotApiEndpoint(token, fetchImpl, signal) {
+	try {
+		const response = await fetchImpl("https://api.github.com/copilot_internal/user", {
+			headers: {
+				Accept: "application/json",
+				Authorization: `token ${token}`,
+				...OPENCODE_HEADERS
+			},
+			signal
+		});
+		if (!response.ok) return void 0;
+		const data = await response.json();
+		if (!isRecord(data) || !isRecord(data.endpoints)) return void 0;
+		const endpoint = data.endpoints.api;
+		return typeof endpoint === "string" ? normalizeGitHubCopilotApiEndpoint(endpoint) : void 0;
+	} catch {
+		return;
+	}
+}
+function parseGitHubCopilotApiKey(apiKeyRaw) {
+	try {
+		const parsed = JSON.parse(apiKeyRaw);
+		if (typeof parsed.token === "string") return {
+			accessToken: parsed.token,
+			enterpriseUrl: typeof parsed.enterpriseUrl === "string" ? normalizeGitHubCopilotEnterpriseDomain(parsed.enterpriseUrl) : void 0,
+			apiEndpoint: typeof parsed.apiEndpoint === "string" ? normalizeGitHubCopilotApiEndpoint(parsed.apiEndpoint) : void 0
+		};
+	} catch {}
+	return { accessToken: apiKeyRaw };
+}
+function normalizeDomain(input) {
+	const trimmed = input.trim();
+	if (!trimmed) return null;
+	try {
+		return (trimmed.includes("://") ? new URL(trimmed) : new URL(`https://${trimmed}`)).hostname;
+	} catch {
+		return null;
+	}
+}
+function getGitHubCopilotBaseUrl(enterpriseDomain) {
+	const normalizedEnterpriseDomain = normalizeGitHubCopilotEnterpriseDomain(enterpriseDomain);
+	if (!normalizedEnterpriseDomain) return "https://api.githubcopilot.com";
+	return `https://${normalizedEnterpriseDomain.startsWith("copilot-api.") ? normalizedEnterpriseDomain : `copilot-api.${normalizedEnterpriseDomain}`}`;
+}
+//#endregion
+export { getGitHubCopilotBaseUrl as a, normalizeDomain as c, discoverGitHubCopilotApiEndpoint as i, normalizeGitHubCopilotEnterpriseDomain as l, OPENCODE_HEADERS as n, isPersonalGitHubCopilotBaseUrl as o, PERSONAL_GITHUB_COPILOT_BASE_URL as r, isPublicGitHubHost as s, COPILOT_API_HEADERS as t, parseGitHubCopilotApiKey as u };

package/lib/github-copilot-B2HGSIJK.mjs

@@ -0,0 +1,104 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { n as isRecord } from "./type-guards-B9VVjRDK.mjs";
+import "./utils-DppGHXQB.mjs";
+const OPENCODE_HEADERS = { "User-Agent": "opencode/1.3.15" };
+/**
+* Copilot API version sent on `api.githubcopilot.com` requests (`/models`,
+* chat endpoints). Newer versions unlock tiered context metadata: `/models`
+* reports the full long-context window in `capabilities.limits` plus per-tier
+* boundaries/prices under `billing.token_prices.{default,long_context}`.
+* Without it the endpoint serves default-tier limits only (e.g. 264k instead
+* of 1M for Claude Opus). Never send this to `api.github.com` REST endpoints —
+* they validate `X-GitHub-Api-Version` against the REST version vocabulary.
+*/
+const COPILOT_API_VERSION = "2026-06-01";
+/** Headers for `api.githubcopilot.com` (capi) requests: discovery, chat, policy. */
+const COPILOT_API_HEADERS = {
+	...OPENCODE_HEADERS,
+	"X-GitHub-Api-Version": COPILOT_API_VERSION
+};
+const PUBLIC_GITHUB_HOSTS = /* @__PURE__ */ new Set([
+	"api.github.com",
+	"github.com",
+	"www.github.com"
+]);
+function isPublicGitHubHost(host) {
+	return PUBLIC_GITHUB_HOSTS.has(host.trim().toLowerCase());
+}
+/** Canonical personal-Copilot API host. */
+const PERSONAL_GITHUB_COPILOT_BASE_URL = "https://api.githubcopilot.com";
+/** `true` when the resolved base URL is the canonical personal-Copilot host. */
+function isPersonalGitHubCopilotBaseUrl(baseUrl) {
+	return baseUrl === PERSONAL_GITHUB_COPILOT_BASE_URL;
+}
+function normalizeGitHubCopilotEnterpriseDomain(input) {
+	const trimmed = input?.trim();
+	if (!trimmed) return void 0;
+	const normalized = normalizeDomain(trimmed) ?? trimmed.toLowerCase();
+	if (!normalized || isPublicGitHubHost(normalized)) return void 0;
+	return normalized;
+}
+function normalizeGitHubCopilotApiEndpoint(input) {
+	const trimmed = input?.trim();
+	if (!trimmed?.startsWith("https://")) return void 0;
+	try {
+		const url = new URL(trimmed);
+		if (url.protocol !== "https:" || !url.hostname) return void 0;
+		return trimmed.replace(/\/+$/, "");
+	} catch {
+		return;
+	}
+}
+/**
+* Resolve the plan-specific Copilot API endpoint advertised for a GitHub token.
+* Login and raw environment-token discovery share this best-effort probe. Pass
+* a `signal` to bound it against the same discovery deadline as `/models`; a
+* stalled probe otherwise blocks discovery indefinitely.
+*/
+async function discoverGitHubCopilotApiEndpoint(token, fetchImpl, signal) {
+	try {
+		const response = await fetchImpl("https://api.github.com/copilot_internal/user", {
+			headers: {
+				Accept: "application/json",
+				Authorization: `token ${token}`,
+				...OPENCODE_HEADERS
+			},
+			signal
+		});
+		if (!response.ok) return void 0;
+		const data = await response.json();
+		if (!isRecord(data) || !isRecord(data.endpoints)) return void 0;
+		const endpoint = data.endpoints.api;
+		return typeof endpoint === "string" ? normalizeGitHubCopilotApiEndpoint(endpoint) : void 0;
+	} catch {
+		return;
+	}
+}
+function parseGitHubCopilotApiKey(apiKeyRaw) {
+	try {
+		const parsed = JSON.parse(apiKeyRaw);
+		if (typeof parsed.token === "string") return {
+			accessToken: parsed.token,
+			enterpriseUrl: typeof parsed.enterpriseUrl === "string" ? normalizeGitHubCopilotEnterpriseDomain(parsed.enterpriseUrl) : void 0,
+			apiEndpoint: typeof parsed.apiEndpoint === "string" ? normalizeGitHubCopilotApiEndpoint(parsed.apiEndpoint) : void 0
+		};
+	} catch {}
+	return { accessToken: apiKeyRaw };
+}
+function normalizeDomain(input) {
+	const trimmed = input.trim();
+	if (!trimmed) return null;
+	try {
+		return (trimmed.includes("://") ? new URL(trimmed) : new URL(`https://${trimmed}`)).hostname;
+	} catch {
+		return null;
+	}
+}
+function getGitHubCopilotBaseUrl(enterpriseDomain) {
+	const normalizedEnterpriseDomain = normalizeGitHubCopilotEnterpriseDomain(enterpriseDomain);
+	if (!normalizedEnterpriseDomain) return "https://api.githubcopilot.com";
+	return `https://${normalizedEnterpriseDomain.startsWith("copilot-api.") ? normalizedEnterpriseDomain : `copilot-api.${normalizedEnterpriseDomain}`}`;
+}
+//#endregion
+export { getGitHubCopilotBaseUrl as a, normalizeDomain as c, discoverGitHubCopilotApiEndpoint as i, normalizeGitHubCopilotEnterpriseDomain as l, OPENCODE_HEADERS as n, isPersonalGitHubCopilotBaseUrl as o, PERSONAL_GITHUB_COPILOT_BASE_URL as r, isPublicGitHubHost as s, COPILOT_API_HEADERS as t, parseGitHubCopilotApiKey as u };

package/lib/github-copilot-BWT3eAOF.mjs

@@ -0,0 +1,208 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { V as ProviderHttpError, c as OAuthError, h as LoginCancelledError } from "./error-yCSG0mGC.mjs";
+import { r as getBundledModels } from "./models-D_XnT6ay.mjs";
+import { a as getGitHubCopilotBaseUrl, c as normalizeDomain, i as discoverGitHubCopilotApiEndpoint, l as normalizeGitHubCopilotEnterpriseDomain, n as OPENCODE_HEADERS, s as isPublicGitHubHost, t as COPILOT_API_HEADERS } from "./github-copilot-jscUZ8Hf.mjs";
+import { scheduler } from "node:timers/promises";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/github-copilot.ts
+/**
+* GitHub Copilot OAuth flow (opencode OAuth app)
+*/
+const CLIENT_ID = "Ov23li8tweQw6odWQebz";
+const INITIAL_POLL_INTERVAL_MULTIPLIER = 1.2;
+const SLOW_DOWN_POLL_INTERVAL_MULTIPLIER = 1.4;
+function getUrls(domain) {
+	return {
+		deviceCodeUrl: `https://${domain}/login/device/code`,
+		accessTokenUrl: `https://${domain}/login/oauth/access_token`
+	};
+}
+async function fetchJson(url, init, fetchImpl) {
+	const response = await fetchImpl(url, init);
+	if (!response.ok) {
+		const text = await response.text();
+		throw new ProviderHttpError(`${response.status} ${response.statusText}: ${text}`, response.status);
+	}
+	return response.json();
+}
+async function startDeviceFlow(domain, fetchImpl) {
+	const data = await fetchJson(getUrls(domain).deviceCodeUrl, {
+		method: "POST",
+		headers: {
+			Accept: "application/json",
+			"Content-Type": "application/json",
+			...OPENCODE_HEADERS
+		},
+		body: JSON.stringify({
+			client_id: CLIENT_ID,
+			scope: "read:user"
+		})
+	}, fetchImpl);
+	if (!data || typeof data !== "object") throw new OAuthError("Invalid device code response", {
+		kind: "validation",
+		provider: "github-copilot"
+	});
+	const deviceCode = data.device_code;
+	const userCode = data.user_code;
+	const verificationUri = data.verification_uri;
+	const interval = data.interval;
+	const expiresIn = data.expires_in;
+	if (typeof deviceCode !== "string" || typeof userCode !== "string" || typeof verificationUri !== "string" || typeof interval !== "number" || typeof expiresIn !== "number") throw new OAuthError("Invalid device code response fields", {
+		kind: "validation",
+		provider: "github-copilot"
+	});
+	return {
+		device_code: deviceCode,
+		user_code: userCode,
+		verification_uri: verificationUri,
+		interval,
+		expires_in: expiresIn
+	};
+}
+async function pollForGitHubAccessToken(domain, deviceCode, intervalSeconds, expiresIn, signal, fetchImpl, pollIntervalFloorMs = 1e3, pollIntervalScaleMs = 1e3) {
+	const urls = getUrls(domain);
+	const deadline = Date.now() + expiresIn * 1e3;
+	let intervalMs = Math.max(pollIntervalFloorMs, Math.floor(intervalSeconds * pollIntervalScaleMs));
+	let intervalMultiplier = INITIAL_POLL_INTERVAL_MULTIPLIER;
+	let slowDownResponses = 0;
+	while (Date.now() < deadline) {
+		if (signal?.aborted) throw new LoginCancelledError();
+		const remainingMs = deadline - Date.now();
+		const waitMs = Math.min(Math.ceil(intervalMs * intervalMultiplier), remainingMs);
+		try {
+			await scheduler.wait(waitMs, { signal });
+		} catch {
+			throw new LoginCancelledError();
+		}
+		const raw = await fetchJson(urls.accessTokenUrl, {
+			method: "POST",
+			headers: {
+				Accept: "application/json",
+				"Content-Type": "application/json",
+				...OPENCODE_HEADERS
+			},
+			body: JSON.stringify({
+				client_id: CLIENT_ID,
+				device_code: deviceCode,
+				grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+			})
+		}, fetchImpl);
+		if (raw && typeof raw === "object" && typeof raw.access_token === "string") return raw.access_token;
+		if (raw && typeof raw === "object" && typeof raw.error === "string") {
+			const { error, error_description: description, interval } = raw;
+			if (error === "authorization_pending") continue;
+			if (error === "slow_down") {
+				slowDownResponses += 1;
+				intervalMs = typeof interval === "number" && interval > 0 ? Math.max(pollIntervalFloorMs, interval * pollIntervalScaleMs) : Math.max(pollIntervalFloorMs, intervalMs + 5 * pollIntervalScaleMs);
+				intervalMultiplier = SLOW_DOWN_POLL_INTERVAL_MULTIPLIER;
+				continue;
+			}
+			const descriptionSuffix = description ? `: ${description}` : "";
+			throw new OAuthError(`Device flow failed: ${error}${descriptionSuffix}`, {
+				kind: "polling",
+				provider: "github-copilot"
+			});
+		}
+	}
+	if (slowDownResponses > 0) throw new OAuthError("Device flow timed out after one or more slow_down responses. This is often caused by clock drift in WSL or VM environments. Please sync or restart the VM clock and try again.", {
+		kind: "timeout",
+		provider: "github-copilot"
+	});
+	throw new OAuthError("Device flow timed out", {
+		kind: "timeout",
+		provider: "github-copilot"
+	});
+}
+/** Far-future expiry (10 years). GitHub OAuth tokens are long-lived; no JWT exchange needed. */
+const FAR_FUTURE_MS = Date.now() + 315576e6;
+/**
+* Refresh GitHub Copilot token.
+* With the opencode OAuth flow, the GitHub token is used directly — no JWT exchange needed.
+*/
+function refreshGitHubCopilotToken(refreshToken, enterpriseDomain, apiEndpoint) {
+	return {
+		refresh: refreshToken,
+		access: refreshToken,
+		expires: FAR_FUTURE_MS,
+		enterpriseUrl: enterpriseDomain,
+		apiEndpoint
+	};
+}
+/**
+* Enable a model for the user's GitHub Copilot account.
+* This is required for some models (like Claude, Grok) before they can be used.
+*/
+async function enableGitHubCopilotModel(token, modelId, fetchImpl, enterpriseDomain, apiEndpoint) {
+	const url = `${apiEndpoint ?? getGitHubCopilotBaseUrl(enterpriseDomain)}/models/${modelId}/policy`;
+	try {
+		return (await fetchImpl(url, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				Authorization: `Bearer ${token}`,
+				...COPILOT_API_HEADERS,
+				"openai-intent": "chat-policy",
+				"x-interaction-type": "chat-policy"
+			},
+			body: JSON.stringify({ state: "enabled" })
+		})).ok;
+	} catch {
+		return false;
+	}
+}
+/**
+* Enable all known GitHub Copilot models that may require policy acceptance.
+* Called after successful login to ensure all models are available.
+*/
+async function enableAllGitHubCopilotModels(token, enterpriseDomain, apiEndpoint, fetchImpl, onProgress) {
+	const wireModelIds = [...new Set(getBundledModels("github-copilot").map((model) => model.requestModelId ?? model.id))];
+	const BATCH_SIZE = 5;
+	for (let i = 0; i < wireModelIds.length; i += BATCH_SIZE) {
+		const batch = wireModelIds.slice(i, i + BATCH_SIZE);
+		await Promise.all(batch.map(async (modelId) => {
+			const success = await enableGitHubCopilotModel(token, modelId, fetchImpl, enterpriseDomain, apiEndpoint);
+			onProgress?.(modelId, success);
+		}));
+	}
+}
+/**
+* Login with GitHub Copilot OAuth (device code flow)
+*
+* @param options.onAuth - Callback with URL and optional instructions (user code)
+* @param options.onPrompt - Callback to prompt user for input
+* @param options.onProgress - Optional progress callback
+* @param options.signal - Optional AbortSignal for cancellation
+*/
+async function loginGitHubCopilot(options) {
+	const fetchImpl = options.fetch ?? fetch;
+	const input = await options.onPrompt({
+		message: "GitHub Enterprise URL/domain (blank for github.com)",
+		placeholder: "company.ghe.com",
+		allowEmpty: true
+	});
+	if (options.signal?.aborted) throw new LoginCancelledError();
+	const trimmed = input.trim();
+	const normalizedDomain = normalizeDomain(input);
+	if (trimmed && !normalizedDomain) throw new OAuthError("Invalid GitHub Enterprise URL/domain", {
+		kind: "validation",
+		provider: "github-copilot"
+	});
+	const enterpriseDomain = normalizeGitHubCopilotEnterpriseDomain(normalizedDomain ?? void 0);
+	const domain = normalizedDomain && isPublicGitHubHost(normalizedDomain) ? "github.com" : normalizedDomain ?? "github.com";
+	const device = await startDeviceFlow(domain, fetchImpl);
+	options.onAuth(device.verification_uri, `Enter code: ${device.user_code}`);
+	const githubAccessToken = await pollForGitHubAccessToken(domain, device.device_code, device.interval, device.expires_in, options.signal, fetchImpl, options.pollIntervalFloorMs, options.pollIntervalScaleMs);
+	const apiEndpoint = await discoverGitHubCopilotApiEndpoint(githubAccessToken, fetchImpl);
+	const credentials = {
+		refresh: githubAccessToken,
+		access: githubAccessToken,
+		expires: FAR_FUTURE_MS,
+		enterpriseUrl: enterpriseDomain ?? void 0,
+		apiEndpoint
+	};
+	options.onProgress?.("Enabling models...");
+	await enableAllGitHubCopilotModels(githubAccessToken, enterpriseDomain ?? void 0, apiEndpoint, fetchImpl);
+	return credentials;
+}
+//#endregion
+export { loginGitHubCopilot, refreshGitHubCopilotToken };