@xiaoso/dsh-tool-plus 0.1.6 → 0.1.7-beta.0

package/lib/{event-stream-Dh2guZxS.mjs → event-stream-ulcDenZD.mjs}

@@ -1,7 +1,7 @@
 import { installBunShim as __installBunShim } from "./bun-shim.mjs";
 __installBunShim();
-import { C as classifyMessage, s as ProviderResponseError } from "./error-C-f_Wnw4.mjs";
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/utils/event-stream.ts
+import { s as ProviderResponseError, w as classifyMessage } from "./error-CORgGg5a.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/utils/event-stream.ts
 var EventStream = class {
 	queue = [];
 	waiting = [];
@@ -18,6 +18,13 @@ var EventStream = class {
 	* not a provider stall; idle watchdogs consult {@link hasPendingLocalWork}.
 	*/
 	#pendingLocalWork = 0;
+	/**
+	* A downstream stream whose local work also counts as ours — set when this
+	* stream forwards another stream's events (e.g. the Cursor discovered-id
+	* retry drains an inner stream), so the watchdog on this stream sees the
+	* inner exec bridge's busy state instead of aborting a healthy tool run.
+	*/
+	#localWorkDelegate;
 	finalResultPromise;
 	resolveFinalResult;
 	rejectFinalResult;
@@ -99,9 +106,18 @@ var EventStream = class {
 	result() {
 		return this.finalResultPromise;
 	}
-	/** True while local work tracked via {@link trackLocalWork} is pending. */
+	/** True while local work tracked via {@link trackLocalWork} — on this stream or a forwarded delegate — is pending. */
 	get hasPendingLocalWork() {
-		return this.#pendingLocalWork > 0;
+		return this.#pendingLocalWork > 0 || (this.#localWorkDelegate?.hasPendingLocalWork ?? false);
+	}
+	/**
+	* Count `source`'s pending local work as this stream's own. Used when this
+	* stream forwards another's events (Cursor discovered-id retry) so the
+	* watchdog does not abort a live tool run happening on the inner stream.
+	* Pass `undefined` to detach once forwarding ends.
+	*/
+	forwardLocalWorkFrom(source) {
+		this.#localWorkDelegate = source;
 	}
 	/**
 	* Track a local-work promise so idle watchdogs on this stream do not treat

package/lib/{gemini-headers-DKUShltF.mjs → gemini-headers-Co9cVvex.mjs}

@@ -1,6 +1,6 @@
 import { installBunShim as __installBunShim } from "./bun-shim.mjs";
 __installBunShim();
-//#region node_modules/.pnpm/@oh-my-pi+pi-catalog@17.3.5/node_modules/@oh-my-pi/pi-catalog/src/wire/gemini-headers.ts
+//#region node_modules/.pnpm/@oh-my-pi+pi-catalog@18.1.17/node_modules/@oh-my-pi/pi-catalog/src/wire/gemini-headers.ts
 /**
 * Build a User-Agent string that identifies as Gemini CLI to unlock higher rate limits.
 * Uses the same format as the official Gemini CLI (v0.35+):
@@ -51,4 +51,4 @@ function getAntigravityModelWireProfile(wireModelId) {
 	return ANTIGRAVITY_MODEL_WIRE_PROFILES[wireModelId];
 }
 //#endregion
-export { getGeminiCliHeaders as i, getAntigravityUserAgent as n, getAntigravityVersion as r, getAntigravityModelWireProfile as t };
+export { getAntigravityUserAgent as n, getGeminiCliHeaders as r, getAntigravityModelWireProfile as t };

package/lib/{github-copilot-suDymKrx.mjs → github-copilot-Dstq1D3s.mjs}

@@ -1,14 +1,40 @@
 import { installBunShim as __installBunShim } from "./bun-shim.mjs";
 __installBunShim();
-import { V as ProviderHttpError, c as OAuthError, h as LoginCancelledError } from "./error-C-f_Wnw4.mjs";
-import { r as getBundledModels } from "./models-DRA2c_8U.mjs";
-import { a as getGitHubCopilotBaseUrl, c as normalizeDomain, i as discoverGitHubCopilotApiEndpoint, l as normalizeGitHubCopilotEnterpriseDomain, n as OPENCODE_HEADERS, s as isPublicGitHubHost, t as COPILOT_API_HEADERS } from "./github-copilot-B3kQl0g0.mjs";
+import { V as ProviderHttpError, f as OAuthError, g as OnPromptRequiredError, m as LoginCancelledError } from "./error-CORgGg5a.mjs";
+import { r as getBundledModels } from "./models-DnXMYGcJ.mjs";
+import { _ as normalizeCopilotIntegrationId, f as discoverGitHubCopilotApiEndpoint, h as isPublicGitHubHost, o as wrapFetchForCopilotFallback, p as getGitHubCopilotBaseUrl, r as resolveCopilotIntegrationIdOverride, s as COPILOT_API_HEADERS, v as normalizeDomain, y as normalizeGitHubCopilotEnterpriseDomain } from "./github-copilot-headers-DOh1gt_w.mjs";
 import { scheduler } from "node:timers/promises";
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/github-copilot.ts
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/github-copilot.ts
 /**
-* GitHub Copilot OAuth flow (opencode OAuth app)
+* GitHub Copilot OAuth flow (OpenCode OAuth app, minimal read:user grant).
+*
+* The device flow intentionally uses the OpenCode app identity rather than
+* the official Copilot CLI app: GitHub renders each app's existing per-user
+* grant (Existing access) on the consent page, and Enterprise orgs that
+* restrict OAuth apps block the CLI app's broad historic grant
+* (repo/gist/codespace) no matter what scope this request asks for
+* (issue #11275). API request identity still mimics the Copilot CLI via
+* COPILOT_API_HEADERS. Enterprise domains keep the GitHub-owned Copilot CLI
+* client: private instances run their own OAuth registry and reject the
+* github.com-registered OpenCode client.
+*/
+const OPENCODE_CLIENT_ID = "Ov23li8tweQw6odWQebz";
+const COPILOT_CLI_CLIENT_ID = "Ov23ctDVkRmgkPke0Mmm";
+/**
+* OAuth client for the device flow. Public github.com uses the minimal-grant
+* OpenCode app (narrow consent, issue #11275); private GitHub Enterprise
+* instances run their own OAuth registry, which does not know that github.com
+* registration, so they keep the GitHub-owned Copilot CLI client.
 */
-const CLIENT_ID = "Ov23li8tweQw6odWQebz";
+function resolveOAuthClientId(domain) {
+	return isPublicGitHubHost(domain) ? OPENCODE_CLIENT_ID : COPILOT_CLI_CLIENT_ID;
+}
+const OAUTH_SCOPE = "read:user";
+const OAUTH_HEADERS = {
+	Accept: "application/json",
+	"Content-Type": "application/x-www-form-urlencoded",
+	"User-Agent": "copilot-developer-action/0.0.1"
+};
 const INITIAL_POLL_INTERVAL_MULTIPLIER = 1.2;
 const SLOW_DOWN_POLL_INTERVAL_MULTIPLIER = 1.4;
 function getUrls(domain) {
@@ -28,14 +54,10 @@ async function fetchJson(url, init, fetchImpl) {
 async function startDeviceFlow(domain, fetchImpl) {
 	const data = await fetchJson(getUrls(domain).deviceCodeUrl, {
 		method: "POST",
-		headers: {
-			Accept: "application/json",
-			"Content-Type": "application/json",
-			...OPENCODE_HEADERS
-		},
-		body: JSON.stringify({
-			client_id: CLIENT_ID,
-			scope: "read:user"
+		headers: OAUTH_HEADERS,
+		body: new URLSearchParams({
+			client_id: resolveOAuthClientId(domain),
+			scope: OAUTH_SCOPE
 		})
 	}, fetchImpl);
 	if (!data || typeof data !== "object") throw new OAuthError("Invalid device code response", {
@@ -76,13 +98,9 @@ async function pollForGitHubAccessToken(domain, deviceCode, intervalSeconds, exp
 		}
 		const raw = await fetchJson(urls.accessTokenUrl, {
 			method: "POST",
-			headers: {
-				Accept: "application/json",
-				"Content-Type": "application/json",
-				...OPENCODE_HEADERS
-			},
-			body: JSON.stringify({
-				client_id: CLIENT_ID,
+			headers: OAUTH_HEADERS,
+			body: new URLSearchParams({
+				client_id: resolveOAuthClientId(domain),
 				device_code: deviceCode,
 				grant_type: "urn:ietf:params:oauth:grant-type:device_code"
 			})
@@ -117,7 +135,8 @@ async function pollForGitHubAccessToken(domain, deviceCode, intervalSeconds, exp
 const FAR_FUTURE_MS = Date.now() + 315576e6;
 /**
 * Refresh GitHub Copilot token.
-* With the opencode OAuth flow, the GitHub token is used directly — no JWT exchange needed.
+* GitHub OAuth tokens from both the OpenCode app and the Copilot CLI app
+* remain directly usable, so existing logins need no token exchange or migration.
 */
 function refreshGitHubCopilotToken(refreshToken, enterpriseDomain, apiEndpoint) {
 	return {
@@ -128,11 +147,14 @@ function refreshGitHubCopilotToken(refreshToken, enterpriseDomain, apiEndpoint)
 		apiEndpoint
 	};
 }
+async function refreshGitHubCopilotHook(credentials) {
+	return refreshGitHubCopilotToken(credentials.refresh, credentials.enterpriseUrl, credentials.apiEndpoint);
+}
 /**
 * Enable a model for the user's GitHub Copilot account.
 * This is required for some models (like Claude, Grok) before they can be used.
 */
-async function enableGitHubCopilotModel(token, modelId, fetchImpl, enterpriseDomain, apiEndpoint) {
+async function enableGitHubCopilotModel(token, modelId, fetchImpl, enterpriseDomain, apiEndpoint, integrationId) {
 	const url = `${apiEndpoint ?? getGitHubCopilotBaseUrl(enterpriseDomain)}/models/${modelId}/policy`;
 	try {
 		return (await fetchImpl(url, {
@@ -141,8 +163,10 @@ async function enableGitHubCopilotModel(token, modelId, fetchImpl, enterpriseDom
 				"Content-Type": "application/json",
 				Authorization: `Bearer ${token}`,
 				...COPILOT_API_HEADERS,
-				"openai-intent": "chat-policy",
-				"x-interaction-type": "chat-policy"
+				"Copilot-Integration-Id": integrationId ?? "copilot-chat",
+				"Openai-Intent": "chat-policy",
+				"X-Initiator": "user",
+				"X-Interaction-Type": "chat-policy"
 			},
 			body: JSON.stringify({ state: "enabled" })
 		})).ok;
@@ -154,13 +178,15 @@ async function enableGitHubCopilotModel(token, modelId, fetchImpl, enterpriseDom
 * Enable all known GitHub Copilot models that may require policy acceptance.
 * Called after successful login to ensure all models are available.
 */
-async function enableAllGitHubCopilotModels(token, enterpriseDomain, apiEndpoint, fetchImpl, onProgress) {
+async function enableAllGitHubCopilotModels(token, enterpriseDomain, apiEndpoint, fetchImpl, onProgress, integrationId) {
 	const wireModelIds = [...new Set(getBundledModels("github-copilot").map((model) => model.requestModelId ?? model.id))];
+	const resolvedId = normalizeCopilotIntegrationId(integrationId) ?? resolveCopilotIntegrationIdOverride();
+	const copilotFetch = wrapFetchForCopilotFallback(fetchImpl, true, resolvedId);
 	const BATCH_SIZE = 5;
 	for (let i = 0; i < wireModelIds.length; i += BATCH_SIZE) {
 		const batch = wireModelIds.slice(i, i + BATCH_SIZE);
 		await Promise.all(batch.map(async (modelId) => {
-			const success = await enableGitHubCopilotModel(token, modelId, fetchImpl, enterpriseDomain, apiEndpoint);
+			const success = await enableGitHubCopilotModel(token, modelId, copilotFetch, enterpriseDomain, apiEndpoint, resolvedId);
 			onProgress?.(modelId, success);
 		}));
 	}
@@ -201,8 +227,22 @@ async function loginGitHubCopilot(options) {
 		apiEndpoint
 	};
 	options.onProgress?.("Enabling models...");
-	await enableAllGitHubCopilotModels(githubAccessToken, enterpriseDomain ?? void 0, apiEndpoint, fetchImpl);
+	await enableAllGitHubCopilotModels(githubAccessToken, enterpriseDomain ?? void 0, apiEndpoint, fetchImpl, void 0, options.copilotIntegrationId);
 	return credentials;
 }
+async function loginGitHubCopilotHook(callbacks) {
+	const onPrompt = callbacks.onPrompt;
+	if (!onPrompt) throw new OnPromptRequiredError("GitHub Copilot");
+	return loginGitHubCopilot({
+		onAuth: (url, instructions) => callbacks.onAuth?.({
+			url,
+			instructions
+		}),
+		onPrompt,
+		onProgress: callbacks.onProgress,
+		signal: callbacks.signal,
+		fetch: callbacks.fetch
+	});
+}
 //#endregion
-export { loginGitHubCopilot, refreshGitHubCopilotToken };
+export { loginGitHubCopilotHook, refreshGitHubCopilotHook };

package/lib/github-copilot-headers-DOh1gt_w.mjs

@@ -0,0 +1,312 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { C as warn, N as $env } from "./src-BwW51vA5.mjs";
+import { n as isRecord } from "./type-guards-CttAANEx.mjs";
+import "./utils-DeWqNWV8.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-catalog@18.1.17/node_modules/@oh-my-pi/pi-catalog/src/wire/github-copilot.ts
+const COPILOT_CLI_USER_AGENT = `copilot/1.0.82`;
+/** Headers sent by Copilot CLI to GitHub API and OAuth endpoints. */
+const COPILOT_GITHUB_HEADERS = { "User-Agent": COPILOT_CLI_USER_AGENT };
+/** Copilot CLI identity sent to the Copilot API. */
+const COPILOT_CAPI_IDENTITY_HEADERS = {
+	...COPILOT_GITHUB_HEADERS,
+	"Editor-Version": COPILOT_CLI_USER_AGENT,
+	"Copilot-Integration-Id": "copilot-developer-cli",
+	"Copilot-Harness-Id": "copilot-sdk",
+	"Openai-Intent": "conversation-agent"
+};
+/**
+* Chat-surface identity for Copilot chat and model-policy requests.
+* Some Business organizations gate premium models per client surface and
+* block the CLI identity while allowing chat (issue #11372), so chat traffic
+* defaults to this id with `COPILOT_INTEGRATION_ID` as an explicit pin and a
+* one-shot CLI retry on denial. Model discovery keeps the CLI identity above:
+* it unlocks enterprise/experimental models and listing is not policy-gated
+* the way chat completions are.
+*/
+const COPILOT_CHAT_INTEGRATION_ID = "copilot-chat";
+/**
+* Copilot API version sent on `api.githubcopilot.com` requests (`/models`,
+* chat endpoints). Newer versions unlock tiered context metadata: `/models`
+* reports the full long-context window in `capabilities.limits` plus per-tier
+* boundaries/prices under `billing.token_prices.{default,long_context}`.
+* Without it the endpoint serves default-tier limits only (e.g. 264k instead
+* of 1M for Claude Opus). Never send this to `api.github.com` REST endpoints —
+* they validate `X-GitHub-Api-Version` against the REST version vocabulary.
+*/
+const COPILOT_API_VERSION = "2026-08-01";
+/** Headers shared by Copilot API model requests and model definitions. */
+const COPILOT_API_HEADERS = {
+	...COPILOT_CAPI_IDENTITY_HEADERS,
+	"X-GitHub-Api-Version": COPILOT_API_VERSION
+};
+/** Copilot CLI headers for user-initiated model discovery. */
+const COPILOT_DISCOVERY_HEADERS = {
+	...COPILOT_API_HEADERS,
+	"X-Initiator": "user"
+};
+const MANAGED_COPILOT_HEADER_NAMES = {
+	"user-agent": true,
+	"editor-version": true,
+	"copilot-integration-id": true,
+	"copilot-harness-id": true,
+	"openai-intent": true,
+	"x-github-api-version": true,
+	"x-initiator": true,
+	"x-interaction-type": true
+};
+/** Preserve model-specific headers while enforcing the current Copilot API identity. */
+function mergeCopilotApiHeaders(headers) {
+	const merged = {};
+	if (headers) for (const name in headers) {
+		const value = headers[name];
+		if (value !== void 0 && !MANAGED_COPILOT_HEADER_NAMES[name.toLowerCase()]) merged[name] = value;
+	}
+	return {
+		...merged,
+		...COPILOT_API_HEADERS
+	};
+}
+/**
+* Validate an explicit `Copilot-Integration-Id` override.
+* omp identifies as the Copilot CLI (`copilot-developer-cli`); some Business
+* organizations allow Chat clients but block CLI/agentic ones, rejecting every
+* model with HTTP 403 on an otherwise valid token (issue #11372). Callers pass
+* the raw `COPILOT_INTEGRATION_ID` value; blank or CR/LF-bearing values are
+* rejected so the header stays well-formed and the default identity applies.
+*/
+function normalizeCopilotIntegrationId(value) {
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim();
+	if (!trimmed || /[\r\n]/.test(trimmed)) return void 0;
+	return trimmed;
+}
+const PUBLIC_GITHUB_HOSTS = /* @__PURE__ */ new Set([
+	"api.github.com",
+	"github.com",
+	"www.github.com"
+]);
+function isPublicGitHubHost(host) {
+	return PUBLIC_GITHUB_HOSTS.has(host.trim().toLowerCase());
+}
+/** Canonical personal-Copilot API host. */
+const PERSONAL_GITHUB_COPILOT_BASE_URL = "https://api.githubcopilot.com";
+/** `true` when the resolved base URL is the canonical personal-Copilot host. */
+function isPersonalGitHubCopilotBaseUrl(baseUrl) {
+	return baseUrl === PERSONAL_GITHUB_COPILOT_BASE_URL;
+}
+function normalizeGitHubCopilotEnterpriseDomain(input) {
+	const trimmed = input?.trim();
+	if (!trimmed) return void 0;
+	const normalized = normalizeDomain(trimmed) ?? trimmed.toLowerCase();
+	if (!normalized || isPublicGitHubHost(normalized)) return void 0;
+	return normalized;
+}
+function normalizeGitHubCopilotApiEndpoint(input) {
+	const trimmed = input?.trim();
+	if (!trimmed?.startsWith("https://")) return void 0;
+	try {
+		const url = new URL(trimmed);
+		if (url.protocol !== "https:" || !url.hostname) return void 0;
+		return trimmed.replace(/\/+$/, "");
+	} catch {
+		return;
+	}
+}
+/**
+* Resolve the plan-specific Copilot API endpoint advertised for a GitHub token.
+* Login and raw environment-token discovery share this best-effort probe. Pass
+* a `signal` to bound it against the same discovery deadline as `/models`; a
+* stalled probe otherwise blocks discovery indefinitely.
+*/
+async function discoverGitHubCopilotApiEndpoint(token, fetchImpl, signal) {
+	try {
+		const response = await fetchImpl("https://api.github.com/copilot_internal/user", {
+			headers: {
+				Accept: "application/json",
+				Authorization: `token ${token}`,
+				...COPILOT_GITHUB_HEADERS
+			},
+			signal
+		});
+		if (!response.ok) return void 0;
+		const data = await response.json();
+		if (!isRecord(data) || !isRecord(data.endpoints)) return void 0;
+		const endpoint = data.endpoints.api;
+		return typeof endpoint === "string" ? normalizeGitHubCopilotApiEndpoint(endpoint) : void 0;
+	} catch {
+		return;
+	}
+}
+function parseGitHubCopilotApiKey(apiKeyRaw) {
+	try {
+		const parsed = JSON.parse(apiKeyRaw);
+		if (typeof parsed.token === "string") return {
+			accessToken: parsed.token,
+			enterpriseUrl: typeof parsed.enterpriseUrl === "string" ? normalizeGitHubCopilotEnterpriseDomain(parsed.enterpriseUrl) : void 0,
+			apiEndpoint: typeof parsed.apiEndpoint === "string" ? normalizeGitHubCopilotApiEndpoint(parsed.apiEndpoint) : void 0
+		};
+	} catch {}
+	return { accessToken: apiKeyRaw };
+}
+function normalizeDomain(input) {
+	const trimmed = input.trim();
+	if (!trimmed) return null;
+	try {
+		return (trimmed.includes("://") ? new URL(trimmed) : new URL(`https://${trimmed}`)).hostname;
+	} catch {
+		return null;
+	}
+}
+function getGitHubCopilotBaseUrl(enterpriseDomain) {
+	const normalizedEnterpriseDomain = normalizeGitHubCopilotEnterpriseDomain(enterpriseDomain);
+	if (!normalizedEnterpriseDomain) return "https://api.githubcopilot.com";
+	return `https://${normalizedEnterpriseDomain.startsWith("copilot-api.") ? normalizedEnterpriseDomain : `copilot-api.${normalizedEnterpriseDomain}`}`;
+}
+//#endregion
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/providers/github-copilot-headers.ts
+function resolveGitHubCopilotBaseUrl(baseUrl, apiKey) {
+	if (!apiKey) return baseUrl;
+	const { enterpriseUrl, apiEndpoint } = parseGitHubCopilotApiKey(apiKey);
+	if (apiEndpoint && (!baseUrl || baseUrl.includes("githubcopilot.com"))) return apiEndpoint;
+	if (!enterpriseUrl) return baseUrl;
+	if (baseUrl && !baseUrl.includes("githubcopilot.com")) return baseUrl;
+	return getGitHubCopilotBaseUrl(enterpriseUrl);
+}
+/**
+* Opt-in `Copilot-Integration-Id` override for chat and model-policy requests.
+* Reads `COPILOT_INTEGRATION_ID`; unset/invalid keeps the chat-surface default
+* (`COPILOT_CHAT_INTEGRATION_ID`). Model discovery keeps the CLI identity: it
+* unlocks enterprise/experimental models and listing models is not
+* policy-gated the way chat completions are (#11372).
+*/
+function resolveCopilotIntegrationIdOverride(env = $env) {
+	return normalizeCopilotIntegrationId(env.COPILOT_INTEGRATION_ID);
+}
+/**
+* Explicit caller-supplied `Copilot-Integration-Id`, matched case-insensitively.
+* Takes only caller layers (`extraHeaders` / `options.headers`) — never model
+* catalog headers — so a catalog default can never masquerade as a choice.
+*/
+function explicitCopilotIntegrationId(headers) {
+	if (!headers) return void 0;
+	for (const name of Object.keys(headers)) if (name.toLowerCase() === "copilot-integration-id") return headers[name];
+}
+/**
+* Effective identity before the chat-surface default: explicit value, then
+* request headers, then `COPILOT_INTEGRATION_ID`. Pure given its inputs, so
+* tests inject literals instead of mutating process state.
+*/
+function resolveCopilotRequestIdentity(headers, explicit, env = $env) {
+	return normalizeCopilotIntegrationId(explicit) ?? normalizeCopilotIntegrationId(explicitCopilotIntegrationId(headers)) ?? resolveCopilotIntegrationIdOverride(env);
+}
+/**
+* Reissue chat-surface Copilot 403s once as the Copilot CLI.
+*
+* Chat is the default surface (`COPILOT_CHAT_INTEGRATION_ID`) because Business
+* organizations that gate premium models per client surface commonly allow
+* chat while blocking CLI/agentic clients (issue #11372). The retry fires
+* only for requests carrying the chat default and only when the caller
+* resolved no explicit identity — an explicit choice is never second-guessed.
+* The denied body is drained before reissuing, and the retry carries the CLI
+* identity so the guard passes it through: at most two requests, never a loop.
+*/
+function wrapFetchForCopilotFallback(base, enabled, integrationId) {
+	const inner = base ?? fetch;
+	if (!enabled) return inner;
+	return async (input, init) => {
+		const response = await inner(input, init);
+		if (response.status !== 403) return response;
+		if (input instanceof Request) return response;
+		if (normalizeCopilotIntegrationId(integrationId) !== void 0) return response;
+		const outgoing = new Headers(init?.headers);
+		if (outgoing.get("Copilot-Integration-Id") !== "copilot-chat") return response;
+		try {
+			await response.arrayBuffer();
+		} catch {}
+		warn("GitHub Copilot chat identity denied (HTTP 403); retrying once as the Copilot CLI");
+		const retryHeaders = new Headers(outgoing);
+		retryHeaders.set("Copilot-Integration-Id", COPILOT_CAPI_IDENTITY_HEADERS["Copilot-Integration-Id"]);
+		return inner(input, {
+			...init,
+			headers: retryHeaders
+		});
+	};
+}
+function inferCopilotInitiator(messages) {
+	if (messages.length === 0) return "user";
+	const last = messages[messages.length - 1];
+	const attribution = last.attribution;
+	if (typeof attribution === "string") {
+		const normalizedAttribution = attribution.trim().toLowerCase();
+		if (normalizedAttribution === "user" || normalizedAttribution === "agent") return normalizedAttribution;
+	}
+	const role = last.role;
+	if (!role) return "user";
+	if (role !== "user") return "agent";
+	const content = last.content;
+	if (Array.isArray(content) && content.length > 0) {
+		if (content[content.length - 1].type === "tool_result") return "agent";
+	}
+	return "user";
+}
+/** Check whether any message in the conversation contains image content. */
+function hasCopilotVisionInput(messages) {
+	return messages.some((msg) => {
+		if (msg.role === "user" && Array.isArray(msg.content)) return msg.content.some((c) => c.type === "image");
+		if (msg.role === "toolResult" && Array.isArray(msg.content)) return msg.content.some((c) => c.type === "image");
+		return false;
+	});
+}
+/**
+* Resolve an explicitly configured Copilot initiator header, if present.
+* Handles case-insensitive X-Initiator keys and returns the last valid value.
+*/
+function getCopilotInitiatorOverride(headers) {
+	if (!headers) return void 0;
+	let override;
+	for (const [key, value] of Object.entries(headers)) {
+		if (key.toLowerCase() !== "x-initiator") continue;
+		const normalized = value.trim().toLowerCase();
+		if (normalized === "user" || normalized === "agent") override = normalized;
+	}
+	return override;
+}
+function normalizeCopilotPlanTier(planTier) {
+	if (planTier === "paid") return "paid";
+	return "free";
+}
+function getCopilotPremiumMultiplier(premiumMultiplier, planTier) {
+	const normalizedMultiplier = premiumMultiplier ?? 1;
+	if (normalizeCopilotPlanTier(planTier) === "free" && normalizedMultiplier === 0) return 1;
+	return normalizedMultiplier;
+}
+function getCopilotPremiumRequests(params) {
+	if (params.initiator === "agent") return 0;
+	return getCopilotPremiumMultiplier(params.premiumMultiplier, params.planTier);
+}
+/**
+* Build dynamic Copilot headers that vary per-request.
+* Static headers (User-Agent, Editor-Version, etc.) come from model.headers.
+*/
+function buildCopilotDynamicHeaders(params) {
+	const initiator = params.initiatorOverride ?? getCopilotInitiatorOverride(params.headers) ?? inferCopilotInitiator(params.messages);
+	const headers = {
+		...COPILOT_CAPI_IDENTITY_HEADERS,
+		"X-Initiator": initiator,
+		"X-Interaction-Type": `conversation-${initiator}`
+	};
+	headers["Copilot-Integration-Id"] = normalizeCopilotIntegrationId(params.integrationId) ?? "copilot-chat";
+	if (params.hasImages) headers["Copilot-Vision-Request"] = "true";
+	return {
+		headers,
+		initiator,
+		premiumRequests: getCopilotPremiumRequests({
+			initiator,
+			premiumMultiplier: params.premiumMultiplier,
+			planTier: params.planTier
+		})
+	};
+}
+//#endregion
+export { normalizeCopilotIntegrationId as _, resolveGitHubCopilotBaseUrl as a, parseGitHubCopilotApiKey as b, COPILOT_CHAT_INTEGRATION_ID as c, PERSONAL_GITHUB_COPILOT_BASE_URL as d, discoverGitHubCopilotApiEndpoint as f, mergeCopilotApiHeaders as g, isPublicGitHubHost as h, resolveCopilotRequestIdentity as i, COPILOT_DISCOVERY_HEADERS as l, isPersonalGitHubCopilotBaseUrl as m, hasCopilotVisionInput as n, wrapFetchForCopilotFallback as o, getGitHubCopilotBaseUrl as p, resolveCopilotIntegrationIdOverride as r, COPILOT_API_HEADERS as s, buildCopilotDynamicHeaders as t, COPILOT_GITHUB_HEADERS as u, normalizeDomain as v, normalizeGitHubCopilotEnterpriseDomain as y };

package/lib/gitlab-duo-DSCMrU0m.mjs

@@ -0,0 +1,11 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { i as clearGitLabDuoDirectAccessCache } from "./stream-B_7qN-bA.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/gitlab-duo.ts
+/** GitLab Duo OAuth residue: invalidate direct-access credentials after token rotation. */
+const gitLabDuoClearCacheHook = async (credentials) => {
+	clearGitLabDuoDirectAccessCache();
+	return credentials;
+};
+//#endregion
+export { gitLabDuoClearCacheHook };

package/lib/google-CtsKkOQK.mjs

@@ -0,0 +1,38 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { h as MissingApiKeyError } from "./error-CORgGg5a.mjs";
+import { Ct as applyInferenceHeaders, n as getEnvApiKey } from "./stream-B_7qN-bA.mjs";
+import { p as streamGoogleGenAI, t as buildGoogleGenerateContentParams } from "./google-shared-B0aNCYEH.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/providers/google.ts
+const DEFAULT_GENERATIVE_LANGUAGE_BASE = "https://generativelanguage.googleapis.com/v1beta";
+const streamGoogle = (model, context, options) => {
+	const apiKey = options?.apiKey || getEnvApiKey(model.provider);
+	if (!apiKey) throw new MissingApiKeyError(void 0, "Google Generative AI requires an API key (GEMINI_API_KEY or options.apiKey).");
+	return streamGoogleGenAI({
+		model,
+		options,
+		api: "google-generative-ai",
+		prepare: () => {
+			const params = buildGoogleGenerateContentParams(model, context, options ?? {});
+			const url = `${model.baseUrl?.trim() || DEFAULT_GENERATIVE_LANGUAGE_BASE}/models/${model.id}:streamGenerateContent?alt=sse`;
+			const headers = {
+				"x-goog-api-key": apiKey,
+				...model.headers,
+				...options?.headers
+			};
+			applyInferenceHeaders(headers, {
+				provider: model.provider,
+				protocol: "google",
+				sessionId: options?.sessionId ?? options?.promptCacheKey
+			});
+			return {
+				params,
+				url,
+				headers,
+				fetch: options?.fetch
+			};
+		}
+	});
+};
+//#endregion
+export { streamGoogle };