cartethyia 2.7.4 → 2.7.6

package/src/providers/integrations/factory/factory.ts

@@ -106,7 +106,7 @@ function factoryClientHeaders(orgId: string): Record<string, string> {
  * (`packages/ai/src/providers/factory-droid.ts:271` — `"x-api-provider":
  * input.upstream`), so a value outside it has no meaning on this wire.
  */
-export const FACTORY_DROID_UPSTREAMS = [
+const FACTORY_DROID_UPSTREAMS = [
   "fireworks",
   "baseten",
   "mistral",
@@ -123,7 +123,7 @@ export const FACTORY_DROID_UPSTREAMS = [
   "databricks",
 ] as const;
 
-export type FactoryDroidUpstream = (typeof FACTORY_DROID_UPSTREAMS)[number];
+type FactoryDroidUpstream = (typeof FACTORY_DROID_UPSTREAMS)[number];
 
 const FACTORY_DROID_UPSTREAM_SET: ReadonlySet<string> = new Set(FACTORY_DROID_UPSTREAMS);
 
@@ -154,7 +154,7 @@ function logDroppedUpstream(reason: string, value: string): void {
  * unmapped failure. Omitting falls back to Factory's default routing, which is
  * the behavior a request that names no upstream already gets.
  */
-export function factoryApiProviderHeader(
+function factoryApiProviderHeader(
   options: Readonly<Record<string, unknown>> | undefined,
 ): Record<string, string> {
   const value = options?.["factory_api_provider"];
@@ -179,7 +179,7 @@ export function factoryApiProviderHeader(
  * `/api/cli/whoami` reported. An account with no recorded residency is the
  * global host, which is Factory's default.
  */
-export function factoryBaseUrl(context: ProviderDispatchContext): string {
+function factoryBaseUrl(context: ProviderDispatchContext): string {
   const region = context.credential.auth_state?.["region"];
   return region === "eu" ? FACTORY_DROID_EU_BASE_URL : FACTORY_DROID_BASE_URL;
 }
@@ -200,7 +200,7 @@ export function factoryBaseUrl(context: ProviderDispatchContext): string {
  * operator wrote into `auth_state`. The two-axis read is kept because the donor
  * needs it, not because we currently populate the second axis.
  */
-export function factoryInferenceRegion(
+function factoryInferenceRegion(
   context: ProviderDispatchContext,
 ): "global" | "us" | "eu" {
   const state = context.credential.auth_state;
@@ -266,7 +266,7 @@ const REGION_UPSTREAMS: Readonly<Record<"global" | "us" | "eu", readonly Factory
  * is, which is a property of the route rather than of the request. The donor's
  * own message text is preserved as the `reason` so the mapping is traceable.
  */
-export function factoryRegionUnavailable(modelId: string, region: string): GatewayError {
+function factoryRegionUnavailable(modelId: string, region: string): GatewayError {
   return new GatewayError(
     "capability_unsupported",
     400,
@@ -294,7 +294,7 @@ export function factoryRegionUnavailable(modelId: string, region: string): Gatew
  * Sending `configured_order` without that discovery would claim a rotation we
  * never resolved.
  */
-export function factoryRoutingSourceHeader(request: CanonicalRequest): Record<string, string> {
+function factoryRoutingSourceHeader(request: CanonicalRequest): Record<string, string> {
   const continuing = request.messages.some((message) => message.role === "assistant");
   return { "x-provider-routing-source": continuing ? "session_lock" : "registry_default" };
 }
@@ -313,7 +313,7 @@ export function factoryRoutingSourceHeader(request: CanonicalRequest): Record<st
  * donor's own region-unavailable error rather than an upstream 4xx this layer
  * cannot explain.
  */
-export function factoryRegionCheckedApiProviderHeader(
+function factoryRegionCheckedApiProviderHeader(
   request: CanonicalRequest,
   context: ProviderDispatchContext,
 ): Record<string, string> {
@@ -330,7 +330,7 @@ export function factoryRegionCheckedApiProviderHeader(
 }
 
 /** The two routing headers together, as every Factory wire sends them. */
-export function factoryRoutingHeaders(
+function factoryRoutingHeaders(
   request: CanonicalRequest,
   context: ProviderDispatchContext,
 ): Record<string, string> {

package/src/providers/integrations/github/github-discovery.ts

@@ -29,10 +29,12 @@ import {
   GITHUB_PROVIDER_ID,
   GITHUB_ENDPOINT_PATH,
   GITHUB_RESPONSES_ENDPOINT_PATH,
+  GITHUB_MESSAGES_ENDPOINT_PATH,
   GITHUB_AUTO_MODELS,
   recordGithubModelRoutes,
 } from "./github";
-import { GITHUB_REQUEST_HEADERS, parseGithubCredential } from "./github-oauth";
+import { GITHUB_REQUEST_HEADERS, githubCopilotClientIds, parseGithubCredential } from "./github-oauth";
+import { createHash } from "node:crypto";
 
 /** A context window above this is unsatisfiable headroom, not a real limit. */
 const MAX_CONTEXT = 1_000_000_000;
@@ -47,12 +49,11 @@ function positiveLimit(value: unknown): number | undefined {
  * The surfaces a row answers on, normalized to the canonical paths this
  * gateway registers.
  *
- * A row that supports neither chat nor responses is skipped rather than
- * defaulted: Copilot also serves a native Anthropic `/v1/messages` surface for
- * some SKUs, and this adapter speaks only the OpenAI wire. Registering such a
- * row as chat would publish a route that fails on first dispatch.
+ * Copilot serves three OpenAI/Anthropic surfaces: `/chat/completions`,
+ * `/responses`, and `/v1/messages`. A row that supports none of them is
+ * skipped rather than defaulted.
  */
-function wireFamilyFor(entry: Record<string, unknown>): "chat" | "responses" | undefined {
+function wireFamilyFor(entry: Record<string, unknown>): "chat" | "responses" | "messages" | undefined {
   const declared = boundedUpstreamArray(entry.supported_endpoints);
   if (!declared) return "chat";
   const endpoints = new Set<string>();
@@ -60,11 +61,12 @@ function wireFamilyFor(entry: Record<string, unknown>): "chat" | "responses" | u
     const label = sanitizeUpstreamLabel(value);
     if (label !== undefined) endpoints.add(label.replace(/^\/v1(?=\/)/, ""));
   }
-  // Chat is preferred when a row supports both: it is the surface every
-  // OpenAI-compatible client already speaks, and the upstream answers it for
-  // the same SKU. Responses is used only when chat is absent.
+  // Chat is preferred when a row supports it: it is the surface every
+  // OpenAI-compatible client already speaks. Responses and Messages are used
+  // only when chat is absent, in that order.
   if (endpoints.has("/chat/completions")) return "chat";
   if (endpoints.has("/responses")) return "responses";
+  if (endpoints.has("/messages")) return "messages";
   return undefined;
 }
 
@@ -75,6 +77,34 @@ function supports(entry: Record<string, unknown>, key: string): boolean {
   return declared?.[key] === true;
 }
 
+/**
+ * Price deltas from the account's `/models` row when it publishes `token_prices`
+ * (dollars per 1M tokens). This is the real per-account price Copilot serves,
+ * which the shared models.dev catalog cannot know; when absent the base-catalog
+ * estimate is used instead.
+ */
+function copilotCost(entry: Record<string, unknown>): ModelDefinition["cost"] {
+  const billing = isRecord(entry.billing) ? entry.billing : undefined;
+  const prices = isRecord(billing?.token_prices) ? billing.token_prices : undefined;
+  const defaultTier = isRecord(prices?.default) ? prices.default : undefined;
+  const input = positiveLimit(defaultTier?.input_price);
+  const output = positiveLimit(defaultTier?.output_price);
+  if (input === undefined && output === undefined) {
+    return modelsDevCatalog.costFor(GITHUB_PROVIDER_ID, String(entry.id ?? ""));
+  }
+  return {
+    input: input ?? null,
+    output: output ?? null,
+    ...(typeof (defaultTier as Record<string, unknown> | undefined)?.cache_read_price === "number"
+      ? { cache_read: (defaultTier as { cache_read_price?: number }).cache_read_price }
+      : {}),
+    ...(typeof (defaultTier as Record<string, unknown> | undefined)?.cache_write_price === "number"
+      ? { cache_write: (defaultTier as { cache_write_price?: number }).cache_write_price }
+      : {}),
+    pricing_model: "pay-per-use",
+  };
+}
+
 function toModelDefinition(entry: Record<string, unknown>): ModelDefinition | undefined {
   const modelId = sanitizeUpstreamLabel(entry.id);
   if (modelId === undefined) return undefined;
@@ -89,16 +119,32 @@ function toModelDefinition(entry: Record<string, unknown>): ModelDefinition | un
   // clamped the same way every other catalog row is.
   const outputLimit = Math.min(declaredOutput, contextLimit);
   const vision = supports(entry, "vision");
+  // `reasoning_effort` is a list (e.g. ["low","medium","high","xhigh","max"])
+  // when the model supports effort levels; absence means the model does not
+  // expose an effort knob. Carrying it lets routing clamp to the model's real
+  // ladder instead of the provider-wide `max→high` cap.
+  const supportsObj = isRecord(capabilities?.supports) ? capabilities.supports : undefined;
+  const reasoningEfforts = Array.isArray(supportsObj?.reasoning_effort)
+    ? (supportsObj.reasoning_effort as unknown[])
+        .filter((level): level is string => typeof level === "string" && level.length > 0)
+    : undefined;
+  const cost = copilotCost(entry);
   return {
     modelId,
     wireFamily,
-    endpointPath: wireFamily === "responses" ? GITHUB_RESPONSES_ENDPOINT_PATH : GITHUB_ENDPOINT_PATH,
+    endpointPath:
+      wireFamily === "responses"
+        ? GITHUB_RESPONSES_ENDPOINT_PATH
+        : wireFamily === "messages"
+          ? GITHUB_MESSAGES_ENDPOINT_PATH
+          : GITHUB_ENDPOINT_PATH,
     contextLimit,
     outputLimit,
     modalities: { input: vision ? ["text", "image"] : ["text"], output: ["text"] },
     reasoning: true,
+    ...(reasoningEfforts === undefined ? {} : { reasoningEfforts }),
     toolCall: true,
-    cost: modelsDevCatalog.costFor(GITHUB_PROVIDER_ID, modelId),
+    cost,
   };
 }
 
@@ -125,8 +171,20 @@ export async function discoverGithubModels(
   const signal =
     input.signal === undefined ? timeoutSignal : AbortSignal.any([input.signal, timeoutSignal]);
   try {
+    // The reference client stamps its Copilot identity on `/models` too
+    // (`_mixinHeaders` covers the Models request type): session + machine ids.
+    // Machine id is per-account — see `githubCopilotClientIds`.
+    const accountKey = createHash("sha256").update(`${apiHost}:${access}`).digest("hex");
+    const { sessionId, machineId } = await githubCopilotClientIds(accountKey);
     const response = await fetcher(`https://${apiHost}/models`, {
-      headers: { accept: "application/json", authorization: `Bearer ${access}`, ...GITHUB_REQUEST_HEADERS },
+      headers: {
+        accept: "application/json",
+        authorization: `Bearer ${access}`,
+        ...GITHUB_REQUEST_HEADERS,
+        "VScode-SessionId": sessionId,
+        "VScode-MachineId": machineId,
+        "editor-device-id": machineId,
+      },
       signal,
     });
     if (!response.ok) return null;

package/src/providers/integrations/github/github-oauth.ts

@@ -29,13 +29,31 @@ import type { OAuthTokenRefreshResult } from "../../authentication/oauth-refresh
 import { OAuthDeviceFlow } from "../../authentication/oauth-device-flow";
 import type { FetchLike } from "../../authentication/oauth-client";
 import { resolveGithubEnterpriseDomain } from "../../../config/providers";
+import { randomUUID, createHash } from "node:crypto";
+import { getOrCreateInstallId } from "../shared/install-id";
 
 
 /** Public GitHub OAuth app id the Copilot clients use; not a secret. */
 export const GITHUB_CLIENT_ID = "Iv1.b507a08c87ecfe98" as const;
+/** The OpenCode desktop client's own GitHub OAuth app id (used by its Copilot integration). */
+export const GITHUB_OPENCODE_CLIENT_ID = "Ov23li8tweQw6odWQebz" as const;
 export const GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token" as const;
 /** Default API host when a token carries no `proxy-ep` claim. */
 export const GITHUB_DEFAULT_API_HOST = "api.individual.githubcopilot.com" as const;
+/**
+ * The Copilot API host OpenCode's integration uses. The reference plugin always
+ * dials `api.githubcopilot.com` for GitHub.com (never the per-claim
+ * `api.individual.*` host the VS Code minted tokens carry), so an OpenCode
+ * login pins this host rather than falling back to the VS Code default.
+ */
+export const GITHUB_OPENCODE_API_HOST = "api.githubcopilot.com" as const;
+/**
+ * How long an OpenCode login's credential is treated as valid before the
+ * refresh sweep revisits it. The raw GitHub OAuth token has no Copilot token
+ * expiry (there is no minted token), so this is a far-future safeguard, not a
+ * real lifetime: a re-login or upstream expiry is what actually rotates it.
+ */
+const GITHUB_OPENCODE_TOKEN_LIFETIME_MS = 365 * 24 * 60 * 60 * 1000;
 
 /**
  * Headers every Copilot inference and policy request must carry.
@@ -43,17 +61,64 @@ export const GITHUB_DEFAULT_API_HOST = "api.individual.githubcopilot.com" as con
  * The API rejects a request that does not identify a Copilot client, so these
  * are a protocol requirement rather than cosmetic fingerprinting — unlike the
  * Codex/Claude CLI identities elsewhere in this repository, which exist to look
- * like a first-party client. The version pair is the Copilot Chat extension's,
- * which is what the upstream expects for this client id.
+ * like a first-party client. The version pair is the Copilot Chat extension's
+ * (0.72.0 on VS Code 1.144), which is what the upstream expects for this
+ * client id.
  */
 export const GITHUB_REQUEST_HEADERS: Readonly<Record<string, string>> = Object.freeze({
-  "user-agent": "GitHubCopilotChat/0.70.0",
-  "editor-version": "vscode/1.142.0",
-  "editor-plugin-version": "copilot-chat/0.70.0",
+  "user-agent": "GitHubCopilotChat/0.72.0",
+  "editor-version": "vscode/1.144.0",
+  "editor-plugin-version": "copilot-chat/0.72.0",
   "copilot-integration-id": "vscode-chat",
   "x-github-api-version": "2026-08-01",
 });
 
+/**
+ * Stable per-process Copilot session id.
+ *
+ * The reference extension (`_mixinHeaders`) stamps `VScode-SessionId` with the
+ * VS Code window session and `VScode-MachineId` with the machine id. There is
+ * no VS Code window here, so the closest 1:1 shapes are: a session id minted
+ * once per gateway process (a new window = a new process in the reference), and
+ * a stable per-installation identity for the machine id.
+ */
+export const GITHUB_COPILOT_SESSION_ID = randomUUID();
+
+/**
+ * Resolves the Copilot client identity headers shared by chat/auto/discovery.
+ *
+ * The machine id is derived deterministically from the persisted install id and
+ * an account fingerprint when one is provided. The reference extension uses one
+ * machine id per VS Code installation for every account, but this gateway pools
+ * many accounts on one host — sharing one id across all of them makes every
+ * account look like a single device (an easy clustering/abuse signal). A
+ * per-account machine id keeps each account looking like its own device while
+ * staying stable across restarts for the same account. Without an account key
+ * (e.g. credential could not be parsed) the raw install id is used.
+ */
+export async function githubCopilotClientIds(
+  accountKey?: string,
+): Promise<{
+  readonly sessionId: string;
+  readonly machineId: string;
+}> {
+  const installId = await getOrCreateInstallId("github");
+  const machineId =
+    accountKey === undefined || accountKey.length === 0
+      ? installId
+      : deterministicMachineId(installId, accountKey);
+  return {
+    sessionId: GITHUB_COPILOT_SESSION_ID,
+    machineId,
+  };
+}
+
+/** Stable UUID-shaped machine id derived from the install id and an account key. */
+export function deterministicMachineId(installId: string, accountKey: string): string {
+  const digest = createHash("sha256").update(`${installId}:${accountKey}`).digest("hex");
+  return `${digest.slice(0, 8)}-${digest.slice(8, 12)}-${digest.slice(12, 16)}-${digest.slice(16, 20)}-${digest.slice(20, 32)}`;
+}
+
 const DEVICE_INTERVAL_SECONDS = 5;
 const DEVICE_EXPIRY_SECONDS = 900;
 /** Copilot tokens are short-lived; a missing `expires_at` falls back to 25 minutes. */
@@ -195,17 +260,80 @@ async function fetchGitHubLogin(
   }
 }
 
+interface CopilotUserProfile {
+  readonly chat_enabled?: boolean;
+  readonly can_signup_for_limited?: boolean;
+}
+
+/**
+ * Reads the Copilot entitlement profile for a freshly approved GitHub token.
+ *
+ * OAuth itself succeeds for any GitHub account; entitlement is the only signal
+ * that the account can chat. Mirrors the reference OpenCode provider: an
+ * explicit `chat_enabled: false` is a denial (the account is not signed up or
+ * has no seat), and a failed/malformed lookup must not turn a GitHub hiccup
+ * into a denial — only an explicit answer blocks login.
+ */
+async function fetchGitHubCopilotEntitlement(
+  githubAccessToken: string,
+  domain: string,
+  fetchFn: FetchLike,
+  signal: AbortSignal,
+): Promise<{ denied: string } | { denied?: undefined }> {
+  try {
+    const endpoint =
+      domain === "github.com"
+        ? "https://api.github.com/copilot_internal/user"
+        : `https://api.${domain}/copilot_internal/user`;
+    const response = await fetchFn(endpoint, {
+      headers: {
+        accept: "application/json",
+        authorization: `Bearer ${githubAccessToken}`,
+        "user-agent": GITHUB_REQUEST_HEADERS["user-agent"]!,
+        "x-github-api-version": "2025-04-01",
+      },
+      signal,
+    });
+    if (!response.ok) return { denied: undefined };
+    const profile = record(await response.json()) as CopilotUserProfile | undefined;
+    if (profile?.chat_enabled === false) {
+      if (profile.can_signup_for_limited) {
+        return {
+          denied:
+            "This GitHub account is not signed up for GitHub Copilot. Sign up for Copilot Free at https://github.com/features/copilot/plans and connect again.",
+        };
+      }
+      return {
+        denied:
+          "This GitHub account does not have GitHub Copilot access. It needs an active Copilot subscription or a seat assigned by an organization.",
+      };
+    }
+    return { denied: undefined };
+  } catch {
+    // Entitlement is a gate, not a reliability dependency: a network glitch
+    // here must not lock out an account that did approve the login.
+    return { denied: undefined };
+  }
+}
+
 export class GithubOAuthClient extends OAuthDeviceFlow {
   override readonly supportsDeviceCode = true;
   override readonly supportsBrowserCode = false;
 
   protected override readonly providerLabel = "GitHub Copilot";
-  protected override readonly clientId = GITHUB_CLIENT_ID;
   protected override readonly tokenUrl = GITHUB_ACCESS_TOKEN_URL;
   protected override readonly scopes = "read:user";
 
-  constructor(fetchFn: FetchLike = globalThis.fetch) {
+  /** Which GitHub OAuth app this flow presents. Defaults to the Copilot Chat
+   *  extension's app; OpenCode's own app differs (`GITHUB_OPENCODE_CLIENT_ID`). */
+  protected override readonly clientId: string;
+
+  constructor(
+    fetchFn: FetchLike = globalThis.fetch,
+    clientId: string = GITHUB_CLIENT_ID,
+  ) {
     super(fetchFn);
+    this.clientId = clientId;
   }
 
   override async startDeviceAuth(_context?: OAuthDeviceFlowContext): Promise<OAuthDeviceStartResult> {
@@ -217,7 +345,7 @@ export class GithubOAuthClient extends OAuthDeviceFlow {
         "content-type": "application/x-www-form-urlencoded",
         "user-agent": GITHUB_REQUEST_HEADERS["user-agent"]!,
       },
-      body: new URLSearchParams({ client_id: GITHUB_CLIENT_ID, scope: "read:user" }),
+      body: new URLSearchParams({ client_id: this.clientId, scope: "read:user" }),
     });
     const body = record(await readJsonResponse(response, "GitHub device authorization"));
     const deviceCode = nonEmptyTrimmedString(body?.device_code);
@@ -271,7 +399,7 @@ export class GithubOAuthClient extends OAuthDeviceFlow {
         "user-agent": GITHUB_REQUEST_HEADERS["user-agent"]!,
       },
       body: new URLSearchParams({
-        client_id: GITHUB_CLIENT_ID,
+        client_id: this.clientId,
         device_code: deviceAuthId,
         grant_type: "urn:ietf:params:oauth:grant-type:device_code",
       }),
@@ -314,21 +442,48 @@ export class GithubOAuthClient extends OAuthDeviceFlow {
           : `GitHub device polling failed (${response.status})`;
       return { status: "failed", reason };
     }
-    let minted;
+    let minted: Awaited<ReturnType<typeof mintGithubToken>> | undefined;
     try {
-      minted = await mintGithubToken(githubToken, domain, this.fetchFn);
+      // OAuth succeeds for any GitHub account; the entitlement profile is the
+      // only signal that the account can actually chat. An explicit denial is
+      // surfaced as a failed verdict before any token is minted or stored,
+      // mirroring the reference OpenCode provider.
+      const entitlement = await fetchGitHubCopilotEntitlement(
+        githubToken,
+        domain,
+        this.fetchFn,
+        AbortSignal.timeout(10_000),
+      );
+      if (entitlement.denied !== undefined) {
+        return { status: "failed", reason: entitlement.denied };
+      }
+      // OpenCode's OAuth app is the client the `opencode-copilot` wire mode
+      // presents upstream, and that mode uses the raw GitHub token directly —
+      // no minted Copilot token. The VS Code mint endpoint
+      // (`/copilot_internal/v2/token`) rejects non-VS-Code client ids with 403
+      // (GitHub's anti-scraping gate), so an OpenCode login must not mint.
+      if (this.clientId !== GITHUB_OPENCODE_CLIENT_ID) {
+        minted = await mintGithubToken(githubToken, domain, this.fetchFn);
+      }
     } catch (error) {
       // The mint runs after approval: surface its reason as a failed verdict,
       // not an exception that escapes the dashboard's poll request.
       return { status: "failed", reason: error instanceof Error ? error.message : "GitHub Copilot token mint failed" };
     }
     const label = await fetchGitHubLogin(githubToken, domain, this.fetchFn, AbortSignal.timeout(10_000));
+    const access = minted === undefined ? githubToken : minted.access;
+    const apiHost = minted === undefined ? GITHUB_OPENCODE_API_HOST : minted.apiHost;
+    const expiresAt =
+      minted === undefined
+        ? new Date(Date.now() + GITHUB_OPENCODE_TOKEN_LIFETIME_MS)
+        : minted.expiresAt;
     const result: OAuthExchangeResult = {
-      access: encodeGithubCredential(minted.access, minted.apiHost, githubToken),
+      access: encodeGithubCredential(access, apiHost, githubToken),
       // The GitHub token is the refresh value: it is what re-mints the Copilot
-      // token, which expires on its own much shorter clock.
+      // token (VS Code app) or is the raw credential itself (OpenCode app),
+      // depending on which app the flow presented.
       refresh: githubToken,
-      expiresAt: minted.expiresAt,
+      expiresAt,
       ...(label === undefined ? {} : { accountLabel: label }),
     };
     return { status: "complete", result };
@@ -336,6 +491,21 @@ export class GithubOAuthClient extends OAuthDeviceFlow {
 
 
   override async refresh(refreshToken: string, signal?: AbortSignal): Promise<OAuthTokenRefreshResult> {
+    // OpenCode's app uses the raw GitHub token directly — there is no minted
+    // Copilot token to re-mint, and the VS Code mint endpoint rejects the
+    // OpenCode client id. Refresh is then a no-op that keeps the credential
+    // valid on its far-future lifetime.
+    if (this.clientId === GITHUB_OPENCODE_CLIENT_ID) {
+      return {
+        access: encodeGithubCredential(
+          refreshToken,
+          GITHUB_OPENCODE_API_HOST,
+          refreshToken,
+        ),
+        refresh: refreshToken,
+        expiresAt: new Date(Date.now() + GITHUB_OPENCODE_TOKEN_LIFETIME_MS),
+      };
+    }
     const minted = await mintGithubToken(
       refreshToken,
       copilotGitHubDomain(),