cartethyia 2.7.4 → 2.7.6

package/src/providers/integrations/github/github.ts

@@ -23,14 +23,16 @@ import { allParts, type CanonicalEvent, type CanonicalRequest, type ContentPart
 import { OpenAICompatibleAdapter, withBearerAuthentication } from "../../adapters/compatible-adapter";
 import { postUpstreamJson } from "../../../protocol/upstream/post-json";
 import { providerBaseUrl } from "../../provider-metadata";
-import { getOrCreateInstallId } from "../shared/install-id";
 import { resolveRedisClient } from "../../../persistence/redis";
 import { applyParamQuirks } from "../../../protocol/translation/quirks";
 import { resolveInboundSessionId } from "../../operations/session-resolution";
 import {
   GITHUB_REQUEST_HEADERS,
+  githubCopilotClientIds,
   parseGithubCredential,
+  type GithubCredential,
 } from "./github-oauth";
+import { resolveGithubCopilotMode } from "../../../config/providers";
 
 export const GITHUB_PROVIDER_ID = "github" as const;
 
@@ -44,17 +46,34 @@ export const GITHUB_ENDPOINT_PATH = "/chat/completions" as const;
  */
 export const GITHUB_RESPONSES_ENDPOINT_PATH = "/responses" as const;
 
+/**
+ * Anthropic Messages surface. Copilot serves the premium Claude family
+ * (`claude-sonnet-*`, `claude-opus-*`, `claude-haiku-*`, `claude-fable-*`)
+ * on the native `/v1/messages` wire, and some SKUs are messages-only. The
+ * adapter's shared pipeline already speaks the messages codec; this constant
+ * lets discovery route those rows here instead of dropping them.
+ */
+export const GITHUB_MESSAGES_ENDPOINT_PATH = "/v1/messages" as const;
+
 
 
 /**
- * The highest reasoning effort Copilot serves. A caller asking for `max` or
- * `xhigh` is answered at `high` rather than refused: the model has no level
- * above it, and the request is otherwise valid.
+ * The highest reasoning effort Copilot serves as a fallback when a model does
+ * not declare its own ladder. A caller asking for `max` or `xhigh` is answered
+ * at `high` rather than refused: the model has no level above it, and the
+ * request is otherwise valid.
  */
 const GITHUB_REASONING_EFFORT_CAP = "high";
 const GITHUB_CAPPED_EFFORTS = new Set(["max", "xhigh"]);
 
-/** Rewrites an effort above Copilot's ceiling to `high`, on either wire. */
+/**
+ * Rewrites an effort above Copilot's ceiling to the highest level we know the
+ * model accepts. The shared encoder already pinned the effort to the model's
+ * declared ladder (`resolveThinkingForModel` reads `reasoningEfforts` from the
+ * catalog); this hook only guards a bare fallback so a caller asking for
+ * `max`/`xhigh` on a model without a declared ladder is answered at `high`
+ * rather than refused.
+ */
 function clampGithubReasoningEffort(payload: Record<string, unknown>): void {
   const effort = payload["reasoning_effort"];
   if (typeof effort === "string" && GITHUB_CAPPED_EFFORTS.has(effort)) {
@@ -88,12 +107,6 @@ export const GITHUB_EXCLUDED_MODEL_IDS: ReadonlySet<string> = new Set([
   "gpt-6-luna-medium",
   "gpt-6-luna-high",
   "kimi-k3",
-  "kimi-k3-base",
-  "kimi-k3-copilot",
-  "mai-code-1-flash-4th",
-  "mai-code-1-flash-secondary",
-  "mai-code-1-flash-tertiary",
-  "mai-code-1.1-flash",
 ]);
 
 const modelRoutesByCredential = new Map<string, ReadonlyMap<string, GithubModelRoute>>();
@@ -122,7 +135,10 @@ function parseRouteMap(raw: string): Map<string, GithubModelRoute> | undefined {
       if (typeof modelId !== "string" || route === null || typeof route !== "object") continue;
       const wireFamily = (route as { wireFamily?: unknown }).wireFamily;
       const endpointPath = (route as { endpointPath?: unknown }).endpointPath;
-      if ((wireFamily === "chat" || wireFamily === "responses") && typeof endpointPath === "string") {
+      if (
+        (wireFamily === "chat" || wireFamily === "responses" || wireFamily === "messages") &&
+        typeof endpointPath === "string"
+      ) {
         map.set(modelId, { wireFamily, endpointPath });
       }
     }
@@ -162,7 +178,7 @@ async function writeSharedModelRoutes(
 }
 
 export interface GithubModelRoute {
-  readonly wireFamily: "chat" | "responses";
+  readonly wireFamily: "chat" | "responses" | "messages";
   readonly endpointPath: string;
 }
 const GITHUB_AUTO_SESSION_CACHE_MAX_ENTRIES = 50;
@@ -187,8 +203,8 @@ export function recordGithubModelRoutes(
   if (key === undefined) return;
   const routes = models
     .filter(
-      (model): model is ModelDefinition & { readonly wireFamily: "chat" | "responses" } =>
-        model.wireFamily === "chat" || model.wireFamily === "responses",
+      (model): model is ModelDefinition & { readonly wireFamily: "chat" | "responses" | "messages" } =>
+        model.wireFamily === "chat" || model.wireFamily === "responses" || model.wireFamily === "messages",
     )
     .map((model) => [
       model.modelId.toLowerCase(),
@@ -304,6 +320,9 @@ function routeFromAutoModel(value: unknown): GithubModelRoute | undefined {
   if (endpoints.has("/responses")) {
     return { wireFamily: "responses", endpointPath: GITHUB_RESPONSES_ENDPOINT_PATH };
   }
+  if (endpoints.has("/messages")) {
+    return { wireFamily: "messages", endpointPath: GITHUB_MESSAGES_ENDPOINT_PATH };
+  }
   return undefined;
 }
 
@@ -485,6 +504,36 @@ class GithubAdapter extends OpenAICompatibleAdapter {
     );
   }
 
+  /**
+   * Minimal OpenCode-style Copilot headers using the long-lived GitHub OAuth
+   * token directly (no minted Copilot token, no VS Code identity). This is
+   * the shape the official OpenCode plugin sends; proven live (2026-11-03):
+   *
+   * - POST /auto with these headers + the raw GitHub token -> 200, returns the
+   *   session token and selects gpt-6-luna;
+   * - POST /responses with `Copilot-Session-Token` + GitHub token -> 200 stream.
+   */
+  async #opencodeStyleHeaders(
+    context: ProviderDispatchContext,
+    request: CanonicalRequest,
+    credential: GithubCredential,
+  ): Promise<Record<string, string>> {
+    const headers: Record<string, string> = {
+      "content-type": "application/json",
+      "user-agent": "opencode/0.1.0",
+      "openai-intent": "conversation-edits",
+      "x-github-api-version": "2026-08-01",
+      "x-interaction-type": "conversation-agent",
+      "x-interaction-id": randomUUID(),
+      "x-initiator": isAgentInitiated(request) ? "agent" : "user",
+      "x-request-id": context.request_id ?? randomUUID(),
+    };
+    if (credential.github !== undefined && credential.github.length > 0) {
+      headers.authorization = `Bearer ${credential.github}`;
+    }
+    return headers;
+  }
+
   async #selectAutoModel(
     prompt: string,
     tier: "efficiency" | "balance" | "intelligence",
@@ -493,13 +542,24 @@ class GithubAdapter extends OpenAICompatibleAdapter {
     candidate: ProviderDispatchTarget,
     context: ProviderDispatchContext,
   ): Promise<GithubAutoDecision> {
-    const headers = await this.prepareHeaders(context, request, candidate);
     const credential = context.credential.secret === undefined
       ? undefined
       : parseGithubCredential(new TextDecoder().decode(context.credential.secret));
     if (credential === undefined) {
       throw new GatewayError("authentication_failed", 401, "GitHub Copilot credential is missing (request {requestId}). Wrong key, right door — check the credential 🔑");
     }
+    // `opencode-copilot` mode (default): raw GitHub token + minimal headers,
+    // proven the most stable (single token, no mint expiry). The reference
+    // mode (`vscode-client-real`) uses the minted Copilot token + full VS Code
+    // headers — but a stale/expired minted token fails with 403 and the
+    // reference headers on /auto can answer 400 "invalid apiVersion" unless the
+    // minted token is fresh, so the default stays opencode.
+    const headers =
+      resolveGithubCopilotMode() === "opencode-copilot" &&
+      credential.github !== undefined &&
+      credential.github.length > 0
+        ? await this.#opencodeStyleHeaders(context, request, credential)
+        : await this.prepareHeaders(context, request, candidate);
     const payload: Record<string, unknown> = { prompt, tier };
     if (hasImage) payload.has_image = true;
     const outboundFetch = context.outbound_fetch ?? this.#fetch ?? globalThis.fetch;
@@ -631,32 +691,80 @@ class GithubAdapter extends OpenAICompatibleAdapter {
     // it and wins — the route-level User-Agent is for generic OpenAI-compatible
     // hosts and would be rejected here.
     Object.assign(headers, GITHUB_REQUEST_HEADERS);
+    const secret = context.credential.secret;
+    let parsedCredential: ReturnType<typeof parseGithubCredential> | undefined;
+    if (secret !== undefined && secret.length > 0) {
+      try {
+        parsedCredential = parseGithubCredential(new TextDecoder().decode(secret));
+      } catch {
+        // Unparseable credential; fall back to the reference identity below.
+      }
+    }
     const autoSessionToken = this.#autoSessionTokens.get(request);
-    if (autoSessionToken !== undefined) {
+    // Auto-selected requests stream behind the session token. In the default
+    // `opencode-copilot` mode (raw GitHub token + minimal headers, proven 200
+    // on /auto and /responses), the whole request uses the OpenCode shape. The
+    // reference mode (`vscode-client-real`) keeps the reference identity and
+    // the minted Copilot token.
+    if (autoSessionToken !== undefined && parsedCredential?.github !== undefined) {
+      if (resolveGithubCopilotMode() === "opencode-copilot") {
+        const opencode = await this.#opencodeStyleHeaders(context, request, parsedCredential);
+        for (const key of Object.keys(headers)) delete headers[key];
+        Object.assign(headers, opencode);
+        headers["Copilot-Session-Token"] = autoSessionToken;
+        return headers;
+      }
+      headers["Copilot-Session-Token"] = autoSessionToken;
+    } else if (autoSessionToken !== undefined) {
       headers["Copilot-Session-Token"] = autoSessionToken;
     }
     const requestId = context.request_id ?? randomUUID();
+    // Reference (`_mixinHeaders` + request path): the interaction id is a
+    // separate value from the request id (`X-Request-Id`), and the Copilot
+    // client identity is stamped as `VScode-SessionId`/`VScode-MachineId`.
+    // The library version header carries the fetcher library id (`node-http`
+    // etc.), not the extension version — we previously sent the extension
+    // version there, which the upstream reads as a different client fingerprint.
+    const interactionId = randomUUID();
+    // Machine id is per-account (stable derive from install id + account
+    // fingerprint), so a pooled gateway does not make every account look like
+    // one device.
+    const accountKey =
+      parsedCredential === undefined
+        ? undefined
+        : createHash("sha256")
+            .update(`${parsedCredential.apiHost}:${parsedCredential.access}`)
+            .digest("hex");
+    const { sessionId, machineId } = await githubCopilotClientIds(accountKey);
     Object.assign(headers, {
-      "editor-device-id": await getOrCreateInstallId("github"),
+      "editor-device-id": machineId,
+      "VScode-MachineId": machineId,
+      "VScode-SessionId": sessionId,
       "openai-intent": "conversation-agent",
+      // Reference stamps `Openai-Organization` on HTTP chat requests.
+      ...(candidate?.wire_family === "chat" ? { "Openai-Organization": "github-copilot" } : {}),
       "x-agent-task-id": requestId,
+      "x-interaction-id": interactionId,
       "x-initiator": isAgentInitiated(request) ? "agent" : "user",
       "x-interaction-type": "conversation-agent",
       "x-request-id": requestId,
+      "x-vscode-user-agent-library-version": "node-http",
     });
+    // The copy Claude family is served on the native Anthropic Messages wire,
+    // which gates feature betas behind `anthropic-beta` (mirroring the
+    // Copilot extension's `getAnthropicBetaHeader`). Adaptive thinking is the
+    // baseline the model roster declares, so it is requested for every messages
+    // route; the header is scoped to that wire and never sent elsewhere.
+    if (candidate?.wire_family === "messages") {
+      headers["anthropic-beta"] = "interleaved-thinking-2025-05-14";
+    }
     if (allParts(request).some(containsImage)) {
       headers["copilot-vision-request"] = "true";
     } else {
       delete headers["copilot-vision-request"];
     }
-    const secret = context.credential.secret;
-    if (secret === undefined || secret.length === 0) return headers;
-    try {
-      const { access } = parseGithubCredential(new TextDecoder().decode(secret));
-      headers.authorization = `Bearer ${access}`;
-    } catch {
-      // Left as the factory sent it: the request fails closed at the upstream
-      // auth boundary, and the parse error belongs to the credential boundary.
+    if (parsedCredential !== undefined) {
+      headers.authorization = `Bearer ${parsedCredential.access}`;
     }
     return headers;
   }