codex-copilot-dx 0.4.14 → 0.4.16

package/README.md

@@ -27,7 +27,7 @@ npx codex-copilot-dx@latest
 > Tip: the `@latest` suffix forces `npx` to fetch the newest release instead of using a stale cached copy.
 
 On first run, it will:
-1. Authenticate with GitHub via device flow (if needed)
+1. Authenticate with GitHub via device flow (if needed), after first trying compatible local Copilot token sources
 2. Print the local package version and warn when a newer npm release is available
 3. Start the adapter on loopback (`127.0.0.1:2026`)
 4. Configure Codex (`~/.codex/config.toml`) to use the adapter, including stale shell env base URLs if present
@@ -48,6 +48,15 @@ codex-copilot-dx doctor
 
 The doctor checks the GitHub token, Codex config, Claude Code settings, Claude App gateway profile, and whether the local adapter port is listening.
 
+When the saved token is missing, `codex-copilot-dx` first looks for compatible local Copilot GitHub tokens, validates them with GitHub and Copilot, and imports a valid one before starting device login. It checks explicit token sources (`CCDX_GITHUB_TOKEN`, `CCDX_GITHUB_TOKEN_PATH`, `CCDX_GITHUB_TOKEN_PATHS`) plus common local `auth.json` layouts under application config directories. It does not rely on a specific app name. If a saved token later fails with `401` or `403`, the adapter repeats that discovery and retries once before asking you to reauthenticate.
+
+If Copilot token refresh still fails with `401` or `403`, the saved GitHub token may be expired, revoked, or missing Copilot access. Delete the saved token and start the tool again to trigger GitHub device login:
+
+```bash
+rm ~/.local/share/copilot-api/github_token
+codex-copilot-dx
+```
+
 ### Claude App opt-in
 
 Claude App support is opt-in so the default Codex Desktop and Claude Code setup stays unchanged:
@@ -83,6 +92,10 @@ Environment variables:
 | `CCDX_CONFIGURE_CLAUDE_DESKTOP` | unset | Set to `1` to write the Claude App 3P gateway profile during startup |
 | `CCDX_CLAUDE_DESKTOP_API_KEY` | generated for opt-in setup | Bearer key written into the Claude App profile and recognized by the adapter for model discovery |
 | `CCDX_CLAUDE_MODEL_ALIASES` | built-in Claude aliases | Comma-separated Desktop-to-upstream aliases, for example `claude-sonnet-4-6=claude-sonnet-4.6` |
+| `CCDX_GITHUB_TOKEN` | unset | Explicit GitHub Copilot OAuth token to validate and import before device login |
+| `CCDX_GITHUB_TOKEN_PATH` | unset | Explicit file containing a GitHub Copilot OAuth token to validate and import before device login |
+| `CCDX_GITHUB_TOKEN_PATHS` | unset | Multiple token files separated by the platform path delimiter (`:` on macOS/Linux, `;` on Windows) |
+| `CCDX_DISABLE_TOKEN_DISCOVERY` | unset | Set to `1` to skip local token discovery and go straight to the saved token or device flow |
 | `CCDX_USAGE_PATH` | `~/.local/share/codex-copilot-dx/usage.jsonl` | Local JSONL token usage log |
 | `CCDX_DISABLE_USAGE` | unset | Set to `1` to disable usage logging |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-copilot-dx",
-  "version": "0.4.14",
+  "version": "0.4.16",
   "description": "Use Codex Desktop, Claude Code, and Claude App with GitHub Copilot",
   "type": "module",
   "bin": {

package/src/auth.mjs

@@ -6,11 +6,23 @@ import { status } from "./status.mjs";
 
 const CLIENT_ID = "Iv1.b507a08c87ecfe98"; // Public GitHub Copilot client ID.
 const SCOPE = "read:user";
+const GITHUB_API = "https://api.github.com";
+const COPILOT_TOKEN_URL = `${GITHUB_API}/copilot_internal/v2/token`;
+const DISABLE_TOKEN_DISCOVERY_VALUES = new Set(["1", "true", "yes"]);
+const MAX_AUTH_JSON_BYTES = 1024 * 1024;
 
 export function githubTokenPath(home = os.homedir()) {
   return path.join(home, ".local", "share", "copilot-api", "github_token");
 }
 
+export function githubReauthMessage(reason, home = os.homedir()) {
+  const tokenPath = githubTokenPath(home);
+  return `${reason}
+Delete the saved GitHub token, then run codex-copilot-dx again to log in:
+  rm '${tokenPath}'
+  codex-copilot-dx`;
+}
+
 // Map GitHub polling responses to a small local state machine.
 export function interpretPoll(data) {
   if (typeof data.access_token === "string" && data.access_token) return { state: "done", token: data.access_token };
@@ -23,6 +35,263 @@ export function interpretPoll(data) {
 
 function sleep(ms) { return new Promise((r) => setTimeout(r, ms)); }
 
+function expandHome(filePath, home = os.homedir()) {
+  if (!filePath) return "";
+  if (filePath === "~") return home;
+  if (filePath.startsWith("~/")) return path.join(home, filePath.slice(2));
+  return filePath;
+}
+
+function isTokenDiscoveryDisabled(env = process.env) {
+  return DISABLE_TOKEN_DISCOVERY_VALUES.has(String(env.CCDX_DISABLE_TOKEN_DISCOVERY || "").toLowerCase());
+}
+
+function splitPathList(value) {
+  return String(value || "")
+    .split(path.delimiter)
+    .map((item) => item.trim())
+    .filter(Boolean);
+}
+
+function localAuthRoots(home, env = process.env) {
+  const roots = [
+    path.join(home, "Library", "Application Support"),
+    env.APPDATA ? expandHome(env.APPDATA, home) : "",
+    env.XDG_CONFIG_HOME ? expandHome(env.XDG_CONFIG_HOME, home) : path.join(home, ".config"),
+  ].filter(Boolean);
+  return [...new Set(roots)];
+}
+
+function addAuthJsonSource(sources, seen, filePath) {
+  if (seen.has(filePath)) return;
+  if (!fs.existsSync(filePath)) return;
+  seen.add(filePath);
+  sources.push({ type: "auth-json", path: filePath });
+}
+
+function localAuthJsonSources(home, env = process.env) {
+  const sources = [];
+  const seen = new Set();
+
+  for (const root of localAuthRoots(home, env)) {
+    let appDirs;
+    try {
+      appDirs = fs.readdirSync(root, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+
+    for (const appDirent of appDirs) {
+      if (!appDirent.isDirectory()) continue;
+      const appDir = path.join(root, appDirent.name);
+      addAuthJsonSource(sources, seen, path.join(appDir, "auth.json"));
+
+      const profilesDir = path.join(appDir, "profiles");
+      let profileDirs;
+      try {
+        profileDirs = fs.readdirSync(profilesDir, { withFileTypes: true });
+      } catch {
+        continue;
+      }
+
+      for (const profileDirent of profileDirs) {
+        if (!profileDirent.isDirectory()) continue;
+        addAuthJsonSource(sources, seen, path.join(profilesDir, profileDirent.name, "auth.json"));
+      }
+    }
+  }
+
+  return sources;
+}
+
+function explicitTokenFileSources(home, env = process.env) {
+  const paths = [];
+  if (typeof env.CCDX_GITHUB_TOKEN_PATH === "string" && env.CCDX_GITHUB_TOKEN_PATH.trim()) {
+    paths.push(env.CCDX_GITHUB_TOKEN_PATH.trim());
+  }
+  paths.push(...splitPathList(env.CCDX_GITHUB_TOKEN_PATHS));
+
+  const seen = new Set();
+  return paths
+    .map((filePath) => expandHome(filePath, home))
+    .filter((filePath) => {
+      if (seen.has(filePath)) return false;
+      seen.add(filePath);
+      return true;
+    })
+    .map((filePath) => ({
+      type: "token-file",
+      name: "configured token file",
+      path: filePath,
+    }));
+}
+
+function looksLikeCopilotAuthJson(json) {
+  if (!json || typeof json !== "object") return false;
+  if (json.ghcAuth || json.gitHubTokens || json.githubToken || json.githubCopilot || json.copilot) return true;
+  return typeof json.access_token === "string" && Boolean(json.copilotAccess || json.copilotToken || json.copilot_token);
+}
+
+function readSmallJson(filePath) {
+  const stat = fs.statSync(filePath);
+  if (!stat.isFile() || stat.size > MAX_AUTH_JSON_BYTES) return null;
+  return JSON.parse(fs.readFileSync(filePath, "utf8"));
+}
+
+export function githubTokenSources({
+  home = os.homedir(),
+  env = process.env,
+} = {}) {
+  if (isTokenDiscoveryDisabled(env)) return [];
+  const sources = [];
+  if (typeof env.CCDX_GITHUB_TOKEN === "string" && env.CCDX_GITHUB_TOKEN.trim()) {
+    sources.push({ type: "env", name: "CCDX_GITHUB_TOKEN", token: env.CCDX_GITHUB_TOKEN.trim() });
+  }
+  sources.push(...explicitTokenFileSources(home, env));
+  sources.push(...localAuthJsonSources(home, env));
+  return sources;
+}
+
+export function sourceDescription(source) {
+  if (!source) return "unknown source";
+  if (source.type === "env") return source.name;
+  if (source.type === "token-file") return `${source.name} (${source.path})`;
+  if (source.type === "auth-json") return `local auth file (${source.path})`;
+  return source.path || source.name || "unknown source";
+}
+
+export function extractGithubTokenFromAuthJson(json) {
+  const candidates = [
+    json?.ghcAuth?.gitHubTokens?.access_token,
+    json?.ghcAuth?.gitHubTokens?.accessToken,
+    json?.ghcAuth?.githubToken,
+    json?.gitHubTokens?.access_token,
+    json?.gitHubTokens?.accessToken,
+    json?.githubToken,
+    json?.access_token,
+    json?.accessToken,
+  ];
+  return candidates.find((value) => typeof value === "string" && value.trim())?.trim() || "";
+}
+
+export function readGithubTokenSource(source) {
+  if (source?.type === "env") return source.token || "";
+  if (source?.type === "token-file") return fs.readFileSync(source.path, "utf8").trim();
+  if (source?.type === "auth-json") {
+    const json = readSmallJson(source.path);
+    if (!looksLikeCopilotAuthJson(json)) return "";
+    return extractGithubTokenFromAuthJson(json);
+  }
+  return "";
+}
+
+export async function validateGithubToken(token, {
+  fetchImpl = fetch,
+  signal,
+} = {}) {
+  if (typeof token !== "string" || !token.trim()) {
+    return { ok: false, reason: "empty_token" };
+  }
+
+  const headers = { Authorization: `token ${token.trim()}`, Accept: "application/json" };
+  let userResp;
+  try {
+    userResp = await fetchImpl(`${GITHUB_API}/user`, { headers, signal });
+  } catch (e) {
+    return { ok: false, transient: true, reason: "github_user_request_failed", error: e };
+  }
+
+  if (!userResp.ok) {
+    return {
+      ok: false,
+      status: userResp.status,
+      reason: userResp.status === 401 || userResp.status === 403 ? "github_token_invalid" : "github_user_failed",
+    };
+  }
+
+  let userData = {};
+  try {
+    userData = await userResp.json();
+  } catch {}
+  const login = typeof userData.login === "string" ? userData.login : "";
+
+  let copilotResp;
+  try {
+    copilotResp = await fetchImpl(COPILOT_TOKEN_URL, { headers, signal });
+  } catch (e) {
+    return { ok: false, transient: true, reason: "copilot_token_request_failed", login, error: e };
+  }
+
+  if (!copilotResp.ok) {
+    return {
+      ok: false,
+      status: copilotResp.status,
+      reason: copilotResp.status === 401 || copilotResp.status === 403 ? "copilot_access_denied" : "copilot_token_failed",
+      login,
+    };
+  }
+
+  let copilotTokenData = {};
+  try {
+    copilotTokenData = await copilotResp.json();
+  } catch (e) {
+    return { ok: false, reason: "copilot_token_parse_failed", login, error: e };
+  }
+
+  if (!copilotTokenData.token) {
+    return { ok: false, reason: "copilot_token_missing", login };
+  }
+
+  return { ok: true, login, copilotTokenData };
+}
+
+export async function discoverGithubToken({
+  home = os.homedir(),
+  env = process.env,
+  fetchImpl = fetch,
+  signal,
+  excludeTokens = [],
+} = {}) {
+  const excluded = new Set(excludeTokens);
+  const seen = new Set(excluded);
+  const failures = [];
+
+  for (const source of githubTokenSources({ home, env })) {
+    let token = "";
+    try {
+      token = readGithubTokenSource(source).trim();
+    } catch (e) {
+      failures.push({ source, reason: "read_failed", error: e });
+      continue;
+    }
+
+    if (!token || seen.has(token)) continue;
+    seen.add(token);
+
+    const validation = await validateGithubToken(token, { fetchImpl, signal });
+    if (validation.ok) return { ok: true, token, source, validation };
+    failures.push({ source, validation });
+  }
+
+  return { ok: false, failures };
+}
+
+export async function importDiscoveredGithubToken({
+  home = os.homedir(),
+  env = process.env,
+  fetchImpl = fetch,
+  signal,
+  excludeTokens = [],
+  log = console.log,
+} = {}) {
+  const discovered = await discoverGithubToken({ home, env, fetchImpl, signal, excludeTokens });
+  if (!discovered.ok) return null;
+  writeToken(discovered.token, home);
+  const login = discovered.validation.login ? ` for ${discovered.validation.login}` : "";
+  log(status("ok", `Imported GitHub token from ${sourceDescription(discovered.source)}${login}`));
+  return discovered;
+}
+
 // On macOS, copy the user code and open the verification page. Fail quietly.
 function openAndCopy(userCode, verificationUri) {
   if (process.platform !== "darwin") return;
@@ -42,32 +311,48 @@ function openAndCopy(userCode, verificationUri) {
   } catch {}
 }
 
-export async function ensureAuth() {
-  const GITHUB_TOKEN_PATH = githubTokenPath();
+export async function ensureAuth({
+  home = os.homedir(),
+  env = process.env,
+  fetchImpl = fetch,
+  signal,
+  log = console.log,
+  openAndCopyFn = openAndCopy,
+} = {}) {
+  const GITHUB_TOKEN_PATH = githubTokenPath(home);
   if (fs.existsSync(GITHUB_TOKEN_PATH)) {
-    console.log(status("ok", "GitHub token found"));
-    return;
+    const existing = fs.readFileSync(GITHUB_TOKEN_PATH, "utf8").trim();
+    if (existing) {
+      log(status("ok", "GitHub token found"));
+      return;
+    }
+    log(status("warn", "GitHub token file is empty"));
   }
-  console.log(status("wait", "No GitHub token found. Starting device login..."));
+
+  const imported = await importDiscoveredGithubToken({ home, env, fetchImpl, signal, log });
+  if (imported) return;
+
+  log(status("wait", "No usable GitHub token found. Starting device login..."));
 
   // Request a device code.
-  const codeResp = await fetch("https://github.com/login/device/code", {
+  const codeResp = await fetchImpl("https://github.com/login/device/code", {
     method: "POST",
     headers: { "Content-Type": "application/json", Accept: "application/json" },
     body: JSON.stringify({ client_id: CLIENT_ID, scope: SCOPE }),
+    signal,
   });
   if (!codeResp.ok) throw new Error(`device code request failed: ${codeResp.status}`);
   const { device_code, user_code, verification_uri, interval } = await codeResp.json();
 
   // Prompt the user.
-  console.log(`\n${status("info", `Open ${verification_uri}`)}\n${status("info", `Enter code: ${user_code}`)}\n`);
-  openAndCopy(user_code, verification_uri);
+  log(`\n${status("info", `Open ${verification_uri}`)}\n${status("info", `Enter code: ${user_code}`)}\n`);
+  openAndCopyFn(user_code, verification_uri);
 
   // Poll until GitHub completes the device flow.
   let waitMs = (interval || 5) * 1000;
   while (true) {
     await sleep(waitMs);
-    const pollResp = await fetch("https://github.com/login/oauth/access_token", {
+    const pollResp = await fetchImpl("https://github.com/login/oauth/access_token", {
       method: "POST",
       headers: { "Content-Type": "application/json", Accept: "application/json" },
       body: JSON.stringify({
@@ -75,6 +360,7 @@ export async function ensureAuth() {
         device_code,
         grant_type: "urn:ietf:params:oauth:grant-type:device_code",
       }),
+      signal,
     });
     if (!pollResp.ok) {
       // Treat transient network/server errors as pending and retry.
@@ -83,8 +369,8 @@ export async function ensureAuth() {
     const data = await pollResp.json();
     const r = interpretPoll(data);
     if (r.state === "done") {
-      writeToken(r.token);
-      console.log(status("ok", "Login successful"));
+      writeToken(r.token, home);
+      log(status("ok", "Login successful"));
       return;
     }
     if (r.state === "slow") { waitMs += 5000; continue; }
@@ -93,8 +379,9 @@ export async function ensureAuth() {
   }
 }
 
-function writeToken(token) {
-  const GITHUB_TOKEN_PATH = githubTokenPath();
+export function writeToken(token, home = os.homedir()) {
+  const GITHUB_TOKEN_PATH = githubTokenPath(home);
   fs.mkdirSync(path.dirname(GITHUB_TOKEN_PATH), { recursive: true });
   fs.writeFileSync(GITHUB_TOKEN_PATH, token, { mode: 0o600 });
+  fs.chmodSync(GITHUB_TOKEN_PATH, 0o600);
 }

package/src/copilot.mjs

@@ -1,10 +1,9 @@
 import fs from "node:fs";
-import path from "node:path";
 import os from "node:os";
 import { randomUUID } from "node:crypto";
 import { status } from "./status.mjs";
+import { githubReauthMessage, githubTokenPath, importDiscoveredGithubToken } from "./auth.mjs";
 
-const GITHUB_TOKEN_PATH = path.join(os.homedir(), ".local", "share", "copilot-api", "github_token");
 export const DEFAULT_API_BASE = "https://api.githubcopilot.com";
 let apiBase = DEFAULT_API_BASE;
 const IMG_MAX_DIM = parseInt(process.env.CCDX_IMG_MAX_DIM || "2048", 10);
@@ -248,22 +247,24 @@ export async function refreshVSCodeVersion() {
 let copilotToken = null;
 let copilotTokenExpiry = 0;
 
-function getGithubToken() {
+function getGithubToken({ home = os.homedir() } = {}) {
+  const GITHUB_TOKEN_PATH = githubTokenPath(home);
   if (!fs.existsSync(GITHUB_TOKEN_PATH)) {
-    throw new Error("GitHub token not found. Run the tool once to log in.");
+    throw new Error("GitHub token not found. Run codex-copilot-dx again to log in.");
   }
-  return fs.readFileSync(GITHUB_TOKEN_PATH, "utf-8").trim();
+  const token = fs.readFileSync(GITHUB_TOKEN_PATH, "utf-8").trim();
+  if (!token) throw new Error(githubReauthMessage("GitHub token file is empty."));
+  return token;
 }
 
-export async function getCopilotToken({ signal } = {}) {
-  if (copilotToken && Date.now() < copilotTokenExpiry - 60000) return copilotToken;
-  const ghToken = getGithubToken();
-  const resp = await fetch(`${GITHUB_API}/copilot_internal/v2/token`, {
+function requestCopilotToken(ghToken, { fetchImpl = fetch, signal } = {}) {
+  return fetchImpl(`${GITHUB_API}/copilot_internal/v2/token`, {
     headers: { Authorization: `token ${ghToken}`, Accept: "application/json" },
     signal,
   });
-  if (!resp.ok) throw new Error(`Failed to get Copilot token: ${resp.status}`);
-  const data = await resp.json();
+}
+
+function cacheCopilotTokenData(data) {
   if (!data.token) throw new Error("Copilot token response missing token field");
   copilotToken = data.token;
   apiBase = parseApiBase(data);
@@ -274,6 +275,35 @@ export async function getCopilotToken({ signal } = {}) {
   return copilotToken;
 }
 
+export async function getCopilotToken({
+  signal,
+  home = os.homedir(),
+  env = process.env,
+  fetchImpl = fetch,
+} = {}) {
+  if (copilotToken && Date.now() < copilotTokenExpiry - 60000) return copilotToken;
+  const ghToken = getGithubToken({ home });
+  const resp = await requestCopilotToken(ghToken, { fetchImpl, signal });
+  if (!resp.ok) {
+    if (resp.status === 401 || resp.status === 403) {
+      const imported = await importDiscoveredGithubToken({
+        home,
+        env,
+        fetchImpl,
+        signal,
+        excludeTokens: [ghToken],
+      });
+      if (imported?.validation?.copilotTokenData?.token) {
+        return cacheCopilotTokenData(imported.validation.copilotTokenData);
+      }
+      throw new Error(githubReauthMessage(`Failed to get Copilot token: ${resp.status}. The saved GitHub token may be expired, revoked, or missing Copilot access.`));
+    }
+    throw new Error(`Failed to get Copilot token: ${resp.status}`);
+  }
+  const data = await resp.json();
+  return cacheCopilotTokenData(data);
+}
+
 // chatReq is already converted by the adapter. The caller parses the raw Response.
 export async function chatCompletions(chatReq, { signal } = {}) {
   const token = await getCopilotToken({ signal });