dsh-github-copilot 0.4.0-alpha.29 → 0.4.0-alpha.31

package/lib/index.js

@@ -962,7 +962,7 @@ let SearchRoutingController = (() => {
 //#endregion
 //#region package.json
 var name$1 = "dsh-github-copilot";
-var version = "0.4.0-alpha.29";
+var version = "0.4.0-alpha.31";
 //#endregion
 //#region lib/types/probe.js
 /**
@@ -4603,15 +4603,24 @@ function createAccountProvider(descriptors, guard, baseURL) {
 			}));
 			headers.authorization = `Bearer ${options.apiKey}`;
 			headers["x-api-key"] = null;
+			let unauthorized = false;
+			const fetch = options.fetch ?? globalThis.fetch;
+			const observeResponse = async (input, init) => {
+				const response = await fetch(input, init);
+				if (response.status === 401) unauthorized = true;
+				return response;
+			};
 			const wireOptions = model.api === "anthropic-messages" ? {
 				...options,
 				signal: lease.signal,
 				apiKey: void 0,
-				headers
+				headers,
+				fetch: observeResponse
 			} : {
 				...options,
 				signal: lease.signal,
-				headers
+				headers,
+				fetch: observeResponse
 			};
 			if (!hasApi(model, "openai-responses") && !hasApi(model, "openai-completions") && !hasApi(model, "anthropic-messages")) {
 				lease.release();
@@ -4622,6 +4631,9 @@ function createAccountProvider(descriptors, guard, baseURL) {
 					yield* native.streamSimple(model, context, wireOptions);
 				} finally {
 					lease.release();
+					if (unauthorized && !guard.signal.aborted && !options.signal?.aborted) try {
+						guard.onUnauthorized?.();
+					} catch {}
 				}
 			})();
 		})
@@ -4655,7 +4667,7 @@ function active(signal) {
 * Bind model discovery to the existing native OAuth lifecycle. No model catalog,
 * login, environment fallback or separate credential record is introduced here.
 */
-function createAccountModelAuth(credentials) {
+function createAccountModelAuth(credentials, renewRejectedCredential) {
 	const native = githubCopilotProvider();
 	const oauth = native.auth.oauth;
 	if (oauth === void 0) throw new Error("COPILOT_ACCOUNT_OAUTH_UNAVAILABLE");
@@ -4686,7 +4698,13 @@ function createAccountModelAuth(credentials) {
 	return {
 		async resolveAuth(signal) {
 			try {
-				const key = copilotAccountKey(await readGrant(signal));
+				const before = await readGrant(signal);
+				const key = copilotAccountKey(before);
+				const rejectedAccess = renewRejectedCredential?.(before) === true ? before.access : void 0;
+				const forResolution = (grant) => rejectedAccess !== void 0 && grant.access === rejectedAccess ? {
+					...grant,
+					expires: 0
+				} : grant;
 				const guardedOAuth = {
 					...oauth,
 					login: async () => {
@@ -4717,15 +4735,16 @@ function createAccountModelAuth(credentials) {
 						const value = await credentials.read(provider);
 						active(signal);
 						if (value?.type !== "oauth") throw new Error("COPILOT_ACCOUNT_OAUTH_REQUIRED");
-						matches(normalizeGitHubCopilotOAuthCredential(value), key);
-						return value;
+						const grant = normalizeGitHubCopilotOAuthCredential(value);
+						matches(grant, key);
+						return forResolution(grant);
 					},
 					list: () => credentials.list(),
 					modify: (provider, mutate) => credentials.modify(provider, async (value) => {
 						active(signal);
 						if (value?.type !== "oauth") throw new Error("COPILOT_ACCOUNT_OAUTH_REQUIRED");
 						matches(normalizeGitHubCopilotOAuthCredential(value), key);
-						const next = await mutate(value);
+						const next = await mutate(forResolution(normalizeGitHubCopilotOAuthCredential(value)));
 						active(signal);
 						if (next !== void 0) matches(normalizeGitHubCopilotOAuthCredential(next), key);
 						return next;
@@ -4746,6 +4765,7 @@ function createAccountModelAuth(credentials) {
 				if (resolved?.auth.apiKey === void 0) throw new Error("COPILOT_ACCOUNT_OAUTH_REQUIRED");
 				const grant = await readGrant(signal);
 				matches(grant, key);
+				if (rejectedAccess !== void 0 && grant.access === rejectedAccess) throw new Error("COPILOT_ACCOUNT_TOKEN_REJECTED");
 				const auth = {
 					apiKey: resolved.auth.apiKey,
 					baseURL: trustedGitHubCopilotBaseUrl(resolved.auth.baseUrl, grant),
@@ -5890,7 +5910,21 @@ function apply$1(ctx, config = {}) {
 	const budgetSettings = requestBudgetSettings ?? (() => requestBudget ?? {});
 	resolveRequestBudgetPolicy(budgetSettings());
 	const store = createGitHubCopilotCredentialStore(ctx, GITHUB_COPILOT_PREVIEW_PROVIDER_ID);
-	const nativeAuth = createAccountModelAuth(createGitHubCopilotCredentialStore(ctx));
+	let rejectedAuth;
+	let authRecovery;
+	const nativeAuth = createAccountModelAuth(createGitHubCopilotCredentialStore(ctx), (grant) => {
+		const accountKey = copilotAccountKey(grant);
+		if (rejectedAuth?.accountKey !== accountKey || rejectedAuth.tokenFingerprint !== tokenFingerprint(grant.access)) return false;
+		const now = Date.now();
+		const cooldown = Math.max(1e3, cacheSettings().accountModelFailureCooldownMs ?? 3e5);
+		const age = authRecovery === void 0 ? void 0 : now - authRecovery.at;
+		if (!Number.isFinite(now) || authRecovery?.accountKey === accountKey && (age === void 0 || !Number.isFinite(age) || age < cooldown)) throw failure("COPILOT_PREVIEW_AUTH_RECOVERY_COOLDOWN");
+		authRecovery = {
+			accountKey,
+			at: now
+		};
+		return true;
+	});
 	const nativeModels = getBuiltinModels("github-copilot");
 	const nativeApis = new Map(nativeModels.map((model) => [model.id, model.api]));
 	let lastValidatedProof;
@@ -6086,7 +6120,15 @@ function apply$1(ctx, config = {}) {
 	const optionsFor = (lease, inspectRequest) => {
 		const guard = {
 			...lifetime.guard(lease),
-			...inspectRequest === void 0 ? {} : { inspectRequest }
+			...inspectRequest === void 0 ? {} : { inspectRequest },
+			onUnauthorized() {
+				if (lease === void 0 || !lifetime.isCurrent(lease.revision) || source.readDisplaySnapshot() !== lease.snapshot || provenSnapshot !== lease.snapshot || snapshotProof !== lease.proof) return;
+				rejectedAuth = lease.proof;
+				lifetime.change();
+				provenSnapshot = void 0;
+				snapshotProof = void 0;
+				lastValidatedProof = void 0;
+			}
 		};
 		const { provider } = createAccountProvider(lease?.snapshot.models ?? [], guard, lease?.proof.baseURL ?? "https://api.individual.githubcopilot.com");
 		const profile = Object.freeze({

package/lib/types/account-model-auth.d.ts

@@ -11,5 +11,5 @@ export declare function copilotEntitlementKey(grant: Pick<GitHubCopilotOAuthCred
  * Bind model discovery to the existing native OAuth lifecycle. No model catalog,
  * login, environment fallback or separate credential record is introduced here.
  */
-export declare function createAccountModelAuth(credentials: CredentialStore): Pick<AccountModelSourceDependencies, 'resolveAuth' | 'assertAuthCurrent'>;
+export declare function createAccountModelAuth(credentials: CredentialStore, renewRejectedCredential?: (grant: GitHubCopilotOAuthCredential) => boolean): Pick<AccountModelSourceDependencies, 'resolveAuth' | 'assertAuthCurrent'>;
 //# sourceMappingURL=account-model-auth.d.ts.map

package/lib/types/preview-provider.d.ts

@@ -11,6 +11,8 @@ export interface PreviewProviderGuard {
         signal: AbortSignal;
         release(): void;
     }>;
+    /** Actual model HTTP 401 only; called after release, without replaying the request. */
+    onUnauthorized?(): void;
 }
 /** Guard for one selected model in an account-bound descriptor snapshot. */
 export interface AccountProviderGuard extends PreviewProviderGuard {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-github-copilot",
   "description": "DSH companion for GitHub Copilot sign-in, account-aware model profiles, tool compatibility, and provider-hosted search.",
-  "version": "0.4.0-alpha.29",
+  "version": "0.4.0-alpha.31",
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/",