github-router 0.3.271 → 0.3.274

package/dist/{token-iaSGp76k.js → token-Bz6HoH2H.js}

@@ -1,12 +1,13 @@
 import { t as PATHS } from "./paths-Bg1_DWhi.js";
 import consola from "consola";
 import path from "node:path";
-import { randomBytes, randomUUID } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import fs from "node:fs/promises";
 import process$1 from "node:process";
 //#region src/lib/state.ts
 const state = {
 	accountType: "enterprise",
+	copilotTokenGeneration: 0,
 	manualApprove: false,
 	rateLimitWait: false,
 	showToken: false,
@@ -125,8 +126,60 @@ const TRANSIENT_CODES = /* @__PURE__ */ new Set([
 	"EAI_AGAIN",
 	"UND_ERR_CONNECT_TIMEOUT",
 	"UND_ERR_HEADERS_TIMEOUT",
-	"UND_ERR_SOCKET"
+	"UND_ERR_SOCKET",
+	"UND_ERR_CLOSED",
+	"ERR_HTTP2_INVALID_SESSION",
+	"ERR_HTTP2_GOAWAY_SESSION",
+	"ERR_HTTP2_STREAM_CANCEL"
 ]);
+/**
+* TLS faults that are genuinely permanent: a protocol/version/cipher mismatch,
+* or a certificate this client cannot validate. Retrying any of these buys
+* three times the latency before the identical failure.
+*
+* Deliberately NOT the blanket `"ssl routines"` match this replaces. Every
+* OpenSSL error carries that string, so the catch-all also swallowed alert 20
+* (`bad record mac`) — an integrity fault a fresh connection routinely clears.
+* See TRANSIENT_TLS_MESSAGES.
+*
+* Each entry must stay disjoint from TRANSIENT_TLS_MESSAGES. The bucket order
+* in `classifyTransportError` checks the narrower transient alert first, so an
+* overlap would resolve as transient; `tests/upstream-retry.test.ts` pins that
+* no error matches two buckets.
+*/
+const DETERMINISTIC_TLS_MESSAGES = [
+	"self signed certificate",
+	"certificate has expired",
+	"unable to verify the first certificate",
+	"unable to get local issuer certificate",
+	"hostname/ip does not match certificate",
+	"certificate verify failed",
+	"unknown ca",
+	"wrong version number",
+	"unsupported protocol",
+	"no protocols available",
+	"alert handshake failure",
+	"alert protocol version",
+	"alert insufficient security",
+	"tls handshake"
+];
+/**
+* TLS alert 20 (`bad_record_mac`) ONLY — a record failed AEAD authentication
+* somewhere on the path. The connection is unusable, but the next one is
+* typically fine, which is exactly what a bounded retry is for.
+*
+* This also matches OpenSSL's local-detection wording ("decryption failed or
+* bad record mac", reason 281) as well as the received-alert wording ("ssl/tls
+* alert bad record mac", reason 1020). Both are integrity faults and both
+* warrant the same one-bounded-replay policy.
+*
+* An earlier revision promoted four alert phrases; three were wrong and stay
+* deterministic on purpose. Alert 10 (`unexpected message`) is protocol state,
+* alert 21 (`decryption failed`) is legacy-server incompatibility, and alert 22
+* (`record overflow`) is a malformed or desynchronised stream. Promoting those
+* converts fail-fast configuration errors into 3x latency.
+*/
+const TRANSIENT_TLS_MESSAGES = ["bad record mac"];
 const DETERMINISTIC_CODES = /* @__PURE__ */ new Set([
 	"ENOTFOUND",
 	"ECONNREFUSED",
@@ -201,6 +254,15 @@ function sanitizeTransportText(value) {
 * Classify errors thrown before the first response byte. Deterministic
 * connectivity/configuration signals win over generic runtime wording such as
 * TypeError("fetch failed"), because the nested cause is more specific.
+*
+* Buckets are evaluated in a stated total order, narrowest first, and the first
+* match wins — so no error can land in two of them:
+*
+*   1. caller cancel
+*   2. TLS alert 20 (`bad record mac`) — integrity, retryable
+*   3. deterministic cert/config codes and messages, plus refused/DNS-miss
+*   4. transient codes (incl. HTTP/2 session death) and generic transport text
+*   5. everything else — `non_transport`, rethrown raw
 */
 function classifyTransportError(error, opts = {}) {
 	const name = readStringProperty(error, "name") ?? "Error";
@@ -228,7 +290,14 @@ function classifyTransportError(error, opts = {}) {
 		code,
 		causeCode
 	};
-	if (codes.some((value) => DETERMINISTIC_CODES.has(value)) || messages.includes("self signed certificate") || messages.includes("certificate has expired") || messages.includes("unable to verify the first certificate") || messages.includes("unable to get local issuer certificate") || messages.includes("hostname/ip does not match certificate") || messages.includes("tls handshake") || messages.includes("ssl routines") || messages.includes("econnrefused") || messages.includes("enotfound")) return {
+	if (TRANSIENT_TLS_MESSAGES.some((phrase) => messages.includes(phrase))) return {
+		classification: "transient",
+		name,
+		message,
+		code,
+		causeCode
+	};
+	if (codes.some((value) => DETERMINISTIC_CODES.has(value)) || DETERMINISTIC_TLS_MESSAGES.some((phrase) => messages.includes(phrase)) || messages.includes("ssl routines") || messages.includes("econnrefused") || messages.includes("enotfound")) return {
 		classification: "deterministic",
 		name,
 		message,
@@ -410,10 +479,10 @@ async function forwardError(c, error) {
 		if (error.classification === "transient") return c.json({
 			type: "error",
 			error: {
-				type: "overloaded_error",
-				message: `Upstream transport was interrupted at ${target} after ${error.attempts} attempts; retry later. ${diagnostic}`
+				type: "api_error",
+				message: `Upstream transport was interrupted at ${target} after ${error.attempts} attempts. ${diagnostic}`
 			}
-		}, 503);
+		}, 502);
 		return c.json({
 			type: "error",
 			error: {
@@ -563,9 +632,113 @@ function isAllowedCopilotHost(rawUrl) {
 	if (parsed.protocol !== "https:") return false;
 	return COPILOT_HOST_ALLOWLIST.includes(parsed.hostname);
 }
-const getCopilotToken = async () => {
-	const response = await fetchWithTransientRetry(() => fetch(`${GITHUB_API_BASE_URL}/copilot_internal/v2/token`, { headers: githubHeaders(state) }), { label: "/copilot_internal/v2/token" });
-	if (!response.ok) throw new HTTPError("Failed to get Copilot token", response);
+/**
+* Short, non-reversible identifier for a credential, safe to log.
+*
+* During the 2026-08-08 incident the logs could not answer the one question
+* that mattered: was the process holding a stale credential, or was the
+* credential on disk itself dead? The operator re-authenticated at 13:53 and
+* the proxy kept failing, and nothing recorded whether those were the same
+* secret. A truncated SHA-256 makes two credentials comparable across log
+* lines without ever printing one. 8 hex chars is ample to distinguish the
+* handful of credentials a machine sees, and far too short to attack.
+*/
+function credentialFingerprint(token) {
+	if (!token) return "none";
+	return createHash("sha256").update(token).digest("hex").slice(0, 8);
+}
+/**
+* A failed `/copilot_internal/v2/token` exchange, carrying enough to diagnose
+* it after the fact.
+*
+* The predecessor threw `HTTPError("Failed to get Copilot token", response)`
+* and every catch logged only `.message`, so status and body were dropped —
+* which is why the incident is unattributable.
+*/
+var CopilotTokenExchangeError = class extends HTTPError {
+	kind;
+	status;
+	/** Fingerprint of the credential that was rejected, never the credential. */
+	credential;
+	constructor(opts) {
+		super(`Failed to get Copilot token: HTTP ${opts.status} (${opts.kind}, credential ${opts.credential})${opts.detail ? ` — ${opts.detail}` : ""}`, opts.response);
+		this.kind = opts.kind;
+		this.status = opts.status;
+		this.credential = opts.credential;
+	}
+};
+/** Upper bound on how much of an error body we quote into a log line. */
+const ERROR_BODY_SNIPPET_CHARS = 300;
+/**
+* `notification_id` values that mean "the credential is valid but the
+* entitlement is not". These need a different remedy than a bad credential:
+* telling someone whose subscription lapsed to re-authenticate sends them
+* around a loop that cannot help.
+*/
+const ENTITLEMENT_NOTIFICATIONS = /* @__PURE__ */ new Set([
+	"access_revoked",
+	"subscription_ended",
+	"no_copilot_access"
+]);
+/**
+* Classify a non-OK exchange response.
+*
+* Deliberately asymmetric: only a 401, or a 403 that NAMES an entitlement
+* problem, is treated as terminal. A bare 403 stays transient because GitHub
+* returns 403 for primary rate limits (`x-ratelimit-remaining: 0`) and
+* secondary abuse limits — telling a user with a perfectly good credential to
+* re-authenticate because they were briefly rate-limited would be a worse
+* failure than the one being fixed. The costs are not symmetric: calling a
+* terminal failure transient wastes some retries, while calling a transient
+* failure terminal kills a working session.
+*/
+function classifyExchangeFailure(status, body) {
+	if (status === 401) return "credential_rejected";
+	if (status === 403) {
+		let notificationId;
+		try {
+			const parsed = JSON.parse(body);
+			notificationId = parsed.notification_id ?? parsed.error?.notification_id;
+		} catch {}
+		if (typeof notificationId === "string" && ENTITLEMENT_NOTIFICATIONS.has(notificationId)) return "entitlement_lapsed";
+	}
+	return "transient";
+}
+/**
+* Exchange the GitHub credential for a short-lived Copilot token.
+*
+* `credentialOverride` lets a caller try a candidate credential WITHOUT
+* publishing it to the process-global `state` first. That matters because
+* `state` is shared by every concurrent request: installing an unvalidated
+* credential globally, even briefly, would make unrelated in-flight requests
+* send it and 401 while a perfectly good credential was still in hand.
+*/
+const getCopilotToken = async (credentialOverride) => {
+	const credential = credentialFingerprint(credentialOverride ?? state.githubToken);
+	const authState = credentialOverride === void 0 ? state : {
+		...state,
+		githubToken: credentialOverride
+	};
+	const response = await fetchWithTransientRetry(() => fetch(`${GITHUB_API_BASE_URL}/copilot_internal/v2/token`, { headers: githubHeaders(authState) }), { label: "/copilot_internal/v2/token" });
+	if (!response.ok) {
+		let body;
+		try {
+			body = await response.text();
+		} catch {
+			body = "(could not read error body)";
+		}
+		throw new CopilotTokenExchangeError({
+			kind: classifyExchangeFailure(response.status, body),
+			status: response.status,
+			credential,
+			detail: body.slice(0, ERROR_BODY_SNIPPET_CHARS).replaceAll(/\s+/g, " ").trim(),
+			response: new Response(body, {
+				status: response.status,
+				statusText: response.statusText,
+				headers: response.headers
+			})
+		});
+	}
 	const data = await response.json();
 	if (data.endpoints?.api) if (isAllowedCopilotHost(data.endpoints.api)) state.copilotApiUrl = data.endpoints.api;
 	else consola.warn(`Refusing to honor Copilot API endpoint "${data.endpoints.api}" from the token-exchange response — not in allowlist (${COPILOT_HOST_ALLOWLIST.join(", ")}). ` + (state.copilotApiUrl ? `Keeping existing override "${state.copilotApiUrl}".` : `Falling back to the default api.githubcopilot.com.`));
@@ -1096,6 +1269,43 @@ async function pollAccessToken(deviceCode, clientId = GITHUB_CLIENT_ID) {
 //#region src/lib/token.ts
 const readGithubToken = () => fs.readFile(PATHS.GITHUB_TOKEN_PATH, "utf8");
 /**
+* Transient filesystem errors from a read that raced the temp+rename write.
+*
+* On Windows a read landing in that window fails with one of these even
+* though a perfectly good file exists microseconds later. Treating one as
+* fatal at startup would cost a launch for no reason.
+*/
+const TRANSIENT_READ_CODES = /* @__PURE__ */ new Set([
+	"EPERM",
+	"EBUSY",
+	"EACCES",
+	"ENOENT"
+]);
+function isTransientReadError(err) {
+	const code = err?.code;
+	return typeof code === "string" && TRANSIENT_READ_CODES.has(code);
+}
+/**
+* Read the credential file, retrying briefly through a racing rename.
+*
+* Same delays and the same reasoning as {@link RENAME_RETRY_DELAYS_MS} on the
+* write side: the contending handle closes almost immediately, so a short
+* bounded retry converts a spurious launch failure into a non-event. A
+* persistent failure still propagates — the caller must not believe a
+* credential was read when it was not.
+*/
+async function readGithubTokenWithRetry() {
+	let lastErr;
+	for (let attempt = 0; attempt <= RENAME_RETRY_DELAYS_MS.length; attempt++) try {
+		return await readGithubToken();
+	} catch (err) {
+		lastErr = err;
+		if (!isTransientReadError(err)) throw err;
+		if (attempt < RENAME_RETRY_DELAYS_MS.length) await new Promise((resolve) => setTimeout(resolve, RENAME_RETRY_DELAYS_MS[attempt]));
+	}
+	throw lastErr;
+}
+/**
 * Backoff for a transient Windows rename failure. On Windows `fs.rename` over
 * an existing destination transiently fails with EPERM / EBUSY / EACCES when
 * anything else holds the target open for a moment (antivirus, the search
@@ -1158,10 +1368,60 @@ const writeGithubToken = (token) => writeTokenFileAtomic(PATHS.GITHUB_TOKEN_PATH
 const readGithubAgentToken = () => fs.readFile(PATHS.GITHUB_AGENT_TOKEN_PATH, "utf8");
 const writeGithubAgentToken = (token) => writeTokenFileAtomic(PATHS.GITHUB_AGENT_TOKEN_PATH, token);
 /**
+* Safety margin subtracted from the derived refresh deadline, so a request
+* arriving just before expiry refreshes rather than racing it.
+*/
+const REFRESH_SKEW_MS = 12e4;
+/**
+* Bounds on a `refresh_in` we are willing to turn into a timer delay. An
+* absurd or missing upstream value must not produce a zero-length timer (a
+* hot loop hammering GitHub) or an effectively infinite one (a token that is
+* never refreshed). 60s floor, 6h ceiling, 1500s default — the value GitHub
+* actually returns today.
+*/
+const MIN_REFRESH_IN_S = 60;
+const MAX_REFRESH_IN_S = 21600;
+const DEFAULT_REFRESH_IN_S = 1500;
+/** Backoff schedule after a failed refresh, then hold at the last value. */
+const REFRESH_BACKOFF_MS = [
+	5e3,
+	15e3,
+	6e4,
+	3e5
+];
+function clampRefreshIn(refreshIn) {
+	if (typeof refreshIn !== "number" || !Number.isFinite(refreshIn)) return DEFAULT_REFRESH_IN_S;
+	return Math.min(Math.max(refreshIn, MIN_REFRESH_IN_S), MAX_REFRESH_IN_S);
+}
+/**
+* Adopt an exchange result into `state`.
+*
+* The generation bump is what lets an in-flight request know a newer token
+* exists (see `State.copilotTokenGeneration`), so it happens on EVERY success
+* — including one that returns a byte-identical token, which upstream
+* demonstrably does.
+*/
+/**
+* Floor on how far ahead the derived refresh deadline may be placed.
+*
+* The deadline is `now + refresh_in - skew`, and the skew (120s) is larger
+* than the `refresh_in` floor (60s) — so a short upstream `refresh_in` would
+* put the deadline in the PAST, the scheduler would floor its delay to 1s,
+* and the proxy would hammer the token endpoint at 1 Hz forever. The deadline
+* must always be in the future, whatever upstream says.
+*/
+const MIN_REFRESH_LEAD_MS = 3e4;
+function commitCopilotToken(token, refreshIn) {
+	state.copilotToken = token;
+	state.copilotTokenGeneration += 1;
+	const lead = Math.max(clampRefreshIn(refreshIn) * 1e3 - REFRESH_SKEW_MS, MIN_REFRESH_LEAD_MS);
+	state.copilotTokenRefreshAt = Date.now() + lead;
+}
+/**
 * Fetch the Copilot token and keep it fresh in the background.
 *
 * Returns a disposer that stops the refresh loop. **Long-lived callers**
-* (`start`/`claude`/`codex`, via `setupAndServe`) can ignore it — the interval
+* (`start`/`claude`/`codex`, via `setupAndServe`) can ignore it — the timer
 * is `unref()`d, so it never holds the event loop open on its own. The one-shot
 * `models` command calls it, so ownership of the timer is explicit rather than
 * implied by a runtime flag. (`check-usage` does not call this function at all;
@@ -1170,95 +1430,222 @@ const writeGithubAgentToken = (token) => writeTokenFileAtomic(PATHS.GITHUB_AGENT
 * Both halves are load-bearing, for different failure modes. Without the
 * `unref()`, `github-router models` printed its full correct output and then
 * hung forever: its success path just returns (only the failure branches call
-* `process.exit`), and the un-unref'd interval pinned the event loop. Without
+* `process.exit`), and the un-unref'd timer pinned the event loop. Without
 * the disposer, that fix would depend on a property no caller can see, so the
 * next one-shot command would inherit the same trap.
+*
+* The schedule is a SELF-RE-ARMING `setTimeout`, not a fixed `setInterval`.
+* Three reasons: the delay tracks each response's own `refresh_in` instead of
+* the one captured at startup; a failure can back off (5s → 15s → 60s → 300s)
+* instead of waiting a full period during which the token is already dead;
+* and one timer cannot disagree with itself the way a period timer plus a
+* separate retry timer can.
 */
 const setupCopilotToken = async () => {
 	const { token, refresh_in } = await getCopilotToken();
-	state.copilotToken = token;
-	consola.debug("GitHub Copilot Token fetched successfully!");
+	commitCopilotToken(token, refresh_in);
+	consola.debug(`GitHub Copilot Token fetched successfully! (credential ${credentialFingerprint(state.githubToken)})`);
 	if (state.showToken) consola.info("Copilot token:", token);
-	const refreshInterval = Math.max((refresh_in - 60) * 1e3, 1e3);
-	const handle = setInterval(() => {
-		refreshCopilotToken("interval");
-	}, refreshInterval);
-	handle.unref?.();
-	let stopped = false;
+	let handle;
+	let disposed = false;
+	let failures = 0;
+	const arm = (delayMs) => {
+		if (disposed) return;
+		handle = setTimeout(() => {
+			tick();
+		}, delayMs);
+		handle.unref?.();
+	};
+	const tick = async () => {
+		const outcome = await refreshCopilotToken("interval");
+		if (disposed) return;
+		if (outcome === "refreshed") {
+			failures = 0;
+			arm(nextDelayFromState());
+			return;
+		}
+		const delay = REFRESH_BACKOFF_MS[Math.min(failures, REFRESH_BACKOFF_MS.length - 1)];
+		failures += 1;
+		arm(delay);
+	};
+	arm(nextDelayFromState());
 	return () => {
-		if (stopped) return;
-		stopped = true;
-		clearInterval(handle);
+		if (disposed) return;
+		disposed = true;
+		if (handle) clearTimeout(handle);
 	};
 };
+/**
+* Delay until the next scheduled refresh, from the deadline already stored on
+* `state`. Floored at 1s so a pathological deadline can never busy-loop.
+*/
+function nextDelayFromState() {
+	const deadline = state.copilotTokenRefreshAt;
+	if (deadline === void 0) return DEFAULT_REFRESH_IN_S * 1e3;
+	return Math.max(deadline - Date.now(), 1e3);
+}
 let inflightRefresh;
 let lastRefreshSuccess = 0;
 let lastRefreshFailure = 0;
 const REFRESH_SUCCESS_COOLDOWN_MS = 3e4;
 const REFRESH_FAILURE_COOLDOWN_MS = 5e3;
+/**
+* Read the credential from disk, returning it only if it is usable.
+*
+* Every failure mode here resolves to `undefined` (meaning "keep using what
+* is in memory") rather than throwing or returning a partial value. The file
+* is replaced by temp+rename (`writeTokenFileAtomic`), and on Windows a read
+* racing that rename fails with EPERM/EBUSY/EACCES/ENOENT. None of those mean
+* the in-memory credential went bad, so none of them may clear it — and a
+* filesystem error must never escape into the refresh loop and kill the timer.
+*/
+async function readGithubTokenIfUsable() {
+	if (state.githubTokenSource === "explicit") return void 0;
+	try {
+		const trimmed = (await readGithubToken()).trim();
+		return trimmed.length > 0 ? trimmed : void 0;
+	} catch (err) {
+		consola.debug("Could not re-read GitHub credential from disk:", err);
+		return;
+	}
+}
+/**
+* Perform one exchange, preferring a newer credential from disk if there is one.
+*
+* The disk token is a CANDIDATE: it is passed to the exchange directly and
+* published to `state.githubToken` only after that exchange succeeds. It is
+* never installed globally on spec — `state` is shared by every concurrent
+* request, so an unvalidated credential visible there would be sent by
+* unrelated in-flight requests and 401 them while a working credential was
+* still in hand.
+*/
+async function exchangeWithFreshestCredential() {
+	const onDisk = await readGithubTokenIfUsable();
+	const inMemory = state.githubToken;
+	if (onDisk && onDisk !== inMemory) {
+		consola.info(`GitHub credential on disk differs from the one in memory (${credentialFingerprint(inMemory)} → ${credentialFingerprint(onDisk)}); trying it.`);
+		const result = await getCopilotToken(onDisk);
+		state.githubToken = onDisk;
+		state.githubTokenSource = "file";
+		return result;
+	}
+	return getCopilotToken();
+}
 async function refreshCopilotToken(reason) {
 	if (inflightRefresh) return inflightRefresh;
-	if (reason === "401-retry") {
-		const now = Date.now();
-		if (now - lastRefreshSuccess < REFRESH_SUCCESS_COOLDOWN_MS) {
-			consola.debug(`refreshCopilotToken(${reason}) skipped: prior success within ${REFRESH_SUCCESS_COOLDOWN_MS}ms`);
-			return;
-		}
-		if (now - lastRefreshFailure < REFRESH_FAILURE_COOLDOWN_MS) {
-			consola.debug(`refreshCopilotToken(${reason}) skipped: prior failure within ${REFRESH_FAILURE_COOLDOWN_MS}ms`);
-			return;
-		}
-	}
-	inflightRefresh = (async () => {
-		consola.debug(`Refreshing Copilot token (reason=${reason})`);
+	const run = async () => {
 		try {
-			const { token } = await getCopilotToken();
-			state.copilotToken = token;
-			lastRefreshSuccess = Date.now();
-			consola.debug("Copilot token refreshed");
-			if (state.showToken) consola.info("Refreshed Copilot token:", token);
-		} catch (error) {
-			lastRefreshFailure = Date.now();
-			consola.error(`Failed to refresh Copilot token (reason=${reason}):`, error);
+			if (reason === "401-retry" || reason === "expiry") {
+				const now = Date.now();
+				const onDisk = await readGithubTokenIfUsable();
+				if (!Boolean(onDisk && onDisk !== state.githubToken)) {
+					if (now - lastRefreshSuccess < REFRESH_SUCCESS_COOLDOWN_MS) {
+						consola.debug(`refreshCopilotToken(${reason}) skipped: prior success within ${REFRESH_SUCCESS_COOLDOWN_MS}ms`);
+						return "skipped";
+					}
+					if (now - lastRefreshFailure < REFRESH_FAILURE_COOLDOWN_MS) {
+						consola.debug(`refreshCopilotToken(${reason}) skipped: prior failure within ${REFRESH_FAILURE_COOLDOWN_MS}ms`);
+						return "skipped";
+					}
+				}
+			}
+			consola.debug(`Refreshing Copilot token (reason=${reason})`);
+			try {
+				const { token, refresh_in } = await exchangeWithFreshestCredential();
+				commitCopilotToken(token, refresh_in);
+				lastRefreshSuccess = Date.now();
+				consola.debug(`Copilot token refreshed (credential ${credentialFingerprint(state.githubToken)}, generation ${state.copilotTokenGeneration})`);
+				if (state.showToken) consola.info("Refreshed Copilot token:", token);
+				return "refreshed";
+			} catch (error) {
+				lastRefreshFailure = Date.now();
+				consola.error(`Failed to refresh Copilot token (reason=${reason}):`, error instanceof Error ? error.message : error);
+				if (error instanceof CopilotTokenExchangeError) {
+					if (error.kind === "credential_rejected") return "credential_rejected";
+					if (error.kind === "entitlement_lapsed") return "entitlement_lapsed";
+				}
+				return "transient_failure";
+			}
 		} finally {
-			inflightRefresh = void 0;
+			if (inflightRefresh === attempt) inflightRefresh = void 0;
 		}
-	})();
-	return inflightRefresh;
+	};
+	const attempt = run();
+	inflightRefresh = attempt;
+	return attempt;
+}
+/**
+* Refresh the Copilot token if its derived deadline has passed.
+*
+* Called on EVERY request. The common path is one `Date.now()` and one
+* integer compare — no I/O — against an upstream call that costs hundreds of
+* milliseconds, so the overhead is not measurable. Sampling (every Nth
+* request) was considered and rejected: a session that idles and then resumes
+* may issue only a handful of requests, so a sampled guard would fail to fire
+* in precisely the scenario it exists for. Actual refreshes do not get more
+* frequent, because `refreshCopilotToken` is single-flighted and the deadline
+* moves forward on success.
+*/
+async function ensureFreshCopilotToken() {
+	const deadline = state.copilotTokenRefreshAt;
+	if (deadline === void 0 || Date.now() < deadline) return;
+	await refreshCopilotToken("expiry");
 }
 /**
 * Try `request()`. If it returns a 401, refresh the Copilot token (subject
 * to the single-flight + refresh-storm-protection of `refreshCopilotToken`)
-* and retry once. After one retry, propagate whatever the second attempt
-* returned — the caller's existing 401-handling path is preserved.
+* and retry once — but ONLY if the token actually moved on.
+*
+* The retry criterion is the generation counter, not the refresh's verdict
+* and not a token-string comparison. Both alternatives are wrong:
+*
+*   - By verdict: requests A and B both hold token T0 and both 401. A
+*     refreshes to T1. B's refresh call lands inside the 30s success cooldown
+*     and reports "skipped", so a verdict-based rule would give up and fail B
+*     with a 503 — even though T1 is sitting in state and would have worked.
+*   - By string: upstream demonstrably returns a byte-identical token from
+*     two consecutive successful exchanges, so an unchanged string does not
+*     mean an unchanged credential state.
+*
+* Comparing generations answers the question the request actually has: is
+* what is in state now different from what I already tried? When it is not,
+* we skip a re-send that is guaranteed to 401 again.
 *
 * The `request` callback is responsible for capturing `state.copilotToken`
 * locally before any await; this helper does NOT re-build the request
 * itself, just re-invokes the callback after a refresh.
 */
 async function tryRefreshAndRetry(request, routePath) {
+	await ensureFreshCopilotToken();
+	const generationBefore = state.copilotTokenGeneration;
 	const first = await request();
 	if (first.status !== 401) return first;
 	consola.warn(`${routePath}: upstream returned 401, attempting one token refresh + retry`);
 	await refreshCopilotToken("401-retry");
+	if (state.copilotTokenGeneration === generationBefore) {
+		consola.debug(`${routePath}: no newer Copilot token available (generation ${generationBefore}); not retrying`);
+		return first;
+	}
 	return request();
 }
 async function setupGitHubToken(options) {
 	try {
-		const githubToken = await readGithubToken();
+		const githubToken = await readGithubTokenWithRetry();
 		if (githubToken && !options?.force) {
 			state.githubToken = githubToken;
+			state.githubTokenSource = "file";
 			if (state.showToken) consola.info("GitHub token:", githubToken);
 			await logUser();
 			return;
 		}
-		consola.info("Not logged in, getting new access token");
+		consola.info(options?.force ? "Re-authenticating, getting new access token" : "Not logged in, getting new access token");
 		const response = await getDeviceCode();
 		consola.debug("Device code response:", response);
 		consola.info(`Please enter the code "${response.user_code}" in ${response.verification_uri}`);
 		const token = await pollAccessToken(response);
 		await writeGithubToken(token);
 		state.githubToken = token;
+		state.githubTokenSource = "file";
 		if (state.showToken) consola.info("GitHub token:", token);
 		await logUser();
 	} catch (error) {
@@ -1342,4 +1729,4 @@ async function warnIfAgentScopesInsufficient() {
 //#endregion
 export { state as A, GITHUB_GRAPHQL_URL as C, githubAgentGraphQLHeaders as D, copilotVersion as E, githubAgentHeaders as O, GITHUB_API_BASE_URL as S, copilotHeaders as T, forwardError as _, cacheCopilotVersion as a, sanitizeTransportText as b, filterBetaHeader as c, resolveModel as d, sleep as f, HTTPError as g, isAllowedCopilotHost as h, tryRefreshAndRetry as i, githubHeaders as k, isNullish as l, getGitHubUser as m, setupGitHubAgentToken as n, cacheModels as o, getModels as p, setupGitHubToken as r, cacheVSCodeVersion as s, setupCopilotToken as t, resolveCodexModel as u, classifyTransportError as v, copilotBaseUrl as w, withTransientRetry as x, fetchWithTransientRetry as y };
 
-//# sourceMappingURL=token-iaSGp76k.js.map
+//# sourceMappingURL=token-Bz6HoH2H.js.map