github-router 0.3.273 → 0.3.274

package/dist/{start-CWWqjjwm.js → start-Cy_fEtEw.js}

@@ -1,5 +1,5 @@
-import { $ as browserToolsEnabled, Ct as provisionAndIndexColbert, Et as warmTreeSitterPool, St as colbertDegradedWarning, bt as provisionBrowserAssets } from "./peer-mcp-personas-DAZU1OfN.js";
-import { a as sharedServerArgs, i as setupAndServe, n as getCodexEnvVars, o as startKeepAwake, r as parseSharedArgs, t as getClaudeCodeEnvVars, u as runSelfUpdate } from "./server-setup-I5KYkuxE.js";
+import { $ as browserToolsEnabled, Ct as provisionAndIndexColbert, Et as warmTreeSitterPool, St as colbertDegradedWarning, bt as provisionBrowserAssets } from "./peer-mcp-personas-pzk1zcDa.js";
+import { a as sharedServerArgs, i as setupAndServe, n as getCodexEnvVars, o as startKeepAwake, r as parseSharedArgs, t as getClaudeCodeEnvVars, u as runSelfUpdate } from "./server-setup-CNKsKERG.js";
 import { defineCommand } from "citty";
 import consola from "consola";
 import process$1 from "node:process";
@@ -129,4 +129,4 @@ const start = defineCommand({
 //#endregion
 export { start };
 
-//# sourceMappingURL=start-CWWqjjwm.js.map
+//# sourceMappingURL=start-Cy_fEtEw.js.map

package/dist/{start-CWWqjjwm.js.map → start-Cy_fEtEw.js.map}

@@ -1 +1 @@
-{"version":3,"file":"start-CWWqjjwm.js","names":["process"],"sources":["../src/lib/shell.ts","../src/start.ts"],"sourcesContent":["import process from \"node:process\"\n\ntype ShellName = \"bash\" | \"zsh\" | \"fish\" | \"powershell\" | \"cmd\" | \"sh\"\ntype EnvVars = Record<string, string | undefined>\n\nfunction getShell(): ShellName {\n  const { platform, env } = process\n\n  if (platform === \"win32\") {\n    // Git Bash / MSYS2 / Cygwin set SHELL even on Windows\n    if (env.SHELL) {\n      if (env.SHELL.endsWith(\"zsh\")) return \"zsh\"\n      if (env.SHELL.endsWith(\"fish\")) return \"fish\"\n      if (env.SHELL.endsWith(\"bash\")) return \"bash\"\n      return \"sh\"\n    }\n\n    // Windows PowerShell 5.x sets this\n    if (env.POWERSHELL_DISTRIBUTION_CHANNEL) return \"powershell\"\n\n    // PowerShell (both 5.x and 7+/pwsh) adds user-scoped module paths\n    // at runtime. The system-level PSModulePath in CMD lacks these paths.\n    if (env.PSModulePath) {\n      const lower = env.PSModulePath.toLowerCase()\n      if (\n        lower.includes(\"documents\\\\powershell\")\n        || lower.includes(\"documents\\\\windowspowershell\")\n      ) {\n        return \"powershell\"\n      }\n    }\n\n    return \"cmd\"\n  }\n\n  const shellPath = env.SHELL\n  if (shellPath) {\n    if (shellPath.endsWith(\"zsh\")) return \"zsh\"\n    if (shellPath.endsWith(\"fish\")) return \"fish\"\n    if (shellPath.endsWith(\"bash\")) return \"bash\"\n  }\n\n  return \"sh\"\n}\n\nfunction quotePosixValue(value: string): string {\n  return `'${value.replace(/'/g, \"'\\\\''\")}'`\n}\n\nfunction quotePowerShellValue(value: string): string {\n  return `'${value.replace(/'/g, \"''\")}'`\n}\n\n/**\n * Generates a copy-pasteable script to set multiple environment variables\n * and run a subsequent command.\n * @param {EnvVars} envVars - An object of environment variables to set.\n * @param {string} commandToRun - The command to run after setting the variables.\n * @returns {string} The formatted script string.\n */\nexport function generateEnvScript(\n  envVars: EnvVars,\n  commandToRun: string = \"\",\n): string {\n  const shell = getShell()\n  const filteredEnvVars = Object.entries(envVars).filter(\n    ([, value]) => value !== undefined,\n  ) as Array<[string, string]>\n\n  let commandBlock: string\n\n  switch (shell) {\n    case \"powershell\": {\n      commandBlock = filteredEnvVars\n        .map(([key, value]) => `$env:${key} = ${quotePowerShellValue(value)}`)\n        .join(\"; \")\n      break\n    }\n    case \"cmd\": {\n      commandBlock = filteredEnvVars\n        .map(([key, value]) => `set \"${key}=${value}\"`)\n        .join(\" & \")\n      break\n    }\n    case \"fish\": {\n      commandBlock = filteredEnvVars\n        .map(([key, value]) => `set -gx ${key} ${quotePosixValue(value)}`)\n        .join(\"; \")\n      break\n    }\n    default: {\n      // bash, zsh, sh\n      const assignments = filteredEnvVars\n        .map(([key, value]) => `${key}=${quotePosixValue(value)}`)\n        .join(\" \")\n      commandBlock = filteredEnvVars.length > 0 ? `export ${assignments}` : \"\"\n      break\n    }\n  }\n\n  if (commandBlock && commandToRun) {\n    const separator =\n      shell === \"cmd\" ? \" & \" : shell === \"powershell\" ? \"; \" : \" && \"\n    return `${commandBlock}${separator}${commandToRun}`\n  }\n\n  return commandBlock || commandToRun\n}\n","#!/usr/bin/env node\n\nimport { defineCommand } from \"citty\"\nimport clipboard from \"clipboardy\"\nimport consola from \"consola\"\n\nimport { generateEnvScript } from \"./lib/shell\"\nimport { DEFAULT_CODEX_MODEL, DEFAULT_PORT } from \"./lib/port\"\nimport { provisionBrowserAssets } from \"./lib/browser-mcp/provision\"\nimport { browserToolsEnabled } from \"./lib/mcp-capabilities\"\nimport { colbertDegradedWarning, provisionAndIndexColbert } from \"./lib/colbert\"\nimport { startKeepAwake } from \"./lib/keep-awake\"\nimport { warmTreeSitterPool } from \"./lib/tree-sitter-pool/pool\"\nimport {\n  getClaudeCodeEnvVars,\n  getCodexEnvVars,\n  parseSharedArgs,\n  setupAndServe,\n  sharedServerArgs,\n} from \"./lib/server-setup\"\nimport { runSelfUpdate } from \"./lib/self-update\"\n\nfunction printAndCopyCommand(command: string, label: string): void {\n  consola.box(`${label}\\n\\n${command}`)\n  try {\n    clipboard.writeSync(command)\n    consola.success(`Copied ${label} command to clipboard!`)\n  } catch {\n    consola.warn(\"Failed to copy to clipboard. Copy the command above manually.\")\n  }\n}\n\nfunction generateClaudeCodeCommand(serverUrl: string, model?: string) {\n  const envVars = getClaudeCodeEnvVars(serverUrl, model)\n  const command = generateEnvScript(envVars, \"claude --dangerously-skip-permissions\")\n  printAndCopyCommand(command, \"Claude Code\")\n}\n\nfunction generateCodexCommand(serverUrl: string, model?: string) {\n  const codexModel = model ?? DEFAULT_CODEX_MODEL\n  const envVars = getCodexEnvVars(serverUrl)\n  const command = generateEnvScript(envVars, `codex -m ${codexModel}`)\n  printAndCopyCommand(command, \"Codex CLI\")\n}\n\nexport const start = defineCommand({\n  meta: {\n    name: \"start\",\n    description: \"Start the github-router server\",\n  },\n  args: {\n    ...sharedServerArgs,\n    cc: {\n      type: \"boolean\",\n      default: false,\n      description:\n        \"Generate a command to launch Claude Code with Copilot API config\",\n    },\n    cx: {\n      type: \"boolean\",\n      default: false,\n      description:\n        \"Generate a command to launch Codex CLI with Copilot API config\",\n    },\n    model: {\n      alias: \"m\",\n      type: \"string\",\n      description: \"Override the default model (used with --cc or --cx)\",\n    },\n  },\n  async run({ args }) {\n    const parsed = parseSharedArgs(args as unknown as Record<string, unknown>)\n\n    const { serverUrl } = await setupAndServe({\n      ...parsed,\n      port: parsed.port ?? DEFAULT_PORT,\n      silent: false,\n    })\n\n    // Best-effort self-update (detached, applies next launch). Runs\n    // after the server is listening so the bounded probe can't delay it.\n    void runSelfUpdate({ selfUpdate: args[\"self-update\"] !== false })\n\n    // Best-effort ColBERT semantic-search provision + background index of\n    // the launch cwd (if a git repo). ON by default; never blocks launch,\n    // never throws. Opt out with GH_ROUTER_DISABLE_SEMANTIC_SEARCH=1.\n    void provisionAndIndexColbert()\n\n    // Surface a terminally-failed semantic index to the HUMAN (see the note\n    // in claude.ts). Fire-and-forget; lexical search still works.\n    void colbertDegradedWarning()\n      .then((warning) => {\n        if (warning) process.stderr.write(`${warning}\\n`)\n      })\n      .catch(() => {})\n\n    // Ready one tree-sitter worker in the background so the first code search\n    // avoids WASM/grammar initialization. One worker keeps launch CPU bounded;\n    // demand grows the pool lazily. Opt out with GH_ROUTER_DISABLE_TS_POOL_WARMUP=1.\n    void warmTreeSitterPool()\n\n    // Best-effort: keep the machine awake while the proxy serves (win32\n    // default-on; opt out with GH_ROUTER_DISABLE_KEEP_AWAKE=1). Holds a\n    // SetThreadExecutionState assertion via a persistent PowerShell\n    // helper. Self-registers its own SIGINT/SIGTERM/exit reaper — load-\n    // bearing here, because `start` has no launchChild/onShutdown.\n    startKeepAwake()\n\n    // Best-effort: materialize the browser extension + bridge into the\n    // stable app-dir and stamp the running version, so a one-time \"Load\n    // unpacked\" survives npx/bunx upgrades. Gated on --browse; never\n    // blocks launch, never throws.\n    if (browserToolsEnabled()) {\n      void provisionBrowserAssets().catch((err) =>\n        consola.debug(\"Browser extension provisioning failed:\", err),\n      )\n    }\n\n    if (args.cc) generateClaudeCodeCommand(serverUrl, args.model)\n    if (args.cx) generateCodexCommand(serverUrl, args.model)\n\n    consola.box(\n      `🌐 Usage Viewer: https://animeshkundu.github.io/github-router/dashboard.html?endpoint=${serverUrl}/usage`,\n    )\n  },\n})\n"],"mappings":";;;;;;;AAKA,SAAS,WAAsB;CAC7B,MAAM,EAAE,UAAU,QAAQA;CAE1B,IAAI,aAAa,SAAS;EAExB,IAAI,IAAI,OAAO;GACb,IAAI,IAAI,MAAM,SAAS,KAAK,GAAG,OAAO;GACtC,IAAI,IAAI,MAAM,SAAS,MAAM,GAAG,OAAO;GACvC,IAAI,IAAI,MAAM,SAAS,MAAM,GAAG,OAAO;GACvC,OAAO;EACT;EAGA,IAAI,IAAI,iCAAiC,OAAO;EAIhD,IAAI,IAAI,cAAc;GACpB,MAAM,QAAQ,IAAI,aAAa,YAAY;GAC3C,IACE,MAAM,SAAS,uBAAuB,KACnC,MAAM,SAAS,8BAA8B,GAEhD,OAAO;EAEX;EAEA,OAAO;CACT;CAEA,MAAM,YAAY,IAAI;CACtB,IAAI,WAAW;EACb,IAAI,UAAU,SAAS,KAAK,GAAG,OAAO;EACtC,IAAI,UAAU,SAAS,MAAM,GAAG,OAAO;EACvC,IAAI,UAAU,SAAS,MAAM,GAAG,OAAO;CACzC;CAEA,OAAO;AACT;AAEA,SAAS,gBAAgB,OAAuB;CAC9C,OAAO,IAAI,MAAM,QAAQ,MAAM,OAAO,EAAE;AAC1C;AAEA,SAAS,qBAAqB,OAAuB;CACnD,OAAO,IAAI,MAAM,QAAQ,MAAM,IAAI,EAAE;AACvC;;;;;;;;AASA,SAAgB,kBACd,SACA,eAAuB,IACf;CACR,MAAM,QAAQ,SAAS;CACvB,MAAM,kBAAkB,OAAO,QAAQ,OAAO,CAAC,CAAC,QAC7C,GAAG,WAAW,UAAU,KAAA,CAC3B;CAEA,IAAI;CAEJ,QAAQ,OAAR;EACE,KAAK;GACH,eAAe,gBACZ,KAAK,CAAC,KAAK,WAAW,QAAQ,IAAI,KAAK,qBAAqB,KAAK,GAAG,CAAC,CACrE,KAAK,IAAI;GACZ;EAEF,KAAK;GACH,eAAe,gBACZ,KAAK,CAAC,KAAK,WAAW,QAAQ,IAAI,GAAG,MAAM,EAAE,CAAC,CAC9C,KAAK,KAAK;GACb;EAEF,KAAK;GACH,eAAe,gBACZ,KAAK,CAAC,KAAK,WAAW,WAAW,IAAI,GAAG,gBAAgB,KAAK,GAAG,CAAC,CACjE,KAAK,IAAI;GACZ;EAEF,SAAS;GAEP,MAAM,cAAc,gBACjB,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG,gBAAgB,KAAK,GAAG,CAAC,CACzD,KAAK,GAAG;GACX,eAAe,gBAAgB,SAAS,IAAI,UAAU,gBAAgB;GACtE;EACF;CACF;CAEA,IAAI,gBAAgB,cAGlB,OAAO,GAAG,eADR,UAAU,QAAQ,QAAQ,UAAU,eAAe,OAAO,SACvB;CAGvC,OAAO,gBAAgB;AACzB;;;ACrFA,SAAS,oBAAoB,SAAiB,OAAqB;CACjE,QAAQ,IAAI,GAAG,MAAM,MAAM,SAAS;CACpC,IAAI;EACF,UAAU,UAAU,OAAO;EAC3B,QAAQ,QAAQ,UAAU,MAAM,uBAAuB;CACzD,QAAQ;EACN,QAAQ,KAAK,+DAA+D;CAC9E;AACF;AAEA,SAAS,0BAA0B,WAAmB,OAAgB;CAGpE,oBADgB,kBADA,qBAAqB,WAAW,KACd,GAAS,uCACjB,GAAG,aAAa;AAC5C;AAEA,SAAS,qBAAqB,WAAmB,OAAgB;CAC/D,MAAM,aAAa,SAAA;CAGnB,oBADgB,kBADA,gBAAgB,SACE,GAAS,YAAY,YAC7B,GAAG,WAAW;AAC1C;AAEA,MAAa,QAAQ,cAAc;CACjC,MAAM;EACJ,MAAM;EACN,aAAa;CACf;CACA,MAAM;EACJ,GAAG;EACH,IAAI;GACF,MAAM;GACN,SAAS;GACT,aACE;EACJ;EACA,IAAI;GACF,MAAM;GACN,SAAS;GACT,aACE;EACJ;EACA,OAAO;GACL,OAAO;GACP,MAAM;GACN,aAAa;EACf;CACF;CACA,MAAM,IAAI,EAAE,QAAQ;EAClB,MAAM,SAAS,gBAAgB,IAA0C;EAEzE,MAAM,EAAE,cAAc,MAAM,cAAc;GACxC,GAAG;GACH,MAAM,OAAO,QAAA;GACb,QAAQ;EACV,CAAC;EAID,cAAmB,EAAE,YAAY,KAAK,mBAAmB,MAAM,CAAC;EAKhE,yBAA8B;EAI9B,uBAA4B,CAAC,CAC1B,MAAM,YAAY;GACjB,IAAI,SAAS,QAAQ,OAAO,MAAM,GAAG,QAAQ,GAAG;EAClD,CAAC,CAAC,CACD,YAAY,CAAC,CAAC;EAKjB,mBAAwB;EAOxB,eAAe;EAMf,IAAI,oBAAoB,GACtB,uBAA4B,CAAC,CAAC,OAAO,QACnC,QAAQ,MAAM,0CAA0C,GAAG,CAC7D;EAGF,IAAI,KAAK,IAAI,0BAA0B,WAAW,KAAK,KAAK;EAC5D,IAAI,KAAK,IAAI,qBAAqB,WAAW,KAAK,KAAK;EAEvD,QAAQ,IACN,yFAAyF,UAAU,OACrG;CACF;AACF,CAAC"}
+{"version":3,"file":"start-Cy_fEtEw.js","names":["process"],"sources":["../src/lib/shell.ts","../src/start.ts"],"sourcesContent":["import process from \"node:process\"\n\ntype ShellName = \"bash\" | \"zsh\" | \"fish\" | \"powershell\" | \"cmd\" | \"sh\"\ntype EnvVars = Record<string, string | undefined>\n\nfunction getShell(): ShellName {\n  const { platform, env } = process\n\n  if (platform === \"win32\") {\n    // Git Bash / MSYS2 / Cygwin set SHELL even on Windows\n    if (env.SHELL) {\n      if (env.SHELL.endsWith(\"zsh\")) return \"zsh\"\n      if (env.SHELL.endsWith(\"fish\")) return \"fish\"\n      if (env.SHELL.endsWith(\"bash\")) return \"bash\"\n      return \"sh\"\n    }\n\n    // Windows PowerShell 5.x sets this\n    if (env.POWERSHELL_DISTRIBUTION_CHANNEL) return \"powershell\"\n\n    // PowerShell (both 5.x and 7+/pwsh) adds user-scoped module paths\n    // at runtime. The system-level PSModulePath in CMD lacks these paths.\n    if (env.PSModulePath) {\n      const lower = env.PSModulePath.toLowerCase()\n      if (\n        lower.includes(\"documents\\\\powershell\")\n        || lower.includes(\"documents\\\\windowspowershell\")\n      ) {\n        return \"powershell\"\n      }\n    }\n\n    return \"cmd\"\n  }\n\n  const shellPath = env.SHELL\n  if (shellPath) {\n    if (shellPath.endsWith(\"zsh\")) return \"zsh\"\n    if (shellPath.endsWith(\"fish\")) return \"fish\"\n    if (shellPath.endsWith(\"bash\")) return \"bash\"\n  }\n\n  return \"sh\"\n}\n\nfunction quotePosixValue(value: string): string {\n  return `'${value.replace(/'/g, \"'\\\\''\")}'`\n}\n\nfunction quotePowerShellValue(value: string): string {\n  return `'${value.replace(/'/g, \"''\")}'`\n}\n\n/**\n * Generates a copy-pasteable script to set multiple environment variables\n * and run a subsequent command.\n * @param {EnvVars} envVars - An object of environment variables to set.\n * @param {string} commandToRun - The command to run after setting the variables.\n * @returns {string} The formatted script string.\n */\nexport function generateEnvScript(\n  envVars: EnvVars,\n  commandToRun: string = \"\",\n): string {\n  const shell = getShell()\n  const filteredEnvVars = Object.entries(envVars).filter(\n    ([, value]) => value !== undefined,\n  ) as Array<[string, string]>\n\n  let commandBlock: string\n\n  switch (shell) {\n    case \"powershell\": {\n      commandBlock = filteredEnvVars\n        .map(([key, value]) => `$env:${key} = ${quotePowerShellValue(value)}`)\n        .join(\"; \")\n      break\n    }\n    case \"cmd\": {\n      commandBlock = filteredEnvVars\n        .map(([key, value]) => `set \"${key}=${value}\"`)\n        .join(\" & \")\n      break\n    }\n    case \"fish\": {\n      commandBlock = filteredEnvVars\n        .map(([key, value]) => `set -gx ${key} ${quotePosixValue(value)}`)\n        .join(\"; \")\n      break\n    }\n    default: {\n      // bash, zsh, sh\n      const assignments = filteredEnvVars\n        .map(([key, value]) => `${key}=${quotePosixValue(value)}`)\n        .join(\" \")\n      commandBlock = filteredEnvVars.length > 0 ? `export ${assignments}` : \"\"\n      break\n    }\n  }\n\n  if (commandBlock && commandToRun) {\n    const separator =\n      shell === \"cmd\" ? \" & \" : shell === \"powershell\" ? \"; \" : \" && \"\n    return `${commandBlock}${separator}${commandToRun}`\n  }\n\n  return commandBlock || commandToRun\n}\n","#!/usr/bin/env node\n\nimport { defineCommand } from \"citty\"\nimport clipboard from \"clipboardy\"\nimport consola from \"consola\"\n\nimport { generateEnvScript } from \"./lib/shell\"\nimport { DEFAULT_CODEX_MODEL, DEFAULT_PORT } from \"./lib/port\"\nimport { provisionBrowserAssets } from \"./lib/browser-mcp/provision\"\nimport { browserToolsEnabled } from \"./lib/mcp-capabilities\"\nimport { colbertDegradedWarning, provisionAndIndexColbert } from \"./lib/colbert\"\nimport { startKeepAwake } from \"./lib/keep-awake\"\nimport { warmTreeSitterPool } from \"./lib/tree-sitter-pool/pool\"\nimport {\n  getClaudeCodeEnvVars,\n  getCodexEnvVars,\n  parseSharedArgs,\n  setupAndServe,\n  sharedServerArgs,\n} from \"./lib/server-setup\"\nimport { runSelfUpdate } from \"./lib/self-update\"\n\nfunction printAndCopyCommand(command: string, label: string): void {\n  consola.box(`${label}\\n\\n${command}`)\n  try {\n    clipboard.writeSync(command)\n    consola.success(`Copied ${label} command to clipboard!`)\n  } catch {\n    consola.warn(\"Failed to copy to clipboard. Copy the command above manually.\")\n  }\n}\n\nfunction generateClaudeCodeCommand(serverUrl: string, model?: string) {\n  const envVars = getClaudeCodeEnvVars(serverUrl, model)\n  const command = generateEnvScript(envVars, \"claude --dangerously-skip-permissions\")\n  printAndCopyCommand(command, \"Claude Code\")\n}\n\nfunction generateCodexCommand(serverUrl: string, model?: string) {\n  const codexModel = model ?? DEFAULT_CODEX_MODEL\n  const envVars = getCodexEnvVars(serverUrl)\n  const command = generateEnvScript(envVars, `codex -m ${codexModel}`)\n  printAndCopyCommand(command, \"Codex CLI\")\n}\n\nexport const start = defineCommand({\n  meta: {\n    name: \"start\",\n    description: \"Start the github-router server\",\n  },\n  args: {\n    ...sharedServerArgs,\n    cc: {\n      type: \"boolean\",\n      default: false,\n      description:\n        \"Generate a command to launch Claude Code with Copilot API config\",\n    },\n    cx: {\n      type: \"boolean\",\n      default: false,\n      description:\n        \"Generate a command to launch Codex CLI with Copilot API config\",\n    },\n    model: {\n      alias: \"m\",\n      type: \"string\",\n      description: \"Override the default model (used with --cc or --cx)\",\n    },\n  },\n  async run({ args }) {\n    const parsed = parseSharedArgs(args as unknown as Record<string, unknown>)\n\n    const { serverUrl } = await setupAndServe({\n      ...parsed,\n      port: parsed.port ?? DEFAULT_PORT,\n      silent: false,\n    })\n\n    // Best-effort self-update (detached, applies next launch). Runs\n    // after the server is listening so the bounded probe can't delay it.\n    void runSelfUpdate({ selfUpdate: args[\"self-update\"] !== false })\n\n    // Best-effort ColBERT semantic-search provision + background index of\n    // the launch cwd (if a git repo). ON by default; never blocks launch,\n    // never throws. Opt out with GH_ROUTER_DISABLE_SEMANTIC_SEARCH=1.\n    void provisionAndIndexColbert()\n\n    // Surface a terminally-failed semantic index to the HUMAN (see the note\n    // in claude.ts). Fire-and-forget; lexical search still works.\n    void colbertDegradedWarning()\n      .then((warning) => {\n        if (warning) process.stderr.write(`${warning}\\n`)\n      })\n      .catch(() => {})\n\n    // Ready one tree-sitter worker in the background so the first code search\n    // avoids WASM/grammar initialization. One worker keeps launch CPU bounded;\n    // demand grows the pool lazily. Opt out with GH_ROUTER_DISABLE_TS_POOL_WARMUP=1.\n    void warmTreeSitterPool()\n\n    // Best-effort: keep the machine awake while the proxy serves (win32\n    // default-on; opt out with GH_ROUTER_DISABLE_KEEP_AWAKE=1). Holds a\n    // SetThreadExecutionState assertion via a persistent PowerShell\n    // helper. Self-registers its own SIGINT/SIGTERM/exit reaper — load-\n    // bearing here, because `start` has no launchChild/onShutdown.\n    startKeepAwake()\n\n    // Best-effort: materialize the browser extension + bridge into the\n    // stable app-dir and stamp the running version, so a one-time \"Load\n    // unpacked\" survives npx/bunx upgrades. Gated on --browse; never\n    // blocks launch, never throws.\n    if (browserToolsEnabled()) {\n      void provisionBrowserAssets().catch((err) =>\n        consola.debug(\"Browser extension provisioning failed:\", err),\n      )\n    }\n\n    if (args.cc) generateClaudeCodeCommand(serverUrl, args.model)\n    if (args.cx) generateCodexCommand(serverUrl, args.model)\n\n    consola.box(\n      `🌐 Usage Viewer: https://animeshkundu.github.io/github-router/dashboard.html?endpoint=${serverUrl}/usage`,\n    )\n  },\n})\n"],"mappings":";;;;;;;AAKA,SAAS,WAAsB;CAC7B,MAAM,EAAE,UAAU,QAAQA;CAE1B,IAAI,aAAa,SAAS;EAExB,IAAI,IAAI,OAAO;GACb,IAAI,IAAI,MAAM,SAAS,KAAK,GAAG,OAAO;GACtC,IAAI,IAAI,MAAM,SAAS,MAAM,GAAG,OAAO;GACvC,IAAI,IAAI,MAAM,SAAS,MAAM,GAAG,OAAO;GACvC,OAAO;EACT;EAGA,IAAI,IAAI,iCAAiC,OAAO;EAIhD,IAAI,IAAI,cAAc;GACpB,MAAM,QAAQ,IAAI,aAAa,YAAY;GAC3C,IACE,MAAM,SAAS,uBAAuB,KACnC,MAAM,SAAS,8BAA8B,GAEhD,OAAO;EAEX;EAEA,OAAO;CACT;CAEA,MAAM,YAAY,IAAI;CACtB,IAAI,WAAW;EACb,IAAI,UAAU,SAAS,KAAK,GAAG,OAAO;EACtC,IAAI,UAAU,SAAS,MAAM,GAAG,OAAO;EACvC,IAAI,UAAU,SAAS,MAAM,GAAG,OAAO;CACzC;CAEA,OAAO;AACT;AAEA,SAAS,gBAAgB,OAAuB;CAC9C,OAAO,IAAI,MAAM,QAAQ,MAAM,OAAO,EAAE;AAC1C;AAEA,SAAS,qBAAqB,OAAuB;CACnD,OAAO,IAAI,MAAM,QAAQ,MAAM,IAAI,EAAE;AACvC;;;;;;;;AASA,SAAgB,kBACd,SACA,eAAuB,IACf;CACR,MAAM,QAAQ,SAAS;CACvB,MAAM,kBAAkB,OAAO,QAAQ,OAAO,CAAC,CAAC,QAC7C,GAAG,WAAW,UAAU,KAAA,CAC3B;CAEA,IAAI;CAEJ,QAAQ,OAAR;EACE,KAAK;GACH,eAAe,gBACZ,KAAK,CAAC,KAAK,WAAW,QAAQ,IAAI,KAAK,qBAAqB,KAAK,GAAG,CAAC,CACrE,KAAK,IAAI;GACZ;EAEF,KAAK;GACH,eAAe,gBACZ,KAAK,CAAC,KAAK,WAAW,QAAQ,IAAI,GAAG,MAAM,EAAE,CAAC,CAC9C,KAAK,KAAK;GACb;EAEF,KAAK;GACH,eAAe,gBACZ,KAAK,CAAC,KAAK,WAAW,WAAW,IAAI,GAAG,gBAAgB,KAAK,GAAG,CAAC,CACjE,KAAK,IAAI;GACZ;EAEF,SAAS;GAEP,MAAM,cAAc,gBACjB,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG,gBAAgB,KAAK,GAAG,CAAC,CACzD,KAAK,GAAG;GACX,eAAe,gBAAgB,SAAS,IAAI,UAAU,gBAAgB;GACtE;EACF;CACF;CAEA,IAAI,gBAAgB,cAGlB,OAAO,GAAG,eADR,UAAU,QAAQ,QAAQ,UAAU,eAAe,OAAO,SACvB;CAGvC,OAAO,gBAAgB;AACzB;;;ACrFA,SAAS,oBAAoB,SAAiB,OAAqB;CACjE,QAAQ,IAAI,GAAG,MAAM,MAAM,SAAS;CACpC,IAAI;EACF,UAAU,UAAU,OAAO;EAC3B,QAAQ,QAAQ,UAAU,MAAM,uBAAuB;CACzD,QAAQ;EACN,QAAQ,KAAK,+DAA+D;CAC9E;AACF;AAEA,SAAS,0BAA0B,WAAmB,OAAgB;CAGpE,oBADgB,kBADA,qBAAqB,WAAW,KACd,GAAS,uCACjB,GAAG,aAAa;AAC5C;AAEA,SAAS,qBAAqB,WAAmB,OAAgB;CAC/D,MAAM,aAAa,SAAA;CAGnB,oBADgB,kBADA,gBAAgB,SACE,GAAS,YAAY,YAC7B,GAAG,WAAW;AAC1C;AAEA,MAAa,QAAQ,cAAc;CACjC,MAAM;EACJ,MAAM;EACN,aAAa;CACf;CACA,MAAM;EACJ,GAAG;EACH,IAAI;GACF,MAAM;GACN,SAAS;GACT,aACE;EACJ;EACA,IAAI;GACF,MAAM;GACN,SAAS;GACT,aACE;EACJ;EACA,OAAO;GACL,OAAO;GACP,MAAM;GACN,aAAa;EACf;CACF;CACA,MAAM,IAAI,EAAE,QAAQ;EAClB,MAAM,SAAS,gBAAgB,IAA0C;EAEzE,MAAM,EAAE,cAAc,MAAM,cAAc;GACxC,GAAG;GACH,MAAM,OAAO,QAAA;GACb,QAAQ;EACV,CAAC;EAID,cAAmB,EAAE,YAAY,KAAK,mBAAmB,MAAM,CAAC;EAKhE,yBAA8B;EAI9B,uBAA4B,CAAC,CAC1B,MAAM,YAAY;GACjB,IAAI,SAAS,QAAQ,OAAO,MAAM,GAAG,QAAQ,GAAG;EAClD,CAAC,CAAC,CACD,YAAY,CAAC,CAAC;EAKjB,mBAAwB;EAOxB,eAAe;EAMf,IAAI,oBAAoB,GACtB,uBAA4B,CAAC,CAAC,OAAO,QACnC,QAAQ,MAAM,0CAA0C,GAAG,CAC7D;EAGF,IAAI,KAAK,IAAI,0BAA0B,WAAW,KAAK,KAAK;EAC5D,IAAI,KAAK,IAAI,qBAAqB,WAAW,KAAK,KAAK;EAEvD,QAAQ,IACN,yFAAyF,UAAU,OACrG;CACF;AACF,CAAC"}

package/dist/{token-Bz7iN8US.js → token-Bz6HoH2H.js}

@@ -1,12 +1,13 @@
 import { t as PATHS } from "./paths-Bg1_DWhi.js";
 import consola from "consola";
 import path from "node:path";
-import { randomBytes, randomUUID } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import fs from "node:fs/promises";
 import process$1 from "node:process";
 //#region src/lib/state.ts
 const state = {
 	accountType: "enterprise",
+	copilotTokenGeneration: 0,
 	manualApprove: false,
 	rateLimitWait: false,
 	showToken: false,
@@ -631,9 +632,113 @@ function isAllowedCopilotHost(rawUrl) {
 	if (parsed.protocol !== "https:") return false;
 	return COPILOT_HOST_ALLOWLIST.includes(parsed.hostname);
 }
-const getCopilotToken = async () => {
-	const response = await fetchWithTransientRetry(() => fetch(`${GITHUB_API_BASE_URL}/copilot_internal/v2/token`, { headers: githubHeaders(state) }), { label: "/copilot_internal/v2/token" });
-	if (!response.ok) throw new HTTPError("Failed to get Copilot token", response);
+/**
+* Short, non-reversible identifier for a credential, safe to log.
+*
+* During the 2026-08-08 incident the logs could not answer the one question
+* that mattered: was the process holding a stale credential, or was the
+* credential on disk itself dead? The operator re-authenticated at 13:53 and
+* the proxy kept failing, and nothing recorded whether those were the same
+* secret. A truncated SHA-256 makes two credentials comparable across log
+* lines without ever printing one. 8 hex chars is ample to distinguish the
+* handful of credentials a machine sees, and far too short to attack.
+*/
+function credentialFingerprint(token) {
+	if (!token) return "none";
+	return createHash("sha256").update(token).digest("hex").slice(0, 8);
+}
+/**
+* A failed `/copilot_internal/v2/token` exchange, carrying enough to diagnose
+* it after the fact.
+*
+* The predecessor threw `HTTPError("Failed to get Copilot token", response)`
+* and every catch logged only `.message`, so status and body were dropped —
+* which is why the incident is unattributable.
+*/
+var CopilotTokenExchangeError = class extends HTTPError {
+	kind;
+	status;
+	/** Fingerprint of the credential that was rejected, never the credential. */
+	credential;
+	constructor(opts) {
+		super(`Failed to get Copilot token: HTTP ${opts.status} (${opts.kind}, credential ${opts.credential})${opts.detail ? ` — ${opts.detail}` : ""}`, opts.response);
+		this.kind = opts.kind;
+		this.status = opts.status;
+		this.credential = opts.credential;
+	}
+};
+/** Upper bound on how much of an error body we quote into a log line. */
+const ERROR_BODY_SNIPPET_CHARS = 300;
+/**
+* `notification_id` values that mean "the credential is valid but the
+* entitlement is not". These need a different remedy than a bad credential:
+* telling someone whose subscription lapsed to re-authenticate sends them
+* around a loop that cannot help.
+*/
+const ENTITLEMENT_NOTIFICATIONS = /* @__PURE__ */ new Set([
+	"access_revoked",
+	"subscription_ended",
+	"no_copilot_access"
+]);
+/**
+* Classify a non-OK exchange response.
+*
+* Deliberately asymmetric: only a 401, or a 403 that NAMES an entitlement
+* problem, is treated as terminal. A bare 403 stays transient because GitHub
+* returns 403 for primary rate limits (`x-ratelimit-remaining: 0`) and
+* secondary abuse limits — telling a user with a perfectly good credential to
+* re-authenticate because they were briefly rate-limited would be a worse
+* failure than the one being fixed. The costs are not symmetric: calling a
+* terminal failure transient wastes some retries, while calling a transient
+* failure terminal kills a working session.
+*/
+function classifyExchangeFailure(status, body) {
+	if (status === 401) return "credential_rejected";
+	if (status === 403) {
+		let notificationId;
+		try {
+			const parsed = JSON.parse(body);
+			notificationId = parsed.notification_id ?? parsed.error?.notification_id;
+		} catch {}
+		if (typeof notificationId === "string" && ENTITLEMENT_NOTIFICATIONS.has(notificationId)) return "entitlement_lapsed";
+	}
+	return "transient";
+}
+/**
+* Exchange the GitHub credential for a short-lived Copilot token.
+*
+* `credentialOverride` lets a caller try a candidate credential WITHOUT
+* publishing it to the process-global `state` first. That matters because
+* `state` is shared by every concurrent request: installing an unvalidated
+* credential globally, even briefly, would make unrelated in-flight requests
+* send it and 401 while a perfectly good credential was still in hand.
+*/
+const getCopilotToken = async (credentialOverride) => {
+	const credential = credentialFingerprint(credentialOverride ?? state.githubToken);
+	const authState = credentialOverride === void 0 ? state : {
+		...state,
+		githubToken: credentialOverride
+	};
+	const response = await fetchWithTransientRetry(() => fetch(`${GITHUB_API_BASE_URL}/copilot_internal/v2/token`, { headers: githubHeaders(authState) }), { label: "/copilot_internal/v2/token" });
+	if (!response.ok) {
+		let body;
+		try {
+			body = await response.text();
+		} catch {
+			body = "(could not read error body)";
+		}
+		throw new CopilotTokenExchangeError({
+			kind: classifyExchangeFailure(response.status, body),
+			status: response.status,
+			credential,
+			detail: body.slice(0, ERROR_BODY_SNIPPET_CHARS).replaceAll(/\s+/g, " ").trim(),
+			response: new Response(body, {
+				status: response.status,
+				statusText: response.statusText,
+				headers: response.headers
+			})
+		});
+	}
 	const data = await response.json();
 	if (data.endpoints?.api) if (isAllowedCopilotHost(data.endpoints.api)) state.copilotApiUrl = data.endpoints.api;
 	else consola.warn(`Refusing to honor Copilot API endpoint "${data.endpoints.api}" from the token-exchange response — not in allowlist (${COPILOT_HOST_ALLOWLIST.join(", ")}). ` + (state.copilotApiUrl ? `Keeping existing override "${state.copilotApiUrl}".` : `Falling back to the default api.githubcopilot.com.`));
@@ -1164,6 +1269,43 @@ async function pollAccessToken(deviceCode, clientId = GITHUB_CLIENT_ID) {
 //#region src/lib/token.ts
 const readGithubToken = () => fs.readFile(PATHS.GITHUB_TOKEN_PATH, "utf8");
 /**
+* Transient filesystem errors from a read that raced the temp+rename write.
+*
+* On Windows a read landing in that window fails with one of these even
+* though a perfectly good file exists microseconds later. Treating one as
+* fatal at startup would cost a launch for no reason.
+*/
+const TRANSIENT_READ_CODES = /* @__PURE__ */ new Set([
+	"EPERM",
+	"EBUSY",
+	"EACCES",
+	"ENOENT"
+]);
+function isTransientReadError(err) {
+	const code = err?.code;
+	return typeof code === "string" && TRANSIENT_READ_CODES.has(code);
+}
+/**
+* Read the credential file, retrying briefly through a racing rename.
+*
+* Same delays and the same reasoning as {@link RENAME_RETRY_DELAYS_MS} on the
+* write side: the contending handle closes almost immediately, so a short
+* bounded retry converts a spurious launch failure into a non-event. A
+* persistent failure still propagates — the caller must not believe a
+* credential was read when it was not.
+*/
+async function readGithubTokenWithRetry() {
+	let lastErr;
+	for (let attempt = 0; attempt <= RENAME_RETRY_DELAYS_MS.length; attempt++) try {
+		return await readGithubToken();
+	} catch (err) {
+		lastErr = err;
+		if (!isTransientReadError(err)) throw err;
+		if (attempt < RENAME_RETRY_DELAYS_MS.length) await new Promise((resolve) => setTimeout(resolve, RENAME_RETRY_DELAYS_MS[attempt]));
+	}
+	throw lastErr;
+}
+/**
 * Backoff for a transient Windows rename failure. On Windows `fs.rename` over
 * an existing destination transiently fails with EPERM / EBUSY / EACCES when
 * anything else holds the target open for a moment (antivirus, the search
@@ -1226,10 +1368,60 @@ const writeGithubToken = (token) => writeTokenFileAtomic(PATHS.GITHUB_TOKEN_PATH
 const readGithubAgentToken = () => fs.readFile(PATHS.GITHUB_AGENT_TOKEN_PATH, "utf8");
 const writeGithubAgentToken = (token) => writeTokenFileAtomic(PATHS.GITHUB_AGENT_TOKEN_PATH, token);
 /**
+* Safety margin subtracted from the derived refresh deadline, so a request
+* arriving just before expiry refreshes rather than racing it.
+*/
+const REFRESH_SKEW_MS = 12e4;
+/**
+* Bounds on a `refresh_in` we are willing to turn into a timer delay. An
+* absurd or missing upstream value must not produce a zero-length timer (a
+* hot loop hammering GitHub) or an effectively infinite one (a token that is
+* never refreshed). 60s floor, 6h ceiling, 1500s default — the value GitHub
+* actually returns today.
+*/
+const MIN_REFRESH_IN_S = 60;
+const MAX_REFRESH_IN_S = 21600;
+const DEFAULT_REFRESH_IN_S = 1500;
+/** Backoff schedule after a failed refresh, then hold at the last value. */
+const REFRESH_BACKOFF_MS = [
+	5e3,
+	15e3,
+	6e4,
+	3e5
+];
+function clampRefreshIn(refreshIn) {
+	if (typeof refreshIn !== "number" || !Number.isFinite(refreshIn)) return DEFAULT_REFRESH_IN_S;
+	return Math.min(Math.max(refreshIn, MIN_REFRESH_IN_S), MAX_REFRESH_IN_S);
+}
+/**
+* Adopt an exchange result into `state`.
+*
+* The generation bump is what lets an in-flight request know a newer token
+* exists (see `State.copilotTokenGeneration`), so it happens on EVERY success
+* — including one that returns a byte-identical token, which upstream
+* demonstrably does.
+*/
+/**
+* Floor on how far ahead the derived refresh deadline may be placed.
+*
+* The deadline is `now + refresh_in - skew`, and the skew (120s) is larger
+* than the `refresh_in` floor (60s) — so a short upstream `refresh_in` would
+* put the deadline in the PAST, the scheduler would floor its delay to 1s,
+* and the proxy would hammer the token endpoint at 1 Hz forever. The deadline
+* must always be in the future, whatever upstream says.
+*/
+const MIN_REFRESH_LEAD_MS = 3e4;
+function commitCopilotToken(token, refreshIn) {
+	state.copilotToken = token;
+	state.copilotTokenGeneration += 1;
+	const lead = Math.max(clampRefreshIn(refreshIn) * 1e3 - REFRESH_SKEW_MS, MIN_REFRESH_LEAD_MS);
+	state.copilotTokenRefreshAt = Date.now() + lead;
+}
+/**
 * Fetch the Copilot token and keep it fresh in the background.
 *
 * Returns a disposer that stops the refresh loop. **Long-lived callers**
-* (`start`/`claude`/`codex`, via `setupAndServe`) can ignore it — the interval
+* (`start`/`claude`/`codex`, via `setupAndServe`) can ignore it — the timer
 * is `unref()`d, so it never holds the event loop open on its own. The one-shot
 * `models` command calls it, so ownership of the timer is explicit rather than
 * implied by a runtime flag. (`check-usage` does not call this function at all;
@@ -1238,95 +1430,222 @@ const writeGithubAgentToken = (token) => writeTokenFileAtomic(PATHS.GITHUB_AGENT
 * Both halves are load-bearing, for different failure modes. Without the
 * `unref()`, `github-router models` printed its full correct output and then
 * hung forever: its success path just returns (only the failure branches call
-* `process.exit`), and the un-unref'd interval pinned the event loop. Without
+* `process.exit`), and the un-unref'd timer pinned the event loop. Without
 * the disposer, that fix would depend on a property no caller can see, so the
 * next one-shot command would inherit the same trap.
+*
+* The schedule is a SELF-RE-ARMING `setTimeout`, not a fixed `setInterval`.
+* Three reasons: the delay tracks each response's own `refresh_in` instead of
+* the one captured at startup; a failure can back off (5s → 15s → 60s → 300s)
+* instead of waiting a full period during which the token is already dead;
+* and one timer cannot disagree with itself the way a period timer plus a
+* separate retry timer can.
 */
 const setupCopilotToken = async () => {
 	const { token, refresh_in } = await getCopilotToken();
-	state.copilotToken = token;
-	consola.debug("GitHub Copilot Token fetched successfully!");
+	commitCopilotToken(token, refresh_in);
+	consola.debug(`GitHub Copilot Token fetched successfully! (credential ${credentialFingerprint(state.githubToken)})`);
 	if (state.showToken) consola.info("Copilot token:", token);
-	const refreshInterval = Math.max((refresh_in - 60) * 1e3, 1e3);
-	const handle = setInterval(() => {
-		refreshCopilotToken("interval");
-	}, refreshInterval);
-	handle.unref?.();
-	let stopped = false;
+	let handle;
+	let disposed = false;
+	let failures = 0;
+	const arm = (delayMs) => {
+		if (disposed) return;
+		handle = setTimeout(() => {
+			tick();
+		}, delayMs);
+		handle.unref?.();
+	};
+	const tick = async () => {
+		const outcome = await refreshCopilotToken("interval");
+		if (disposed) return;
+		if (outcome === "refreshed") {
+			failures = 0;
+			arm(nextDelayFromState());
+			return;
+		}
+		const delay = REFRESH_BACKOFF_MS[Math.min(failures, REFRESH_BACKOFF_MS.length - 1)];
+		failures += 1;
+		arm(delay);
+	};
+	arm(nextDelayFromState());
 	return () => {
-		if (stopped) return;
-		stopped = true;
-		clearInterval(handle);
+		if (disposed) return;
+		disposed = true;
+		if (handle) clearTimeout(handle);
 	};
 };
+/**
+* Delay until the next scheduled refresh, from the deadline already stored on
+* `state`. Floored at 1s so a pathological deadline can never busy-loop.
+*/
+function nextDelayFromState() {
+	const deadline = state.copilotTokenRefreshAt;
+	if (deadline === void 0) return DEFAULT_REFRESH_IN_S * 1e3;
+	return Math.max(deadline - Date.now(), 1e3);
+}
 let inflightRefresh;
 let lastRefreshSuccess = 0;
 let lastRefreshFailure = 0;
 const REFRESH_SUCCESS_COOLDOWN_MS = 3e4;
 const REFRESH_FAILURE_COOLDOWN_MS = 5e3;
+/**
+* Read the credential from disk, returning it only if it is usable.
+*
+* Every failure mode here resolves to `undefined` (meaning "keep using what
+* is in memory") rather than throwing or returning a partial value. The file
+* is replaced by temp+rename (`writeTokenFileAtomic`), and on Windows a read
+* racing that rename fails with EPERM/EBUSY/EACCES/ENOENT. None of those mean
+* the in-memory credential went bad, so none of them may clear it — and a
+* filesystem error must never escape into the refresh loop and kill the timer.
+*/
+async function readGithubTokenIfUsable() {
+	if (state.githubTokenSource === "explicit") return void 0;
+	try {
+		const trimmed = (await readGithubToken()).trim();
+		return trimmed.length > 0 ? trimmed : void 0;
+	} catch (err) {
+		consola.debug("Could not re-read GitHub credential from disk:", err);
+		return;
+	}
+}
+/**
+* Perform one exchange, preferring a newer credential from disk if there is one.
+*
+* The disk token is a CANDIDATE: it is passed to the exchange directly and
+* published to `state.githubToken` only after that exchange succeeds. It is
+* never installed globally on spec — `state` is shared by every concurrent
+* request, so an unvalidated credential visible there would be sent by
+* unrelated in-flight requests and 401 them while a working credential was
+* still in hand.
+*/
+async function exchangeWithFreshestCredential() {
+	const onDisk = await readGithubTokenIfUsable();
+	const inMemory = state.githubToken;
+	if (onDisk && onDisk !== inMemory) {
+		consola.info(`GitHub credential on disk differs from the one in memory (${credentialFingerprint(inMemory)} → ${credentialFingerprint(onDisk)}); trying it.`);
+		const result = await getCopilotToken(onDisk);
+		state.githubToken = onDisk;
+		state.githubTokenSource = "file";
+		return result;
+	}
+	return getCopilotToken();
+}
 async function refreshCopilotToken(reason) {
 	if (inflightRefresh) return inflightRefresh;
-	if (reason === "401-retry") {
-		const now = Date.now();
-		if (now - lastRefreshSuccess < REFRESH_SUCCESS_COOLDOWN_MS) {
-			consola.debug(`refreshCopilotToken(${reason}) skipped: prior success within ${REFRESH_SUCCESS_COOLDOWN_MS}ms`);
-			return;
-		}
-		if (now - lastRefreshFailure < REFRESH_FAILURE_COOLDOWN_MS) {
-			consola.debug(`refreshCopilotToken(${reason}) skipped: prior failure within ${REFRESH_FAILURE_COOLDOWN_MS}ms`);
-			return;
-		}
-	}
-	inflightRefresh = (async () => {
-		consola.debug(`Refreshing Copilot token (reason=${reason})`);
+	const run = async () => {
 		try {
-			const { token } = await getCopilotToken();
-			state.copilotToken = token;
-			lastRefreshSuccess = Date.now();
-			consola.debug("Copilot token refreshed");
-			if (state.showToken) consola.info("Refreshed Copilot token:", token);
-		} catch (error) {
-			lastRefreshFailure = Date.now();
-			consola.error(`Failed to refresh Copilot token (reason=${reason}):`, error);
+			if (reason === "401-retry" || reason === "expiry") {
+				const now = Date.now();
+				const onDisk = await readGithubTokenIfUsable();
+				if (!Boolean(onDisk && onDisk !== state.githubToken)) {
+					if (now - lastRefreshSuccess < REFRESH_SUCCESS_COOLDOWN_MS) {
+						consola.debug(`refreshCopilotToken(${reason}) skipped: prior success within ${REFRESH_SUCCESS_COOLDOWN_MS}ms`);
+						return "skipped";
+					}
+					if (now - lastRefreshFailure < REFRESH_FAILURE_COOLDOWN_MS) {
+						consola.debug(`refreshCopilotToken(${reason}) skipped: prior failure within ${REFRESH_FAILURE_COOLDOWN_MS}ms`);
+						return "skipped";
+					}
+				}
+			}
+			consola.debug(`Refreshing Copilot token (reason=${reason})`);
+			try {
+				const { token, refresh_in } = await exchangeWithFreshestCredential();
+				commitCopilotToken(token, refresh_in);
+				lastRefreshSuccess = Date.now();
+				consola.debug(`Copilot token refreshed (credential ${credentialFingerprint(state.githubToken)}, generation ${state.copilotTokenGeneration})`);
+				if (state.showToken) consola.info("Refreshed Copilot token:", token);
+				return "refreshed";
+			} catch (error) {
+				lastRefreshFailure = Date.now();
+				consola.error(`Failed to refresh Copilot token (reason=${reason}):`, error instanceof Error ? error.message : error);
+				if (error instanceof CopilotTokenExchangeError) {
+					if (error.kind === "credential_rejected") return "credential_rejected";
+					if (error.kind === "entitlement_lapsed") return "entitlement_lapsed";
+				}
+				return "transient_failure";
+			}
 		} finally {
-			inflightRefresh = void 0;
+			if (inflightRefresh === attempt) inflightRefresh = void 0;
 		}
-	})();
-	return inflightRefresh;
+	};
+	const attempt = run();
+	inflightRefresh = attempt;
+	return attempt;
+}
+/**
+* Refresh the Copilot token if its derived deadline has passed.
+*
+* Called on EVERY request. The common path is one `Date.now()` and one
+* integer compare — no I/O — against an upstream call that costs hundreds of
+* milliseconds, so the overhead is not measurable. Sampling (every Nth
+* request) was considered and rejected: a session that idles and then resumes
+* may issue only a handful of requests, so a sampled guard would fail to fire
+* in precisely the scenario it exists for. Actual refreshes do not get more
+* frequent, because `refreshCopilotToken` is single-flighted and the deadline
+* moves forward on success.
+*/
+async function ensureFreshCopilotToken() {
+	const deadline = state.copilotTokenRefreshAt;
+	if (deadline === void 0 || Date.now() < deadline) return;
+	await refreshCopilotToken("expiry");
 }
 /**
 * Try `request()`. If it returns a 401, refresh the Copilot token (subject
 * to the single-flight + refresh-storm-protection of `refreshCopilotToken`)
-* and retry once. After one retry, propagate whatever the second attempt
-* returned — the caller's existing 401-handling path is preserved.
+* and retry once — but ONLY if the token actually moved on.
+*
+* The retry criterion is the generation counter, not the refresh's verdict
+* and not a token-string comparison. Both alternatives are wrong:
+*
+*   - By verdict: requests A and B both hold token T0 and both 401. A
+*     refreshes to T1. B's refresh call lands inside the 30s success cooldown
+*     and reports "skipped", so a verdict-based rule would give up and fail B
+*     with a 503 — even though T1 is sitting in state and would have worked.
+*   - By string: upstream demonstrably returns a byte-identical token from
+*     two consecutive successful exchanges, so an unchanged string does not
+*     mean an unchanged credential state.
+*
+* Comparing generations answers the question the request actually has: is
+* what is in state now different from what I already tried? When it is not,
+* we skip a re-send that is guaranteed to 401 again.
 *
 * The `request` callback is responsible for capturing `state.copilotToken`
 * locally before any await; this helper does NOT re-build the request
 * itself, just re-invokes the callback after a refresh.
 */
 async function tryRefreshAndRetry(request, routePath) {
+	await ensureFreshCopilotToken();
+	const generationBefore = state.copilotTokenGeneration;
 	const first = await request();
 	if (first.status !== 401) return first;
 	consola.warn(`${routePath}: upstream returned 401, attempting one token refresh + retry`);
 	await refreshCopilotToken("401-retry");
+	if (state.copilotTokenGeneration === generationBefore) {
+		consola.debug(`${routePath}: no newer Copilot token available (generation ${generationBefore}); not retrying`);
+		return first;
+	}
 	return request();
 }
 async function setupGitHubToken(options) {
 	try {
-		const githubToken = await readGithubToken();
+		const githubToken = await readGithubTokenWithRetry();
 		if (githubToken && !options?.force) {
 			state.githubToken = githubToken;
+			state.githubTokenSource = "file";
 			if (state.showToken) consola.info("GitHub token:", githubToken);
 			await logUser();
 			return;
 		}
-		consola.info("Not logged in, getting new access token");
+		consola.info(options?.force ? "Re-authenticating, getting new access token" : "Not logged in, getting new access token");
 		const response = await getDeviceCode();
 		consola.debug("Device code response:", response);
 		consola.info(`Please enter the code "${response.user_code}" in ${response.verification_uri}`);
 		const token = await pollAccessToken(response);
 		await writeGithubToken(token);
 		state.githubToken = token;
+		state.githubTokenSource = "file";
 		if (state.showToken) consola.info("GitHub token:", token);
 		await logUser();
 	} catch (error) {
@@ -1410,4 +1729,4 @@ async function warnIfAgentScopesInsufficient() {
 //#endregion
 export { state as A, GITHUB_GRAPHQL_URL as C, githubAgentGraphQLHeaders as D, copilotVersion as E, githubAgentHeaders as O, GITHUB_API_BASE_URL as S, copilotHeaders as T, forwardError as _, cacheCopilotVersion as a, sanitizeTransportText as b, filterBetaHeader as c, resolveModel as d, sleep as f, HTTPError as g, isAllowedCopilotHost as h, tryRefreshAndRetry as i, githubHeaders as k, isNullish as l, getGitHubUser as m, setupGitHubAgentToken as n, cacheModels as o, getModels as p, setupGitHubToken as r, cacheVSCodeVersion as s, setupCopilotToken as t, resolveCodexModel as u, classifyTransportError as v, copilotBaseUrl as w, withTransientRetry as x, fetchWithTransientRetry as y };
 
-//# sourceMappingURL=token-Bz7iN8US.js.map
+//# sourceMappingURL=token-Bz6HoH2H.js.map