agentic-dev-loop 0.11.1__tar.gz → 0.12.0__tar.gz

{agentic_dev_loop-0.11.1/src/agentic_dev_loop.egg-info → agentic_dev_loop-0.12.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 0.11.1
+Version: 0.12.0
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -391,6 +391,12 @@ steps:
   engine-written output - captured step output, retry notes, artifacts, and
   `state_dir` files. (Hygiene: the declaring step's agent has already seen
   the value in its own env.)
+- **File provider and LLM keys.** `from: file` reads a host file (`key` is the
+  path, optional `json_key` selects a JSON field). The `llm:` block accepts
+  exactly one of `api_key_env` or `api_key_secret`; the resolved key joins the
+  redaction set. See [Copilot as an endpoint](docs/setup.md#copilot-subscription-endpoint-058)
+  for the GitHub Copilot subscription profile (`copilot-login` device flow,
+  `copilot-models` probe, and the required endpoint headers).
 
 ### Per-stage networking
 
@@ -462,6 +468,76 @@ lines, the sandbox's new lines are appended in order, both sides converge, and
 the run continues with `[isolation] merged concurrent edits: ...` on the
 console.
 
+### Copilot subscription endpoint
+
+GitHub Copilot subscriptions work as an OpenAI-compatible LLM endpoint: log in
+once, then point an `llm:` block at it. The smoke harness runs the same plan
+against both the Copilot endpoint and a standard OpenAI-compatible endpoint,
+so the provider choice is independent of the pipeline design.
+
+```bash
+agentic-dev-loop copilot-login    # device flow; writes the token (mode 600)
+agentic-dev-loop copilot-models   # the models this token's tier can use
+```
+
+```yaml
+llm:
+  model: openai/gpt-5.6-luna      # pro default; probe-validated (see below)
+  base_url: https://api.githubcopilot.com
+  api_key_secret:
+    from: file
+    key: ~/.agentic-dev-loop/auth/copilot.json
+    json_key: access_token
+  headers:
+    Copilot-Integration-Id: vscode-chat
+    Editor-Version: vscode/1.94.0
+    Openai-Intent: conversation-panel
+llms:
+  flash:
+    model: openai/gpt-4.1         # lite tier; no reasoning_effort (see below)
+    base_url: https://api.githubcopilot.com
+    api_key_secret:
+      from: file
+      key: ~/.agentic-dev-loop/auth/copilot.json
+      json_key: access_token
+    headers:
+      Copilot-Integration-Id: vscode-chat
+      Editor-Version: vscode/1.94.0
+      Openai-Intent: conversation-panel
+```
+
+- The `openai/` prefix on model names is required: litellm otherwise routes a
+  bare `claude-*` name through Anthropic's wire format, which the gateway
+  rejects. The prefix forces the OpenAI-compatible route.
+- The model pins are probe-validated against the live endpoint (2026-11-06).
+  `gpt-5.6-luna` routes through the Responses API (the SDK switches
+  automatically), accepts `xhigh`, and returns real verdicts on the review
+  step. `gpt-4.1` tool-calls cleanly on the chat path but hard-400s on any
+  `reasoning_effort`, so lite-tier steps set none.
+- The brief step runs on the pro model at `medium`: no-effort `gpt-4.1`
+  cannot satisfy the mechanical brief-coverage gate.
+- The engine forces string-encoded message content for Copilot configs: the
+  gateway silently drops ARRAY-encoded tool results, which would leave an
+  agent blind to its own terminal output.
+
+Known limitations (probe-validated, not speculation):
+
+- Anthropic models are unusable for agent steps on this endpoint: the claude
+  pins collapse to tool-less narration on review (planning-docs/059), and
+  claude-opus-4.8 returns two choices on the non-streamed path the engine
+  uses.
+- `gpt-4o-mini` caps chat context at 12288 tokens (it overran on the first
+  smoke run).
+- `gpt-4o` and `gpt-4.1` reject any `reasoning_effort` on the chat path.
+- `gpt-5.x` models are Responses-API-only.
+- kimi-k3 accepts only `low`/`high`/`max` effort, and its tool results were
+  dropped by the gateway until the string-content policy above.
+- `gpt-4.1` carries a gateway "utility model" rate limit that a sustained dev
+  loop can trip; it resets within minutes.
+
+See [docs/setup.md](docs/setup.md#copilot-subscription-endpoint-058) for the
+token lifecycle, the probe-validated headers, and the full details.
+
 
 ## Authoring a loop for your own repo
 

{agentic_dev_loop-0.11.1 → agentic_dev_loop-0.12.0}/README.md

@@ -347,6 +347,12 @@ steps:
   engine-written output - captured step output, retry notes, artifacts, and
   `state_dir` files. (Hygiene: the declaring step's agent has already seen
   the value in its own env.)
+- **File provider and LLM keys.** `from: file` reads a host file (`key` is the
+  path, optional `json_key` selects a JSON field). The `llm:` block accepts
+  exactly one of `api_key_env` or `api_key_secret`; the resolved key joins the
+  redaction set. See [Copilot as an endpoint](docs/setup.md#copilot-subscription-endpoint-058)
+  for the GitHub Copilot subscription profile (`copilot-login` device flow,
+  `copilot-models` probe, and the required endpoint headers).
 
 ### Per-stage networking
 
@@ -418,6 +424,76 @@ lines, the sandbox's new lines are appended in order, both sides converge, and
 the run continues with `[isolation] merged concurrent edits: ...` on the
 console.
 
+### Copilot subscription endpoint
+
+GitHub Copilot subscriptions work as an OpenAI-compatible LLM endpoint: log in
+once, then point an `llm:` block at it. The smoke harness runs the same plan
+against both the Copilot endpoint and a standard OpenAI-compatible endpoint,
+so the provider choice is independent of the pipeline design.
+
+```bash
+agentic-dev-loop copilot-login    # device flow; writes the token (mode 600)
+agentic-dev-loop copilot-models   # the models this token's tier can use
+```
+
+```yaml
+llm:
+  model: openai/gpt-5.6-luna      # pro default; probe-validated (see below)
+  base_url: https://api.githubcopilot.com
+  api_key_secret:
+    from: file
+    key: ~/.agentic-dev-loop/auth/copilot.json
+    json_key: access_token
+  headers:
+    Copilot-Integration-Id: vscode-chat
+    Editor-Version: vscode/1.94.0
+    Openai-Intent: conversation-panel
+llms:
+  flash:
+    model: openai/gpt-4.1         # lite tier; no reasoning_effort (see below)
+    base_url: https://api.githubcopilot.com
+    api_key_secret:
+      from: file
+      key: ~/.agentic-dev-loop/auth/copilot.json
+      json_key: access_token
+    headers:
+      Copilot-Integration-Id: vscode-chat
+      Editor-Version: vscode/1.94.0
+      Openai-Intent: conversation-panel
+```
+
+- The `openai/` prefix on model names is required: litellm otherwise routes a
+  bare `claude-*` name through Anthropic's wire format, which the gateway
+  rejects. The prefix forces the OpenAI-compatible route.
+- The model pins are probe-validated against the live endpoint (2026-11-06).
+  `gpt-5.6-luna` routes through the Responses API (the SDK switches
+  automatically), accepts `xhigh`, and returns real verdicts on the review
+  step. `gpt-4.1` tool-calls cleanly on the chat path but hard-400s on any
+  `reasoning_effort`, so lite-tier steps set none.
+- The brief step runs on the pro model at `medium`: no-effort `gpt-4.1`
+  cannot satisfy the mechanical brief-coverage gate.
+- The engine forces string-encoded message content for Copilot configs: the
+  gateway silently drops ARRAY-encoded tool results, which would leave an
+  agent blind to its own terminal output.
+
+Known limitations (probe-validated, not speculation):
+
+- Anthropic models are unusable for agent steps on this endpoint: the claude
+  pins collapse to tool-less narration on review (planning-docs/059), and
+  claude-opus-4.8 returns two choices on the non-streamed path the engine
+  uses.
+- `gpt-4o-mini` caps chat context at 12288 tokens (it overran on the first
+  smoke run).
+- `gpt-4o` and `gpt-4.1` reject any `reasoning_effort` on the chat path.
+- `gpt-5.x` models are Responses-API-only.
+- kimi-k3 accepts only `low`/`high`/`max` effort, and its tool results were
+  dropped by the gateway until the string-content policy above.
+- `gpt-4.1` carries a gateway "utility model" rate limit that a sustained dev
+  loop can trip; it resets within minutes.
+
+See [docs/setup.md](docs/setup.md#copilot-subscription-endpoint-058) for the
+token lifecycle, the probe-validated headers, and the full details.
+
 
 ## Authoring a loop for your own repo
 

{agentic_dev_loop-0.11.1 → agentic_dev_loop-0.12.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentic-dev-loop"
-version = "0.11.1"
+version = "0.12.0"
 description = "Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase."
 readme = "README.md"
 requires-python = ">=3.12"

{agentic_dev_loop-0.11.1 → agentic_dev_loop-0.12.0}/src/agentic_dev_loop/core/config.py

@@ -10,12 +10,13 @@ from pathlib import Path
 from typing import Any, Literal
 
 import yaml
-from pydantic import BaseModel, ConfigDict, Field, field_validator, model_validator
+from pydantic import (BaseModel, ConfigDict, Field, field_validator,
+                      model_serializer, model_validator)
 
 from agentic_dev_loop.core.paths import _has_wildcards, path_excluded, relative_parts
 
 TERMINALS = frozenset({"success", "failure"})
-KNOWN_SECRET_PROVIDERS = frozenset({"env"})
+KNOWN_SECRET_PROVIDERS = frozenset({"env", "file"})
 MOUNT_MODES = frozenset({"rw", "ro"})
 # The egress preset names the engine ships (BR-9). Config validates the
 # name here; the target data lives in engine/presets.py (preset data,
@@ -183,14 +184,17 @@ def route_target(route: RouteTarget | None) -> str | None:
 
 class SecretSpec(BaseModel):
     """One ``secrets:`` ref - the locator only, never a value. ``from`` names
-    the provider (``env`` first); ``key`` is that provider's locator (for
+    the provider (``env`` or ``file``); ``key`` is that provider's locator (for
     ``env``, the host environment variable to read and the step env name to
-    inject). Unknown keys fail at load (extra="forbid")."""
+    inject; for ``file``, the JSON file path). ``json_key`` selects a key
+    inside the JSON file and is file-provider-only. Unknown keys fail at load
+    (extra="forbid")."""
 
     model_config = ConfigDict(extra="forbid", populate_by_name=True)
 
     from_: str = Field(alias="from")
     key: str
+    json_key: str | None = None
 
     @field_validator("from_")
     @classmethod
@@ -208,6 +212,28 @@ class SecretSpec(BaseModel):
             raise ValueError("secret key must be a non-empty string")
         return v
 
+    @field_validator("json_key")
+    @classmethod
+    def _nonempty_json_key(cls, v: str | None) -> str | None:
+        if v is not None and not v.strip():
+            raise ValueError("secret json_key must be a non-empty string")
+        return v
+
+    @model_validator(mode="after")
+    def _json_key_only_for_file(self) -> "SecretSpec":
+        if self.json_key is not None and self.from_ != "file":
+            raise ValueError(
+                "secret json_key is only valid with the 'file' provider")
+        return self
+
+    @model_serializer(mode="wrap")
+    def _omit_absent_json_key(self, handler):
+        """Keep the pre-058 env-provider dump shape byte-identical."""
+        data = handler(self)
+        if data.get("json_key") is None:
+            data.pop("json_key", None)
+        return data
+
 
 class IsolationConfig(BaseModel):
     """Optional `isolation:` section - configures the always-on sandbox (BR-2).
@@ -600,13 +626,29 @@ class LlmConfig(BaseModel):
 
     model: str
     base_url: str | None = None
-    api_key_env: str
+    # 058 (D3): exactly one host-side key mechanism - an environment variable
+    # (the existing shape) or a file-backed secret spec.
+    api_key_env: str | None = None
+    api_key_secret: SecretSpec | None = None
+    # 058 (D2): extra HTTP headers forwarded verbatim to the SDK LLM
+    # (``extra_headers``). Empty = no change for every existing pipeline.
+    headers: dict[str, str] = Field(default_factory=dict)
     timeout: float | None = None  # omitted → opinionated no-timeout default
     # 047 (D1) / 054 (D6): opt-in passthrough; unset means reasoning is off
     # (the engine forwards none and strips reasoning passback). The SDK
     # "high" default never engages because build_llm always passes the value.
     reasoning_effort: ReasoningEffort | None = None
 
+    @model_validator(mode="after")
+    def _exactly_one_api_key_mechanism(self) -> "LlmConfig":
+        has_env = self.api_key_env is not None
+        has_secret = self.api_key_secret is not None
+        if has_env == has_secret:
+            raise ValueError(
+                "set exactly one of 'api_key_env' or 'api_key_secret' on the "
+                "llm block (neither or both are invalid)")
+        return self
+
 
 class PipelineConfig(BaseModel):
     model_config = ConfigDict(extra="forbid")

{agentic_dev_loop-0.11.1 → agentic_dev_loop-0.12.0}/src/agentic_dev_loop/engine/cli.py

@@ -10,9 +10,12 @@ import json
 import os
 import signal
 import sys
+import threading
 from pathlib import Path
 
 from agentic_dev_loop.core.config import PipelineConfig, load_config
+from .copilot_auth import (TOKEN_PATH, CopilotAuthError, list_copilot_models,
+                           login, read_token)
 from .containers import containers_report
 from .isolation import isolation_state_dir, reap_orphaned_containers
 from .loaders import mark_plan_completed
@@ -46,6 +49,14 @@ def _restore_sigterm_handler(previous) -> None:
     signal.signal(signal.SIGTERM, previous)
 
 
+def _wait_for_interrupt() -> None:
+    """Block until the user presses ctrl+c; a bounded wait keeps the loop
+    responsive to signals without requiring a tty."""
+    idle = threading.Event()
+    while not idle.wait(1.0):
+        pass
+
+
 def _version() -> str:
     """The installed distribution version - the single source of truth."""
     try:
@@ -149,6 +160,52 @@ def _print_containers_report(report) -> None:
               f"run={run} pid={pid_s}")
 
 
+def _token_path(value: str | None) -> Path:
+    return Path(value).expanduser() if value else TOKEN_PATH.expanduser()
+
+
+def _run_copilot_login(argv: list[str]) -> int:
+    parser = argparse.ArgumentParser(
+        prog="agentic-dev-loop copilot-login",
+        description="Run the GitHub device flow and store the Copilot OAuth "
+                    "token (~/.agentic-dev-loop/auth/copilot.json, mode 600).")
+    parser.add_argument("--token-file", default=None,
+                        help="token path (default: "
+                             "~/.agentic-dev-loop/auth/copilot.json)")
+    args = parser.parse_args(argv)
+    path = _token_path(args.token_file)
+    try:
+        login(token_path=path)
+    except CopilotAuthError as e:
+        print(f"copilot-login: {e}", file=sys.stderr)
+        return 1
+    print(f"Copilot token written to {path}")
+    return 0
+
+
+def _run_copilot_models(argv: list[str]) -> int:
+    parser = argparse.ArgumentParser(
+        prog="agentic-dev-loop copilot-models",
+        description="List the Copilot models available to this token's tier.")
+    parser.add_argument("--token-file", default=None,
+                        help="token path (default: "
+                             "~/.agentic-dev-loop/auth/copilot.json)")
+    parser.add_argument("--json", action="store_true",
+                        help="emit the model list as JSON")
+    args = parser.parse_args(argv)
+    try:
+        models = list_copilot_models(read_token(_token_path(args.token_file)))
+    except CopilotAuthError as e:
+        print(f"copilot-models: {e}", file=sys.stderr)
+        return 1
+    if args.json:
+        print(json.dumps({"models": models}, sort_keys=True))
+    else:
+        for model in models:
+            print(model)
+    return 0
+
+
 def build_parser(cfg_path) -> argparse.ArgumentParser:
     """The full parser for one pipeline: core flags + loader-contributed."""
     registry, _ = _registry_for(cfg_path)
@@ -158,13 +215,17 @@ def build_parser(cfg_path) -> argparse.ArgumentParser:
     return parser
 
 
-def main(argv: list[str] | None = None) -> int:
+def main(argv: list[str] | None = None, *, keep_alive: bool = True) -> int:
     if argv is None:
         argv = sys.argv[1:]
     else:
         argv = list(argv)
     if argv and argv[0] == "containers":
         return _run_containers(argv[1:])
+    if argv and argv[0] == "copilot-login":
+        return _run_copilot_login(argv[1:])
+    if argv and argv[0] == "copilot-models":
+        return _run_copilot_models(argv[1:])
     if argv and argv[0] == "init":
         from .onboarding.init import run_init
         return run_init(argv[1:])
@@ -207,6 +268,12 @@ def main(argv: list[str] | None = None) -> int:
         if not success:
             print("agentic-dev-loop: pipeline failed - exiting with code 1",
                   file=sys.stderr)
+        if keep_alive and not args.no_viz:
+            print("Pipeline finished: press ctrl+c to exit")
+            try:
+                _wait_for_interrupt()
+            except KeyboardInterrupt:
+                pass
         return 0 if success else 1
     finally:
         _restore_sigterm_handler(previous)

agentic_dev_loop-0.12.0/src/agentic_dev_loop/engine/copilot_auth.py

@@ -0,0 +1,224 @@
+"""GitHub device flow for Copilot and the Copilot model-list probe (058).
+
+Copilot is used as an OpenAI-compatible endpoint on the existing OpenHands
+runtime: the device flow produces an OAuth access token that becomes the
+LLM's bearer credential. This module is stdlib-only and never runs during a
+pipeline run - the ``copilot-login`` subcommand hosts the interactive flow.
+
+The default client id belongs to OpenCode's OAuth app, not this project; it
+is the zero-setup default and is overridable via
+``AGENTIC_DEV_LOOP_COPILOT_CLIENT_ID`` for production use.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+from datetime import datetime, timezone
+from pathlib import Path
+
+DEVICE_CODE_URL = "https://github.com/login/device/code"
+TOKEN_URL = "https://github.com/login/oauth/access_token"
+COPILOT_BASE_URL = "https://api.githubcopilot.com"
+TOKEN_PATH = Path("~/.agentic-dev-loop/auth/copilot.json")
+
+DEFAULT_CLIENT_ID = "Iv1.b507a08c87ecfe98"
+DEFAULT_SCOPE = "copilot"
+CLIENT_ID_ENV = "AGENTIC_DEV_LOOP_COPILOT_CLIENT_ID"
+REQUEST_TIMEOUT = 30
+
+# Copilot endpoint headers, probe-validated 2026-11-06 against a real token:
+# these three are accepted at /models and /chat/completions.
+# X-GitHub-Api-Version: 2022-11-28 is NOT here: the live endpoint rejects it
+# with 400 "invalid apiVersion" at both endpoints (it was an unprobed
+# community value, now falsified - see aidlc-docs/audit.md).
+COPILOT_HEADERS = {
+    "Copilot-Integration-Id": "vscode-chat",
+    "Editor-Version": "vscode/1.94.0",
+    "Openai-Intent": "conversation-panel",
+}
+
+
+class CopilotAuthError(RuntimeError):
+    """A loud fail-fast auth failure naming the operator's next step."""
+
+
+def client_id() -> str:
+    """The OAuth app id: the overridable env var, else the pinned default."""
+    return os.environ.get(CLIENT_ID_ENV) or DEFAULT_CLIENT_ID
+
+
+def _open_json(request: urllib.request.Request, opener=None) -> dict:
+    opener = opener or urllib.request.urlopen
+    try:
+        with opener(request, timeout=REQUEST_TIMEOUT) as response:
+            return json.loads(response.read().decode("utf-8"))
+    except urllib.error.HTTPError as e:
+        raise CopilotAuthError(_http_error_message(e)) from e
+    except urllib.error.URLError as e:
+        raise CopilotAuthError(
+            f"could not reach {request.full_url}: {e.reason}") from e
+    except json.JSONDecodeError as e:
+        raise CopilotAuthError(
+            f"invalid JSON response from {request.full_url}") from e
+
+
+def _http_error_message(error: urllib.error.HTTPError) -> str:
+    if error.code in (401, 403):
+        return (
+            f"GitHub rejected the token (HTTP {error.code}). If this token "
+            "was created before the 058 Copilot scope fix, delete "
+            f"{TOKEN_PATH.expanduser()} and re-run "
+            "`agentic-dev-loop copilot-login` (the old token has the wrong "
+            "scope).")
+    return f"GitHub request failed (HTTP {error.code}): {error.reason}"
+
+
+def request_device_code(client_id_value: str | None = None,
+                        scope: str = DEFAULT_SCOPE, opener=None) -> dict:
+    data = urllib.parse.urlencode({
+        "client_id": client_id_value or client_id(),
+        "scope": scope,
+    }).encode("utf-8")
+    request = urllib.request.Request(
+        DEVICE_CODE_URL, data=data,
+        headers={"Accept": "application/json",
+                 "Content-Type": "application/x-www-form-urlencoded"},
+        method="POST")
+    return _open_json(request, opener)
+
+
+def poll_for_token(device_code: str, client_id_value: str | None = None,
+                   interval: float = 5, expires_in: float = 900,
+                   sleep=time.sleep, opener=None) -> dict:
+    """Poll the token endpoint until GitHub issues a token or reports a
+    terminal error. ``authorization_pending`` waits; ``slow_down`` grows the
+    interval. Anything else (expired, denied) fails fast."""
+    data = urllib.parse.urlencode({
+        "client_id": client_id_value or client_id(),
+        "device_code": device_code,
+        "grant_type": "urn:ietf:params:oauth:grant-type:device_code",
+    }).encode("utf-8")
+    request = urllib.request.Request(
+        TOKEN_URL, data=data,
+        headers={"Accept": "application/json",
+                 "Content-Type": "application/x-www-form-urlencoded"},
+        method="POST")
+    wait = max(0.0, float(interval))
+    deadline = time.monotonic() + max(0.0, float(expires_in))
+    while True:
+        payload = _open_json(request, opener)
+        if payload.get("access_token"):
+            return payload
+        error = payload.get("error")
+        if error == "authorization_pending":
+            pass
+        elif error == "slow_down":
+            wait += 5
+        else:
+            raise CopilotAuthError(
+                f"device flow failed: {error or 'unknown error'} - run "
+                "`agentic-dev-loop copilot-login` again")
+        if time.monotonic() >= deadline:
+            raise CopilotAuthError(
+                "the device code expired - run "
+                "`agentic-dev-loop copilot-login` again")
+        sleep(wait)
+
+
+def write_token(token: dict, token_path: Path | str | None = None) -> Path:
+    """Write the token JSON atomically-enough with mode 600 from creation."""
+    path = Path(token_path).expanduser() if token_path else TOKEN_PATH.expanduser()
+    path.parent.mkdir(parents=True, exist_ok=True)
+    payload = json.dumps(token, indent=2, sort_keys=True) + "\n"
+    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "w", encoding="utf-8") as handle:
+        handle.write(payload)
+    os.chmod(path, 0o600)
+    return path
+
+
+def login(token_path: Path | str | None = None, *,
+          client_id_value: str | None = None, scope: str = DEFAULT_SCOPE,
+          sleep=time.sleep, opener=None, printer=print) -> dict:
+    """Run the device flow and persist the token. Prints the verification URL
+    and user code; never called by build_llm or a pipeline run."""
+    device = request_device_code(
+        client_id_value=client_id_value, scope=scope, opener=opener)
+    uri = device.get("verification_uri") or device.get(
+        "verification_uri_complete")
+    code = device.get("user_code", "")
+    printer(f"Go to {uri} and enter code: {code}")
+    token = poll_for_token(
+        device["device_code"],
+        client_id_value=client_id_value,
+        interval=device.get("interval", 5),
+        expires_in=device.get("expires_in", 900),
+        sleep=sleep, opener=opener)
+    write_token(token, token_path)
+    return token
+
+
+def _is_expired(expires_at) -> bool:
+    if isinstance(expires_at, (int, float)):
+        return time.time() >= expires_at
+    if isinstance(expires_at, str):
+        try:
+            moment = datetime.fromisoformat(expires_at.replace("Z", "+00:00"))
+        except ValueError:
+            return False
+        return datetime.now(timezone.utc) >= moment
+    return False
+
+
+def read_token(token_path: Path | str | None = None) -> str:
+    """Read the stored access token. Missing, unreadable, expired, or
+    token-less files all fail fast with the copilot-login command."""
+    path = Path(token_path).expanduser() if token_path else TOKEN_PATH.expanduser()
+    if not path.is_file():
+        raise CopilotAuthError(
+            f"Copilot token not found at {path} - run "
+            "`agentic-dev-loop copilot-login`")
+    try:
+        payload = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError) as e:
+        raise CopilotAuthError(
+            f"Copilot token file {path} is unreadable: {e} - run "
+            "`agentic-dev-loop copilot-login` again") from e
+    token = payload.get("access_token") if isinstance(payload, dict) else None
+    if not isinstance(token, str) or not token:
+        raise CopilotAuthError(
+            f"Copilot token file {path} has no access_token - run "
+            "`agentic-dev-loop copilot-login` again")
+    if _is_expired(payload.get("expires_at")):
+        raise CopilotAuthError(
+            f"Copilot token at {path} has expired - run "
+            "`agentic-dev-loop copilot-login` again")
+    return token
+
+
+def list_copilot_models(token: str, opener=None) -> list[str]:
+    """GET /models for this token's tier (the probe behind copilot-models and
+    the smoke pre-flight). Premium models are plan-gated; never assume one."""
+    request = urllib.request.Request(
+        f"{COPILOT_BASE_URL}/models",
+        headers={"Authorization": f"Bearer {token}",
+                 "Accept": "application/json",
+                 **COPILOT_HEADERS},
+        method="GET")
+    payload = _open_json(request, opener)
+    data = payload.get("data") if isinstance(payload, dict) else None
+    if not isinstance(data, list):
+        raise CopilotAuthError(
+            "unexpected response from the Copilot /models endpoint")
+    models = [item.get("id") for item in data
+              if isinstance(item, dict) and isinstance(item.get("id"), str)]
+    if not models:
+        raise CopilotAuthError(
+            "the Copilot /models endpoint listed no models for this token's "
+            "tier - run `agentic-dev-loop copilot-login` and retry")
+    return models

{agentic_dev_loop-0.11.1 → agentic_dev_loop-0.12.0}/src/agentic_dev_loop/engine/llm.py

@@ -6,6 +6,9 @@ import os
 from openhands.sdk import LLM
 
 from agentic_dev_loop.core.config import LlmConfig
+from agentic_dev_loop.engine.provider_wire import adapter_for
+from agentic_dev_loop.engine.secrets import (
+    SecretResolutionError, resolve_secret_spec)
 
 # 054 (D8): reasoning passback is config-gated, never name-list-gated. The
 # SDK gates reasoning_content passback on a closed model-name list
@@ -82,20 +85,39 @@ if not getattr(_ORIGINAL_FORMAT_MESSAGES, "_agentic_dev_loop_reasoning_repair",
     LLM.format_messages_for_llm = _config_gated_reasoning_serializer
 
 
-def build_llm(cfg: LlmConfig, reasoning_effort: str | None = None) -> LLM:
+def resolve_api_key(cfg: LlmConfig, environ=None) -> str:
+    """Resolve the configured host-side key: the existing env mechanism, or
+    the file-backed secret spec. Missing values fail fast naming the fix."""
+    if cfg.api_key_secret is not None:
+        try:
+            return resolve_secret_spec(cfg.api_key_secret, environ)
+        except SecretResolutionError as e:
+            raise RuntimeError(f"llm api_key_secret: {e}") from e
     api_key = os.environ.get(cfg.api_key_env)
     if not api_key:
         raise RuntimeError(f"{cfg.api_key_env} environment variable is required")
+    return api_key
+
+
+def build_llm(cfg: LlmConfig, reasoning_effort: str | None = None) -> LLM:
+    api_key = resolve_api_key(cfg)
     # 054 (D6): a step's value wins, else the effective profile's value, else
     # off. reasoning_effort is always passed (None when unset) so the SDK
     # "high" default cannot engage; absent effort = reasoning off.
     effort = reasoning_effort if reasoning_effort is not None else cfg.reasoning_effort
+    # Copilot gateway policy (provider_wire.py): the gateway silently drops
+    # ARRAY-encoded tool-result content, so Copilot-configured instances
+    # force the SDK's documented string content serializer. Every other
+    # gateway keeps the SDK default (None = auto-detect by model registry).
+    adapter = adapter_for(cfg.base_url)
     llm = LLM(
         model=cfg.model,
         api_key=api_key,
         base_url=cfg.base_url,
         timeout=cfg.timeout,  # policy: no LLM timeout unless explicitly set
         reasoning_effort=effort,
+        extra_headers=dict(cfg.headers),
+        force_string_serializer=adapter.force_string_serializer if adapter else None,
     )
     llm._agentic_dev_loop_reasoning_effort = effort
     return llm