feat(oauth): GitHub Copilot device-flow login#153
Closed
Wibias wants to merge 4 commits into
Closed
Conversation
Exchange a GitHub device-flow login for a short-lived Copilot API token via copilot_internal, with allowlisted verify/API URLs, redacted errors, and lazy-only refresh.
Wibias
changed the title
Avoid email-shaped URL userinfo literals and stop fabricating noreply addresses from GitHub login.
Accept CLI report schemaVersion 3 and grant pull-requests:read so fork PR changed-file listing works.
This reverts commit bc50cf2.
Contributor
Author
|
I do not have a Copilot account, so its kinda hard to test for me. |
lidge-jun
added a commit
that referenced
this pull request
Jul 19, 2026
…ewal, redaction, identity Security repairs for community PR #153 absorb (source head 1034be9), Sol C4 review findings: - registry: github-copilot preset gains allowKeyAuthOverride so persisted authMode:'key' users keep working after the key->oauth flip (router honors the override; same pattern as xai). - device flow: access-token-only success (classic gho_ tokens, no refresh token) is now valid; the credential refresh field carries the DURABLE GitHub grant (gho_ access token or ghr_ refresh token). def.refresh inspects the prefix: ghr_ -> refresh grant + Copilot exchange, otherwise direct Copilot re-exchange — expiry renewal and 401 recovery work for both. - poll cadence: wait-before-poll per RFC 8628, slow_down adds +5s (server interval wins), every poll fetch bounded by remaining flow lifetime. - redaction: GitHub token prefixes (ghp_/gho_/ghu_/ghs_/ghr_/github_pat_), the Copilot tid=...;...:sig token grammar, and raw JSON token fields are fully redacted; upstream-error path can no longer echo credentials. - identity: /user lookup retries once then FAILS the login — identity-less GitHub credentials are never persisted, so a transient failure cannot clobber another account via the active-slot replace path. - terminal refresh: allowlisted OAuth codes (invalid_grant/access_denied/ expired_token) surface as status-only messages and now match isTerminalRefreshError, marking needsReauth instead of retrying forever. - 401 replay: the oauth-401 refresh+replay branch now covers github-copilot (was reachable only for xai). - transport: OAuth bearers fail closed to allowlisted *.githubcopilot.com hosts even when the credential lacks endpoints.api or baseUrl was edited. - Activation tests for each repair (access-only login, gho_ re-exchange, terminal-code canary leak check, identity fail/retry, host fail-closed, token-grammar redaction). Co-authored-by: Wibias <37517432+Wibias@users.noreply.github.com>
lidge-jun
added a commit
that referenced
this pull request
Jul 19, 2026
…oss locales P3 follow-ups for community PR #153 absorb (source head 1034be9): - providers.md: preset catalog counts updated to the actual registry (53 presets: 42 key, 7 OAuth, 3 local, 1 forward). - ko/zh-cn provider guides: GitHub Copilot section now describes the device-flow OAuth login (ocx login github-copilot) with the unofficial- bridge caveat instead of the stale subscription-token guidance. - Removed the unused assertNoSecretLeak production helper from the oauth module (test-only concern living in production code). Co-authored-by: Wibias <37517432+Wibias@users.noreply.github.com>
Owner
|
Thanks — this was the biggest community contribution yet, and the device-flow architecture (VS Code client id → copilot_internal exchange, host allowlists, honest editor headers) was solid. It's landed on
Full suite green (3,087 tests) + privacy scan. Closing in favor of the dev-landed commits; ships with the next release. Closes #151. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ocx login github-copilot(GitHub device flow →copilot_internal/v2/tokenexchange) so Copilot Pro subscriptions work without a pasted API key.github-copilotregistry preset from key → oauth with candid ToS/client-id notes, editor fingerprint headers, andlazy-onlyrefresh.github.com/login/devicebrowser opens, allowlisted*.githubcopilot.comAPI hosts (noprojectIdoverload / SSRF), cancel/slow_downhandling.Closes #151
Notes for reviewers
Iv1.b507a08c87ecfe98) — unofficial bridge; GitHub may tighten this path.Test plan
bun test tests/github-copilot-oauth.test.ts tests/provider-registry-parity.test.ts tests/oauth-public-surface.test.tsocx login github-copilotwith an active Copilot Pro account — device code + dashboard login~/.opencodex/auth.jsonstores Copilot access + GitHub refresh (no secrets in CLI output)github-copilot/ default model and confirm 200