(Gj[@,UdZddlmZddlZddlZddlZddlZddlZddlZddl m Z ddl m Z ddl mZmZejeZdZdZd Zd Zd Zd Zd7dZd8dZd9dZd:dZdddd;dZiZded <d!Z d"Z!d#Z"d$Z#dd,Z&d?d.Z'd/d0d1d@d6Z(dS)AuGitHub Copilot authentication utilities. Implements the OAuth device code flow used by the Copilot CLI and handles token validation/exchange for the Copilot API. Token type support (per GitHub docs): gho_ OAuth token ✓ (default via copilot login) github_pat_ Fine-grained PAT ✓ (needs Copilot Requests permission) ghu_ GitHub App token ✓ (via environment variable) ghp_ Classic PAT ✗ NOT SUPPORTED Credential search order (matching Copilot CLI behaviour): 1. COPILOT_GITHUB_TOKEN env var 2. GH_TOKEN env var 3. GITHUB_TOKEN env var 4. gh auth token CLI fallback ) annotationsN)Path)Optional) IS_WINDOWSwindows_hide_flagszIv1.b507a08c87ecfe98ghp_)gho_ github_pat_ghu_)COPILOT_GITHUB_TOKENGH_TOKEN GITHUB_TOKENtokenstrreturntuple[bool, str]cn|}|sdS|trdSdS)zYValidate that a token is usable with the Copilot API. Returns (valid, message). )Fz Empty token)Fu3Classic Personal Access Tokens (ghp_*) are not supported by the Copilot API. Use one of: → `copilot login` or `hermes model` to authenticate via OAuth → A fine-grained PAT (github_pat_*) with Copilot Requests permission → `gh auth login` with the default device code flow (produces gho_* tokens))TOK)strip startswith_CLASSIC_PAT_PREFIX)rs =/home/rurouni/.hermes/hermes-agent/hermes_cli/copilot_auth.pyvalidate_copilot_tokenr6sG KKMME $## +,,    :tuple[str, str]cNtD]b}tj|d}|r7t |\}}|st d||\||fcSct}|r*t |\}}|std||dfSdS)zResolve a GitHub token suitable for Copilot API use. Returns (token, source) where source describes where the token came from. Raises ValueError if only a classic PAT is available. z"Token from %s is not supported: %sz5Token from `gh auth token` is a classic PAT (ghp_*). z gh auth token)rr) COPILOT_ENV_VARSosgetenvrrloggerwarning_try_gh_cli_token ValueError)env_varvalvalidmsgrs rresolve_copilot_tokenr+Ks$   i$$**,,  /44JE3 8'3<       E &+E22 s MMM o%% 6r list[str]cng}tjd}|r||ddtt jdz dz dz fD]Z}||vrt j|r4t j |t j r||[|S)zIReturn candidate ``gh`` binary paths, including common Homebrew installs.ghz/opt/homebrew/bin/ghz/usr/local/bin/ghz.localbin) shutilwhichappendrrhomer!pathisfileaccessX_OK) candidatesresolved candidates r_gh_cli_candidatesr;jsJ|D!!H$(###  DIKK( "U *T 122))  " "  7>>) $ $ )9bg)F)F )   i ( ( ( r Optional[str]c Btjdd}dtjD}t rdt ini}tD]}|ddg}|r|d|gz } tj |fddd |d |}n?#ttj f$r&}t d ||Yd }~`d }~wwxYw|jd kr4|jr|jcSd S)aaReturn a token from ``gh auth token`` when the GitHub CLI is available. When COPILOT_GH_HOST is set, passes ``--hostname`` so gh returns the correct host's token. Also strips GITHUB_TOKEN / GH_TOKEN from the subprocess environment so ``gh`` reads from its own credential store (hosts.yml) instead of just echoing the env var back. COPILOT_GH_HOSTrc"i|] \}}|dv || S)>r r).0kvs r z%_try_gh_cli_token..s3;;;$!Q999A999r creationflagsauthrz --hostnameTr)capture_outputtexttimeoutenvz#gh CLI token lookup failed (%s): %sNr)r!r"renvironitemsrrr; subprocessrunFileNotFoundErrorTimeoutExpiredr#debug returncodestdout)hostname clean_env _popen_kwargsgh_pathcmdresultexcs rr%r%smy*B//5577H;;"*"2"2"4"4;;;I@JQ_&8&:&:;;rM%''))(  , L(+ +C ^#   FF":#<=    LL> M M M HHHH    ! !fm&9&9&;&; !=&&(( ( ( ( 4sB  C6CCz github.comi,)hosttimeout_secondsr[r\floatc8 ddl}ddl}|d}d|d}d|d}|jt dd}|j||d d d d  } |j |d5}tj | } dddn #1swxYwYnE#t$r8} td| t#d| Yd} ~ dSd} ~ wwxYw| dd} | dd} | dd} t'| dt(d}| r| st#ddSt#t#d| t#d| t#t#dddt+j|z}t+j|krKt+j|t0z|jt | dd }|j||d d d d  } |j |d!5}tj | }dddn #1swxYwYn##t$rt#d"ddYwxYw|d#rt#d$|d#S|d%d}|d&krt#d"ddw|d'kr`|d}t3|t4t6fr|dkrt5|}n|d(z }t#d"dd|d)krt#t#d*dS|d+krt#t#d,dS|r"t#t#d-|dSt+j|kKt#t#d.dS)/a Run the GitHub OAuth device code flow for Copilot. Prints instructions for the user, polls for completion, and returns the OAuth access token on success, or None on failure/cancellation. This replicates the flow used by opencode and the Copilot CLI. rN/https://z/login/device/codez/login/oauth/access_tokenz read:user) client_idscopeapplication/jsonz!application/x-www-form-urlencodedHermesAgent/1.0)Acceptz Content-Type User-Agent)dataheadersrIz+Failed to initiate device authorization: %su, ✗ Failed to start device authorization: verification_urizhttps://github.com/login/device user_coder device_codeintervalu* ✗ GitHub did not return a device code.z! Open this URL in your browser: z Enter this code: z Waiting for authorization...T)endflushz,urn:ietf:params:oauth:grant-type:device_code)rarm grant_type . access_tokenu ✓errorauthorization_pending slow_downr expired_tokenu, ✗ Device code expired. Please try again. access_deniedu ✗ Authorization was denied.u ✗ Authorization failed: u* ✗ Timed out waiting for authorization.)urllib.request urllib.parserstripparse urlencodeCOPILOT_OAUTH_CLIENT_IDencoderequestRequesturlopenjsonloadsreaddecode Exceptionr#rvprintgetmax_DEVICE_CODE_POLL_INTERVALtime monotonicsleep_DEVICE_CODE_POLL_SAFETY_MARGIN isinstanceintr])r[r\urllibdomaindevice_code_urlaccess_token_urlrgreqresp device_datarZrkrlrmrndeadline poll_datapoll_reqrYrvserver_intervals rcopilot_device_code_loginrs{ [[  F;;;;OC&CCC < ! !,##  vxx .  (?+   !  C ^ # #C # 4 4 ;*TYY[[%7%7%9%9::K ; ; ; ; ; ; ; ; ; ; ; ; ; ; ;  BCHHH BSBBCCCttttt #'9;\]] R00I//-44K;??:/IJJANNH i :;;;t GGG @.> @ @AAA + + +,,, GGG *$????~/1H .  X % % 8==>>>L**0&H, ,    688  >)) , C/*   ''"'== :DIIKK$6$6$8$899 : : : : : : : : : : : : : : :    #2T * * * * H  ::n % % * &MMM.) ) 7B'' + + + #2T * * * *  k ! !$jj44O/C<88 _q=P=P//A  #2T * * * *  o % % GGG @ A A A4 o % % GGG 3 4 4 44   GGG 888 9 9 94m .  X % %p GGG 6777 4srC-9C! C-!C%%C-(C%)C-- D/7-D**D/%L9L: LL  L L LL21L2z+dict[str, tuple[str, float, Optional[str]]] _jwt_cachexz0https://api.github.com/copilot_internal/v2/tokenvscode/1.104.1zGitHubCopilotChat/0.26.7 raw_tokencddl}||ddS)zNShort fingerprint of a raw token for cache keying (avoids storing full token).rN)hashlibsha256r hexdigest)rrs r_token_fingerprintr-s>NNN >>)**,, - - 7 7 9 9#2# >>rg$@rjrI tuple[str, float, Optional[str]]c zddl}t|}t|}|r*|\}}}t j|t z kr|||fS|jtdd|tdtd} |j ||5} tj | } dddn #1swxYwYn%#t $r} t#d | | d} ~ wwxYw| d d }| d d}|st#d |rt%|nt jdz}d}| d} t'| t(rMt+| dpd d} | r| }|st1|}|||ft|<t2d|||||fS)aExchange a raw GitHub token for a short-lived Copilot API token. Calls ``GET https://api.github.com/copilot_internal/v2/token`` with the raw GitHub token and returns ``(api_token, expires_at, base_url)``. The returned token is a semicolon-separated string (not a standard JWT) used as ``Authorization: Bearer `` for Copilot API requests. ``base_url`` is the account-specific API host: the authoritative ``endpoints.api`` advertised by the exchange (enterprise/proxied accounts), falling back to a host derived from the token's ``proxy-ep`` field. Individual accounts have neither, so ``base_url`` is None. Results are cached in-process and reused until close to expiry. Raises ``ValueError`` on failure. rNGETztoken rc) AuthorizationrfreEditor-Version)methodrhrjzCopilot token exchange failed: rr expires_atz+Copilot token exchange returned empty tokeni endpointsapir_z3Copilot token exchanged, expires_at=%s, base_url=%s)r{rrrr_JWT_REFRESH_MARGIN_SECONDSrr_TOKEN_EXCHANGE_URL_EXCHANGE_USER_AGENT_EDITOR_VERSIONrrrrrrr&r]rdictrrr}_derive_base_url_from_proxy_epr#rQ)rrIrfpcached api_tokenrbase_urlrrrgrZr api_endpoints rexchange_copilot_tokenr3s  I & &B^^B  F 3*0' :x 9;;&AA A Aj(2 2 . 1i11.(-    !  CK ^ # #C # 9 9 4T:diikk002233D 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 KKK@3@@AAsJK"%%I,**J HFGGG'1Hz"""dikkD6HJ#H%%I)T""$9==//5266<<>>EEcJJ  $#H =1)<<X6JrN LL= j( **s<C<+9C0$ C<0C44C<7C48C<< DDDcfddl}|d|}|sdS|d}dD]0}||r|t |d}n1|d}|drd|t ddz}n|}d |S) aDerive the Copilot API base URL from a proxy-ep field in the token. The exchanged Copilot token is a semicolon-separated string like ``tid=xxx;exp=xxx;proxy-ep=proxy.enterprise.githubcopilot.com;...``. This extracts ``proxy-ep`` and converts it to an API base URL by replacing the leading ``proxy.`` with ``api.``. Returns ``https://{api_hostname}`` or None if proxy-ep is absent. rNz(?:^|;)\s*proxy-ep=([^;\s]+)ro)r`zhttp://r_zproxy.zapi.r`)researchgrouprlenr})rrmproxy_epprefixapi_hosts rrrsIII 1599A twwqzzH)   v & & F -H E s##H8$$HS]]^^44 h  rtuple[str, Optional[str]]c|s|dfS t|\}}}||fS#t$r)}td||dfcYd}~Sd}~wwxYw)a2Exchange a raw GitHub token for a Copilot API token, with fallback. Convenience wrapper: returns ``(api_token, base_url)`` on success, or ``(raw_token, None)`` if the exchange fails (e.g. network error, unsupported account type). This preserves existing behaviour for accounts that don't need exchange while enabling access to internal-only models for those that do. ``base_url`` is the account-specific API endpoint advertised by the exchange (``endpoints.api``, with a ``proxy-ep`` fallback), or None for individual accounts. Nz2Copilot token exchange failed, using raw token: %s)rrr#rQ)rr_rrZs rget_copilot_api_tokenrs $!7 !B!B 1h(""  I3OOO$s AA A ATF) is_agent_turn is_visionrboolrdict[str, str]c,dddd|rdndd}|rd|d <|S) z~Build the standard headers for Copilot API requests. Replicates the header set used by opencode and the Copilot CLI. rrdz vscode-chatzconversation-editsagentuser)rrfzCopilot-Integration-Idz Openai-Intentz x-initiatortruezCopilot-Vision-Requestr@)rrrhs rcopilot_request_headersrsB+'"/-"/;wwV G3,2() Nr)rrrr)rr)rr,)rr<)r[rr\r]rr<)rrrr)rrrIr]rr)rrrr<)rrrr)rrrrrr))__doc__ __future__rrloggingr!r0rMrpathlibrtypingrhermes_cli._subprocess_compatrr getLogger__name__r#rr_SUPPORTED_PREFIXESr rrrr+r;r%rr__annotations__rrrrrrrrrr@rrrs$#"""""   HHHHHHHH  8 $ $15H"#*>*!!!!P xxxxxx~;= <<<<!I"1???? @DI+I+I+I+I+I+X!!!!@4r