epjwjUdZddlmZddlZddlZddlZddlZddlZddlZddl m Z ddl m Z ddl mZmZejeZdZdZd Zd Zd Zd ZdNdZdOdZdPdZdQdZddddRdZiZded <d!Z d"Z!d#Z"d$Z#d Z$d%Z%d&Z&d'Z'iZ(d(ed)<d*Z)d+Z*e+hd,Z,dSd.Z-dTd2Z.dUd4Z/dVd6Z0dWd9Z1dXd=Z2d>d?dYdBZ3dZdCZ4d[dEZ5dFdGdHd\dMZ6dS)]uGitHub Copilot authentication utilities. Implements the OAuth device code flow used by the Copilot CLI and handles token validation/exchange for the Copilot API. Token type support (per GitHub docs): gho_ OAuth token ✓ (default via copilot login) github_pat_ Fine-grained PAT ✓ (needs Copilot Requests permission) ghu_ GitHub App token ✓ (via environment variable) ghp_ Classic PAT ✗ NOT SUPPORTED Credential search order (matching Copilot CLI behaviour): 1. COPILOT_GITHUB_TOKEN env var 2. GH_TOKEN env var 3. GITHUB_TOKEN env var 4. gh auth token CLI fallback ) annotationsN)Path)Optional) IS_WINDOWSwindows_hide_flagszIv1.b507a08c87ecfe98ghp_)gho_ github_pat_ghu_)COPILOT_GITHUB_TOKENGH_TOKEN GITHUB_TOKENtokenstrreturntuple[bool, str]cn|}|sdS|trdSdS)zYValidate that a token is usable with the Copilot API. Returns (valid, message). )Fz Empty token)Fu3Classic Personal Access Tokens (ghp_*) are not supported by the Copilot API. Use one of: → `copilot login` or `hermes model` to authenticate via OAuth → A fine-grained PAT (github_pat_*) with Copilot Requests permission → `gh auth login` with the default device code flow (produces gho_* tokens))TOK)strip startswith_CLASSIC_PAT_PREFIX)rs =/home/thesage/.hermes/hermes-agent/hermes_cli/copilot_auth.pyvalidate_copilot_tokenr6sG KKMME $## +,,    :tuple[str, str]cd}tD]d}tj|d}|r9d}t |\}}|st d||^||fcSe|rt ddSt}|r*t |\}}|std||dfSdS) zResolve a GitHub token suitable for Copilot API use. Returns (token, source) where source describes where the token came from. Raises ValueError if only a classic PAT is available. FTz"Token from %s is not supported: %szCopilot env var(s) set but none held a supported token; skipping `gh auth token` fallback to honor explicit env-var intent (and avoid the subprocess cost on cold start, #60800).)rrz5Token from `gh auth token` is a classic PAT (ghp_*). z gh auth token) COPILOT_ENV_VARSosgetenvrrloggerwarningdebug_try_gh_cli_token ValueError)any_env_var_setenv_varvalvalidmsgrs rresolve_copilot_tokenr-KsO#   i$$**,,  "O/44JE3 8'3<    &  L   v   E &+E22 s MMM o%% 6r list[str]cng}tjd}|r||ddtt jdz dz dz fD]Z}||vrt j|r4t j |t j r||[|S)zIReturn candidate ``gh`` binary paths, including common Homebrew installs.ghz/opt/homebrew/bin/ghz/usr/local/bin/ghz.localbin) shutilwhichappendrrhomer!pathisfileaccessX_OK) candidatesresolved candidates r_gh_cli_candidatesr=|sJ|D!!H$(###  DIKK( "U *T 122))  " "  7>>) $ $ )9bg)F)F )   i ( ( ( r Optional[str]c Ftjdd}dtjD}t rdt ini}tD]}|ddg}|r|d|gz } tj |fddd d d |d |}n?#ttj f$r&}t d ||Yd}~bd}~wwxYw|jdkr4|jr|jcSdS)aaReturn a token from ``gh auth token`` when the GitHub CLI is available. When COPILOT_GH_HOST is set, passes ``--hostname`` so gh returns the correct host's token. Also strips GITHUB_TOKEN / GH_TOKEN from the subprocess environment so ``gh`` reads from its own credential store (hosts.yml) instead of just echoing the env var back. COPILOT_GH_HOSTrc"i|] \}}|dv || S)>r r).0kvs r z%_try_gh_cli_token..s3;;;$!Q999A999r creationflagsauthrz --hostnameTutf-8replacer)capture_outputtextencodingerrorstimeoutenvz#gh CLI token lookup failed (%s): %sNr)r!r"renvironitemsrrr= subprocessrunFileNotFoundErrorTimeoutExpiredr#r% returncodestdout)hostname clean_env _popen_kwargsgh_pathcmdresultexcs rr&r&sqy*B//5577H;;"*"2"2"4"4;;;I@JQ_&8&:&:;;rM%''))(  , L(+ +C ^#GI   FF":#<=    LL> M M M HHHH    ! !fm&9&9&;&; !=&&(( ( ( ( 4sB""C8CCz github.comi,)hosttimeout_secondsr`rafloatc8 ddl}ddl}|d}d|d}d|d}|jt dd}|j||d d d d  } |j |d5}tj | } dddn #1swxYwYnE#t$r8} td| t#d| Yd} ~ dSd} ~ wwxYw| dd} | dd} | dd} t'| dt(d}| r| st#ddSt#t#d| t#d| t#t#dddt+j|z}t+j|krKt+j|t0z|jt | dd }|j||d d d d  } |j |d!5}tj | }dddn #1swxYwYn##t$rt#d"ddYwxYw|d#rt#d$|d#S|d%d}|d&krt#d"ddw|d'kr`|d}t3|t4t6fr|dkrt5|}n|d(z }t#d"dd|d)krt#t#d*dS|d+krt#t#d,dS|r"t#t#d-|dSt+j|kKt#t#d.dS)/a Run the GitHub OAuth device code flow for Copilot. Prints instructions for the user, polls for completion, and returns the OAuth access token on success, or None on failure/cancellation. This replicates the flow used by opencode and the Copilot CLI. rN/https://z/login/device/codez/login/oauth/access_tokenz read:user) client_idscopeapplication/jsonz!application/x-www-form-urlencodedHermesAgent/1.0)Acceptz Content-Type User-Agent)dataheadersrOz+Failed to initiate device authorization: %su, ✗ Failed to start device authorization: verification_urizhttps://github.com/login/device user_coder device_codeintervalu* ✗ GitHub did not return a device code.z! Open this URL in your browser: z Enter this code: z Waiting for authorization...T)endflushz,urn:ietf:params:oauth:grant-type:device_code)rfrr grant_type . access_tokenu ✓errorauthorization_pending slow_downr expired_tokenu, ✗ Device code expired. Please try again. access_deniedu ✗ Authorization was denied.u ✗ Authorization failed: u* ✗ Timed out waiting for authorization.)urllib.request urllib.parserstripparse urlencodeCOPILOT_OAUTH_CLIENT_IDencoderequestRequesturlopenjsonloadsreaddecode Exceptionr#r{printgetmax_DEVICE_CODE_POLL_INTERVALtime monotonicsleep_DEVICE_CODE_POLL_SAFETY_MARGIN isinstanceintrb)r`raurllibdomaindevice_code_urlaccess_token_urlrlreqresp device_datar_rprqrrrsdeadline poll_datapoll_reqr^r{server_intervals rcopilot_device_code_loginrs{ [[  F;;;;OC&CCC < ! !,##  vxx .  (?+   !  C ^ # #C # 4 4 ;*TYY[[%7%7%9%9::K ; ; ; ; ; ; ; ; ; ; ; ; ; ; ;  BCHHH BSBBCCCttttt #'9;\]] R00I//-44K;??:/IJJANNH i :;;;t GGG @.> @ @AAA + + +,,, GGG *$????~/1H .  X % % 8==>>>L**0&H, ,    688  >)) , C/*   ''"'== :DIIKK$6$6$8$899 : : : : : : : : : : : : : : :    #2T * * * * H  ::n % % * &MMM.) ) 7B'' + + + #2T * * * *  k ! !$jj44O/C<88 _q=P=P//A  #2T * * * *  o % % GGG @ A A A4 o % % GGG 3 4 4 44   GGG 888 9 9 94m .  X % %p GGG 6777 4srC-9C! C-!C%%C-(C%)C-- D/7-D**D/%L9L: LL  L L LL21L2z+dict[str, tuple[str, float, Optional[str]]] _jwt_cachexz0https://api.github.com/copilot_internal/v2/tokenvscode/1.104.1zGitHubCopilotChat/0.26.7g?z.copilot_jwt.jsonizdict[str, float]_exchange_failure_cachegN@g @> raw_tokencddl}||ddS)zNShort fingerprint of a raw token for cache keying (avoids storing full token).rN)hashlibsha256r hexdigest)rrs r_token_fingerprintr\s>NNN >>)**,, - - 7 7 9 9#2# >>rr6rOptional[dict]ct |jtkr"tdtdSt j|d}t|tr|ndS#t$r&}td|Yd}~dSd}~wwxYw)ugBounded read of the on-disk JWT store → dict, or None if unusable. Single chokepoint for every read of the persisted store (load, eviction, save-merge). A well-formed store is a few KB; a file over the 1 MiB cap or with non-dict content is treated as unusable so a corrupt/oversized file can't balloon memory or get rewritten back out. z6Persisted Copilot JWT store exceeds %d bytes; ignoringNrIrMz.Failed to read persisted Copilot JWT store: %s) statst_size_JWT_DISK_MAX_BYTESr#r%rr read_textrdictr)r6loadedr_s r_read_jwt_storerbs  99;; !4 4 4 LLHJ]   4DNNGN<<==#FD11;vvt;  EsKKKtttttsABAB B7B22B7Nonec|sdSt|}t|dt|dt }|r|sdS t |}|||vr||=||jdz}| tj |d tj |dn#t$rYnwxYwtj||dSdSdS#t$r&}t d|Yd}~dSd}~wwxYw)aDrop any cached exchanged JWT for ``raw_token`` (in-process + on-disk). Used by the runtime stale-credential recovery path: when a live request starts failing with a Copilot ``model_not_available_for_integrator`` / ``model_not_supported`` 400, the cached exchanged token (or a degraded raw fallback that was cached in its place) is stale. Evicting both cache tiers forces the next ``exchange_copilot_token`` call to hit the network and mint a fresh token instead of returning the poisoned cache entry. N.tmprIrz&Failed to evict cached Copilot JWT: %s)rrpopr_jwt_disk_pathexistsr with_suffixsuffix write_textrdumpsr!chmodrrJr#r%)rfpr6storetmpr_s revict_cached_exchanged_tokenrws}  I & &BNN2tD)))   D t{{}} D%%  ub ""4;#788C NN4:e,,wN ? ? ? e$$$$     JsD ! ! ! ! !   DDD =sCCCCCCCCCDs=1ADC&%D& C30D2C33D ED<<EOptional[Path]cp ddlm}t|tz S#t$rYdSwxYw)zAPath to the on-disk exchanged-JWT cache (profile-aware), or None.rget_hermes_homeN)hermes_constantsrr_JWT_DISK_FILENAMErrs rrrsW444444OO%%&&);;; tts $' 55r*Optional[tuple[str, float, Optional[str]]]ct}|r|sdS t|}|||nd}t |t sdS|dd}t |ddpd}|d}|r|r|||fSn2#t$r%}t d|Yd}~nd}~wwxYwdS)uPLoad a persisted exchanged JWT for ``fp`` → (api_token, expires_at, base_url).N api_tokenr expires_atrbase_urlz(Failed to load persisted Copilot JWT: %s) rrrrrrrbrr#r%)rr6rentryrrrr_s r_load_jwt_from_diskrs   D t{{}}tF %%!&!2 " %&& 4IIk2.. 599\155:;; 99Z((  3 3j(2 2 FFF ?EEEEEEEEF 4s=C'AC C0 C++C0rrrct}|sdS i}|rt|pi}tjfd|D}|||d||<||jdz}|tj |d tj |dn#t$rYnwxYwtj || tj |ddS#t$rYdSwxYw#t$r&}td|Yd}~dSd}~wwxYw) z:Persist an exchanged JWT (0o600), pruning expired entries.Nci|]F\}}t|tr,t|ddpdkC||GS)rr)rrrbr)rCrDrEnows rrFz%_save_jwt_to_disk..sc   1!T"" (-QUU<-C-C-Hq'I'IC'O'O q'O'O'Or)rrrrrIrrz!Failed to persist Copilot JWT: %s)rrrrrRrrrrrr!rrrJr#r%) rrrrr6rrr_rs @r_save_jwt_to_diskrs   D ? ;;== 0#D))/REikk         #$   b t{V344 tz%((7;;;  HS%     D  3  HT5 ! ! ! ! !    DD  ??? 8#>>>>>>>>>?sZB)D#?CD# C"D#!C""D#;D D D#D  D## E-EEg$@rorO tuple[str, float, Optional[str]]c 2ddl}t|}t|}|r*|\}}}t j|t z kr|||fSt |}|r7|\}}}t j|t z kr|||ft|<|||fSt|d} t j| kr4tdt| t jz d|j tdd|tdtd  } d} d} d } tt D]-} |j | | 5}t%j|} dddn #1swxYwYn#t,$r}|} t/|d dpt/|dd}|t0vr#d} t2d|Yd}~nc|t dz krGt6|dzz}t2d|dzt ||t j|Yd}~'d}~wwxYw| I| rt:nt<}t j|zt|<tdt d| | t|d| dd}| dd}|std|rtA|nt jdz}d}| d}tC|tDrMtG|dpd$%d}|r|}|stM|}|||ft|<tO||||t2d|||||fS)aExchange a raw GitHub token for a short-lived Copilot API token. Calls ``GET https://api.github.com/copilot_internal/v2/token`` with the raw GitHub token and returns ``(api_token, expires_at, base_url)``. The returned token is a semicolon-separated string (not a standard JWT) used as ``Authorization: Bearer `` for Copilot API requests. ``base_url`` is the account-specific API host: the authoritative ``endpoints.api`` advertised by the exchange (enterprise/proxied accounts), falling back to a host derived from the token's ``proxy-ep`` field. Individual accounts have neither, so ``base_url`` is None. Results are cached in-process and reused until close to expiry. Raises ``ValueError`` on failure. rNgzHCopilot token exchange recently failed; skipping re-attempt for another sGETztoken rh) AuthorizationrkrjEditor-Version)methodrmFrocodestatusTz7Copilot token exchange rejected (HTTP %s); not retryingrtzCCopilot token exchange attempt %d/%d failed (%s); retrying in %.1fsz$Copilot token exchange failed after z attempts: rrrz+Copilot token exchange returned empty tokeni endpointsapirdz3Copilot token exchanged, expires_at=%s, base_url=%s)(rrrrr_JWT_REFRESH_MARGIN_SECONDSrrr'rrr_TOKEN_EXCHANGE_URL_EXCHANGE_USER_AGENT_EDITOR_VERSIONrange_EXCHANGE_MAX_ATTEMPTSrrrrrrgetattr!_EXCHANGE_PERMANENT_HTTP_STATUSESr#r%_EXCHANGE_BACKOFF_BASE_SECONDSr'_EXCHANGE_FAILURE_TTL_PERMANENT_SECONDS'_EXCHANGE_FAILURE_TTL_TRANSIENT_SECONDSrrbrrrrr_derive_base_url_from_proxy_epr)rrOrrcachedrrr disk_cached _fail_untilrrllast_excpermanent_failureattemptrr_rsleep_sttlr api_endpoints rexchange_copilot_tokenrs  I & &B^^B  F 3*0' :x 9;;&AA A Aj(2 2&b))K3*5' :x 9;;&AA A A'X>JrNj(2 2 *--b#66K y{{[   ={TY[[899 = = =   . 1i11.(-    !  C$ D$(H/00$$ $''W'== 8z$))++"4"4"6"677 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 E $ $ $HS&$//O73$3O3OF:::$(! M/!3338GaKH YaK!7g 7###! $" |! 9 3 38 '+ikkC&7# `3I ` `V^ ` `   D)))"%%I,**J HFGGG'1Hz"""dikkD6HJ#H%%I)T""$9==//5266<<>>EEcJJ  $#H =1)<<X6JrNb)Z::: LL= j( **sDG69F;/ G;F? ?GF? G JA I="AI==Jcfddl}|d|}|sdS|d}dD]0}||r|t |d}n1|d}|drd|t ddz}n|}d |S) aDerive the Copilot API base URL from a proxy-ep field in the token. The exchanged Copilot token is a semicolon-separated string like ``tid=xxx;exp=xxx;proxy-ep=proxy.enterprise.githubcopilot.com;...``. This extracts ``proxy-ep`` and converts it to an API base URL by replacing the leading ``proxy.`` with ``api.``. Returns ``https://{api_hostname}`` or None if proxy-ep is absent. rNz(?:^|;)\s*proxy-ep=([^;\s]+)rt)rezhttp://rdzproxy.zapi.re)researchgrouprlenr)rrmproxy_epprefixapi_hosts rrrjsIII 1599A twwqzzH)   v & & F -H E s##H8$$HS]]^^44 h  rtuple[str, Optional[str]]c|s|dfS t|\}}}||fS#t$r)}td||dfcYd}~Sd}~wwxYw)a2Exchange a raw GitHub token for a Copilot API token, with fallback. Convenience wrapper: returns ``(api_token, base_url)`` on success, or ``(raw_token, None)`` if the exchange fails (e.g. network error, unsupported account type). This preserves existing behaviour for accounts that don't need exchange while enabling access to internal-only models for those that do. ``base_url`` is the account-specific API endpoint advertised by the exchange (``endpoints.api``, with a ``proxy-ep`` fallback), or None for individual accounts. Nz2Copilot token exchange failed, using raw token: %s)rrr#r%)rr_rr_s rget_copilot_api_tokenr s $!7 !B!B 1h(""  I3OOO$s AA A ATF) is_agent_turn is_visionr boolr dict[str, str]c,dddd|rdndd}|rd|d <|S) z~Build the standard headers for Copilot API requests. Replicates the header set used by opencode and the Copilot CLI. rriz vscode-chatzconversation-editsagentuser)rrkzCopilot-Integration-Idz Openai-Intentz x-initiatortruezCopilot-Vision-RequestrB)r r rms rcopilot_request_headersrsB+'"/-"/;wwV G3,2() Nr)rrrr)rr)rr.)rr>)r`rrarbrr>)rrrr)r6rrr)rrrr)rr)rrrr) rrrrrrbrr>rr)rrrOrbrr)rrrr>)rrrr)r rr rrr)7__doc__ __future__rrloggingr!r2rSrpathlibrtypingrhermes_cli._subprocess_compatrr getLogger__name__r#rr_SUPPORTED_PREFIXESr rrrr-r=r&rr__annotations__rrrrrrrrrrr frozensetrrrrrrrrrr rrBrrr s$#"""""   HHHHHHHH  8 $ $15H"#*....b*!!!!P xxxxxx~;= <<<<!I"1!$(-/....*.'*0'%.Iooo$>$>!???? *!D!D!D!DH."?"?"?"?J@DG+G+G+G+G+G+T!!!!@4r