`gj[@BUdZddlmZddlZddlZddlZddlZddlZddlZddl m Z ddl m Z ddl mZmZej eZdZdZd Zd Zd Zd Zd%d Zd&dZd'dZd(dZddd d)dZiZded<dZ dZ!dZ"dZ#d*dZ$ddd+dZ%d,dZ&d-d Z'd!d"d# d.d$Z(y)/uGitHub Copilot authentication utilities. Implements the OAuth device code flow used by the Copilot CLI and handles token validation/exchange for the Copilot API. Token type support (per GitHub docs): gho_ OAuth token ✓ (default via copilot login) github_pat_ Fine-grained PAT ✓ (needs Copilot Requests permission) ghu_ GitHub App token ✓ (via environment variable) ghp_ Classic PAT ✗ NOT SUPPORTED Credential search order (matching Copilot CLI behaviour): 1. COPILOT_GITHUB_TOKEN env var 2. GH_TOKEN env var 3. GITHUB_TOKEN env var 4. gh auth token CLI fallback ) annotationsN)Path)Optional) IS_WINDOWSwindows_hide_flagszIv1.b507a08c87ecfe98ghp_)gho_ github_pat_ghu_)COPILOT_GITHUB_TOKENGH_TOKEN GITHUB_TOKENcV|j}|sy|jtryy)zYValidate that a token is usable with the Copilot API. Returns (valid, message). )Fz Empty token)Fu3Classic Personal Access Tokens (ghp_*) are not supported by the Copilot API. Use one of: → `copilot login` or `hermes model` to authenticate via OAuth → A fine-grained PAT (github_pat_*) with Copilot Requests permission → `gh auth login` with the default device code flow (produces gho_* tokens))TOK)strip startswith_CLASSIC_PAT_PREFIX)tokens J/root/.hermes/venv/lib/python3.12/site-packages/hermes_cli/copilot_auth.pyvalidate_copilot_tokenr6s. KKME # +,  ctD]V}tj|dj}|s*t |\}}|st j d||R||fcSt}|r"t |\}}|std||dfSy)zResolve a GitHub token suitable for Copilot API use. Returns (token, source) where source describes where the token came from. Raises ValueError if only a classic PAT is available. z"Token from %s is not supported: %sz5Token from `gh auth token` is a classic PAT (ghp_*). z gh auth token)rr) COPILOT_ENV_VARSosgetenvrrloggerwarning_try_gh_cli_token ValueError)env_varvalvalidmsgrs rresolve_copilot_tokenr'Ks$  ii$**, /4JE38'3<     E +E2 sGuM o%% rclg}tjd}|r|j|ddtt j dz dz dz fD]]}||vrt jj|s(t j|t jsM|j|_|S)zIReturn candidate ``gh`` binary paths, including common Homebrew installs.ghz/opt/homebrew/bin/ghz/usr/local/bin/ghz.localbin) shutilwhichappendstrrhomerpathisfileaccessX_OK) candidatesresolved candidates r_gh_cli_candidatesr7jsJ||D!H(#  DIIK( "U *T 12)  "  77>>) $9bgg)F   i () rc btjddj}tjj Dcic] \}}|dvr||}}}t r dt ini}tD]r}|ddg}|r|d|gz } tj|fddd |d |}|jd k(s=|jjsX|jjcSy cc}}w#ttjf$r!}tjd ||Yd }~d }~wwxYw)aaReturn a token from ``gh auth token`` when the GitHub CLI is available. When COPILOT_GH_HOST is set, passes ``--hostname`` so gh returns the correct host's token. Also strips GITHUB_TOKEN / GH_TOKEN from the subprocess environment so ``gh`` reads from its own credential store (hosts.yml) instead of just echoing the env var back. COPILOT_GH_HOSTr>r r creationflagsauthrz --hostnameTr)capture_outputtexttimeoutenvz#gh CLI token lookup failed (%s): %sNr)rrrenvironitemsrrr7 subprocessrunFileNotFoundErrorTimeoutExpiredrdebug returncodestdout) hostnamekv clean_env _popen_kwargsgh_pathcmdresultexcs rr!r!s>yy*B/557H#%**"2"2"4;$!Q99A;I;@J_&8&:;rM%')(  L(+ +C ^^#   F    !fmm&9&9&;==&&( (#)$ -;"":#<#<=  LL> M  sC. C44D. D))D.z github.comi,)hosttimeout_secondscddl}ddl}|jd}d|d}d|d}|jj t ddj }|jj||d d d d  } |jj|d5}tj|jj} ddd j%dd} | j%dd} | j%dd} t'| j%dt(d}| r| s t#dyt#t#d| t#d| t#t#dddt+j,|z}t+j,|krt+j.|t0z|jj t | dd j }|jj||d d d d  } |jj|d!5}tj|jj}dddj%d#rt#d$|d#S|j%d%d}|d&k(rt#d"dd'|d'k(rM|j%d}t3|t4t6fr|dkDr t5|}n|d(z }t#d"ddy|d)k(rt#t#d*y|d+k(rt#t#d,y|rt#t#d-|yt+j,|krt#t#d.y#1swYxYw#t$r.} tj!d| t#d| Yd} ~ yd} ~ wwxYw#1swYkxYw#t$rt#d"ddYgwxYw)/a Run the GitHub OAuth device code flow for Copilot. Prints instructions for the user, polls for completion, and returns the OAuth access token on success, or None on failure/cancellation. This replicates the flow used by opencode and the Copilot CLI. rN/https://z/login/device/codez/login/oauth/access_tokenz read:user) client_idscopeapplication/jsonz!application/x-www-form-urlencodedHermesAgent/1.0)Acceptz Content-Type User-Agent)dataheadersr>z+Failed to initiate device authorization: %su, ✗ Failed to start device authorization: verification_urizhttps://github.com/login/device user_coder device_codeintervalu* ✗ GitHub did not return a device code.z! Open this URL in your browser: z Enter this code: z Waiting for authorization...T)endflushz,urn:ietf:params:oauth:grant-type:device_code)rWrc grant_type . access_tokenu ✓errorauthorization_pending slow_downr expired_tokenu, ✗ Device code expired. Please try again. access_deniedu ✗ Authorization was denied.u ✗ Authorization failed: u* ✗ Timed out waiting for authorization.)urllib.request urllib.parserstripparse urlencodeCOPILOT_OAUTH_CLIENT_IDencoderequestRequesturlopenjsonloadsreaddecode Exceptionrrlprintgetmax_DEVICE_CODE_POLL_INTERVALtime monotonicsleep_DEVICE_CODE_POLL_SAFETY_MARGIN isinstanceintfloat)rRrSurllibdomaindevice_code_urlaccess_token_urlr]reqresp device_datarQrarbrcrddeadline poll_datapoll_reqrPrlserver_intervals rcopilot_device_code_loginrs [[ F (:;O!&)BC << ! !,# vx ..  (?+  ! C ^^ # #C # 4 ;**TYY[%7%7%9:K ;#'9;\] R0I//-4K;??:/IJANH i :; G -.>-? @A  { +, G *$?~~/1H .. X % 8==>LL**0&H,   68  >>)) , C/*  ''"'= :DIIK$6$6$89 : ::n % &M.) ) 7B' + + #2T *  k !$jj4O/C<8_q=P/A  #2T *  o % G @ A o % G 3 4  G 08 9m .. X %p G 67 i ; ;  BCH >)**, - 7 7 9#2 >>rg$@r`c ddl}t|}tj|}|r)|\}}}t j|t z kr|||fS|j jtdd|tdtd} |j j||5} tj| jj} ddd jd d }| jd d}|s t#d |r t%|nt jdz}d}| jd} t'| t(r?t+| jdxsd j-j/d} | r| }|s t1|}|||ft|<t2j5d|||||fS#1swYxYw#t $r} t#d | | d} ~ wwxYw)aExchange a raw GitHub token for a short-lived Copilot API token. Calls ``GET https://api.github.com/copilot_internal/v2/token`` with the raw GitHub token and returns ``(api_token, expires_at, base_url)``. The returned token is a semicolon-separated string (not a standard JWT) used as ``Authorization: Bearer `` for Copilot API requests. ``base_url`` is the account-specific API host: the authoritative ``endpoints.api`` advertised by the exchange (enterprise/proxied accounts), falling back to a host derived from the token's ``proxy-ep`` field. Individual accounts have neither, so ``base_url`` is None. Results are cached in-process and reused until close to expiry. Raises ``ValueError`` on failure. rNGETztoken rY) Authorizationr\r[Editor-Version)methodr^r`zCopilot token exchange failed: rr expires_atz+Copilot token exchange returned empty tokeni endpointsapirUz3Copilot token exchanged, expires_at=%s, base_url=%s)rqrrrr_JWT_REFRESH_MARGIN_SECONDSrxry_TOKEN_EXCHANGE_URL_EXCHANGE_USER_AGENT_EDITOR_VERSIONrzr{r|r}r~rr"rrdictr.rrs_derive_base_url_from_proxy_eprrF)rr>rfpcached api_tokenrbase_urlrrr]rQr api_endpoints rexchange_copilot_tokenr3s  I &B^^B F *0' :x 99;&AA Aj(2 2 .. %i[1.(-   ! CK ^^ # #C # 9 4T::diik0023D 4 "%I,*J FGG'1z"diikD6HJ#H%I)T"9==/526<<>EEcJ #H 1)<X6JrN LL= j( **E 4 4 K:3%@AsJKs0G 2GGG G G/G**G/cddl}|jd|}|sy|jd}dD]#}|j|s|t |d}n|j d}|jdrd|t ddz}n|}d |S) aDerive the Copilot API base URL from a proxy-ep field in the token. The exchanged Copilot token is a semicolon-separated string like ``tid=xxx;exp=xxx;proxy-ep=proxy.enterprise.githubcopilot.com;...``. This extracts ``proxy-ep`` and converts it to an API base URL by replacing the leading ``proxy.`` with ``api.``. Returns ``https://{api_hostname}`` or None if proxy-ep is absent. rNz(?:^|;)\s*proxy-ep=([^;\s]+)re)rVzhttp://rUzproxy.zapi.rV)researchgrouprlenrs)rrmproxy_epprefixapi_hosts rrrs 159A wwqzH)   v &F -H s#H8$HS]^44 hZ  rc|s|dfS t|\}}}||fS#t$r$}tjd||dfcYd}~Sd}~wwxYw)a2Exchange a raw GitHub token for a Copilot API token, with fallback. Convenience wrapper: returns ``(api_token, base_url)`` on success, or ``(raw_token, None)`` if the exchange fails (e.g. network error, unsupported account type). This preserves existing behaviour for accounts that don't need exchange while enabling access to internal-only models for those that do. ``base_url`` is the account-specific API endpoint advertised by the exchange (``endpoints.api``, with a ``proxy-ep`` fallback), or None for individual accounts. Nz2Copilot token exchange failed, using raw token: %s)rrrrF)rr_rrQs rget_copilot_api_tokenrs[ $!7 !B 1h(""  I3O$s AAAATF) is_agent_turn is_visionc,dddd|rdndd}|rd|d <|S) z~Build the standard headers for Copilot API requests. Replicates the header set used by opencode and the Copilot CLI. rrZz vscode-chatzconversation-editsagentuser)rr\zCopilot-Integration-Idz Openai-Intentz x-initiatortruezCopilot-Vision-Request)rrr^s rcopilot_request_headersrs3+'"/-"/wV G,2() Nr)rr.returnztuple[bool, str])rztuple[str, str])rz list[str])r Optional[str])rRr.rSrrr)rr.rr.)rr.r>rrz tuple[str, float, Optional[str]])rr.rr)rr.rztuple[str, Optional[str]])rboolrrrzdict[str, str]))__doc__ __future__rr{loggingrr+rBrpathlibrtypingrhermes_cli._subprocess_compatrr getLogger__name__rrvr_SUPPORTED_PREFIXESrrrrr'r7r!rr__annotations__rrrrrrrrrrrrrs$#   H   8 $15H"#*>*!P x xx x~;= 7<!I"1? @DI+X!@4 r