feat(runtime-host): sign in to GitHub Copilot with a device grant

apps/desktop/package.json

@@ -71,6 +71,7 @@
     "@ant-design/icons-svg": "4.5.0",
     "@astryxdesign/core": "0.5.2",
     "@astryxdesign/theme-neutral": "0.5.2",
+    "@babel/parser": "7.29.7",
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/sortable": "^10.0.0",
     "@fontsource-variable/geist": "^5.3.0",

apps/desktop/renderer-architecture.json

@@ -175,7 +175,6 @@
     "src/renderer/settings/runtime-host-onboarding-dialog.tsx",
     "src/renderer/settings/runtime-host-profiles-section.tsx",
     "src/renderer/settings/runtime-host-project-directory-editor.tsx",
-    "src/renderer/settings/runtime-host-settings-bridge.ts",
     "src/renderer/settings/runtime-host-settings-target.tsx",
     "src/renderer/settings/runtime-host-ssh-terminal-dialog.tsx",
     "src/renderer/settings/settings-error-copy.ts",
@@ -3409,21 +3408,17 @@
         }
       },
       "src/renderer/settings/provider-connection-detail.tsx": {
-        "bridgePaths": {
-          "window.maka.githubCopilotSubscription.connectExistingLogin": 1
-        },
+        "bridgePaths": {},
         "environmentCapabilities": {},
         "hookCalls": {
-          "useActionGuard": 1,
           "useConnectionDetail": 1,
           "useEffect": 2,
-          "useMountedRef": 3,
+          "useMountedRef": 2,
           "useOAuthLoginFlow": 1,
-          "useRuntimeHostSettingsErrorReporter": 3,
-          "useRuntimeHostSettingsTarget": 1,
+          "useRuntimeHostSettingsErrorReporter": 2,
           "useState": 8,
           "useToast": 2,
-          "useUiLocale": 4
+          "useUiLocale": 3
         },
         "lifecycleMethods": {},
         "unresolvedDependencies": 0,
@@ -3440,7 +3435,6 @@
           "./runtime-host-settings-target.js": 1,
           "./settings-expandable-row": 1,
           "./settings-section": 1,
-          "./use-action-guard": 1,
           "./use-connection-detail": 1,
           "./use-oauth-login-flow": 1,
           "@astryxdesign/core": 1,
@@ -3520,23 +3514,13 @@
         }
       },
       "src/renderer/settings/provider-oauth-section.tsx": {
-        "bridgePaths": {
-          "window.maka.githubCopilotSubscription.connectExistingLogin": 1,
-          "window.maka.githubCopilotSubscription.getAccountState": 2,
-          "window.maka.githubCopilotSubscription.logout": 1,
-          "window.maka.githubCopilotSubscription.refreshTokens": 1,
-          "window.maka.openAiCodex": 1,
-          "window.maka.xaiOAuth": 1
-        },
+        "bridgePaths": {},
         "environmentCapabilities": {},
         "hookCalls": {
-          "useEffect": 1,
           "useMountedRef": 1,
           "useOAuthLoginFlow": 2,
-          "useRef": 1,
           "useRuntimeHostSettingsGenerationKey": 1,
-          "useRuntimeHostSettingsTarget": 3,
-          "useState": 2,
+          "useState": 1,
           "useUiLocale": 3
         },
         "lifecycleMethods": {},
@@ -3545,7 +3529,6 @@
         "dependencyPaths": {
           "../../preload/bridge-contract.js": 1,
           "../features/connection-settings": 1,
-          "./runtime-host-settings-bridge.js": 1,
           "./runtime-host-settings-target.js": 1,
           "./use-oauth-login-flow": 1,
           "@astryxdesign/core": 1,
@@ -3770,18 +3753,6 @@
           "@maka/ui": 1
         }
       },
-      "src/renderer/settings/runtime-host-settings-bridge.ts": {
-        "bridgePaths": {},
-        "environmentCapabilities": {},
-        "hookCalls": {},
-        "lifecycleMethods": {},
-        "unresolvedDependencies": 0,
-        "actionFactories": [],
-        "dependencyPaths": {
-          "../../preload/bridge-contract.js": 1,
-          "./use-oauth-login-flow.js": 1
-        }
-      },
       "src/renderer/settings/runtime-host-settings-target.tsx": {
         "bridgePaths": {},
         "environmentCapabilities": {},
@@ -4235,18 +4206,14 @@
         }
       },
       "src/renderer/settings/use-connection-detail.ts": {
-        "bridgePaths": {
-          "window.maka.openAiCodex": 1,
-          "window.maka.xaiOAuth": 1
-        },
+        "bridgePaths": {},
         "environmentCapabilities": {},
         "hookCalls": {
           "useEffect": 6,
           "useKeyedActionGuard": 1,
           "useMountedRef": 1,
           "useRef": 4,
           "useRuntimeHostSettingsErrorReporter": 1,
-          "useRuntimeHostSettingsTarget": 1,
           "useState": 14,
           "useToast": 1,
           "useUiLocale": 1
@@ -4255,13 +4222,11 @@
         "unresolvedDependencies": 0,
         "actionFactories": [],
         "dependencyPaths": {
-          "../../preload/bridge-contract.js": 1,
           "../features/connection-settings": 1,
           "./connection-name-draft.js": 1,
           "./provider-connection-status": 1,
           "./relay-profile-draft": 1,
           "./relay-thinking-bulk": 1,
-          "./runtime-host-settings-bridge.js": 1,
           "./runtime-host-settings-target.js": 1,
           "./use-action-guard": 1,
           "./use-oauth-login-flow": 1,

apps/desktop/src/main/__tests__/github-copilot-local-credential.test.ts

@@ -0,0 +1,101 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import assert from 'node:assert/strict';
+import { describe, test } from 'node:test';
+
+import { importGitHubCopilotLocalCredential } from '../oauth/github-copilot-local-credential.js';
+
+describe('importGitHubCopilotLocalCredential', () => {
+  test('prefers an explicit Copilot Requests credential over the generic GitHub CLI login', async () => {
+    const previous = process.env.COPILOT_GITHUB_TOKEN;
+    process.env.COPILOT_GITHUB_TOKEN = 'github_pat_copilot_requests';
+    try {
+      const imported = await importGitHubCopilotLocalCredential();
+
+      assert.deepEqual(JSON.parse(imported.secret ?? ''), {
+        access_token: 'github_pat_copilot_requests',
+        refresh_token: 'github_pat_copilot_requests',
+        expires_at: Number.MAX_SAFE_INTEGER,
+        token_type: 'Bearer',
+        base_url: 'https://api.githubcopilot.com',
+      });
+      assert.deepEqual(imported.result, { ok: true });
+    } finally {
+      if (previous === undefined) delete process.env.COPILOT_GITHUB_TOKEN;
+      else process.env.COPILOT_GITHUB_TOKEN = previous;
+    }
+  });
+
+  test('returns credential material without asking GitHub about entitlement', async () => {
+    let resolutions = 0;
+    const imported = await importGitHubCopilotLocalCredential({
+      resolveGitHubToken: async () => {
+        resolutions += 1;
+        return 'gho_existing_login\n';
+      },
+    });
+
+    assert.equal(resolutions, 1);
+    assert.deepEqual(imported.result, { ok: true });
+    assert.deepEqual(JSON.parse(imported.secret ?? ''), {
+      access_token: 'gho_existing_login',
+      refresh_token: 'gho_existing_login',
+      expires_at: Number.MAX_SAFE_INTEGER,
+      token_type: 'Bearer',
+      base_url: 'https://api.githubcopilot.com',
+    });
+  });
+
+  test('rejects classic PATs locally', async () => {
+    const imported = await importGitHubCopilotLocalCredential({
+      resolveGitHubToken: async () => 'ghp_classic_pat',
+    });
+
+    assert.equal(imported.result.ok, false);
+    if (!imported.result.ok) {
+      assert.equal(imported.result.reason, 'token_exchange_failed');
+      assert.match(imported.result.message, /不支持 classic PAT/);
+      assert.equal(imported.result.message.includes('ghp_classic_pat'), false);
+    }
+    assert.equal(imported.secret, undefined);
+  });
+
+  test('rejects an unsupported local credential shape', async () => {
+    const imported = await importGitHubCopilotLocalCredential({
+      resolveGitHubToken: async () => 'unsupported-token',
+    });
+
+    assert.equal(imported.result.ok, false);
+    if (!imported.result.ok) assert.match(imported.result.message, /凭据类型不受支持/);
+    assert.equal(imported.secret, undefined);
+  });
+
+  test('reports when no local GitHub credential can be discovered', async () => {
+    const imported = await importGitHubCopilotLocalCredential({
+      resolveGitHubToken: async () => {
+        throw new Error('gh is not installed');
+      },
+    });
+
+    assert.equal(imported.result.ok, false);
+    if (!imported.result.ok) assert.match(imported.result.message, /未找到可导入/);
+    assert.equal(imported.secret, undefined);
+  });
+});