feat: add GitHub Copilot OAuth support

[Copilot]

Adds GitHub Copilot as a provider, enabling users with Copilot subscriptions (Pro+, etc.) to route models through api.githubcopilot.com.

Auth

OAuth Device Authorization Grant (RFC 8628) using the same client ID as VS Code's Copilot extension (Iv1.b507a08c87ecfe98). Two-step token flow:

1. Device code flow → long-lived GitHub OAuth token
2. OAuth token → short-lived Copilot API token via api.github.com/copilot_internal/v2/token

Tokens auto-refresh before each request. Credentials stored at ~/.claudish/copilot-oauth.json with 0600 permissions.

Provider routing

• Shortcuts: copilot@, gh@, ghc@
• Legacy prefixes: copilot/, gh/, ghc/
• API: OpenAI-compatible (/chat/completions), so reuses OpenAIHandler

claudish --copilot-login                          # authenticate
claudish --model copilot@gpt-4o "your prompt"     # use
claudish --model gh@claude-3.5-sonnet "prompt"    # shortcut
claudish --copilot-logout                         # clear creds

OpenAIHandler extension

Added optional getApiKey (async token getter) and extraHeaders to the constructor, avoiding a separate handler class. Copilot-specific headers (Editor-Version, Copilot-Integration-Id, etc.) are injected at request time.

new OpenAIHandler(provider, modelName, "", port, {
  getApiKey: getValidCopilotAccessToken,
  extraHeaders: COPILOT_HEADERS,
});

Files touched

All changes applied across the 3 manually-synced package copies (src/, packages/core/src/, packages/cli/src/):

• auth/copilot-oauth.ts — new OAuth module
• providers/model-parser.ts — shortcuts, DIRECT_API_PROVIDERS, legacy prefixes
• providers/remote-provider-registry.ts — provider config + name map
• providers/provider-resolver.ts — API key info + display name
• proxy-server.ts — handler routing
• handlers/openai-handler.ts — dynamic auth support
• packages/cli/src/index.ts — --copilot-login/--copilot-logout flags
• packages/cli/src/cli.ts — help text

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• openrouter.ai
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/bun bun test tests/remote-provider.test.ts git conf�� get --global d-run credential.userngit (dns block)
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/bun bun test tests/remote-provider.test.ts git /.bi�� (dns block)
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/bun bun test tests/remote-provider.test.ts git ish/�� rs/openai-handler.ts --global k/_temp/copilot-developer-action-main/dist/ripgrep/bin/linux-x64/rg user.email (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.