Protected ReadonlycliProtected ReadonlycredentialProtected ReadonlyloggerProtectedloginProtectedloginProtectedloginProtectedloginProtectedloginProtected ReadonlysdkTerminates a login that is still in progress, if any.
Resolves once the token the CLI may already have written has been removed again, so that a caller which cancels a sign-in can rely on nothing being left behind in plain text.
ProtectedcreateBuilds the environment for the login process.
The CLI is pointed at a private home and its use of the system keychain is disabled, so that it persists the token where we can take it over instead of in the keyring of the user. Tokens from the environment are removed so that a sign-in always establishes fresh credentials rather than silently succeeding with something the user configured elsewhere.
ProtectedcreateCreates the private Copilot home the login is run against.
ProtectedcreateWrites the opener the CLI is pointed at instead of a real browser, and returns its path.
The CLI opens a browser whenever it believes one is available, even for the device code flow, and
prefers the command in BROWSER over the opener of the platform. Pointing it at a script that
does nothing is therefore the reliable way to keep the flow in the dialog, where the user can read
and copy the code. Opening a browser would also be wrong whenever the backend does not run on the
user's own machine.
ProtectedextractDescribes why a login failed, based on what the CLI reported.
A line that names the problem is preferred, and the tail of the output is used otherwise, since the wording of the CLI is not stable enough to rely on and a bare exit code is not diagnosable.
ProtectedfindSearches the configuration the CLI wrote in its private home for the persisted token.
The file and the field the CLI uses are not part of its public interface, so every JSON file it wrote is searched for a value shaped like a GitHub token rather than relying on a fixed layout.
ProtectedfindSearches text for a value shaped like a GitHub token.
Only the files the CLI wrote into the private home of this sign-in are searched, so anything shaped like a token in them is the token that was just obtained.
Reports whether this application holds Copilot credentials.
Deliberately based on our own store rather than on what the Copilot CLI reports: the CLI also accepts a token from the environment or the sign-in of the GitHub CLI, and neither of those is a sign-in of this application, so neither may make it appear signed in.
ProtectedlistThe files of the private home that are inspected for the token.
The logs are skipped, and the configuration the CLI writes is not plain JSON but carries comments, so the files are searched as text rather than parsed.
ProtectedparseExtracts the login the CLI reported for the account that signed in, if it reported one.
ProtectedparseExtracts the verification URL and the user code from the output of the CLI.
Returns undefined while the output does not contain both yet.
ProtectedremoveRemoves the private Copilot home, including the token the CLI wrote into it.
Discards the credentials of this application. Nothing outside of it is touched.
Starts copilot login --device-code and resolves once it reported the code the user has to
enter. The process keeps running and polls GitHub itself until waitForLogin is awaited.
OptionalenterpriseUrl: stringProtectedstopStops a sign-in that is still in progress when the connection this provider belongs to closes.
Unbinding a container runs @preDestroy rather than dispose, matching the client provider.
Without this, the copilot login child process and the temporary home holding its token would
be left behind.
ProtectedstoreMoves the token the CLI just persisted into our own credential store.
ProtectedtoTurns the configured GitHub Enterprise deployment into the URL the CLI is pointed at.
A bare domain is the expected form and gets a scheme. Plain HTTP is upgraded rather than passed
on: the sign-in carries credentials, and a host that only matched "http" at the start of its
name, such as httpbin.example.com, must not be mistaken for a URL that already has a scheme.
Waits for the login started by startLogin to complete.
Resolves false when the authorization was denied or expired.
Authentication against GitHub Copilot, performed by the official Copilot CLI on our behalf.
Access to the Copilot features is granted per OAuth application and the built-in Theia OAuth app is not entitled for them, whereas the Copilot CLI is. This provider therefore does not run an OAuth flow of its own but drives
copilot login --device-codeand reports its progress, so that the familiar sign-in dialog can be used.The credentials end up owned by this application rather than by the CLI: the login is run against a private, temporary Copilot home with the system keychain disabled, so that the CLI writes its token there instead of into the user's keyring. The token is then moved into CopilotCredentialStore and the temporary home is removed. Signing out consequently only has to delete our own entry, and never touches credentials of the user's machine such as their keyring entries or their GitHub CLI sign-in.