feat: add GitHub Copilot token provider and GitHub device auth

[alfadb]

Summary

• Add GitHub Copilot token provider + helpers for gateway usage, including model listing and platform-aware gateway routing.
• Add GitHub device auth flow (service + device session store) and wire it into admin/gateway + admin UI device auth modal.
• Add copilot/aggregator platform support across backend + admin UI (accounts/groups, error passthrough rules, platform badges/icons).
• Harden upstream URL handling (validated URL helpers for OpenAI Responses / Anthropic Messages) and add gosec annotations/docs.
• Fix gateway handler to guard against nil API key.

Config

• Add Copilot + GitHub device auth settings to config and deploy/config.example.yaml.

Tests

• backend: go test ./... (pass)
• frontend: pnpm -C frontend run typecheck (pass)
• frontend: pnpm -C frontend run lint:check (pass)
• frontend: pnpm -C frontend run test:run (pass; 6 files / 45 tests)

[Copilot]

Pull request overview

This pull request adds GitHub Copilot support to the application by implementing token provisioning via GitHub device authentication flow and integrating it with the existing gateway services.

Changes:

• Added GitHub Copilot token provider that exchanges GitHub personal access tokens for Copilot bearer tokens
• Implemented GitHub OAuth device authentication flow with session management for obtaining GitHub tokens
• Extended OpenAI and Claude gateway services to detect and handle GitHub Copilot accounts with special headers and URL patterns

Reviewed changes

Copilot reviewed 38 out of 40 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
frontend/vitest.config.ts	Fixed config handling to support function-based vite configs
frontend/src/i18n/locales/*.ts	Added translations for GitHub device auth UI
frontend/src/components/admin/account/GitHubDeviceAuthModal.vue	New modal component for GitHub device authorization flow
frontend/src/components/admin/account/AccountActionMenu.vue	Added device auth action for GitHub Copilot accounts
frontend/src/views/admin/AccountsView.vue	Integrated device auth modal and fixed auto-refresh type checking
frontend/src/api/admin/accounts.ts	Added API client methods for device auth endpoints
frontend/src/tests/setup.ts	Added File.prototype.text polyfill for jsdom compatibility
frontend/src/tests/integration/*.spec.ts	Added flushPromises calls to fix test timing issues
deploy/config.example.yaml	Added GitHub Copilot and GitHub API domains to allowlist
backend/internal/config/config.go	Added GitHub domains to default allowlist
backend/internal/service/github_copilot_token_provider.go	Token provider for exchanging GitHub tokens for Copilot tokens
backend/internal/service/github_device_auth_service.go	Service implementing GitHub OAuth device flow
backend/internal/service/github_copilot_helpers.go	Helper functions for detecting and handling Copilot accounts
backend/internal/service/github_device_session_store.go	In-memory session store for device auth sessions
backend/internal/service/openai_responses_url.go	URL helper for OpenAI/Copilot responses endpoint
backend/internal/service/anthropic_messages_url.go	URL helper for Anthropic messages endpoint
backend/internal/service/openai_gateway_service.go	Extended to handle GitHub Copilot accounts with token refresh on 401
backend/internal/service/gateway_service.go	Extended to handle GitHub Copilot accounts in Claude gateway
backend/internal/service/account_test_service.go	Updated test service to support Copilot token provider
backend/internal/service/token_cache_key.go	Added cache key helper for Copilot tokens
backend/internal/service/wire.go	Added new services to dependency injection
backend/internal/repository/github_device_session_store.go	Redis-backed session store implementation
backend/internal/repository/wire.go	Added session store to DI
backend/internal/handler/admin/account_handler.go	Added endpoints for starting, polling, and cancelling device auth
backend/internal/server/routes/admin.go	Added device auth routes
backend/cmd/server/wire_gen.go	Generated wire code with new dependencies
.gitignore	Added .sisyphus/ to gitignore
backend/go.mod, backend/go.sum	Added google/subcommands and golang.org/x/tools dependencies
backend/internal/service/*_test.go	Comprehensive unit tests for new services
backend/internal/repository/*_test.go	Unit and integration tests for session store
backend/internal/handler/admin/account_github_device_auth_test.go	Handler tests for device auth endpoints

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Error type suffix mismatch: The error type is "expired_token" but should be "expired_code" to accurately reflect that it's the device code that expired, not an access token. This improves clarity and follows the naming convention used in the GitHub OAuth device flow documentation.

Suggested change

	return &GitHubDeviceAuthPollResult{Status: "error", Error: "expired_token", ErrorDesc: "device code expired"}, nil
	return &GitHubDeviceAuthPollResult{Status: "error", Error: "expired_code", ErrorDesc: "device code expired"}, nil

[Copilot]

The in-memory implementation of GitHubDeviceSessionStore ignores the TTL parameter and never expires sessions. This can lead to memory leaks if sessions are not explicitly cancelled or if poll operations fail. Consider implementing automatic expiration using a background goroutine with time.After, or at minimum document that this implementation is only suitable for testing and that production should use the Redis-backed implementation.

Suggested change

	func (s *inMemoryGitHubDeviceSessionStore) Set(_ context.Context, id string, sess *GitHubDeviceSession, _ time.Duration) error {
	s.mu.Lock()
	defer s.mu.Unlock()
	s.sessions[id] = sess
	func (s *inMemoryGitHubDeviceSessionStore) Set(_ context.Context, id string, sess *GitHubDeviceSession, ttl time.Duration) error {
	s.mu.Lock()
	s.sessions[id] = sess
	s.mu.Unlock()
	if ttl > 0 {
	go func(id string, ttl time.Duration) {
	timer := time.NewTimer(ttl)
	defer timer.Stop()
	<-timer.C
	_ = s.Delete(context.Background(), id)
	}(id, ttl)
	}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3747043ab7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve Copilot base path when appending /responses

When isGitHubCopilot is true, this strips any trailing /v1 unconditionally before appending /responses. That breaks path-prefixed deployments such as https://...githubcopilot.com/copilot/v1, which should resolve to /copilot/v1/responses but now become /copilot/responses and return 404. This is a regression for valid base URLs that intentionally include a routed /v1 segment.

Useful? React with 👍 / 👎.

[alfadb]

Superseded by integration branch.