feat: add GitHub Copilot token provider and GitHub device auth

.gitignore

@@ -85,6 +85,7 @@ temp/
 .cache/
 .dev/
 .serena/
+.sisyphus/
 
 # ===================
 # 构建产物
@@ -129,4 +130,4 @@ deploy/docker-compose.override.yml
 .gocache/
 vite.config.js
 docs/*
-.serena/
+.serena/

backend/cmd/server/wire.go

@@ -69,6 +69,7 @@ func provideCleanup(
 	opsScheduledReport *service.OpsScheduledReportService,
 	schedulerSnapshot *service.SchedulerSnapshotService,
 	tokenRefresh *service.TokenRefreshService,
+	copilotModelRefresh *service.CopilotModelRefreshService,
 	accountExpiry *service.AccountExpiryService,
 	subscriptionExpiry *service.SubscriptionExpiryService,
 	usageCleanup *service.UsageCleanupService,
@@ -135,6 +136,12 @@ func provideCleanup(
 				tokenRefresh.Stop()
 				return nil
 			}},
+			{"CopilotModelRefreshService", func() error {
+				if copilotModelRefresh != nil {
+					copilotModelRefresh.Stop()
+				}
+				return nil
+			}},
 			{"AccountExpiryService", func() error {
 				accountExpiry.Stop()
 				return nil

backend/go.mod

@@ -75,6 +75,7 @@ require (
 	github.com/goccy/go-json v0.10.2 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
+	github.com/google/subcommands v1.2.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/hashicorp/hcl/v2 v2.18.1 // indirect
@@ -144,6 +145,7 @@ require (
 	golang.org/x/mod v0.31.0 // indirect
 	golang.org/x/sys v0.40.0 // indirect
 	golang.org/x/text v0.33.0 // indirect
+	golang.org/x/tools v0.40.0 // indirect
 	google.golang.org/grpc v1.75.1 // indirect
 	google.golang.org/protobuf v1.36.10 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect

backend/go.sum

@@ -116,6 +116,8 @@ github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
 github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
+github.com/google/subcommands v1.2.0 h1:vWQspBTo2nEqTUFita5/KeEWlUL8kQObDFbub/EN9oE=
+github.com/google/subcommands v1.2.0/go.mod h1:ZjhPrFU+Olkh9WazFPsl27BQ4UPiG37m3yTrtFlrHVk=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/wire v0.7.0 h1:JxUKI6+CVBgCO2WToKy/nQk0sS+amI9z9EjVmdaocj4=

backend/internal/config/config.go

@@ -38,31 +38,32 @@ const (
 )
 
 type Config struct {
-	Server       ServerConfig               `mapstructure:"server"`
-	CORS         CORSConfig                 `mapstructure:"cors"`
-	Security     SecurityConfig             `mapstructure:"security"`
-	Billing      BillingConfig              `mapstructure:"billing"`
-	Turnstile    TurnstileConfig            `mapstructure:"turnstile"`
-	Database     DatabaseConfig             `mapstructure:"database"`
-	Redis        RedisConfig                `mapstructure:"redis"`
-	Ops          OpsConfig                  `mapstructure:"ops"`
-	JWT          JWTConfig                  `mapstructure:"jwt"`
-	Totp         TotpConfig                 `mapstructure:"totp"`
-	LinuxDo      LinuxDoConnectConfig       `mapstructure:"linuxdo_connect"`
-	Default      DefaultConfig              `mapstructure:"default"`
-	RateLimit    RateLimitConfig            `mapstructure:"rate_limit"`
-	Pricing      PricingConfig              `mapstructure:"pricing"`
-	Gateway      GatewayConfig              `mapstructure:"gateway"`
-	APIKeyAuth   APIKeyAuthCacheConfig      `mapstructure:"api_key_auth_cache"`
-	Dashboard    DashboardCacheConfig       `mapstructure:"dashboard_cache"`
-	DashboardAgg DashboardAggregationConfig `mapstructure:"dashboard_aggregation"`
-	UsageCleanup UsageCleanupConfig         `mapstructure:"usage_cleanup"`
-	Concurrency  ConcurrencyConfig          `mapstructure:"concurrency"`
-	TokenRefresh TokenRefreshConfig         `mapstructure:"token_refresh"`
-	RunMode      string                     `mapstructure:"run_mode" yaml:"run_mode"`
-	Timezone     string                     `mapstructure:"timezone"` // e.g. "Asia/Shanghai", "UTC"
-	Gemini       GeminiConfig               `mapstructure:"gemini"`
-	Update       UpdateConfig               `mapstructure:"update"`
+	Server              ServerConfig               `mapstructure:"server"`
+	CORS                CORSConfig                 `mapstructure:"cors"`
+	Security            SecurityConfig             `mapstructure:"security"`
+	Billing             BillingConfig              `mapstructure:"billing"`
+	Turnstile           TurnstileConfig            `mapstructure:"turnstile"`
+	Database            DatabaseConfig             `mapstructure:"database"`
+	Redis               RedisConfig                `mapstructure:"redis"`
+	Ops                 OpsConfig                  `mapstructure:"ops"`
+	JWT                 JWTConfig                  `mapstructure:"jwt"`
+	Totp                TotpConfig                 `mapstructure:"totp"`
+	LinuxDo             LinuxDoConnectConfig       `mapstructure:"linuxdo_connect"`
+	Default             DefaultConfig              `mapstructure:"default"`
+	RateLimit           RateLimitConfig            `mapstructure:"rate_limit"`
+	Pricing             PricingConfig              `mapstructure:"pricing"`
+	Gateway             GatewayConfig              `mapstructure:"gateway"`
+	APIKeyAuth          APIKeyAuthCacheConfig      `mapstructure:"api_key_auth_cache"`
+	Dashboard           DashboardCacheConfig       `mapstructure:"dashboard_cache"`
+	DashboardAgg        DashboardAggregationConfig `mapstructure:"dashboard_aggregation"`
+	UsageCleanup        UsageCleanupConfig         `mapstructure:"usage_cleanup"`
+	Concurrency         ConcurrencyConfig          `mapstructure:"concurrency"`
+	TokenRefresh        TokenRefreshConfig         `mapstructure:"token_refresh"`
+	CopilotModelRefresh CopilotModelRefreshConfig  `mapstructure:"copilot_model_refresh"`
+	RunMode             string                     `mapstructure:"run_mode" yaml:"run_mode"`
+	Timezone            string                     `mapstructure:"timezone"` // e.g. "Asia/Shanghai", "UTC"
+	Gemini              GeminiConfig               `mapstructure:"gemini"`
+	Update              UpdateConfig               `mapstructure:"update"`
 }
 
 type GeminiConfig struct {
@@ -128,6 +129,12 @@ type TokenRefreshConfig struct {
 	RetryBackoffSeconds int `mapstructure:"retry_backoff_seconds"`
 }
 
+type CopilotModelRefreshConfig struct {
+	Enabled               bool `mapstructure:"enabled"`
+	CheckIntervalMinutes  int  `mapstructure:"check_interval_minutes"`
+	RequestTimeoutSeconds int  `mapstructure:"request_timeout_seconds"`
+}
+
 type PricingConfig struct {
 	// 价格数据远程URL（默认使用LiteLLM镜像）
 	RemoteURL string `mapstructure:"remote_url"`
@@ -724,6 +731,8 @@ func setDefaults() {
 	viper.SetDefault("security.url_allowlist.upstream_hosts", []string{
 		"api.openai.com",
 		"api.anthropic.com",
+		"*.githubcopilot.com",
+		"api.github.com",
 		"api.kimi.com",
 		"open.bigmodel.cn",
 		"api.minimaxi.com",
@@ -923,6 +932,10 @@ func setDefaults() {
 	viper.SetDefault("token_refresh.max_retries", 3)                   // 最多重试3次
 	viper.SetDefault("token_refresh.retry_backoff_seconds", 2)         // 重试退避基础2秒
 
+	viper.SetDefault("copilot_model_refresh.enabled", true)
+	viper.SetDefault("copilot_model_refresh.check_interval_minutes", 360)
+	viper.SetDefault("copilot_model_refresh.request_timeout_seconds", 30)
+
 	// Gemini OAuth - configure via environment variables or config file
 	// GEMINI_OAUTH_CLIENT_ID and GEMINI_OAUTH_CLIENT_SECRET
 	// Default: uses Gemini CLI public credentials (set via environment)

backend/internal/domain/constants.go

@@ -16,14 +16,56 @@ const (
 	RoleUser  = "user"
 )
 
-// Platform constants
+// Platform constants (API protocol type)
 const (
 	PlatformAnthropic   = "anthropic"
 	PlatformOpenAI      = "openai"
+	PlatformCopilot     = "copilot"
+	PlatformAggregator  = "aggregator"
 	PlatformGemini      = "gemini"
 	PlatformAntigravity = "antigravity"
 )
 
+// Provider constants (actual service source)
+// Provider identifies the upstream service provider for a model,
+// enabling differentiation of context windows and pricing for the same model name.
+const (
+	ProviderOpenAI      = "openai"      // OpenAI 官方 API
+	ProviderAzure       = "azure"       // Azure OpenAI
+	ProviderCopilot     = "copilot"     // GitHub Copilot
+	ProviderAnthropic   = "anthropic"   // Anthropic 官方 API
+	ProviderGemini      = "gemini"      // Google Gemini 官方 API
+	ProviderVertexAI    = "vertex"      // Google Vertex AI
+	ProviderAntigravity = "antigravity" // Antigravity 服务
+	ProviderBedrock     = "bedrock"     // AWS Bedrock
+	ProviderOpenRouter  = "openrouter"  // OpenRouter 聚合
+	ProviderAggregator  = "aggregator"  // 通用聚合器
+)
+
+// ProviderToPlatform maps provider to the API protocol (platform) it uses.
+// This enables automatic platform inference from provider namespace.
+var ProviderToPlatform = map[string]string{
+	ProviderOpenAI:      PlatformOpenAI,
+	ProviderAzure:       PlatformOpenAI,
+	ProviderCopilot:     PlatformCopilot,
+	ProviderAnthropic:   PlatformAnthropic,
+	ProviderGemini:      PlatformGemini,
+	ProviderVertexAI:    PlatformGemini,
+	ProviderAntigravity: PlatformAntigravity,
+	ProviderBedrock:     PlatformOpenAI, // Bedrock uses OpenAI-compatible format
+	ProviderOpenRouter:  PlatformOpenAI,
+	ProviderAggregator:  PlatformAggregator,
+}
+
+// GetPlatformFromProvider returns the platform (API protocol) for a given provider.
+// Returns empty string if provider is unknown.
+func GetPlatformFromProvider(provider string) string {
+	if platform, ok := ProviderToPlatform[provider]; ok {
+		return platform
+	}
+	return ""
+}
+
 // Account type constants
 const (
 	AccountTypeOAuth      = "oauth"       // OAuth类型账号（full scope: profile + inference）

backend/internal/handler/admin/account_data_handler_test.go

@@ -64,6 +64,8 @@ func setupAccountDataRouter() (*gin.Engine, *stubAdminService) {
 		nil,
 		nil,
 		nil,
+		nil,
+		nil,
 	)
 
 	router.GET("/api/v1/admin/accounts/data", h.ExportData)