#1286 taught the credential files to carry the GitHub host their token came
from, but the environment and `gh auth token` rungs carried none, so they were
always addressed to api.github.com. A user whose only Copilot credential is a
GitHub Enterprise Cloud login — GH_TOKEN exported alongside GH_HOST, or
`gh auth login --hostname <tenant>.ghe.com` — got a 401 and a terminal failure
with nothing to act on.
The environment rung now reads GH_HOST out of the same environment as the
token. The gh rung resolves the host from gh's own hosts.yml, found via
GH_CONFIG_DIR, then XDG_CONFIG_HOME/gh, then ~/.config/gh, and picked the way
gh picks the host for `gh auth token`: GH_HOST, else the single configured
host, else dotcom. That is a file read rather than a second `gh auth status`
spawn, because gh writes hosts.yml for every login, keyring-backed ones
included.
Both are new untrusted inputs, so they stay raw all the way to
`apiHost(for:)`, where #1286's character validation refuses a crafted value
such as `evil.com?.ghe.com` before any URL exists — that host passes the
`.ghe.com` suffix check but builds a URL whose host is api.evil.com, which
would then receive the Authorization header.
Both Copilot quota readers hardcoded
https://api.github.com/copilot_internal/user and dropped the host their
credential was read from, so an enterprise on a GitHub Enterprise Cloud
data-residency host (<tenant>.ghe.com) could only ever report
"Temporarily unavailable": its token is not a dotcom token, and dotcom is
not an endpoint it may be sent to.
A discovered credential now carries its host. hosts.json is keyed by
GitHub host and newer apps.json files key by "<host>:<app id>", so the
token and the host always come from the same entry; the rungs that carry
no host of their own (an app-name apps.json key, COPILOT_GITHUB_TOKEN /
GH_TOKEN / GITHUB_TOKEN, gh auth token, a pasted token) mean dotcom. The
endpoint follows the host: api.github.com for github.com, and
api.<tenant>.ghe.com for an Enterprise Cloud host. With several hosts
signed in github.com wins, otherwise the first .ghe.com tenant in sorted
order, which keeps the pick stable across reads; with exactly one, that
host is used.
A host neither rule can address, such as a self-hosted GitHub Enterprise
Server install, fails with a message naming that host instead of falling
back to dotcom, and network and HTTP failures name the host that was
tried. macOS Settings now says which host answered in the Copilot
connection row. Tokens are still never logged and sanitizeForUI is
unchanged.
Closes#1286
A Free or Individual plan reports premium_interactions with entitlement 0
and 0% remaining, which both the menubar and the desktop decoder turned
into a full 100% used ring. Verified against a live quota payload.
The Copilot CLI's Keychain item is written by a Node keyring library, so
/usr/bin/security is not in its partition list. Unlike the Claude Code item,
every read would raise the macOS "allow access?" dialog, and with the probe
cache a user who clicks Deny would be asked again every five minutes.
`gh auth token` already reaches the same users, because the Copilot CLI itself
falls back to gh, so the rung was risk without benefit.
The chain is now legacy plugin files, ~/.copilot/config.json and settings.json,
the environment variables, `gh auth token`, and a pasted token. No `security`
subprocess remains in the adapter, and the probe cache collapses to the single
gh answer.
Modern Copilot clients no longer write ~/.config/github-copilot/hosts.json or
apps.json, so the menubar reported "No GitHub Copilot credentials found" even
after signing in through VS Code and the Copilot CLI.
Discovery now walks an ordered read-only chain, first hit wins, every rung
tolerating an absent, locked, or malformed source: the legacy plugin files,
the Copilot CLI keychain item (service copilot-cli, read via /usr/bin/security
so no partition-list prompt can fire), ~/.copilot/config.json and
settings.json, COPILOT_GITHUB_TOKEN / GH_TOKEN / GITHUB_TOKEN, `gh auth token`,
and finally a token pasted into Settings. The two subprocess rungs are cached
for five minutes so eligibility checks and the 30s refresh cadence never spawn
per call, and hasCredential stays spawn-free.
VS Code's encrypted secret storage is deliberately untouched.
The no-credentials message now says usage tracking still works and names every
way to connect, and the Copilot settings pane gains a token field.
* feat(menubar): add native capacity dock
* fix(menubar): harden dock interaction boundaries
* feat(menubar): polish native Capacity Dock for launch
- Flush top-edge docking via NSHostingView safe-area opt-out; shielding
window level so the rail necks into the physical top like the system notch
- Liquid Glass legibility scrim so labels stay readable on light wallpapers
- Weekly-else-monthly headline window; unified severity colour bands
(green <50 / yellow / orange / red) across rings and detail bars
- Squircle gauge + graphite theme defaults; auto-show connected
subscriptions (up to 5) until the user edits the set, then respect it
- Capacity Dock Settings menu item; re-centre the settings window; info
glyph for the About row
- Trim dead provider-credential override fields down to apiKey only
- Reconcile and extend tests for all of the above
---------
Co-authored-by: iamtoruk <hello@agentseal.org>
Ports the desktop app's Copilot flow (editor-plugin OAuth token from
~/.config/github-copilot, copilot_internal/user snapshot) read-only,
with github.com-host preference and UI-string sanitization.
