Vendor OpenClaw source as Adolf fork baseline

Adolf is a fork/vendored clone of github.com/openclaw/openclaw (v2026.6.11),
free to diverge. Tree copied sans upstream .git; upstream remote added for
future syncs. Node pinned to 24 (.nvmrc); engines already require >=22.19.
Preserves docs/ARCHITECTURE.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LeqyaxJF2nbRXJtae2kNB2

extensions/github-copilot/auth.test.ts

@@ -0,0 +1,110 @@
+// Github Copilot tests cover auth plugin behavior.
+import { afterAll, afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const ensureAuthProfileStoreMock = vi.hoisted(() => vi.fn());
+const listProfilesForProviderMock = vi.hoisted(() => vi.fn());
+const coerceSecretRefMock = vi.hoisted(() => vi.fn());
+const resolveRequiredConfiguredSecretRefInputStringMock = vi.hoisted(() => vi.fn());
+
+vi.mock("openclaw/plugin-sdk/provider-auth", () => ({
+  coerceSecretRef: coerceSecretRefMock,
+  ensureAuthProfileStore: ensureAuthProfileStoreMock,
+  listProfilesForProvider: listProfilesForProviderMock,
+}));
+
+vi.mock("openclaw/plugin-sdk/secret-input-runtime", () => ({
+  resolveRequiredConfiguredSecretRefInputString: resolveRequiredConfiguredSecretRefInputStringMock,
+}));
+
+import { resolveFirstGithubToken } from "./auth.js";
+
+afterAll(() => {
+  vi.doUnmock("openclaw/plugin-sdk/provider-auth");
+  vi.doUnmock("openclaw/plugin-sdk/secret-input-runtime");
+  vi.resetModules();
+});
+
+describe("resolveFirstGithubToken", () => {
+  beforeEach(() => {
+    ensureAuthProfileStoreMock.mockReturnValue({
+      profiles: {
+        "github-copilot:github": {
+          type: "token",
+          tokenRef: { source: "file", provider: "default", id: "/providers/github-copilot/token" },
+        },
+      },
+    });
+    listProfilesForProviderMock.mockReturnValue(["github-copilot:github"]);
+    coerceSecretRefMock.mockReturnValue({
+      source: "file",
+      provider: "default",
+      id: "/providers/github-copilot/token",
+    });
+    resolveRequiredConfiguredSecretRefInputStringMock.mockResolvedValue("resolved-profile-token");
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+    ensureAuthProfileStoreMock.mockReset();
+    listProfilesForProviderMock.mockReset();
+    coerceSecretRefMock.mockReset();
+    resolveRequiredConfiguredSecretRefInputStringMock.mockReset();
+  });
+
+  it("prefers env tokens when available", async () => {
+    const result = await resolveFirstGithubToken({
+      env: { GH_TOKEN: "env-token" } as NodeJS.ProcessEnv,
+    });
+
+    expect(result).toEqual({
+      githubToken: "env-token",
+      hasProfile: true,
+    });
+    expect(resolveRequiredConfiguredSecretRefInputStringMock).not.toHaveBeenCalled();
+  });
+
+  it("returns direct profile tokens before resolving SecretRefs", async () => {
+    ensureAuthProfileStoreMock.mockReturnValue({
+      profiles: {
+        "github-copilot:github": {
+          type: "token",
+          token: "profile-token",
+        },
+      },
+    });
+    coerceSecretRefMock.mockReturnValue(null);
+
+    const result = await resolveFirstGithubToken({
+      env: {} as NodeJS.ProcessEnv,
+    });
+
+    expect(result).toEqual({
+      githubToken: "profile-token",
+      hasProfile: true,
+    });
+  });
+
+  it("resolves non-env SecretRefs when config is available", async () => {
+    const config = { secrets: { defaults: { provider: "default" } } } as never;
+    const env = {} as NodeJS.ProcessEnv;
+    const result = await resolveFirstGithubToken({
+      config,
+      env,
+    });
+
+    expect(result).toEqual({
+      githubToken: "resolved-profile-token",
+      hasProfile: true,
+    });
+    expect(resolveRequiredConfiguredSecretRefInputStringMock).toHaveBeenCalledWith({
+      config,
+      env,
+      value: {
+        source: "file",
+        provider: "default",
+        id: "/providers/github-copilot/token",
+      },
+      path: "providers.github-copilot.authProfiles.github-copilot:github.tokenRef",
+    });
+  });
+});