Vendor OpenClaw source as Adolf fork baseline

Adolf is a fork/vendored clone of github.com/openclaw/openclaw (v2026.6.11),
free to diverge. Tree copied sans upstream .git; upstream remote added for
future syncs. Node pinned to 24 (.nvmrc); engines already require >=22.19.
Preserves docs/ARCHITECTURE.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LeqyaxJF2nbRXJtae2kNB2

extensions/github-copilot/login.ts

@@ -0,0 +1,374 @@
+// Github Copilot plugin module implements login behavior.
+import { intro, note, outro, spinner } from "@clack/prompts";
+import { stylePromptTitle } from "openclaw/plugin-sdk/cli-runtime";
+import { logConfigUpdated, updateConfig } from "openclaw/plugin-sdk/config-mutation";
+import {
+  resolveExpiresAtMsFromDurationMs,
+  nonNegativeSecondsToSafeMilliseconds,
+  positiveSecondsToSafeMilliseconds,
+  resolveTimerTimeoutMs,
+} from "openclaw/plugin-sdk/number-runtime";
+import {
+  applyAuthProfileConfig,
+  ensureAuthProfileStore,
+  upsertAuthProfileWithLock,
+} from "openclaw/plugin-sdk/provider-auth";
+import { readProviderJsonResponse } from "openclaw/plugin-sdk/provider-http";
+import type { RuntimeEnv } from "openclaw/plugin-sdk/runtime";
+import { fetchWithSsrFGuard, type SsrFPolicy } from "openclaw/plugin-sdk/ssrf-runtime";
+
+const CLIENT_ID = "Iv1.b507a08c87ecfe98";
+const DEVICE_CODE_URL = "https://github.com/login/device/code";
+const ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
+const GITHUB_DEVICE_VERIFICATION_URL = "https://github.com/login/device";
+const GITHUB_AUTH_SSRF_POLICY: SsrFPolicy = { hostnameAllowlist: ["github.com"] };
+
+type DeviceCodeResponse = {
+  deviceCode: string;
+  userCode: string;
+  verificationUri: string;
+  expiresInMs: number;
+  expiresAt: number;
+  intervalMs: number;
+};
+
+type DeviceTokenResponse =
+  | {
+      access_token: string;
+      token_type: string;
+      scope?: string;
+    }
+  | {
+      error: string;
+      error_description?: string;
+      error_uri?: string;
+    };
+
+const GITHUB_DEVICE_ACCESS_DENIED = Symbol("github-device-access-denied");
+const GITHUB_DEVICE_EXPIRED = Symbol("github-device-expired");
+
+type UpsertAuthProfileParams = Parameters<typeof upsertAuthProfileWithLock>[0];
+
+class GitHubDeviceFlowError extends Error {
+  readonly kind: symbol;
+  constructor(kind: symbol, message: string) {
+    super(message);
+    this.kind = kind;
+    this.name = "GitHubDeviceFlowError";
+  }
+}
+
+let githubDeviceFlowFetchGuard = fetchWithSsrFGuard;
+
+export function setGitHubCopilotDeviceFlowFetchGuardForTesting(
+  impl: typeof fetchWithSsrFGuard | null,
+): void {
+  githubDeviceFlowFetchGuard = impl ?? fetchWithSsrFGuard;
+}
+
+async function upsertAuthProfileWithLockOrThrow(params: UpsertAuthProfileParams): Promise<void> {
+  const updated = await upsertAuthProfileWithLock(params);
+  if (!updated) {
+    throw new Error(
+      "Failed to update auth profile store; the auth store lock may be busy. Wait a moment and retry.",
+    );
+  }
+}
+
+function isGitHubDeviceAccessDeniedError(err: unknown): boolean {
+  return err instanceof GitHubDeviceFlowError && err.kind === GITHUB_DEVICE_ACCESS_DENIED;
+}
+
+function isGitHubDeviceExpiredError(err: unknown): boolean {
+  return err instanceof GitHubDeviceFlowError && err.kind === GITHUB_DEVICE_EXPIRED;
+}
+
+function parseJsonResponse(value: unknown): Record<string, unknown> {
+  if (!value || typeof value !== "object") {
+    throw new Error("Unexpected response from GitHub");
+  }
+  return value as Record<string, unknown>;
+}
+
+function parseDeviceCodeResponse(
+  value: Record<string, unknown>,
+  issuedAt: number,
+): DeviceCodeResponse {
+  const expiresInMs = positiveSecondsToSafeMilliseconds(value.expires_in);
+  const intervalMs = nonNegativeSecondsToSafeMilliseconds(value.interval);
+  const expiresAt =
+    expiresInMs === undefined
+      ? undefined
+      : resolveExpiresAtMsFromDurationMs(expiresInMs, { nowMs: issuedAt });
+
+  if (
+    typeof value.device_code !== "string" ||
+    !value.device_code ||
+    typeof value.user_code !== "string" ||
+    !value.user_code ||
+    typeof value.verification_uri !== "string" ||
+    !value.verification_uri ||
+    expiresInMs === undefined ||
+    expiresAt === undefined ||
+    intervalMs === undefined
+  ) {
+    throw new Error("GitHub device code response missing fields");
+  }
+
+  return {
+    deviceCode: value.device_code,
+    userCode: value.user_code,
+    verificationUri: value.verification_uri,
+    expiresInMs,
+    expiresAt,
+    intervalMs,
+  };
+}
+
+async function postGitHubDeviceFlowForm(params: {
+  url: string;
+  body: URLSearchParams;
+  failureLabel: string;
+}): Promise<Record<string, unknown>> {
+  const { response, release } = await githubDeviceFlowFetchGuard({
+    url: params.url,
+    init: {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/x-www-form-urlencoded",
+      },
+      body: params.body,
+    },
+    requireHttps: true,
+    policy: GITHUB_AUTH_SSRF_POLICY,
+    auditContext: "github-copilot-device-flow",
+  });
+  try {
+    if (!response.ok) {
+      throw new Error(`${params.failureLabel}: HTTP ${response.status}`);
+    }
+    return parseJsonResponse(
+      await readProviderJsonResponse(response, "github-copilot.device-flow"),
+    );
+  } finally {
+    await release();
+  }
+}
+
+async function requestDeviceCode(params: { scope: string }): Promise<DeviceCodeResponse> {
+  const body = new URLSearchParams({
+    client_id: CLIENT_ID,
+    scope: params.scope,
+  });
+
+  const json = await postGitHubDeviceFlowForm({
+    url: DEVICE_CODE_URL,
+    body,
+    failureLabel: "GitHub device code failed",
+  });
+  // Anchor expiry to when GitHub issued the code, before UI prompts or browser launch.
+  return parseDeviceCodeResponse(json, Date.now());
+}
+
+async function pollForAccessToken(params: {
+  deviceCode: string;
+  intervalMs: number;
+  expiresAt: number;
+}): Promise<string> {
+  const bodyBase = new URLSearchParams({
+    client_id: CLIENT_ID,
+    device_code: params.deviceCode,
+    grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+  });
+
+  while (Date.now() < params.expiresAt) {
+    const json = (await postGitHubDeviceFlowForm({
+      url: ACCESS_TOKEN_URL,
+      body: bodyBase,
+      failureLabel: "GitHub device token failed",
+    })) as DeviceTokenResponse;
+    if ("access_token" in json && typeof json.access_token === "string") {
+      return json.access_token;
+    }
+
+    const err = "error" in json ? json.error : "unknown";
+    if (err === "authorization_pending") {
+      await sleepGitHubDevicePollDelay(params.intervalMs, params.expiresAt);
+      continue;
+    }
+    if (err === "slow_down") {
+      await sleepGitHubDevicePollDelay(params.intervalMs + 2000, params.expiresAt);
+      continue;
+    }
+    if (err === "expired_token") {
+      throw new GitHubDeviceFlowError(
+        GITHUB_DEVICE_EXPIRED,
+        "GitHub device code expired; run login again",
+      );
+    }
+    if (err === "access_denied") {
+      throw new GitHubDeviceFlowError(GITHUB_DEVICE_ACCESS_DENIED, "GitHub login cancelled");
+    }
+    throw new Error(`GitHub device flow error: ${err}`);
+  }
+
+  throw new GitHubDeviceFlowError(
+    GITHUB_DEVICE_EXPIRED,
+    "GitHub device code expired; run login again",
+  );
+}
+
+async function sleepGitHubDevicePollDelay(delayMs: number, expiresAt: number): Promise<void> {
+  const requestedDelayMs = Math.max(1, Math.floor(delayMs));
+  const targetAt = Math.min(Date.now() + requestedDelayMs, expiresAt);
+  while (Date.now() < targetAt) {
+    const remainingMs = Math.max(1, targetAt - Date.now());
+    const safeDelayMs = resolveTimerTimeoutMs(remainingMs, 1);
+    await new Promise((resolve) => {
+      setTimeout(resolve, Math.min(safeDelayMs, remainingMs));
+    });
+  }
+}
+
+function normalizeGitHubDeviceVerificationUrl(raw: string): string {
+  let parsed: URL;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    throw new Error("GitHub device flow returned an invalid verification URL");
+  }
+
+  if (
+    parsed.protocol !== "https:" ||
+    parsed.hostname !== "github.com" ||
+    parsed.pathname !== "/login/device" ||
+    parsed.username ||
+    parsed.password
+  ) {
+    throw new Error("GitHub device flow returned an unexpected verification URL");
+  }
+
+  return GITHUB_DEVICE_VERIFICATION_URL;
+}
+
+function normalizeGitHubDeviceUserCode(raw: string): string {
+  const userCode = raw.trim();
+  if (!userCode || userCode.length > 64) {
+    throw new Error("GitHub device flow returned an invalid user code");
+  }
+  return userCode;
+}
+
+export type GitHubCopilotDeviceFlowResult =
+  | { status: "authorized"; accessToken: string }
+  | { status: "access_denied" }
+  | { status: "expired" };
+
+export type GitHubCopilotDeviceFlowIO = {
+  showCode(args: { verificationUrl: string; userCode: string; expiresInMs: number }): Promise<void>;
+  openUrl?: (url: string) => Promise<void>;
+};
+
+export async function runGitHubCopilotDeviceFlow(
+  io: GitHubCopilotDeviceFlowIO,
+): Promise<GitHubCopilotDeviceFlowResult> {
+  const device = await requestDeviceCode({ scope: "read:user" });
+  const verificationUrl = normalizeGitHubDeviceVerificationUrl(device.verificationUri);
+  const userCode = normalizeGitHubDeviceUserCode(device.userCode);
+  await io.showCode({
+    verificationUrl,
+    userCode,
+    expiresInMs: device.expiresInMs,
+  });
+
+  try {
+    await io.openUrl?.(verificationUrl);
+  } catch {
+    // The code and URL have already been shown. Browser launch is best-effort.
+  }
+
+  try {
+    const accessToken = await pollForAccessToken({
+      deviceCode: device.deviceCode,
+      intervalMs: Math.max(1000, device.intervalMs),
+      expiresAt: device.expiresAt,
+    });
+    return { status: "authorized", accessToken };
+  } catch (err) {
+    if (isGitHubDeviceAccessDeniedError(err)) {
+      return { status: "access_denied" };
+    }
+    if (isGitHubDeviceExpiredError(err)) {
+      return { status: "expired" };
+    }
+    throw err;
+  }
+}
+
+export async function githubCopilotLoginCommand(
+  opts: { profileId?: string; yes?: boolean; agentDir?: string },
+  runtime: RuntimeEnv,
+) {
+  if (!process.stdin.isTTY) {
+    throw new Error("github-copilot login requires an interactive TTY.");
+  }
+
+  intro(stylePromptTitle("GitHub Copilot login"));
+
+  const profileId = opts.profileId?.trim() || "github-copilot:github";
+  const store = ensureAuthProfileStore(opts.agentDir, {
+    allowKeychainPrompt: false,
+  });
+
+  if (store.profiles[profileId] && !opts.yes) {
+    note(
+      `Auth profile already exists: ${profileId}\nRe-running will overwrite it.`,
+      stylePromptTitle("Existing credentials"),
+    );
+  }
+
+  const spin = spinner();
+  spin.start("Requesting device code from GitHub...");
+  const device = await requestDeviceCode({ scope: "read:user" });
+  spin.stop("Device code ready");
+
+  note(
+    [`Visit: ${device.verificationUri}`, `Code: ${device.userCode}`].join("\n"),
+    stylePromptTitle("Authorize"),
+  );
+
+  const intervalMs = Math.max(1000, device.intervalMs);
+
+  const polling = spinner();
+  polling.start("Waiting for GitHub authorization...");
+  const accessToken = await pollForAccessToken({
+    deviceCode: device.deviceCode,
+    intervalMs,
+    expiresAt: device.expiresAt,
+  });
+  polling.stop("GitHub access token acquired");
+
+  await upsertAuthProfileWithLockOrThrow({
+    profileId,
+    credential: {
+      type: "token",
+      provider: "github-copilot",
+      token: accessToken,
+    },
+    agentDir: opts.agentDir,
+  });
+
+  await updateConfig((cfg) =>
+    applyAuthProfileConfig(cfg, {
+      provider: "github-copilot",
+      profileId,
+      mode: "token",
+    }),
+  );
+
+  logConfigUpdated(runtime);
+  runtime.log(`Auth profile: ${profileId} (github-copilot/token)`);
+
+  outro("Done");
+}