dsh-provider-copilot

Usage — inside dsh

The /copilot login | logout | status commands are real dsh commands, registered when the host command service is present (dsh Web resolves / lines against them):

/copilot login    # Device Flow: prints the verification URL + code and
                  #   finishes authorizing in the background
/copilot status   # source, expiry, model count, p50/p95 latency
/copilot logout   # wipes cache + memory + metrics

/copilot login returns the GitHub verification URL and the one-time code to enter there; authorization continues in the background once you approve it in the browser:

In dsh's model picker (the group is visible from install, see above), select a model inside the Copilot (GitHub) group. Selecting a model makes it the default for new sessions; each session keeps its own recorded selection. Pick again any time to switch models. Sending a request requires a credential: set COPILOT_TOKEN / COPILOT_GITHUB_TOKEN, or run /copilot login above. Once signed in, the advertised list is intersected with the upstream /models catalog.

Usage — programmatic (BYOK)

import { AuthManager, CopilotClient, CopilotProvider } from "dsh-provider-copilot";

const auth = new AuthManager({
    byok: { kind: "github", token: process.env.MY_GITHUB_TOKEN! },
});
const client = new CopilotClient({
    getBearer: async () => {
        const s = await auth.getSession();
        return { token: s.token, endpoints: { api: s.endpoints.api } };
    },
});
const provider = new CopilotProvider({ client });

for await (const chunk of provider.stream({
    model: "gpt-4o-mini",
    messages: [{ role: "user", content: "hi" }],
})) {
    if (chunk.type === "text") process.stdout.write(chunk.text);
}

Token source priority

AuthManager resolves credentials in this order:

1. byok constructor option — a { kind: "bearer" | "github", token }.
2. env COPILOT_TOKEN — a raw Copilot bearer; skips exchange.
3. env COPILOT_GITHUB_TOKEN — a GitHub token; drives exchange.
4. On-disk OAuth cache from a previous /copilot login.
5. ~/.config/gh/hosts.yml (opt-in: DSH_COPILOT_ALLOW_GH_HOSTS=1).
6. GH_TOKEN / GITHUB_TOKEN (opt-in: DSH_COPILOT_ALLOW_ENV_GH=1).

Sources 5–6 are opt-in because "any GitHub token" leaking into a Copilot-specific credential surface is easy to do by accident.

Configuration

Env var	Effect
COPILOT_TOKEN	Skip exchange; use as Copilot bearer directly.
COPILOT_GITHUB_TOKEN	GitHub token to exchange for a Copilot bearer.
DSH_COPILOT_ALLOW_GH_HOSTS	1 enables reading gh hosts.yml as fallback.
DSH_COPILOT_ALLOW_ENV_GH	1 enables reading GH_TOKEN / GITHUB_TOKEN fallback.
DSH_COPILOT_NO_LOG	1 disables JSONL log writes (no directory / files).
XDG_CONFIG_HOME	Standard XDG override for cache & log location.