fix(oauth): GHE Copilot OAuth lifecycle — connect, manual refresh, proactive refresh

[hppsc1215]

Summary

GHE Copilot's OAuth lifecycle was broken end to end: an account could not be connected, and once connected its token could not be refreshed. Three related fixes, all in provider-specific branches that ghe-copilot was left out of when the provider was introduced.

1. Connecting an account failed with gheUrl is required for GHE Copilot OAuth.
The poll handler's ghe-copilot branch was unreachable dead code. The provider is listed in NO_PKCE_DEVICE_CODE_PROVIDERS, and that set-based check runs first — so pollForToken() was called without the extraData carrying gheUrl, and normalizeGheUrl(extraData?.gheUrl || config.gheUrl) threw because neither source was populated. Fixed by checking provider === "ghe-copilot" before falling through to the set check. The device-code handler in the same file already used the correct pattern (gate on the set, special-case ghe-copilot inside the block).

2. Every manual Refresh click returned Token refresh failed — provider returned no new token, and the proactive refresh never fired.
GHE Copilot's device-code flow never yields a refresh_token — only a GitHub access token plus a short-lived (~30 min) Copilot sub-token. The manual refresh route went through getAccessToken(), which returns null immediately when credentials.refreshToken is missing. The health-check sweep and checkAndRefreshToken() (which runs before every chat request) had the same bare provider === "github" gate.

refreshCopilotToken() now takes an optional baseUrl so it can target a GHE host's <gheUrl>/api/v3 Copilot token endpoint instead of api.github.com, which never issues a token scoped to a GHE account. ghe-copilot is wired in alongside github at all four sites, with resolveCopilotTokenBaseUrl() / getCopilotTokenBaseUrl() deriving the host from providerSpecificData.gheUrl.

3. The health-check sweep logged one noise line per tick.
The access-token-only branch logged has no refresh token but has a GitHub access token; keeping connection active unconditionally. That path runs once per TICK_MS (60 s) for every github / ghe-copilot connection — ~1440 identical entries per day per connection, all reporting that nothing changed. The line predates this branch (v3.8.43, b729a8f27), but ghe-copilot only started reaching it once the provider was added to GITHUB_ACCESS_TOKEN_ONLY_PROVIDERS in fix 2, which is what made the volume visible. It is now gated on copilotAboutToExpire — the same flag that already drives the surrounding status/error writes — and states whether the refresh succeeded or failed, so a genuine failure stays visible instead of being buried.

Note: fix 3 also affects plain github connections, not just ghe-copilot — it is the same shared code path and the same per-tick volume.

Related Issues

• Follow-up to feat(providers): Complete GHE Copilot OAuth provider implementation #7546 (GHE Copilot OAuth provider) — these four provider-specific branches were missed when that PR landed.
• Follow-up to fix(ghe-copilot): route OpenAI-native models via Responses API #8835 (GHE Copilot Responses API routing).

Validation

Verified live against a real GHE Copilot connection on a Docker build of this branch, not only by reading the code:

• Connect — account deleted and re-added through the device-code flow; the connection persists with gheUrl, copilotApiUrl and copilotToken all populated. No gheUrl is required error.
• Manual refresh — the dashboard Refresh button completes without the provider returned no new token error.
• Proactive refresh — on the same connection, copilotTokenExpiresAt advanced ~10 h 05 m over a 10-hour window (~20 refresh cycles) while test_status stayed active. The sub-token lives ~30 min, so without a working proactive path the connection would have gone dead after the first expiry.
• Log gating — after redeploy the per-tick line is gone; a single Copilot token refreshed (no refresh token; connection stays active) line appeared at the moment the 5-minute expiry buffer was crossed and the sweep actually refreshed the token.
• Unit tests — node --experimental-strip-types --test tests/unit/oauth-providers-error-handling.test.ts → 18 tests, 17 pass, 1 fail. The one failure is P0: gitlab-duo is registered in providerRegistry, which throws ERR_MODULE_NOT_FOUND: Cannot find package '@/lib' — the @/ path alias needs the tsx loader, which this checkout has no node_modules for. That test is green in this PR's CI run, and two sibling health-check test files fail locally with the same alias error on a pristine upstream/release/v3.8.50 worktree, so it is a local-runner artifact rather than a regression.
• Red-green on the assertion fix — with upstream's original assertion against this branch's source, P1: tokenHealthCheck checks copilotTokenExpiresAt before refreshing fails; with the widened assertion it passes. The widened pattern was also confirmed to still match upstream's literal form, and to still reject both a Set lookup and a literal comparison that omit .toLowerCase() — so the fix(tokenHealthCheck): normalize provider case in rotating/copilot checks #6947 case-normalization guard is not silently retired.
• tests/unit/codex-manual-refresh-rotating-guard.test.ts → 3/3 pass (this PR touches the file it asserts over).
• node scripts/check/check-file-size.mjs — green (121 frozen files, cap 1000); no rebaseline needed.
• node scripts/check/check-changelog-integrity.mjs — green.
• npm run lint, check:complexity, check:cognitive-complexity, vitest and e2e suites — not run locally: they need node_modules, which this checkout does not have. Left to CI.

CI status on this branch

• Unit Tests fast-path (2/4) was the one genuine failure and is fixed by the assertion commit below.
• Merge integrity (changelog + generated skills) fails identically on unrelated open PRs (e.g. chore(sse): drop the iflow entry from the token-refresh TTL map #8966, chore(ci): remove two fork-owned publish workflows that rode in by accident #8967): check:agent-skills-sync reports omni-auth, omni-usage-logs and omni-inference as stale, and the generator reads only src/lib/agentSkills/ — none of the files in this PR. chore(skills): regenerate SKILL.md for routes shipped in v3.8.49 #8954 appears to be regenerating those already.
• Build (advisory) ended with The runner has received a shutdown signal, i.e. an infrastructure cancellation.

Tests Added Or Updated

tests/unit/oauth-providers-error-handling.test.ts — widened one existing assertion. It required the literal toLowerCase() === "github" in src/lib/tokenHealthCheck.ts; that gate is now a lowercase-normalized *_PROVIDERS Set lookup so github and ghe-copilot both take the branch. The assertion accepts either form, and the surrounding invariant is unchanged (see the red-green evidence above). The sibling #6947 tests over ROTATING_REFRESH_PROVIDERS and tokenHealthCheckCopilot.ts are untouched and stayed green.

No new test files. The remaining changes are provider-gating and call-site wiring whose behaviour depends on a live GHE enterprise host (per-enterprise Copilot token endpoint + device-code flow), so they were validated end to end against a real connection as listed above. Happy to add a unit test around resolveCopilotTokenBaseUrl() (pure string derivation, trivially testable) or a fetch-mocked case for the manual-refresh branch if a maintainer would prefer that here.

Coverage Notes

Touches src/ and open-sse/:

File	Change
src/app/api/oauth/[provider]/[action]/route.ts	branch order in the poll handler
open-sse/services/tokenRefresh/providers/copilot.ts	optional baseUrl parameter
src/sse/services/tokenRefresh.ts	wrapper threads baseUrl; new resolveCopilotTokenBaseUrl(); ghe-copilot in checkAndRefreshToken()
src/lib/tokenHealthCheck.ts	GITHUB_ACCESS_TOKEN_ONLY_PROVIDERS set, getCopilotTokenBaseUrl(), log gating

No coverage regression: no existing branch was removed or narrowed. github keeps its exact previous behaviour — resolveCopilotTokenBaseUrl() returns undefined for any provider other than ghe-copilot, and the wrapper then calls the 3-argument form, so the api.github.com default path is byte-identical to before.

Reviewer Notes

• Ported onto v3.8.50, and two of the four anchors had drifted from where the original fork branch found them: refreshCopilotToken was extracted out of open-sse/services/tokenRefresh.ts into tokenRefresh/providers/copilot.ts, and src/lib/tokenHealthCheck.ts now has a single consolidated refreshCopilotToken() call site instead of two (the second provider === "github" check no longer exists). Worth knowing if this is cross-referenced against the older fork history.
• No new feature flag, no migration, no schema change. resolveCopilotTokenBaseUrl() is additive and inert for every provider except ghe-copilot.
• NO_PKCE_DEVICE_CODE_PROVIDERS still contains ghe-copilot and should — GHE genuinely does not use PKCE. The set was never wrong; only the evaluation order was.
• Fix 3 changes log output that operators may be grepping for. The old string has no refresh token but has a GitHub access token no longer appears.
• One comment in src/app/api/providers/[id]/refresh/route.ts deliberately avoids writing the generic access-token helper's name followed by (. tests/unit/codex-manual-refresh-rotating-guard.test.ts locates that call with a plain substring search and asserts the openai-auth0 rotation guard precedes it, so a textual mention above the call site silently becomes the match instead. An earlier revision of this PR did exactly that; the assertion still passed but was anchored on prose. The constraint is noted inline at the comment.