fix(runtime): exchange raw Copilot OAuth token in runtime resolution

[SvichkarevAnatoly]

What does this PR do?

Fixes GitHub Copilot models failing with HTTP 400 "The requested model is not available for integrator" / "...is not supported".

When Hermes sends a raw GitHub OAuth token (ghu_...) as the Bearer to api.githubcopilot.com, GitHub ignores the Copilot-Integration-Id: vscode-chat header and pins the request to integrator copilot-language-server, whose model allow-list is tiny. As a result Claude, Gemini and most GPT models fail; only a handful (gpt-5.5, gpt-5-mini, …) work.

The credential pool can end up holding the raw token: _seed_from_env writes the raw COPILOT_GITHUB_TOKEN under the same source key as the token-exchanging singleton seeder, and _upsert_entry (matching by source) overwrites the exchanged tid= entry. Runtime resolution then puts the raw token on the wire.

This PR exchanges a raw GitHub token for a short-lived Copilot API token (tid=…) at the two copilot choke points in runtime resolution, and adopts the account-specific base URL advertised by the exchange (Business/Enterprise tenants). Already-exchanged tokens and exchange failures pass through unchanged, so behaviour is never worse than before.

Empirical matrix on one Business seat (same token):

Bearer	Copilot-Integration-Id	Result
raw ghu_…	vscode-chat	400 — integrator copilot-language-server, most models blocked
exchanged tid=…	vscode-chat	200 — all models

Supersedes #24546, which attempts the same exchange but assigns the (token, base_url) tuple returned by get_copilot_api_token directly to api_key, sending a stringified tuple on the wire — every model then fails with invalid token: invalid whitespace. (Verified by applying #24546 on current main.) Credit to @lucvan for identifying the same root cause.

Related Issue

Fixes #45813

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• hermes_cli/runtime_provider.py: add _looks_like_raw_github_token() and _exchange_copilot_api_key(); call the exchange in _resolve_runtime_from_pool_entry and _resolve_explicit_runtime for the copilot provider, adopting the exchange base URL.
• tests/hermes_cli/test_copilot_runtime_token_exchange.py: 4 network-free regression tests — raw-token detection, exchange + base-URL adoption, already-exchanged pass-through, base-URL preserved on exchange failure.

How to Test

1. Configure the Copilot provider via OAuth (Business/Enterprise seat) and select claude-opus-4.8.
2. On main: request fails with HTTP 400 … not available for integrator "copilot-language-server".
3. With this patch: the same request returns 200 and the model answers correctly. Verified across all 13 Copilot models advertised by the seat — every model that previously failed with the integrator error now works.
4. pytest tests/hermes_cli/test_copilot_runtime_token_exchange.py -q → 4 passed.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(runtime):)
• I searched for existing PRs (this supersedes fix(runtime): exchange Copilot raw OAuth token in pool resolution path #24546)
• My PR contains only changes related to this fix
• I've run the relevant tests and they pass (test_copilot_runtime_token_exchange.py, test_provider_attribution_headers.py)
• I've added tests for my changes
• I've tested on my platform: macOS 15

Documentation & Housekeeping

• Docstrings added for new helpers — no user-facing docs/config keys changed (N/A for README / cli-config.yaml.example)
• No architecture/workflow change (N/A for CONTRIBUTING.md / AGENTS.md)
• Cross-platform safe (pure-Python string/token handling, no platform primitives)

[alt-glitch]

This was generated by AI during triage.

Related: supersedes #24546 (same root cause but #24546 assigns the (token, base_url) tuple to api_key, sending a stringified tuple on the wire -> every model fails with invalid whitespace; this PR sends the exchanged tid= token correctly). Also related: #58743 (distinct 400 model_not_available_for_integrator runtime-recovery mechanism). Competing cluster — maintainer to pick; this is the working exchange.

[tonydwb]

Code Review Summary

Verdict: Comment (LGTM)

Copilot OAuth fix: exchanges the raw Copilot OAuth token during runtime resolution. This completes the Copilot OAuth flow by properly exchanging the token rather than using it directly. 2 files changed — runtime resolution and Copilot client.

[teknium1]

Thanks for tracing this to the runtime resolver. The pooled path remains reachable on current main: agent/credential_pool.py:2435-2436 runs the Copilot singleton seeder before the generic environment seeder, and agent/credential_pool.py:2276-2285 then upserts the raw environment token. hermes_cli/runtime_provider.py:416,451-453 forwards that selected pool key without a runtime exchange, so the proposed defense at this boundary is directionally correct.

Problems

• tests/hermes_cli/test_copilot_runtime_token_exchange.py:28-76 tests the new helper only; it never calls either changed resolver branch. That would not catch a future wiring regression at hermes_cli/runtime_provider.py:477 or :1518.

Suggested changes

• Add resolver-level tests for a raw pooled Copilot entry and an explicit raw key, asserting both exchanged token and exchanged base URL are returned. Keep the exchange-failure base-URL assertion on those actual resolution paths.
• Consider reconciling website/docs/integrations/providers.md:180-188, which currently describes direct raw-token authentication.

Automated hermes-sweeper review.

[teknium1]

Please add a regression test through _resolve_runtime_from_pool_entry() with a raw ghu_... entry. These helper-only tests do not prove the changed pooled resolver returns the exchanged key and enterprise base URL.