[diegosouzapw]

Summary

• The github provider config never carried a clientId, so GitHub OAuth refresh_token exchanges were malformed and rejected.
• A Copilot connection using the long-lived refresh path (after its short-lived token expired) got stuck.
• The provider now resolves its public device-flow client_id from the embedded public credential, and client_secret is only sent when one actually exists.

Root cause

PROVIDERS.github had no clientId (the registry entry had authType: "oauth" but no oauth block, so generateLegacyProviders never set it). The two refresh paths read it:

• open-sse/services/tokenRefresh.ts → buildFormParams drops undefined values, so client_id was omitted entirely.
• open-sse/executors/github.ts → new URLSearchParams({...}) stringified undefined, sending the literal client_id=undefined&client_secret=undefined.

Both are rejected by GitHub's token endpoint.

Fix

• Add an oauth block to the github registry entry that resolves clientId from the embedded public credential via resolvePublicCred("github_copilot_id") (Hard Rule chore(ui): rebrand to OmniRoute #11 — never a string literal; env override via GITHUB_OAUTH_CLIENT_ID).
• The executor now builds the form params with the real client_id and only attaches client_secret when one is configured (GitHub Copilot is a public client — it has none).

Attribution

Thanks to @baslr for the original fix.

Test plan

• tests/unit/token-refresh-service.test.ts — rewrote the github refresh test to drop the masking patch and assert the real resolved client_id is sent with no client_secret (red before, green after); 37/37 pass
• tests/unit/executor-github.test.ts — new test asserting the executor sends the real client_id and never client_secret=undefined (red before, green after); 12/12 pass
• npm run typecheck:core — clean
• eslint on changed files — 0 errors
• error-classification + check-public-creds suites — green

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.