fix(copilot): support enterprise ghe.com device login safely

[amitksingh1490]

Summary

Refs #3860. Draft, not ready for merge. Published at the user's explicit request despite external verification gaps.

• Prompt for a bare GitHub hostname when configuring Copilot device login; github.com remains the default. Accept only github.com or a valid single-label <enterprise>.ghe.com host (case-insensitive); reject arbitrary hosts, schemes, ports, userinfo and path/query/fragment input.
• Derive device authorization and OAuth polling on the selected host, and token exchange on api.<enterprise>.ghe.com. Persist the selected configuration. Refresh uses that saved configuration, not the catalog's public GitHub defaults.
• Validate OAuth/token-exchange destinations and browser verification origins. Keep the existing no-redirect auth client. Avoid echoing upstream token-exchange response bodies in errors.
• Use the token response's endpoints.api for model/chat URLs; revalidate saved endpoints. Enterprise tokens cannot silently fall back to public Copilot or a different enterprise; missing enterprise endpoints fail closed. Older public credentials retain the public default.
• Same-file regression tests cover default/enterprise/invalid hosts, tampered destinations, saved-config refresh validation, provider rendering, and synthetic loopback device/poll/exchange/refresh plus redirect/error-body safety.

Official evidence

• GitHub: Using Copilot with an account on GHE.com documents selecting the enterprise hostname, including copilot login --host SUBDOMAIN.ghe.com.
• GitHub Copilot allowlist distinguishes public *.githubcopilot.com endpoints from enterprise *.SUBDOMAIN.ghe.com services.
• Current official VS Code source, examined via gh at microsoft/vscode commit 6182a6ebe: extensions/github-authentication/src/flows.ts derives /login/device/code and /login/oauth/access_token from the enterprise base URI; src/vs/platform/agentHost/common/githubEndpoints.ts derives the api. enterprise REST host and documents per-user Copilot API endpoints; extensions/copilot/src/platform/authentication/common/copilotToken.ts defines the token response's endpoints.api.
• Issue comments/timeline and related open/closed PR searches were refreshed before implementation and publication. No adequate existing enterprise-login PR was found.

Verification actually performed

• cargo test --locked --offline -p forge_domain --lib: 621 passed, including all six new destination tests.
• cargo clippy --locked --offline -p forge_domain --lib -- -D warnings: passed.
• Low-footprint authentication/provider-rendering harness: 11 tests passed, including four new auth/security tests, two new rendering tests and five existing auth utility tests. It compiles verbatim relevant source slices, real forge_domain types and the real auth utilities. A small trait adapter avoids the unrelated cloud SDK dependency graph; the unused non-Copilot template path deliberately panics. This is not a full forge_infra/forge_services/forge_main build. Harness and reproduction scripts are preserved in /home/forge/issue-patches/3860/auth-harness.
• Harness cargo clippy --tests -- -D warnings -A dead_code -A unused_imports: passed (allowances are for unused code/imports caused by slicing).
• rustfmt --edition 2024 --check on the four changed files and git diff --check: passed. Stable rustfmt warned that repository nightly-only settings were ignored; no workspace-wide reformat was applied.
• Tests used two build jobs with debug info/incremental compilation disabled. Initial disk space was 1.6 GB. cargo insta test --accept --test-runner cargo-test -- --locked --offline -p forge_domain --lib unexpectedly rebuilt dependencies and was stopped by the disk guard at the 600 MiB reserve; it is not a passing insta run. No snapshot changes. Only this task's newly created build target was removed afterward; others' artifacts were untouched.

Remaining blockers / required verification

• No enterprise account was available. Requested user-assisted browser device login; no live github.com or ghe.com authentication, token refresh or inference was performed. Loopback tests use synthetic credentials and a synthetic provider ID, never relax production Copilot validation, and do not prove enterprise service compatibility/client authorization.
• Full infra/services/CLI crate tests and a debug build of this changed CLI remain blocked by storage budget. Existing debug binary --help and provider login --help passed, but it does not include this patch. Its isolated/no-credentials -p smoke reported No such device or address (os error 6) despite exit 0; not a successful prompt or login test.
• Latest-head CI and any automation-added commits must be reviewed independently before readiness. Do not treat Release Drafter or these partial checks as PR readiness.

Authored scope / recovery

Authored commit: 1a8e1fe00 (four files, +596/-21). Durable worktree: /home/forge/worktrees/3860; patch/evidence: /home/forge/issue-patches/3860 (authored.patch, publication.patch, logs, reproduction harness). Any bot-expanded head is separate from this verified authored scope. No force push, merge, issue closure, workflow approval or automation changes requested/performed.

Co-Authored-By: ForgeCode noreply@forgecode.dev

[amitksingh1490]

Draft verification / authored versus automation head

As of 2026-09-16 05:01 UTC, autofix.ci added 726d55d12 on top of authored 1a8e1fe00.

• Authored scope: 4 files, +596/-21. Local 621 domain tests, strict domain Clippy, 11 targeted source-slice harness tests, harness Clippy, and changed-file formatting checks apply to this scope.
• Current remote PR: 140 files, +1807/-856. Bot commit alone changes 140 files, +1218/-842. It includes broad repository formatting outside [Bug]: GithubCopilot login support for <enterprise>.ghe.com #3860. This expanded head has not received full independent local validation.
• Authored CI run 35057505637 was cancelled after the new head; it is not a passing Build/Test result. New-head Build/Test run 35057741556 and autofix run 35057741586 are pending; zsh performance passed. Release Drafter success is not readiness evidence.
• The clean authored worktree remains at /home/forge/worktrees/3860. Minimal authored patch and bot drift are separately backed up at /home/forge/issue-patches/3860/authored.patch and /home/forge/issue-patches/3860/bot-expanded.patch, with PR/head/CI snapshots and exact local logs.

The PR remains draft / blocked, both for the expanded remote scope and for live enterprise device login/refresh/inference plus changed-CLI verification. Please provide user-assisted browser access to a licensed GHE.com account, never tokens or credentials in comments. Full local infra/services/CLI builds remain constrained by storage; only this issue's own newly generated build target was removed after preserving logs. No force push, automation change, workflow approval, merge or issue closure was performed.

Co-Authored-By: ForgeCode noreply@forgecode.dev

[github-actions]

Action required: PR inactive for 5 days.
Status update or closure in 10 days.

[github-actions]

PR closed after 10 days of inactivity.