fix(copilot): preserve native inline OAuth identity

[oxura]

Description

Closes #3352.

Preserve a native editor's ghu_ OAuth bearer and integration identity only for a recognized Copilot completions host plus a FIM completions path. Apply the same path check after removing a configured gateway prefix. Strip an unrelated x-api-key but do not replace the editor's seat with the operator's configured tid token or stamp chat defaults.

The generic chat/CLI token classifier and managed-seed refresh policy are unchanged. This is the narrow inline-completion exception, not broad GHU forwarding for chat (#3402 covers a different surface).

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• Documentation update

Changes Made

• Preserve native editor OAuth and integration identity on recognized FIM completions, including the configured gateway path.
• Remove a configured gateway prefix only for the same scheme/authority and a complete path segment; keep other recognized endpoints' native paths.
• Add origin/segment auth regressions and credential-gated HTTP coverage of the real passthrough and streaming entrypoints. Remove the obsolete hook-echo tests and fake-module loader while retaining real per-model routing coverage.
• Update the existing VS Code guide.

Testing

• Targeted unit/integration tests pass
• Ruff passes on the three affected Python files
• Scoped mypy passes on headroom/copilot_auth.py
• Auth-precedence/security regressions added
• Actual proxy HTTP testing performed

Normal commit/pre-push qualification completed without bypass: Rust fmt, workspace Clippy and workspace tests; native extension build/install/import verification; critical Python suite; commitlint. The ordinary git push succeeded with the installed native library explicitly resolved.

Test Output

Latest normal pre-push critical suite: 177 passed, 4 skipped, 1 warning in 102.12s
Review follow-up targeted auth/forwarder suite: 222 passed in 64.42s

The warning is the existing Anthropic tokenizer-approximation warning. Targeted auth regression results and actual HTTP results are recorded below; this is not a full-Python-suite claim.

Real Behavior Proof

• Environment: Linux x86_64, Python 3.13; native-core-enabled Headroom before/after HTTP qualification in stateless/offline mode with optimization and Kompress explicitly disabled. Synthetic local upstream and synthetic operator/editor tokens, not live GitHub credentials.
• Exact command / steps: uv run pytest -q tests/test_copilot_inline_client_auth.py tests/test_copilot_auth.py tests/test_copilot_vscode_completions_routing.py tests/test_proxy_copilot_auth_hooks.py tests/test_provider_copilot_vscode_config.py; Ruff on the three affected Python files and uv run mypy headroom/copilot_auth.py. Baseline regressions explicitly imported the unchanged auth module from the sibling main-base worktree. Actual HTTP used the configured gateway path /p/inline-seat-repro/v1/engines/gpt-41-copilot/completions with native Copilot-Integration-Id: vscode and a synthetic GHU bearer, while an operator TID token was configured.
• Observed result: initial baseline 3 failed / 1 passed; after 214 passed in 30.77s, Ruff passed, scoped mypy reported no issues. Copied direct/proxy HTTP response records are below. Proxy liveness was 200. Both actual proxy runs loaded the native core, with no native fallback or stub.
• Real native model parity: explicitly resolve the already installed libonnxruntime.so.1.26.0 through ORT_DYLIB_PATH, then run the unchanged kompress_parity test binary with --nocapture: 2 passed / 21 fixtures matched byte-for-byte in 9.62s.
• Earlier normal-gate attempts exposed an unchanged 500ms dispatch guard failure (771ms) and then a native library-load hang. A debugger stack identified reentrant ORT initialization after a dynamic-library load error; resolving the installed library fixed the latter. No native source, backend, threshold, or hook was changed or bypassed.
• Not tested: a live GitHub token exchange/provider session, an actual Windows VS Code/Copilot client, or a hardware/browser editor integration. The temporary HTTP fixture was removed and both services stopped after qualification.
• Review qualification: four origin/segment cases failed before the correction; the corrected auth module passed 8 cases, and the combined five-file auth/forwarder suite passed as recorded above. Ruff and scoped mypy passed. The forwarder tests initialize the real proxy and use an HTTP credential gate, with no auth-function mocks. A separate production auth API CLI smoke exercised the four reviewed origin/segment paths and preserved editor identity while removing the unrelated provider secret.

Copied response records from the actual initial HTTP qualification (synthetic local provider and tokens; baseline auth module versus this fix):

{"lane":"direct","status":200,"body":{"id":"synthetic-inline-completion","object":"text_completion","choices":[{"index":0,"text":"x * x","finish_reason":"stop"}]}}
{"lane":"proxy-before","status":401,"body":{"error":{"code":"invalid_token","message":"Editor seat and native integration required"}}}
{"lane":"direct-after","status":200,"body":{"id":"synthetic-inline-completion","object":"text_completion","choices":[{"index":0,"text":"x * x","finish_reason":"stop"}]}}
{"lane":"proxy-after","status":200,"body":{"id":"synthetic-inline-completion","object":"text_completion","choices":[{"index":0,"text":"x * x","finish_reason":"stop"}]}}
{"lane":"wrong-client-remains-unauthorized","status":401,"body":{"error":{"code":"invalid_token","message":"Editor seat and native integration required"}}}

Runtime Rollout Safety

• Rollout-managed feature(s): No new feature flag or rollout-managed feature; narrow correctness fix in existing Copilot FIM authentication.
• Minimum rollout channel: Stable; existing Copilot routing/channel controls unchanged.
• Stable/default behavior changed: Native editor GHU identity wins on recognized FIM requests instead of being overwritten by the operator TID/chat identity. Generic chat/CLI and managed-seed behavior is unchanged.
• Kill switch / disable path: No new switch; rollback this commit to restore prior auth precedence. Existing provider/routing configuration is unchanged.
• Unsafe override required: No new production unsafe override. Qualification used an explicitly configured synthetic loopback upstream; it is not a production provider claim.
• Qualification impact: Direct-versus-proxied FIM HTTP auth, legacy/per-SKU/prefixed host paths, chat precedence, and wrong-client rejection qualified; live-provider and actual editor-client limits remain explicit above.
• Rollback path: Revert the auth fix and related tests/docs to base 8c1beb20aeb8f0576095ae4893176ce16c2ede2a.

Review Readiness

• I have performed a self-review
• This PR is ready for human review

Checklist

• Existing auth/routing conventions reused
• Corresponding VS Code documentation updated
• Tests prove the auth fix and preserve chat precedence
• CHANGELOG.md not edited; Conventional Commit PR title used

[github-actions]

PR governance

This PR follows the template and is marked ready for human review.

[oxura]

Updated all seven exact template section names, both self-review/readiness checkboxes, and the actual Changes Made bullet list requested in the edited governance comment. Added copied runtime response records to Real Behavior Proof. The body preserves scoped tests/lint/type checks, ordinary native pre-push qualification and earlier environment failures, rollout/rollback paths, and live-provider/editor limits; no full-Python-suite or live-provider claim was added.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 92.85714% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
headroom/copilot_auth.py	92.85%	0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[chopratejas]

Maintainer check (2026-10-10): updated the branch with current main (51 commits behind, clean merge) and re-ran the five Copilot suites named in the PR on top of that merge locally with the native core loaded:

tests/test_copilot_inline_client_auth.py tests/test_copilot_auth.py tests/test_copilot_vscode_completions_routing.py tests/test_proxy_copilot_auth_hooks.py tests/test_provider_copilot_vscode_config.py
222 passed in 4.36s

This fix is on the path for an Enterprise customer's VS Code inline completions (401 today), so it is queued for review ahead of the other Copilot PRs.

[oxura]

Thanks for merging current main and running the native-core 222-test qualification. The gateway origin/segment correction and its host/scheme/port/segment regressions are retained; the earlier review thread is resolved. The PR evidence distinguishes the synthetic local HTTP qualification from an actual Enterprise/Windows VS Code session.