From 447f5951a99eb34b93b5d71f57f612aac28ce26a Mon Sep 17 00:00:00 2001
From: sykuang <sykuang.tw@gmail.com>
Date: Mon, 16 Feb 2026 03:13:32 +0800
Subject: [PATCH 1/2] feat: Implement GitHub Copilot integration with device
 flow authentication

- Added GitHub Copilot backend to handle chat requests and token exchanges.
- Implemented device flow for GitHub OAuth, allowing users to authenticate via a device code.
- Created functions to manage Copilot API tokens, including caching and refreshing.
- Updated existing structures to support GitHub Copilot as a new AI provider.
- Enhanced the chat request handling to include Copilot-specific headers.
- Added commands for device login start, poll, status, and logout in the RPC server.
- Updated configuration schema to include GitHub Copilot as a valid provider and API type.
- Ensured that Copilot modes are created in the waveai.json configuration file upon successful login.
---
 frontend/app/aipanel/aimode.tsx               | 155 ++++++++++-
 frontend/app/store/wshclientapi.ts            |  20 ++
 frontend/types/gotypes.d.ts                   |  24 ++
 pkg/aiusechat/githubcopilot/copilotbackend.go | 122 +++++++++
 pkg/aiusechat/githubcopilot/copilottoken.go   | 253 ++++++++++++++++++
 pkg/aiusechat/githubcopilot/deviceflow.go     | 167 ++++++++++++
 .../openaichat/openaichat-convertmessage.go   |  25 ++
 pkg/aiusechat/uctypes/uctypes.go              |  16 +-
 pkg/aiusechat/usechat-backend.go              |  46 ++++
 pkg/aiusechat/usechat-mode.go                 |  28 +-
 pkg/wconfig/settingsconfig.go                 |   4 +-
 pkg/wshrpc/wshclient/wshclient.go             |  24 ++
 pkg/wshrpc/wshrpctypes.go                     |  27 ++
 pkg/wshrpc/wshserver/wshserver.go             | 189 +++++++++++++
 schema/waveai.json                            |   4 +-
 15 files changed, 1088 insertions(+), 16 deletions(-)
 create mode 100644 pkg/aiusechat/githubcopilot/copilotbackend.go
 create mode 100644 pkg/aiusechat/githubcopilot/copilottoken.go
 create mode 100644 pkg/aiusechat/githubcopilot/deviceflow.go

diff --git a/frontend/app/aipanel/aimode.tsx b/frontend/app/aipanel/aimode.tsx
index 3602cdd360..9f2f66e43e 100644
--- a/frontend/app/aipanel/aimode.tsx
+++ b/frontend/app/aipanel/aimode.tsx
@@ -2,12 +2,12 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import { Tooltip } from "@/app/element/tooltip";
-import { atoms, getSettingsKeyAtom } from "@/app/store/global";
+import { atoms, getApi, getSettingsKeyAtom } from "@/app/store/global";
 import { RpcApi } from "@/app/store/wshclientapi";
 import { TabRpcClient } from "@/app/store/wshrpcutil";
 import { cn, fireAndForget, makeIconClass } from "@/util/util";
 import { useAtomValue } from "jotai";
-import { memo, useRef, useState } from "react";
+import { memo, useCallback, useEffect, useRef, useState } from "react";
 import { getFilteredAIModeConfigs, getModeDisplayName } from "./ai-utils";
 import { WaveAIModel } from "./waveai-model";
 
@@ -147,6 +147,91 @@ export const AIModeDropdown = memo(({ compatibilityMode = false }: AIModeDropdow
     const telemetryEnabled = useAtomValue(getSettingsKeyAtom("telemetry:enabled")) ?? false;
     const [isOpen, setIsOpen] = useState(false);
     const dropdownRef = useRef<HTMLDivElement>(null);
+    const copilotLoginAbortRef = useRef<AbortController | null>(null);
+    const [copilotLoggedIn, setCopilotLoggedIn] = useState(false);
+    const [copilotLoginState, setCopilotLoginState] = useState<
+        | { status: "idle" }
+        | { status: "waiting"; userCode: string; verificationUri: string }
+        | { status: "polling" }
+        | { status: "complete" }
+        | { status: "error"; message: string }
+    >({ status: "idle" });
+
+    // Check Copilot login status on mount and when dropdown opens
+    useEffect(() => {
+        fireAndForget(async () => {
+            try {
+                const status = await RpcApi.CopilotDeviceLoginStatusCommand(TabRpcClient);
+                setCopilotLoggedIn(status.loggedin);
+            } catch {
+                // ignore errors
+            }
+        });
+    }, [isOpen]);
+
+    const handleCopilotLogin = useCallback(() => {
+        const abortController = new AbortController();
+        copilotLoginAbortRef.current = abortController;
+        fireAndForget(async () => {
+            setCopilotLoginState({ status: "polling" });
+            try {
+                const startData = await RpcApi.CopilotDeviceLoginStartCommand(TabRpcClient);
+                if (abortController.signal.aborted) return;
+                setCopilotLoginState({
+                    status: "waiting",
+                    userCode: startData.usercode,
+                    verificationUri: startData.verificationuri,
+                });
+                // Copy code to clipboard and open browser
+                await navigator.clipboard.writeText(startData.usercode);
+                getApi().openExternal(startData.verificationuri);
+                // Now poll for completion
+                const pollResult = await RpcApi.CopilotDeviceLoginPollCommand(TabRpcClient, {}, { timeout: 15 * 60 * 1000 });
+                if (abortController.signal.aborted) return;
+                if (pollResult.status === "complete") {
+                    setCopilotLoginState({ status: "complete" });
+                    setCopilotLoggedIn(true);
+                    // Auto-switch to the copilot mode if one was created
+                    if (pollResult.modename) {
+                        // Wait briefly for config watcher to pick up the new mode
+                        setTimeout(() => {
+                            model.setAIMode(pollResult.modename);
+                        }, 500);
+                    }
+                    setTimeout(() => setCopilotLoginState({ status: "idle" }), 3000);
+                } else {
+                    setCopilotLoginState({
+                        status: "error",
+                        message: pollResult.error || "Login failed",
+                    });
+                    setTimeout(() => setCopilotLoginState({ status: "idle" }), 5000);
+                }
+            } catch (e: any) {
+                if (abortController.signal.aborted) return;
+                setCopilotLoginState({ status: "error", message: e.message || "Login failed" });
+                setTimeout(() => setCopilotLoginState({ status: "idle" }), 5000);
+            }
+        });
+    }, []);
+
+    const handleCopilotLoginCancel = useCallback(() => {
+        if (copilotLoginAbortRef.current) {
+            copilotLoginAbortRef.current.abort();
+            copilotLoginAbortRef.current = null;
+        }
+        setCopilotLoginState({ status: "idle" });
+    }, []);
+
+    const handleCopilotLogout = useCallback(() => {
+        fireAndForget(async () => {
+            try {
+                await RpcApi.CopilotDeviceLogoutCommand(TabRpcClient);
+                setCopilotLoggedIn(false);
+            } catch (e: any) {
+                console.error("Failed to logout from Copilot:", e);
+            }
+        });
+    }, []);
 
     const { waveProviderConfigs, otherProviderConfigs } = getFilteredAIModeConfigs(
         aiModeConfigs,
@@ -312,6 +397,72 @@ export const AIModeDropdown = memo(({ compatibilityMode = false }: AIModeDropdow
                             <i className={makeIconClass("plus", false)}></i>
                             <span className="text-sm">New Chat</span>
                         </button>
+                        <div className="border-t border-gray-600 my-1" />
+                        {copilotLoginState.status === "idle" && !copilotLoggedIn && (
+                            <button
+                                onClick={handleCopilotLogin}
+                                className="w-full flex items-center gap-2 px-3 pt-1 pb-1 text-gray-300 hover:bg-zinc-700 cursor-pointer transition-colors text-left"
+                            >
+                                <i className="fa-brands fa-github text-[12px]"></i>
+                                <span className="text-sm">Login to GitHub Copilot</span>
+                            </button>
+                        )}
+                        {copilotLoginState.status === "idle" && copilotLoggedIn && (
+                            <div className="w-full flex items-center justify-between px-3 pt-1 pb-1 text-left">
+                                <div className="flex items-center gap-2 text-green-400">
+                                    <i className="fa-brands fa-github text-[12px]"></i>
+                                    <span className="text-sm">Copilot Connected</span>
+                                </div>
+                                <button
+                                    onClick={handleCopilotLogout}
+                                    className="text-[11px] text-gray-500 hover:text-red-400 cursor-pointer transition-colors"
+                                >
+                                    Logout
+                                </button>
+                            </div>
+                        )}
+                        {copilotLoginState.status === "polling" && (
+                            <div className="w-full flex items-center gap-2 px-3 pt-1 pb-1 text-gray-400 text-left">
+                                <i className="fa fa-spinner fa-spin text-[12px]"></i>
+                                <span className="text-sm">Starting login...</span>
+                            </div>
+                        )}
+                        {copilotLoginState.status === "waiting" && (
+                            <div className="w-full flex flex-col gap-1 px-3 pt-1 pb-1 text-left">
+                                <div className="flex items-center gap-2 text-green-300">
+                                    <i className="fa fa-key text-[12px]"></i>
+                                    <span className="text-sm font-bold">{copilotLoginState.userCode}</span>
+                                </div>
+                                <div className="text-[11px] text-gray-400">
+                                    Code copied! Paste it on GitHub.
+                                </div>
+                                <div className="flex items-center justify-between text-gray-400">
+                                    <div className="flex items-center gap-2">
+                                        <i className="fa fa-spinner fa-spin text-[10px]"></i>
+                                        <span className="text-[11px]">Waiting for authorization...</span>
+                                    </div>
+                                    <button
+                                        onClick={handleCopilotLoginCancel}
+                                        className="text-[11px] text-red-400 hover:text-red-300 cursor-pointer transition-colors"
+                                    >
+                                        Cancel
+                                    </button>
+                                </div>
+                            </div>
+                        )}
+                        {copilotLoginState.status === "complete" && (
+                            <div className="w-full flex items-center gap-2 px-3 pt-1 pb-1 text-green-400 text-left">
+                                <i className="fa fa-check text-[12px]"></i>
+                                <span className="text-sm">Logged in to GitHub Copilot!</span>
+                            </div>
+                        )}
+                        {copilotLoginState.status === "error" && (
+                            <div className="w-full flex items-center gap-2 px-3 pt-1 pb-1 text-red-400 text-left">
+                                <i className="fa fa-triangle-exclamation text-[12px]"></i>
+                                <span className="text-sm">{copilotLoginState.message}</span>
+                            </div>
+                        )}
+                        <div className="border-t border-gray-600 my-1" />
                         <button
                             onClick={handleConfigureClick}
                             className="w-full flex items-center gap-2 px-3 pt-1 pb-2 text-gray-300 hover:bg-zinc-700 cursor-pointer transition-colors text-left"
diff --git a/frontend/app/store/wshclientapi.ts b/frontend/app/store/wshclientapi.ts
index 25e2bfe929..6e44213f79 100644
--- a/frontend/app/store/wshclientapi.ts
+++ b/frontend/app/store/wshclientapi.ts
@@ -137,6 +137,26 @@ class RpcApiType {
         return client.wshRpcCall("controllerresync", data, opts);
     }
 
+    // command "copilotdeviceloginpoll" [call]
+    CopilotDeviceLoginPollCommand(client: WshClient, data: CopilotDeviceLoginPollData, opts?: RpcOpts): Promise<CopilotDeviceLoginPollRtnData> {
+        return client.wshRpcCall("copilotdeviceloginpoll", data, opts);
+    }
+
+    // command "copilotdeviceloginstart" [call]
+    CopilotDeviceLoginStartCommand(client: WshClient, opts?: RpcOpts): Promise<CopilotDeviceLoginStartRtnData> {
+        return client.wshRpcCall("copilotdeviceloginstart", null, opts);
+    }
+
+    // command "copilotdeviceloginstatus" [call]
+    CopilotDeviceLoginStatusCommand(client: WshClient, opts?: RpcOpts): Promise<CopilotDeviceLoginStatusRtnData> {
+        return client.wshRpcCall("copilotdeviceloginstatus", null, opts);
+    }
+
+    // command "copilotdevicelogout" [call]
+    CopilotDeviceLogoutCommand(client: WshClient, opts?: RpcOpts): Promise<void> {
+        return client.wshRpcCall("copilotdevicelogout", null, opts);
+    }
+
     // command "createblock" [call]
     CreateBlockCommand(client: WshClient, data: CommandCreateBlockData, opts?: RpcOpts): Promise<ORef> {
         return client.wshRpcCall("createblock", data, opts);
diff --git a/frontend/types/gotypes.d.ts b/frontend/types/gotypes.d.ts
index dada3a248b..a1639ff2f3 100644
--- a/frontend/types/gotypes.d.ts
+++ b/frontend/types/gotypes.d.ts
@@ -800,6 +800,30 @@ declare global {
         keepalivesenttime?: number;
     };
 
+    // wshrpc.CopilotDeviceLoginPollData
+    type CopilotDeviceLoginPollData = {
+    };
+
+    // wshrpc.CopilotDeviceLoginPollRtnData
+    type CopilotDeviceLoginPollRtnData = {
+        status: string;
+        error?: string;
+        modename?: string;
+    };
+
+    // wshrpc.CopilotDeviceLoginStartRtnData
+    type CopilotDeviceLoginStartRtnData = {
+        usercode: string;
+        verificationuri: string;
+        expiresin: number;
+    };
+
+    // wshrpc.CopilotDeviceLoginStatusRtnData
+    type CopilotDeviceLoginStatusRtnData = {
+        loggedin: boolean;
+        error?: string;
+    };
+
     // wshrpc.CpuDataRequest
     type CpuDataRequest = {
         id: string;
diff --git a/pkg/aiusechat/githubcopilot/copilotbackend.go b/pkg/aiusechat/githubcopilot/copilotbackend.go
new file mode 100644
index 0000000000..4f97a16ff2
--- /dev/null
+++ b/pkg/aiusechat/githubcopilot/copilotbackend.go
@@ -0,0 +1,122 @@
+// Copyright 2025, Command Line Inc.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package githubcopilot implements the GitHub Copilot AI backend for Wave Terminal.
+//
+// GitHub Copilot exposes an OpenAI Chat Completions-compatible API, but requires
+// a 2-step authentication flow:
+//
+//  1. The user provides a GitHub token (PAT, OAuth, or Copilot CLI token).
+//  2. That token is exchanged for a short-lived Copilot API token via
+//     https://api.github.com/copilot_internal/v2/token
+//
+// The Copilot API token is then used as a Bearer token against the Copilot API
+// endpoint (derived from the `proxy-ep` field embedded in the token itself).
+//
+// This backend wraps the openaichat backend, intercepting requests to perform
+// the token exchange and inject the correct endpoint + auth headers.
+package githubcopilot
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/wavetermdev/waveterm/pkg/aiusechat/openaichat"
+	"github.com/wavetermdev/waveterm/pkg/aiusechat/uctypes"
+	"github.com/wavetermdev/waveterm/pkg/web/sse"
+)
+
+// RunChatStep executes a chat step against the GitHub Copilot API.
+// It exchanges the GitHub token for a Copilot API token, then delegates
+// to the openaichat backend with the adjusted config.
+func RunChatStep(
+	ctx context.Context,
+	sseHandler *sse.SSEHandlerCh,
+	chatOpts uctypes.WaveChatOpts,
+	cont *uctypes.WaveContinueResponse,
+) (*uctypes.WaveStopReason, []*openaichat.StoredChatMessage, *uctypes.RateLimitInfo, error) {
+	// The config.APIToken holds the GitHub token (PAT/OAuth).
+	// Exchange it for a Copilot API token.
+	githubToken := chatOpts.Config.APIToken
+	if githubToken == "" {
+		return nil, nil, nil, fmt.Errorf("github-copilot: GitHub token is required (set GITHUB_COPILOT_TOKEN secret)")
+	}
+
+	copilotToken, err := GetCopilotToken(githubToken)
+	if err != nil {
+		return nil, nil, nil, fmt.Errorf("github-copilot: token exchange failed: %w", err)
+	}
+
+	// Build a modified chatOpts that uses the Copilot token and endpoint.
+	modifiedOpts := chatOpts
+	modifiedOpts.Config.APIToken = copilotToken.Token
+	modifiedOpts.Config.Endpoint = copilotToken.BaseURL + "/chat/completions"
+
+	// Keep the provider as github-copilot so the openaichat backend
+	// can add the required Copilot-specific headers.
+	modifiedOpts.Config.Provider = uctypes.AIProvider_GitHubCopilot
+
+	return openaichat.RunChatStep(ctx, sseHandler, modifiedOpts, cont)
+}
+
+// UpdateToolUseData delegates to openaichat.
+func UpdateToolUseData(chatId string, toolCallId string, toolUseData uctypes.UIMessageDataToolUse) error {
+	return openaichat.UpdateToolUseData(chatId, toolCallId, toolUseData)
+}
+
+// RemoveToolUseCall delegates to openaichat.
+func RemoveToolUseCall(chatId string, toolCallId string) error {
+	return openaichat.RemoveToolUseCall(chatId, toolCallId)
+}
+
+// ConvertToolResultsToNativeChatMessage delegates to openaichat.
+func ConvertToolResultsToNativeChatMessage(toolResults []uctypes.AIToolResult) ([]uctypes.GenAIMessage, error) {
+	return openaichat.ConvertToolResultsToNativeChatMessage(toolResults)
+}
+
+// ConvertAIMessageToStoredChatMessage delegates to openaichat.
+func ConvertAIMessageToStoredChatMessage(message uctypes.AIMessage) (*openaichat.StoredChatMessage, error) {
+	return openaichat.ConvertAIMessageToStoredChatMessage(message)
+}
+
+// GetFunctionCallInputByToolCallId delegates to openaichat.
+func GetFunctionCallInputByToolCallId(aiChat uctypes.AIChat, toolCallId string) *uctypes.AIFunctionCallInput {
+	return openaichat.GetFunctionCallInputByToolCallId(aiChat, toolCallId)
+}
+
+// ConvertAIChatToUIChat delegates to openaichat.
+func ConvertAIChatToUIChat(aiChat uctypes.AIChat) (*uctypes.UIChat, error) {
+	return openaichat.ConvertAIChatToUIChat(aiChat)
+}
+
+// GetDefaultCopilotModels returns the list of model IDs commonly available
+// through GitHub Copilot. The availability depends on the user's Copilot plan.
+func GetDefaultCopilotModels() []string {
+	return []string{
+		"gpt-4o",
+		"gpt-4.1",
+		"gpt-4.1-mini",
+		"gpt-4.1-nano",
+		"o3-mini",
+		"claude-3.5-sonnet",
+		"claude-3.7-sonnet",
+		"gemini-2.0-flash-001",
+	}
+}
+
+// DefaultCopilotModel returns the recommended default model for GitHub Copilot.
+func DefaultCopilotModel() string {
+	return "gpt-4o"
+}
+
+// IsCopilotModel returns true if the model string looks like a Copilot-available model.
+func IsCopilotModel(model string) bool {
+	m := strings.ToLower(model)
+	for _, dm := range GetDefaultCopilotModels() {
+		if m == strings.ToLower(dm) {
+			return true
+		}
+	}
+	return false
+}
diff --git a/pkg/aiusechat/githubcopilot/copilottoken.go b/pkg/aiusechat/githubcopilot/copilottoken.go
new file mode 100644
index 0000000000..a1b28fc9e3
--- /dev/null
+++ b/pkg/aiusechat/githubcopilot/copilottoken.go
@@ -0,0 +1,253 @@
+// Copyright 2025, Command Line Inc.
+// SPDX-License-Identifier: Apache-2.0
+
+package githubcopilot
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"regexp"
+	"strings"
+	"sync"
+	"time"
+)
+
+const (
+	CopilotTokenURL           = "https://api.github.com/copilot_internal/v2/token"
+	DefaultCopilotAPIBaseURL  = "https://api.individual.githubcopilot.com"
+	CopilotTokenRefreshMargin = 5 * time.Minute
+)
+
+// CopilotToken represents a short-lived Copilot API token obtained by exchanging a GitHub token.
+type CopilotToken struct {
+	Token     string `json:"token"`
+	ExpiresAt int64  `json:"expires_at"` // unix timestamp in seconds
+	BaseURL   string `json:"base_url"`   // derived from the proxy-ep field in the token
+}
+
+// IsUsable returns true if the token is still valid with a safety margin.
+func (ct *CopilotToken) IsUsable() bool {
+	if ct == nil || ct.Token == "" {
+		return false
+	}
+	return time.Until(time.Unix(ct.ExpiresAt, 0)) > CopilotTokenRefreshMargin
+}
+
+var proxyEpRegex = regexp.MustCompile(`(?:^|;)\s*proxy-ep=([^;\s]+)`)
+
+// deriveCopilotBaseURL extracts the API base URL from the Copilot token.
+// The token contains semicolon-delimited key=value pairs, one of which is proxy-ep.
+// We convert proxy.* to api.* to get the base URL.
+func deriveCopilotBaseURL(token string) string {
+	match := proxyEpRegex.FindStringSubmatch(token)
+	if len(match) < 2 || match[1] == "" {
+		return DefaultCopilotAPIBaseURL
+	}
+	proxyEp := strings.TrimSpace(match[1])
+	// Remove scheme if present, then replace proxy. prefix with api.
+	host := proxyEp
+	host = strings.TrimPrefix(host, "https://")
+	host = strings.TrimPrefix(host, "http://")
+	if strings.HasPrefix(strings.ToLower(host), "proxy.") {
+		host = "api." + host[len("proxy."):]
+	}
+	if host == "" {
+		return DefaultCopilotAPIBaseURL
+	}
+	return "https://" + host
+}
+
+// copilotTokenResponse is the JSON response from the Copilot token endpoint.
+type copilotTokenResponse struct {
+	Token     string `json:"token"`
+	ExpiresAt any    `json:"expires_at"` // can be int or string
+}
+
+func parseExpiresAt(v any) (int64, error) {
+	switch val := v.(type) {
+	case float64:
+		ts := int64(val)
+		if ts > 10_000_000_000 {
+			return ts / 1000, nil // was in milliseconds
+		}
+		return ts, nil
+	case string:
+		val = strings.TrimSpace(val)
+		if val == "" {
+			return 0, fmt.Errorf("empty expires_at string")
+		}
+		var ts int64
+		_, err := fmt.Sscanf(val, "%d", &ts)
+		if err != nil {
+			return 0, fmt.Errorf("invalid expires_at string: %q", val)
+		}
+		if ts > 10_000_000_000 {
+			return ts / 1000, nil
+		}
+		return ts, nil
+	case nil:
+		return 0, fmt.Errorf("missing expires_at")
+	default:
+		return 0, fmt.Errorf("unexpected expires_at type: %T", v)
+	}
+}
+
+// ExchangeGitHubTokenForCopilotToken exchanges a GitHub personal access token (or OAuth token)
+// for a short-lived Copilot API token via the GitHub Copilot internal endpoint.
+func ExchangeGitHubTokenForCopilotToken(githubToken string) (*CopilotToken, error) {
+	req, err := http.NewRequest(http.MethodGet, CopilotTokenURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create copilot token request: %w", err)
+	}
+	req.Header.Set("Accept", "application/json")
+	req.Header.Set("Authorization", "Bearer "+githubToken)
+	req.Header.Set("User-Agent", "WaveTerm")
+
+	client := &http.Client{Timeout: 15 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("copilot token exchange request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	bodyBytes, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read copilot token response: %w", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("copilot token exchange failed (HTTP %d): %s", resp.StatusCode, string(bodyBytes))
+	}
+
+	var tokenResp copilotTokenResponse
+	if err := json.Unmarshal(bodyBytes, &tokenResp); err != nil {
+		return nil, fmt.Errorf("failed to parse copilot token response: %w", err)
+	}
+
+	if tokenResp.Token == "" {
+		return nil, fmt.Errorf("copilot token response missing token field")
+	}
+
+	expiresAt, err := parseExpiresAt(tokenResp.ExpiresAt)
+	if err != nil {
+		return nil, fmt.Errorf("copilot token response: %w", err)
+	}
+
+	return &CopilotToken{
+		Token:     tokenResp.Token,
+		ExpiresAt: expiresAt,
+		BaseURL:   deriveCopilotBaseURL(tokenResp.Token),
+	}, nil
+}
+
+// CopilotTokenManager handles caching and refreshing of Copilot API tokens.
+// Thread-safe.
+type CopilotTokenManager struct {
+	mu           sync.Mutex
+	cachedToken  *CopilotToken
+	githubToken  string
+	refreshing   bool
+}
+
+var globalTokenManager = &CopilotTokenManager{}
+
+// GetCopilotToken returns a valid Copilot API token, refreshing if necessary.
+// githubToken is the user's GitHub token (PAT or OAuth access token).
+func GetCopilotToken(githubToken string) (*CopilotToken, error) {
+	return globalTokenManager.GetToken(githubToken)
+}
+
+func (m *CopilotTokenManager) GetToken(githubToken string) (*CopilotToken, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	// If the github token changed, invalidate the cache
+	if m.githubToken != githubToken {
+		m.cachedToken = nil
+		m.githubToken = githubToken
+	}
+
+	// Return cached token if still usable
+	if m.cachedToken.IsUsable() {
+		return m.cachedToken, nil
+	}
+
+	// Exchange for a new token
+	log.Printf("githubcopilot: exchanging GitHub token for Copilot API token\n")
+	token, err := ExchangeGitHubTokenForCopilotToken(githubToken)
+	if err != nil {
+		return nil, err
+	}
+
+	m.cachedToken = token
+	log.Printf("githubcopilot: obtained Copilot API token, expires at %s, base URL: %s\n",
+		time.Unix(token.ExpiresAt, 0).Format(time.RFC3339), token.BaseURL)
+	return token, nil
+}
+
+// ResetCachedToken clears the cached token, forcing a refresh on next call.
+func ResetCachedToken() {
+	globalTokenManager.mu.Lock()
+	defer globalTokenManager.mu.Unlock()
+	globalTokenManager.cachedToken = nil
+}
+
+// CopilotModelInfo represents a model returned by the Copilot /models endpoint.
+type CopilotModelInfo struct {
+	ID      string `json:"id"`
+	Object  string `json:"object"`
+	OwnedBy string `json:"owned_by"`
+}
+
+type copilotModelsResponse struct {
+	Data []CopilotModelInfo `json:"data"`
+}
+
+// FetchAvailableModels queries the Copilot API for the list of models available
+// to the user's subscription. Returns the model IDs.
+func FetchAvailableModels(githubToken string) ([]CopilotModelInfo, error) {
+	// First get a valid Copilot token
+	copilotToken, err := GetCopilotToken(githubToken)
+	if err != nil {
+		return nil, fmt.Errorf("token exchange for model discovery: %w", err)
+	}
+
+	modelsURL := copilotToken.BaseURL + "/models"
+	req, err := http.NewRequest(http.MethodGet, modelsURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("creating models request: %w", err)
+	}
+	req.Header.Set("Authorization", "Bearer "+copilotToken.Token)
+	req.Header.Set("Accept", "application/json")
+	req.Header.Set("Copilot-Integration-Id", "vscode-chat")
+	req.Header.Set("Editor-Version", "WaveTerm/0.11.0")
+	req.Header.Set("Editor-Plugin-Version", "CopilotChat/0.35.0")
+
+	client := &http.Client{Timeout: 15 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("models request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	bodyBytes, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("reading models response: %w", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		log.Printf("githubcopilot: models endpoint returned HTTP %d: %s\n", resp.StatusCode, string(bodyBytes))
+		return nil, fmt.Errorf("models endpoint returned HTTP %d", resp.StatusCode)
+	}
+
+	var modelsResp copilotModelsResponse
+	if err := json.Unmarshal(bodyBytes, &modelsResp); err != nil {
+		return nil, fmt.Errorf("parsing models response: %w", err)
+	}
+
+	log.Printf("githubcopilot: discovered %d available models\n", len(modelsResp.Data))
+	return modelsResp.Data, nil
+}
diff --git a/pkg/aiusechat/githubcopilot/deviceflow.go b/pkg/aiusechat/githubcopilot/deviceflow.go
new file mode 100644
index 0000000000..bbb73158dc
--- /dev/null
+++ b/pkg/aiusechat/githubcopilot/deviceflow.go
@@ -0,0 +1,167 @@
+// Copyright 2025, Command Line Inc.
+// SPDX-License-Identifier: Apache-2.0
+
+package githubcopilot
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+)
+
+const (
+	GitHubCopilotClientID     = "Iv1.b507a08c87ecfe98"
+	GitHubDeviceCodeURL       = "https://github.com/login/device/code"
+	GitHubOAuthAccessTokenURL = "https://github.com/login/oauth/access_token"
+	DeviceCodeGrantType       = "urn:ietf:params:oauth:grant-type:device_code"
+)
+
+// DeviceCodeResponse is the response from GitHub's device code endpoint.
+type DeviceCodeResponse struct {
+	DeviceCode      string `json:"device_code"`
+	UserCode        string `json:"user_code"`
+	VerificationURI string `json:"verification_uri"`
+	ExpiresIn       int    `json:"expires_in"`
+	Interval        int    `json:"interval"`
+}
+
+// AccessTokenResponse is the response from GitHub's OAuth access token endpoint.
+type AccessTokenResponse struct {
+	AccessToken string `json:"access_token,omitempty"`
+	TokenType   string `json:"token_type,omitempty"`
+	Scope       string `json:"scope,omitempty"`
+	Error       string `json:"error,omitempty"`
+}
+
+// RequestDeviceCode initiates the OAuth device code flow by requesting a device code from GitHub.
+func RequestDeviceCode(ctx context.Context) (*DeviceCodeResponse, error) {
+	form := url.Values{}
+	form.Set("client_id", GitHubCopilotClientID)
+	form.Set("scope", "read:user")
+
+	req, err := http.NewRequestWithContext(ctx, "POST", GitHubDeviceCodeURL, strings.NewReader(form.Encode()))
+	if err != nil {
+		return nil, fmt.Errorf("creating device code request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("Accept", "application/json")
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("requesting device code: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("reading device code response: %w", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("device code request failed (status %d): %s", resp.StatusCode, string(body))
+	}
+
+	var dcResp DeviceCodeResponse
+	if err := json.Unmarshal(body, &dcResp); err != nil {
+		return nil, fmt.Errorf("parsing device code response: %w", err)
+	}
+
+	return &dcResp, nil
+}
+
+// PollForAccessToken polls GitHub's OAuth token endpoint until the user completes
+// authorization, the device code expires, or the context is cancelled.
+// Returns the access token string on success.
+func PollForAccessToken(ctx context.Context, deviceCode string, interval int, expiresIn int) (string, error) {
+	if interval < 1 {
+		interval = 5
+	}
+
+	deadline := time.Now().Add(time.Duration(expiresIn) * time.Second)
+
+	for {
+		if time.Now().After(deadline) {
+			return "", fmt.Errorf("device code expired, please try again")
+		}
+
+		// Use a simple timer for the interval wait, but still respect cancellation
+		timer := time.NewTimer(time.Duration(interval) * time.Second)
+		select {
+		case <-ctx.Done():
+			timer.Stop()
+			return "", ctx.Err()
+		case <-timer.C:
+		}
+
+		// Each HTTP request gets its own 30-second timeout, independent of the
+		// parent context, so that the RPC deadline doesn't kill poll requests.
+		token, done, err := tryExchangeDeviceCode(deviceCode)
+		if err != nil {
+			return "", err
+		}
+		if done {
+			return token, nil
+		}
+	}
+}
+
+// tryExchangeDeviceCode makes a single attempt to exchange the device code for an access token.
+// Returns (token, true, nil) on success, ("", false, nil) if still pending, or ("", false, err) on failure.
+func tryExchangeDeviceCode(deviceCode string) (string, bool, error) {
+	// Use a per-request 30s timeout so the parent RPC context deadline
+	// doesn't cause "context deadline exceeded" on individual poll requests.
+	reqCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	form := url.Values{}
+	form.Set("client_id", GitHubCopilotClientID)
+	form.Set("device_code", deviceCode)
+	form.Set("grant_type", DeviceCodeGrantType)
+
+	req, err := http.NewRequestWithContext(reqCtx, "POST", GitHubOAuthAccessTokenURL, strings.NewReader(form.Encode()))
+	if err != nil {
+		return "", false, fmt.Errorf("creating token request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("Accept", "application/json")
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return "", false, fmt.Errorf("polling for access token: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", false, fmt.Errorf("reading token response: %w", err)
+	}
+
+	var tokenResp AccessTokenResponse
+	if err := json.Unmarshal(body, &tokenResp); err != nil {
+		return "", false, fmt.Errorf("parsing token response: %w", err)
+	}
+
+	switch tokenResp.Error {
+	case "":
+		if tokenResp.AccessToken != "" {
+			return tokenResp.AccessToken, true, nil
+		}
+		return "", false, fmt.Errorf("empty access token in response")
+	case "authorization_pending":
+		return "", false, nil
+	case "slow_down":
+		// GitHub asks us to increase interval; we just wait an extra cycle
+		return "", false, nil
+	case "expired_token":
+		return "", false, fmt.Errorf("device code expired, please try again")
+	case "access_denied":
+		return "", false, fmt.Errorf("user denied authorization")
+	default:
+		return "", false, fmt.Errorf("OAuth error: %s", tokenResp.Error)
+	}
+}
diff --git a/pkg/aiusechat/openaichat/openaichat-convertmessage.go b/pkg/aiusechat/openaichat/openaichat-convertmessage.go
index 90fe8c9f1f..a07a5cf6f0 100644
--- a/pkg/aiusechat/openaichat/openaichat-convertmessage.go
+++ b/pkg/aiusechat/openaichat/openaichat-convertmessage.go
@@ -151,6 +151,31 @@ func buildChatHTTPRequest(ctx context.Context, messages []ChatRequestMessage, ch
 
 	req.Header.Set("Accept", "text/event-stream")
 
+	// GitHub Copilot requires IDE identification headers
+	if opts.Provider == uctypes.AIProvider_GitHubCopilot {
+		// Static headers — IDE identification
+		req.Header.Set("User-Agent", "GitHubCopilotChat/0.35.0")
+		req.Header.Set("Editor-Version", "WaveTerm/"+wavebase.WaveVersion)
+		req.Header.Set("Editor-Plugin-Version", "CopilotChat/0.35.0")
+		req.Header.Set("Copilot-Integration-Id", "vscode-chat")
+
+		// Dynamic headers — per-request context
+		req.Header.Set("Openai-Intent", "conversation-edits")
+		initiator := "user"
+		if len(finalMessages) > 0 && finalMessages[len(finalMessages)-1].Role != "user" {
+			initiator = "agent"
+		}
+		req.Header.Set("X-Initiator", initiator)
+
+		// Vision header — only when images are present
+		for _, msg := range finalMessages {
+			if len(msg.ContentParts) > 0 {
+				req.Header.Set("Copilot-Vision-Request", "true")
+				break
+			}
+		}
+	}
+
 	// Only send Wave-specific headers when using Wave provider
 	if opts.Provider == uctypes.AIProvider_Wave {
 		if chatOpts.ClientId != "" {
diff --git a/pkg/aiusechat/uctypes/uctypes.go b/pkg/aiusechat/uctypes/uctypes.go
index 8c6eb57e06..771126641a 100644
--- a/pkg/aiusechat/uctypes/uctypes.go
+++ b/pkg/aiusechat/uctypes/uctypes.go
@@ -21,16 +21,18 @@ const (
 	APIType_OpenAIResponses   = "openai-responses"
 	APIType_OpenAIChat        = "openai-chat"
 	APIType_GoogleGemini      = "google-gemini"
+	APIType_GitHubCopilot     = "github-copilot"
 )
 
 const (
-	AIProvider_Wave        = "wave"
-	AIProvider_Google      = "google"
-	AIProvider_OpenRouter  = "openrouter"
-	AIProvider_OpenAI      = "openai"
-	AIProvider_Azure       = "azure"
-	AIProvider_AzureLegacy = "azure-legacy"
-	AIProvider_Custom      = "custom"
+	AIProvider_Wave           = "wave"
+	AIProvider_Google         = "google"
+	AIProvider_OpenRouter     = "openrouter"
+	AIProvider_OpenAI         = "openai"
+	AIProvider_Azure          = "azure"
+	AIProvider_AzureLegacy    = "azure-legacy"
+	AIProvider_GitHubCopilot  = "github-copilot"
+	AIProvider_Custom         = "custom"
 )
 
 type UseChatRequest struct {
diff --git a/pkg/aiusechat/usechat-backend.go b/pkg/aiusechat/usechat-backend.go
index cb380a457c..eb5b78df4c 100644
--- a/pkg/aiusechat/usechat-backend.go
+++ b/pkg/aiusechat/usechat-backend.go
@@ -9,6 +9,7 @@ import (
 
 	"github.com/wavetermdev/waveterm/pkg/aiusechat/anthropic"
 	"github.com/wavetermdev/waveterm/pkg/aiusechat/gemini"
+	"github.com/wavetermdev/waveterm/pkg/aiusechat/githubcopilot"
 	"github.com/wavetermdev/waveterm/pkg/aiusechat/openai"
 	"github.com/wavetermdev/waveterm/pkg/aiusechat/openaichat"
 	"github.com/wavetermdev/waveterm/pkg/aiusechat/uctypes"
@@ -60,6 +61,7 @@ var _ UseChatBackend = (*openaiResponsesBackend)(nil)
 var _ UseChatBackend = (*openaiCompletionsBackend)(nil)
 var _ UseChatBackend = (*anthropicBackend)(nil)
 var _ UseChatBackend = (*geminiBackend)(nil)
+var _ UseChatBackend = (*githubCopilotBackend)(nil)
 
 // GetBackendByAPIType returns the appropriate UseChatBackend implementation for the given API type
 func GetBackendByAPIType(apiType string) (UseChatBackend, error) {
@@ -72,6 +74,8 @@ func GetBackendByAPIType(apiType string) (UseChatBackend, error) {
 		return &anthropicBackend{}, nil
 	case uctypes.APIType_GoogleGemini:
 		return &geminiBackend{}, nil
+	case uctypes.APIType_GitHubCopilot:
+		return &githubCopilotBackend{}, nil
 	default:
 		return nil, fmt.Errorf("unsupported API type: %s", apiType)
 	}
@@ -260,3 +264,45 @@ func (b *geminiBackend) GetFunctionCallInputByToolCallId(aiChat uctypes.AIChat,
 func (b *geminiBackend) ConvertAIChatToUIChat(aiChat uctypes.AIChat) (*uctypes.UIChat, error) {
 	return gemini.ConvertAIChatToUIChat(aiChat)
 }
+
+// githubCopilotBackend implements UseChatBackend for GitHub Copilot API
+// It wraps the OpenAI Chat Completions backend with Copilot-specific token exchange
+type githubCopilotBackend struct{}
+
+func (b *githubCopilotBackend) RunChatStep(
+	ctx context.Context,
+	sseHandler *sse.SSEHandlerCh,
+	chatOpts uctypes.WaveChatOpts,
+	cont *uctypes.WaveContinueResponse,
+) (*uctypes.WaveStopReason, []uctypes.GenAIMessage, *uctypes.RateLimitInfo, error) {
+	stopReason, msgs, rateLimitInfo, err := githubcopilot.RunChatStep(ctx, sseHandler, chatOpts, cont)
+	var genMsgs []uctypes.GenAIMessage
+	for _, msg := range msgs {
+		genMsgs = append(genMsgs, msg)
+	}
+	return stopReason, genMsgs, rateLimitInfo, err
+}
+
+func (b *githubCopilotBackend) UpdateToolUseData(chatId string, toolCallId string, toolUseData uctypes.UIMessageDataToolUse) error {
+	return githubcopilot.UpdateToolUseData(chatId, toolCallId, toolUseData)
+}
+
+func (b *githubCopilotBackend) RemoveToolUseCall(chatId string, toolCallId string) error {
+	return githubcopilot.RemoveToolUseCall(chatId, toolCallId)
+}
+
+func (b *githubCopilotBackend) ConvertToolResultsToNativeChatMessage(toolResults []uctypes.AIToolResult) ([]uctypes.GenAIMessage, error) {
+	return githubcopilot.ConvertToolResultsToNativeChatMessage(toolResults)
+}
+
+func (b *githubCopilotBackend) ConvertAIMessageToNativeChatMessage(message uctypes.AIMessage) (uctypes.GenAIMessage, error) {
+	return githubcopilot.ConvertAIMessageToStoredChatMessage(message)
+}
+
+func (b *githubCopilotBackend) GetFunctionCallInputByToolCallId(aiChat uctypes.AIChat, toolCallId string) *uctypes.AIFunctionCallInput {
+	return githubcopilot.GetFunctionCallInputByToolCallId(aiChat, toolCallId)
+}
+
+func (b *githubCopilotBackend) ConvertAIChatToUIChat(aiChat uctypes.AIChat) (*uctypes.UIChat, error) {
+	return githubcopilot.ConvertAIChatToUIChat(aiChat)
+}
diff --git a/pkg/aiusechat/usechat-mode.go b/pkg/aiusechat/usechat-mode.go
index b2d6c84614..0a5bec0884 100644
--- a/pkg/aiusechat/usechat-mode.go
+++ b/pkg/aiusechat/usechat-mode.go
@@ -28,10 +28,11 @@ const (
 
 	AzureLegacyDefaultAPIVersion = "2025-04-01-preview"
 
-	OpenAIAPITokenSecretName      = "OPENAI_KEY"
-	OpenRouterAPITokenSecretName  = "OPENROUTER_KEY"
-	AzureOpenAIAPITokenSecretName = "AZURE_OPENAI_KEY"
-	GoogleAIAPITokenSecretName    = "GOOGLE_AI_KEY"
+	OpenAIAPITokenSecretName         = "OPENAI_KEY"
+	OpenRouterAPITokenSecretName     = "OPENROUTER_KEY"
+	AzureOpenAIAPITokenSecretName    = "AZURE_OPENAI_KEY"
+	GoogleAIAPITokenSecretName       = "GOOGLE_AI_KEY"
+	GitHubCopilotAPITokenSecretName  = "GITHUB_COPILOT_TOKEN"
 )
 
 func resolveAIMode(requestedMode string, premium bool) (string, *wconfig.AIModeConfigType, error) {
@@ -147,6 +148,25 @@ func applyProviderDefaults(config *wconfig.AIModeConfigType) {
 			config.Capabilities = []string{uctypes.AICapabilityTools, uctypes.AICapabilityImages, uctypes.AICapabilityPdfs}
 		}
 	}
+	if config.Provider == uctypes.AIProvider_GitHubCopilot {
+		if config.APIType == "" {
+			config.APIType = uctypes.APIType_GitHubCopilot
+		}
+		// The endpoint is dynamically resolved during token exchange,
+		// but we set a placeholder so validation doesn't fail.
+		if config.Endpoint == "" {
+			config.Endpoint = "https://api.individual.githubcopilot.com/chat/completions"
+		}
+		if config.APITokenSecretName == "" {
+			config.APITokenSecretName = GitHubCopilotAPITokenSecretName
+		}
+		if config.Model == "" {
+			config.Model = "gpt-4o"
+		}
+		if len(config.Capabilities) == 0 {
+			config.Capabilities = []string{uctypes.AICapabilityTools, uctypes.AICapabilityImages}
+		}
+	}
 	if config.APIType == "" {
 		config.APIType = uctypes.APIType_OpenAIChat
 	}
diff --git a/pkg/wconfig/settingsconfig.go b/pkg/wconfig/settingsconfig.go
index c744f77aa3..7659498a4c 100644
--- a/pkg/wconfig/settingsconfig.go
+++ b/pkg/wconfig/settingsconfig.go
@@ -274,8 +274,8 @@ type AIModeConfigType struct {
 	DisplayOrder       float64  `json:"display:order,omitempty"`
 	DisplayIcon        string   `json:"display:icon,omitempty"`
 	DisplayDescription string   `json:"display:description,omitempty"`
-	Provider           string   `json:"ai:provider,omitempty" jsonschema:"enum=wave,enum=google,enum=openrouter,enum=openai,enum=azure,enum=azure-legacy,enum=custom"`
-	APIType            string   `json:"ai:apitype,omitempty" jsonschema:"enum=google-gemini,enum=openai-responses,enum=openai-chat"`
+	Provider           string   `json:"ai:provider,omitempty" jsonschema:"enum=wave,enum=google,enum=openrouter,enum=openai,enum=azure,enum=azure-legacy,enum=github-copilot,enum=custom"`
+	APIType            string   `json:"ai:apitype,omitempty" jsonschema:"enum=google-gemini,enum=openai-responses,enum=openai-chat,enum=github-copilot"`
 	Model              string   `json:"ai:model,omitempty"`
 	ThinkingLevel      string   `json:"ai:thinkinglevel,omitempty" jsonschema:"enum=low,enum=medium,enum=high"`
 	Verbosity          string   `json:"ai:verbosity,omitempty" jsonschema:"enum=low,enum=medium,enum=high,description=Text verbosity level (OpenAI Responses API only)"`
diff --git a/pkg/wshrpc/wshclient/wshclient.go b/pkg/wshrpc/wshclient/wshclient.go
index ee14fd7585..6fe4c43e26 100644
--- a/pkg/wshrpc/wshclient/wshclient.go
+++ b/pkg/wshrpc/wshclient/wshclient.go
@@ -172,6 +172,30 @@ func ControllerResyncCommand(w *wshutil.WshRpc, data wshrpc.CommandControllerRes
 	return err
 }
 
+// command "copilotdeviceloginpoll", wshserver.CopilotDeviceLoginPollCommand
+func CopilotDeviceLoginPollCommand(w *wshutil.WshRpc, data wshrpc.CopilotDeviceLoginPollData, opts *wshrpc.RpcOpts) (*wshrpc.CopilotDeviceLoginPollRtnData, error) {
+	resp, err := sendRpcRequestCallHelper[*wshrpc.CopilotDeviceLoginPollRtnData](w, "copilotdeviceloginpoll", data, opts)
+	return resp, err
+}
+
+// command "copilotdeviceloginstart", wshserver.CopilotDeviceLoginStartCommand
+func CopilotDeviceLoginStartCommand(w *wshutil.WshRpc, opts *wshrpc.RpcOpts) (*wshrpc.CopilotDeviceLoginStartRtnData, error) {
+	resp, err := sendRpcRequestCallHelper[*wshrpc.CopilotDeviceLoginStartRtnData](w, "copilotdeviceloginstart", nil, opts)
+	return resp, err
+}
+
+// command "copilotdeviceloginstatus", wshserver.CopilotDeviceLoginStatusCommand
+func CopilotDeviceLoginStatusCommand(w *wshutil.WshRpc, opts *wshrpc.RpcOpts) (*wshrpc.CopilotDeviceLoginStatusRtnData, error) {
+	resp, err := sendRpcRequestCallHelper[*wshrpc.CopilotDeviceLoginStatusRtnData](w, "copilotdeviceloginstatus", nil, opts)
+	return resp, err
+}
+
+// command "copilotdevicelogout", wshserver.CopilotDeviceLogoutCommand
+func CopilotDeviceLogoutCommand(w *wshutil.WshRpc, opts *wshrpc.RpcOpts) error {
+	_, err := sendRpcRequestCallHelper[any](w, "copilotdevicelogout", nil, opts)
+	return err
+}
+
 // command "createblock", wshserver.CreateBlockCommand
 func CreateBlockCommand(w *wshutil.WshRpc, data wshrpc.CommandCreateBlockData, opts *wshrpc.RpcOpts) (waveobj.ORef, error) {
 	resp, err := sendRpcRequestCallHelper[waveobj.ORef](w, "createblock", data, opts)
diff --git a/pkg/wshrpc/wshrpctypes.go b/pkg/wshrpc/wshrpctypes.go
index eefd7fabd7..b203d8d6c9 100644
--- a/pkg/wshrpc/wshrpctypes.go
+++ b/pkg/wshrpc/wshrpctypes.go
@@ -149,6 +149,12 @@ type WshRpcInterface interface {
 	WaveAIAddContextCommand(ctx context.Context, data CommandWaveAIAddContextData) error
 	WaveAIGetToolDiffCommand(ctx context.Context, data CommandWaveAIGetToolDiffData) (*CommandWaveAIGetToolDiffRtnData, error)
 
+	// github copilot device flow
+	CopilotDeviceLoginStartCommand(ctx context.Context) (*CopilotDeviceLoginStartRtnData, error)
+	CopilotDeviceLoginPollCommand(ctx context.Context, data CopilotDeviceLoginPollData) (*CopilotDeviceLoginPollRtnData, error)
+	CopilotDeviceLoginStatusCommand(ctx context.Context) (*CopilotDeviceLoginStatusRtnData, error)
+	CopilotDeviceLogoutCommand(ctx context.Context) error
+
 	// screenshot
 	CaptureBlockScreenshotCommand(ctx context.Context, data CommandCaptureBlockScreenshotData) (string, error)
 
@@ -561,6 +567,27 @@ type CommandWaveAIGetToolDiffRtnData struct {
 	ModifiedContents64 string `json:"modifiedcontents64"`
 }
 
+type CopilotDeviceLoginStartRtnData struct {
+	UserCode        string `json:"usercode"`
+	VerificationURI string `json:"verificationuri"`
+	ExpiresIn       int    `json:"expiresin"`
+}
+
+type CopilotDeviceLoginPollData struct {
+	// No data needed — the server tracks the pending device flow internally
+}
+
+type CopilotDeviceLoginPollRtnData struct {
+	Status   string `json:"status"` // "pending", "complete", "expired", "error"
+	Error    string `json:"error,omitempty"`
+	ModeName string `json:"modename,omitempty"` // the AI mode name to switch to after successful login
+}
+
+type CopilotDeviceLoginStatusRtnData struct {
+	LoggedIn bool   `json:"loggedin"`
+	Error    string `json:"error,omitempty"`
+}
+
 type CommandCaptureBlockScreenshotData struct {
 	BlockId string `json:"blockid"`
 }
diff --git a/pkg/wshrpc/wshserver/wshserver.go b/pkg/wshrpc/wshserver/wshserver.go
index ff6a0eae85..7ac374da77 100644
--- a/pkg/wshrpc/wshserver/wshserver.go
+++ b/pkg/wshrpc/wshserver/wshserver.go
@@ -20,9 +20,12 @@ import (
 	"strings"
 	"time"
 
+	"sync"
+
 	"github.com/skratchdot/open-golang/open"
 	"github.com/wavetermdev/waveterm/pkg/aiusechat"
 	"github.com/wavetermdev/waveterm/pkg/aiusechat/chatstore"
+	"github.com/wavetermdev/waveterm/pkg/aiusechat/githubcopilot"
 	"github.com/wavetermdev/waveterm/pkg/aiusechat/uctypes"
 	"github.com/wavetermdev/waveterm/pkg/blockcontroller"
 	"github.com/wavetermdev/waveterm/pkg/blocklogger"
@@ -62,6 +65,14 @@ import (
 
 var InvalidWslDistroNames = []string{"docker-desktop", "docker-desktop-data"}
 
+// pendingDeviceFlow tracks the in-progress GitHub Copilot device code flow
+var (
+	pendingDeviceFlowMu   sync.Mutex
+	pendingDeviceCode     string
+	pendingDeviceInterval int
+	pendingDeviceExpiry   int
+)
+
 type WshServer struct{}
 
 func (*WshServer) WshServerImpl() {}
@@ -1513,3 +1524,181 @@ func (ws *WshServer) JobControllerDetachJobCommand(ctx context.Context, jobId st
 func (ws *WshServer) BlockJobStatusCommand(ctx context.Context, blockId string) (*wshrpc.BlockJobStatusData, error) {
 	return jobcontroller.GetBlockJobStatus(ctx, blockId)
 }
+
+// CopilotDeviceLoginStartCommand initiates the GitHub OAuth device code flow.
+// It returns the user code and verification URI for the user to complete in their browser.
+func (ws *WshServer) CopilotDeviceLoginStartCommand(ctx context.Context) (*wshrpc.CopilotDeviceLoginStartRtnData, error) {
+	dcResp, err := githubcopilot.RequestDeviceCode(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("starting device login: %w", err)
+	}
+
+	pendingDeviceFlowMu.Lock()
+	pendingDeviceCode = dcResp.DeviceCode
+	pendingDeviceInterval = dcResp.Interval
+	pendingDeviceExpiry = dcResp.ExpiresIn
+	pendingDeviceFlowMu.Unlock()
+
+	return &wshrpc.CopilotDeviceLoginStartRtnData{
+		UserCode:        dcResp.UserCode,
+		VerificationURI: dcResp.VerificationURI,
+		ExpiresIn:       dcResp.ExpiresIn,
+	}, nil
+}
+
+// CopilotDeviceLoginPollCommand polls for the user to complete authorization.
+// On success, it stores the GitHub token in the secret store.
+func (ws *WshServer) CopilotDeviceLoginPollCommand(ctx context.Context, data wshrpc.CopilotDeviceLoginPollData) (*wshrpc.CopilotDeviceLoginPollRtnData, error) {
+	pendingDeviceFlowMu.Lock()
+	deviceCode := pendingDeviceCode
+	interval := pendingDeviceInterval
+	expiresIn := pendingDeviceExpiry
+	pendingDeviceFlowMu.Unlock()
+
+	if deviceCode == "" {
+		return &wshrpc.CopilotDeviceLoginPollRtnData{
+			Status: "error",
+			Error:  "no pending device login, call CopilotDeviceLoginStart first",
+		}, nil
+	}
+
+	token, err := githubcopilot.PollForAccessToken(ctx, deviceCode, interval, expiresIn)
+	if err != nil {
+		// Clear pending state on terminal errors
+		pendingDeviceFlowMu.Lock()
+		pendingDeviceCode = ""
+		pendingDeviceFlowMu.Unlock()
+
+		errMsg := err.Error()
+		if strings.Contains(errMsg, "expired") || strings.Contains(errMsg, "denied") {
+			return &wshrpc.CopilotDeviceLoginPollRtnData{
+				Status: "expired",
+				Error:  errMsg,
+			}, nil
+		}
+		return &wshrpc.CopilotDeviceLoginPollRtnData{
+			Status: "error",
+			Error:  errMsg,
+		}, nil
+	}
+
+	// Store the token
+	err = secretstore.SetSecret("GITHUB_COPILOT_TOKEN", token)
+	if err != nil {
+		return nil, fmt.Errorf("storing copilot token: %w", err)
+	}
+
+	// Ensure a copilot mode exists in waveai.json
+	modeName, err := ensureCopilotAIMode(token)
+	if err != nil {
+		log.Printf("warning: failed to ensure copilot AI mode: %v\n", err)
+	}
+
+	// Clear pending state
+	pendingDeviceFlowMu.Lock()
+	pendingDeviceCode = ""
+	pendingDeviceFlowMu.Unlock()
+
+	return &wshrpc.CopilotDeviceLoginPollRtnData{
+		Status:   "complete",
+		ModeName: modeName,
+	}, nil
+}
+
+// ensureCopilotAIMode creates copilot modes in waveai.json for each available model.
+// It queries the Copilot API to discover which models the user's subscription supports.
+// Returns the default mode name that should be selected.
+func ensureCopilotAIMode(githubToken string) (string, error) {
+	// Check if any copilot modes already exist
+	fullConfig := wconfig.GetWatcher().GetFullConfig()
+	for name, cfg := range fullConfig.WaveAIModes {
+		if cfg.Provider == "github-copilot" {
+			return name, nil
+		}
+	}
+
+	// Discover available models from the Copilot API
+	models, err := githubcopilot.FetchAvailableModels(githubToken)
+	if err != nil {
+		log.Printf("githubcopilot: model discovery failed, using defaults: %v\n", err)
+		// Fall back to default models
+		for _, id := range githubcopilot.GetDefaultCopilotModels() {
+			models = append(models, githubcopilot.CopilotModelInfo{ID: id})
+		}
+	}
+
+	if len(models) == 0 {
+		// Absolute fallback
+		models = []githubcopilot.CopilotModelInfo{{ID: "gpt-4o"}}
+	}
+
+	// Read existing waveai.json
+	m, cerrs := wconfig.ReadWaveHomeConfigFile("waveai.json")
+	if len(cerrs) > 0 {
+		m = make(waveobj.MetaMapType)
+	}
+	if m == nil {
+		m = make(waveobj.MetaMapType)
+	}
+
+	defaultModeName := "copilot/" + models[0].ID
+
+	for i, model := range models {
+		modeName := "copilot/" + model.ID
+		if _, exists := m[modeName]; exists {
+			continue
+		}
+		displayName := "Copilot " + model.ID
+		modeConfig := map[string]interface{}{
+			"display:name":        displayName,
+			"display:order":       10 + i,
+			"display:icon":        "github",
+			"display:description": fmt.Sprintf("GitHub Copilot (%s)", model.ID),
+			"ai:provider":         "github-copilot",
+			"ai:model":            model.ID,
+			"ai:capabilities":     []string{"tools", "images"},
+		}
+		m[modeName] = modeConfig
+	}
+
+	err = wconfig.WriteWaveHomeConfigFile("waveai.json", m)
+	if err != nil {
+		return "", fmt.Errorf("writing waveai.json: %w", err)
+	}
+
+	log.Printf("githubcopilot: created %d copilot modes in waveai.json\n", len(models))
+	return defaultModeName, nil
+}
+
+// CopilotDeviceLoginStatusCommand checks whether there is a stored GitHub Copilot token.
+// If the user is logged in but no copilot modes exist yet, it auto-creates them.
+func (ws *WshServer) CopilotDeviceLoginStatusCommand(ctx context.Context) (*wshrpc.CopilotDeviceLoginStatusRtnData, error) {
+	token, exists, err := secretstore.GetSecret("GITHUB_COPILOT_TOKEN")
+	if err != nil {
+		return &wshrpc.CopilotDeviceLoginStatusRtnData{
+			LoggedIn: false,
+			Error:    err.Error(),
+		}, nil
+	}
+	if exists && token != "" {
+		// Ensure copilot modes exist in waveai.json (no-ops if they already do)
+		go func() {
+			if _, err := ensureCopilotAIMode(token); err != nil {
+				log.Printf("githubcopilot: failed to ensure copilot modes: %v\n", err)
+			}
+		}()
+	}
+	return &wshrpc.CopilotDeviceLoginStatusRtnData{
+		LoggedIn: exists,
+	}, nil
+}
+
+// CopilotDeviceLogoutCommand deletes the stored GitHub Copilot token.
+func (ws *WshServer) CopilotDeviceLogoutCommand(ctx context.Context) error {
+	err := secretstore.DeleteSecret("GITHUB_COPILOT_TOKEN")
+	if err != nil {
+		return fmt.Errorf("failed to delete copilot token: %w", err)
+	}
+	log.Printf("githubcopilot: logged out, token deleted\n")
+	return nil
+}
diff --git a/schema/waveai.json b/schema/waveai.json
index 1c3a186beb..735bd832ba 100644
--- a/schema/waveai.json
+++ b/schema/waveai.json
@@ -24,6 +24,7 @@
             "openai",
             "azure",
             "azure-legacy",
+            "github-copilot",
             "custom"
           ]
         },
@@ -32,7 +33,8 @@
           "enum": [
             "google-gemini",
             "openai-responses",
-            "openai-chat"
+            "openai-chat",
+            "github-copilot"
           ]
         },
         "ai:model": {

From cc9eeb83a0f56018a695d9874b4a136cb0f99598 Mon Sep 17 00:00:00 2001
From: sykuang <sykuang.tw@gmail.com>
Date: Mon, 16 Feb 2026 03:27:41 +0800
Subject: [PATCH 2/2] feat: Add GitHub Copilot support and configuration
 details to documentation

---
 docs/docs/waveai-modes.mdx | 53 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 52 insertions(+), 1 deletion(-)

diff --git a/docs/docs/waveai-modes.mdx b/docs/docs/waveai-modes.mdx
index 33283f8969..1824f5020a 100644
--- a/docs/docs/waveai-modes.mdx
+++ b/docs/docs/waveai-modes.mdx
@@ -37,6 +37,7 @@ Wave AI now supports provider-based configuration which automatically applies se
 - **`google`** - Google AI (Gemini) [[see example](#google-ai-gemini)]
 - **`azure`** - Azure OpenAI Service (modern API) [[see example](#azure-openai-modern-api)]
 - **`azure-legacy`** - Azure OpenAI Service (legacy deployment API) [[see example](#azure-openai-legacy-deployment-api)]
+- **`github-copilot`** - GitHub Copilot (authenticates via device flow, auto-creates modes) [[see example](#github-copilot)]
 - **`custom`** - Custom API endpoint (fully manual configuration) [[see examples](#local-model-examples)]
 
 ### Supported API Types
@@ -46,6 +47,7 @@ Wave AI supports the following API types:
 - **`openai-chat`**: Uses the `/v1/chat/completions` endpoint (most common)
 - **`openai-responses`**: Uses the `/v1/responses` endpoint (modern API for GPT-5+ models)
 - **`google-gemini`**: Google's Gemini API format (automatically set when using `ai:provider: "google"`, not typically used directly)
+- **`github-copilot`**: GitHub Copilot API (automatically set when using `ai:provider: "github-copilot"`, not typically used directly)
 
 ## Global Wave AI Settings
 
@@ -336,6 +338,55 @@ The provider automatically constructs the full endpoint URL and sets the API ver
 For Azure Legacy provider, you must manually specify `ai:capabilities` based on your model's features.
 :::
 
+### GitHub Copilot
+
+[GitHub Copilot](https://github.com/features/copilot) is available to users with a GitHub Copilot subscription. Unlike other providers, Copilot uses **GitHub's device authorization flow** instead of an API key — no manual key configuration is needed.
+
+#### Quick Setup
+
+1. Open the AI mode dropdown in Wave
+2. Click **"Login to GitHub Copilot"**
+3. A device code is copied to your clipboard and GitHub opens in your browser
+4. Paste the code on GitHub and authorize Wave Terminal
+5. Copilot modes are automatically created for all models your subscription supports
+
+After login, copilot modes (e.g., `copilot/gpt-4o`, `copilot/gpt-4.1`, `copilot/claude-3.7-sonnet`) appear in the dropdown and in your `waveai.json`.
+
+#### How It Works
+
+Authentication is handled automatically:
+- Your GitHub token is stored securely in Wave's [secret store](./secrets.mdx) as `GITHUB_COPILOT_TOKEN`
+- Wave exchanges this for a short-lived Copilot API token on each request
+- Available models are discovered automatically from the Copilot API based on your subscription
+
+#### Auto-Generated Configuration
+
+After login, Wave creates mode entries like this in `waveai.json`:
+
+```json
+{
+  "copilot/gpt-4o": {
+    "display:name": "Copilot gpt-4o",
+    "display:order": 10,
+    "display:icon": "github",
+    "display:description": "GitHub Copilot (gpt-4o)",
+    "ai:provider": "github-copilot",
+    "ai:model": "gpt-4o",
+    "ai:capabilities": ["tools", "images"]
+  }
+}
+```
+
+You can customize these entries (change display names, order, etc.) just like any other mode.
+
+#### Logging Out
+
+To disconnect your GitHub Copilot account, click the **"Logout"** button next to "Copilot Connected" in the AI mode dropdown. This deletes the stored token. You can log in again at any time.
+
+:::note
+The available models depend on your Copilot subscription tier. Common models include `gpt-4o`, `gpt-4.1`, `gpt-4.1-mini`, `gpt-4.1-nano`, `o3-mini`, `claude-3.5-sonnet`, `claude-3.7-sonnet`, and `gemini-2.0-flash-001`.
+:::
+
 ## Using Secrets for API Keys
 
 Instead of storing API keys directly in the configuration, you should use Wave's secret store to keep your credentials secure. Secrets are stored encrypted using your system's native keychain.
@@ -473,7 +524,7 @@ If you get "model not found" errors:
 | `display:order` | No | Sort order in the selector (lower numbers first) |
 | `display:icon` | No | Icon identifier for the mode (can use any [FontAwesome icon](https://fontawesome.com/search), use the name without the "fa-" prefix).  Default is "sparkles" |
 | `display:description` | No | Full description of the mode |
-| `ai:provider` | No | Provider preset: `openai`, `openrouter`, `google`, `azure`, `azure-legacy`, `custom` |
+| `ai:provider` | No | Provider preset: `openai`, `openrouter`, `google`, `azure`, `azure-legacy`, `github-copilot`, `custom` |
 | `ai:apitype` | No | API type: `openai-chat`, `openai-responses`, or `google-gemini` (defaults to `openai-chat` if not specified) |
 | `ai:model` | No | Model identifier (required for most providers) |
 | `ai:thinkinglevel` | No | Thinking level: `low`, `medium`, or `high` |