Copilot Business/Enterprise users can't use OpenCode — three compounding auth/endpoint/header issues #20759

Description

Copilot Business and Enterprise users get HTTP 400 "model not supported" errors when using OpenCode. The root cause is three separate issues that compound on each other — fixing any one or two in isolation still leaves the system broken.

Problem 1 — Client ID determines model access:
GitHub maintains a per-client-ID model allowlist on the server side. OpenCode's OAuth App client ID (Ov23li8tweQw6odWQebz) has a different model set than VS Code's GitHub App client ID (Iv1.b507a08c87ecfe98). Every working third-party Copilot tool (copilot.vim, avante.nvim, LiteLLM) uses VS Code's client ID. When a ghu_ token (issued via VS Code's device flow) is sent without matching identity headers, the API rejects the request.

Problem 2 — Raw ghu_ tokens can't be used directly:
The Copilot API endpoints don't accept Authorization: Bearer ghu_xxxxx. You have to exchange the ghu_ token via GET /copilot_internal/v2/token (with Authorization: token ghu_xxxxx) to get a short-lived HMAC-signed bearer token. That bearer is what the API actually accepts.

Problem 3 — Hardcoded API endpoint:
The base() function in copilot.ts hardcodes api.githubcopilot.com. Business subscribers get routed to api.business.githubcopilot.com. The token exchange response provides the correct URL in endpoints.api, but OpenCode ignores it.

Problem 4 — Missing identity headers:
The Business API validates client identity headers (Editor-Version, Editor-Plugin-Version, Copilot-Integration-Id, and a matching User-Agent). OpenCode only sends User-Agent: opencode/<version>.

This is related to #19338 and overlaps with PR #19350, which approaches the same problem by switching OpenCode's entire device flow to VS Code's client ID. The fix in PR #20758 takes a less invasive approach — it detects ghu_ tokens at runtime and adapts behavior while leaving the existing gho_ flow unchanged.

Plugins

GitHub Copilot (built-in)

OpenCode version

v1.3.13 (also affects earlier versions — the hardcoded URL and missing exchange logic have been there since the Copilot plugin was added)

Steps to reproduce

1. Obtain a ghu_ token from a Copilot Business subscription (via VS Code's device flow or the GitHub App OAuth flow)
2. Configure it in OpenCode's auth.json
3. Start a session — OpenCode tries to use the raw ghu_ token directly against api.githubcopilot.com
4. API calls fail because: (a) the raw token isn't accepted (needs bearer exchange), (b) the endpoint is wrong for Business plans, and (c) identity headers are missing

Token types involved

Screenshot and/or share link

N/A — backend auth logic, no UI involved.

Operating System

N/A (platform-independent, server-side logic)

Terminal

N/A