Support multiple authentication flows for enterprise SSO compatibility #1

Problem

I can successfully sign in to GitHub Copilot in VSCode using enterprise SSO, but cannot sign in to opencode using the device code flow. The current implementation only supports a single authentication method, which fails for certain enterprise configurations.

Current Implementation

opencode-github-copilot currently only implements the device code flow (/login/device/code), which may not work for:

• Enterprise SSO configurations
• Self-hosted GitHub Enterprise Server (GHES) instances
• Environments where device code flow is blocked or unsupported
• Web worker contexts (CORS issues)

Proposed Solution

Implement multiple authentication flows with automatic fallback, matching VSCode's production implementation:

1. OAuth Authorization Code Flow with Local Server

• Opens a local loopback server to handle OAuth redirects
• Endpoint: /login/oauth/authorize
• Best for: Desktop environments with enterprise SSO
• Supports: PKCE for enhanced security

2. OAuth Authorization Code Flow with URI Handler

• Uses vscode:// URI handler for redirects
• Endpoint: /login/oauth/authorize
• Best for: Web and remote environments
• Supports: Enterprise SSO, PKCE

3. Device Code Flow (current)

• Keep existing implementation as fallback
• Endpoint: /login/device/code
• Best for: Headless/remote environments

4. Personal Access Token (PAT) Flow

• Manual token entry as last resort
• Endpoint: /settings/tokens/new
• Best for: All environments including old GHES versions

Technical Details

VSCode's implementation (in extensions/github-authentication/src/flows.ts) includes:

Flow Selection Logic:

// Intelligently selects flows based on:
- Extension host type (local/remote/web worker)
- GitHub target (GitHub.com/Enterprise Server/Hosted Enterprise)
- Client capabilities and configuration
- User preferences

Security Features:

• PKCE (Proof Key for Code Exchange) for OAuth flows
• Secure token storage via system keychain
• Proper state/nonce validation

Error Handling:

• Automatic fallback to next available flow
• Network error recovery
• User cancellation handling
• Timeout management (5min for device code)

Benefits

1. Broader Compatibility: Works with enterprise SSO, GHES, and restricted environments
2. Better UX: Automatic fallback prevents authentication failures
3. Production-Grade: Matches VSCode's battle-tested implementation
4. Security: PKCE support for OAuth flows

Enterprise Use Case

Many organizations use:

• GitHub Enterprise with SAML SSO
• Custom OAuth apps with restricted flows
• Network policies that block device code endpoints
• Self-hosted GHES instances (device code requires GHES 3.1+)

Without multiple auth flows, these users cannot use opencode even though they can use VSCode's Copilot.

Reference Implementation

VSCode's GitHub authentication extension:

• Main flows: extensions/github-authentication/src/flows.ts
• Flow selection: getFlows() function with environment detection
• Four flow classes: LocalServerFlow, UrlHandlerFlow, DeviceCodeFlow, PatFlow

Minimal Implementation

At minimum, adding OAuth authorization code flow would significantly improve enterprise compatibility:

1. Supports enterprise SSO configurations
2. Works where device code is blocked
3. Provides better UX for desktop users

Would appreciate consideration for implementing multiple auth flows to improve enterprise user experience!