fix: Codespaces — skip GITHUB_TOKEN auto-enable for github-models, cap retries, fix phantom command

Closes #413

- Skip auto-enabling `github-models` and `github-copilot` providers when
  `CODESPACES=true` and only `GITHUB_TOKEN` is available (the Codespace
  machine token lacks model-inference permissions, causing immediate 429s)
- Cap retry attempts at 5 (`RETRY_MAX_ATTEMPTS`) to prevent infinite
  retry loops with 30+ minute backoff
- Replace phantom `/discover-and-add-mcps` toast with actionable message
  ("Ask the assistant to add them")
- Add `.devcontainer/` config (Node 22, Bun 1.3.10) for reproducible
  Codespace environments
- Update docs to reference `mcp_discover` tool instead of non-existent
  slash command

Author: anandgupta42

.devcontainer/devcontainer.json

@@ -0,0 +1,32 @@
+{
+  "name": "Altimate Code",
+  "image": "mcr.microsoft.com/devcontainers/javascript-node:22",
+  "features": {
+    "ghcr.io/devcontainers/features/git:1": {},
+    "ghcr.io/shyim/devcontainers-features/bun:0": {
+      "version": "1.3.10"
+    }
+  },
+  "postCreateCommand": ".devcontainer/post-create.sh",
+  "customizations": {
+    "vscode": {
+      "extensions": [
+        "biomejs.biome",
+        "dbaeumer.vscode-eslint"
+      ],
+      "settings": {
+        "terminal.integrated.defaultProfile.linux": "bash"
+      }
+    },
+    "codespaces": {
+      "openFiles": [
+        "README.md"
+      ]
+    }
+  },
+  "forwardPorts": [],
+  "remoteEnv": {
+    "BUN_INSTALL": "/home/node/.bun",
+    "PATH": "/home/node/.bun/bin:${containerEnv:PATH}"
+  }
+}

.devcontainer/post-create.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+set -e
+
+echo "=== Altimate Code: Codespace Setup ==="
+
+# Configure git (required for tests)
+git config --global user.name "${GITHUB_USER:-codespace}"
+git config --global user.email "${GITHUB_USER:-codespace}@users.noreply.github.com"
+
+# Install dependencies
+echo "Installing dependencies with Bun..."
+bun install
+
+echo ""
+echo "=== Setup complete! ==="
+echo ""
+echo "Quick start:"
+echo "  bun run build        # Build the CLI"
+echo "  bun test             # Run tests"
+echo "  bun turbo typecheck  # Type-check all packages"
+echo ""
+echo "To install altimate globally after building:"
+echo "  bun link"
+echo ""

docs/docs/configure/tools.md

@@ -131,10 +131,10 @@ The `mcp_discover` tool finds MCP servers configured in other AI coding tools an
 - `mcp_discover(action: "add", scope: "project")` — Write new servers to `.altimate-code/altimate-code.json`
 - `mcp_discover(action: "add", scope: "global")` — Write to the global config dir (`~/.config/opencode/`)
 
-**Auto-discovery:** At startup, altimate-code discovers external MCP servers and shows a toast notification. Servers from your home directory (`~/.claude.json`, `~/.gemini/settings.json`) are auto-enabled since they're user-owned. Servers from project-level files (`.vscode/mcp.json`, `.mcp.json`, `.cursor/mcp.json`) are discovered but **disabled by default** for security — run `/discover-and-add-mcps` to review and enable them.
+**Auto-discovery:** At startup, altimate-code discovers external MCP servers and shows a toast notification. Servers from your home directory (`~/.claude.json`, `~/.gemini/settings.json`) are auto-enabled since they're user-owned. Servers from project-level files (`.vscode/mcp.json`, `.mcp.json`, `.cursor/mcp.json`) are discovered but **disabled by default** for security — ask the assistant to add them or use `mcp_discover(action: "add")`.
 
 !!! tip
-    Home-directory MCP servers (from `~/.claude.json`, `~/.gemini/settings.json`) are loaded automatically. Project-scoped servers require explicit approval via `/discover-and-add-mcps` or `mcp_discover(action: "add")`.
+    Home-directory MCP servers (from `~/.claude.json`, `~/.gemini/settings.json`) are loaded automatically. Project-scoped servers require explicit approval via `mcp_discover(action: "add")`.
 
 !!! warning "Security: untrusted repositories"
     Project-level MCP configs (`.vscode/mcp.json`, `.mcp.json`, `.cursor/mcp.json`) are discovered but not auto-connected. This prevents malicious repositories from executing arbitrary commands. You must explicitly approve project-scoped servers before they run.

docs/docs/reference/security-faq.md

@@ -168,7 +168,7 @@ Altimate Code can automatically discover MCP server definitions from other AI to
 **Security model:**
 
 - **Home-directory configs** (your personal machine config) are treated as trusted and auto-enabled, since you installed them.
-- **Project-scoped configs** (checked into a repo) are discovered but **disabled by default**. You must explicitly approve them via the `/discover-and-add-mcps` tool before they run.
+- **Project-scoped configs** (checked into a repo) are discovered but **disabled by default**. You must explicitly approve them via the `mcp_discover` tool before they run.
 - **Sensitive details are redacted** in discovery notifications. Server commands and URLs are only shown when you explicitly inspect them.
 - **Prototype pollution, command injection, and path traversal** are hardened against with input validation and `Object.create(null)` result objects.
 

packages/opencode/src/mcp/discover.ts

@@ -165,7 +165,7 @@ async function discoverClaudeCode(
  *
  * Security model: Project-scoped servers (.vscode/mcp.json, .mcp.json, etc.) are
  * discovered with enabled=false so they don't auto-connect. Users must explicitly
- * approve them via /discover-and-add-mcps. Home-directory configs (~/.claude.json,
+ * approve them by asking the assistant to add them. Home-directory configs (~/.claude.json,
  * ~/.gemini/settings.json) are auto-enabled since they're user-owned.
  *
  * Searches both the project directory and the home directory.

packages/opencode/src/mcp/index.ts

@@ -215,7 +215,7 @@ export namespace MCP {
 
       // altimate_change start — show discovery toast after MCP connections complete
       if (discoveryResult) {
-        const message = `Discovered ${discoveryResult.serverNames.length} new MCP server(s): ${discoveryResult.serverNames.join(", ")}. Run /discover-and-add-mcps to enable and add them.`
+        const message = `Discovered ${discoveryResult.serverNames.length} new MCP server(s): ${discoveryResult.serverNames.join(", ")}. Ask the assistant to add them, or they will be available automatically in the current session.`
         Bus.publish(TuiEvent.ToastShow, {
           title: "MCP Servers Discovered",
           message,

packages/opencode/src/provider/provider.ts

@@ -1071,11 +1071,27 @@ export namespace Provider {
 
     // load env
     const env = Env.all()
+    // altimate_change start — skip github-models/github-copilot auto-enable from GITHUB_TOKEN in Codespaces
+    // In GitHub Codespaces, GITHUB_TOKEN is a machine-scoped token for repo operations,
+    // not for model inference. Auto-enabling these providers leads to immediate rate limiting
+    // with "Too Many Requests" errors and long retry loops.
+    const isCodespace = Boolean(env["CODESPACES"] || env["GITHUB_CODESPACE_TOKEN"])
+    const codespaceSkipProviders = new Set(["github-models", "github-copilot"])
+    // altimate_change end
     for (const [id, provider] of Object.entries(database)) {
       const providerID = ProviderID.make(id)
       if (disabled.has(providerID)) continue
       const apiKey = provider.env.map((item) => env[item]).find(Boolean)
       if (!apiKey) continue
+      // altimate_change start — skip providers that use GITHUB_TOKEN in Codespaces
+      if (isCodespace && codespaceSkipProviders.has(id) && provider.env.includes("GITHUB_TOKEN")) {
+        const hasExplicitKey = provider.env.some((item) => item !== "GITHUB_TOKEN" && env[item])
+        if (!hasExplicitKey) {
+          log.info("skipping provider in Codespace (GITHUB_TOKEN is not for model inference)", { providerID })
+          continue
+        }
+      }
+      // altimate_change end
       mergeProvider(providerID, {
         source: "env",
         key: provider.env.length === 1 ? apiKey : undefined,

packages/opencode/src/session/processor.ts

@@ -394,7 +394,9 @@ export namespace SessionProcessor {
               })
             } else {
               const retry = SessionRetry.retryable(error)
-              if (retry !== undefined) {
+              // altimate_change start — cap retries to avoid infinite retry loops (e.g. GitHub Models rate limits in Codespaces)
+              if (retry !== undefined && attempt < SessionRetry.RETRY_MAX_ATTEMPTS) {
+                // altimate_change end
                 attempt++
                 const delay = SessionRetry.delay(attempt, error.name === "APIError" ? error : undefined)
                 SessionStatus.set(input.sessionID, {

packages/opencode/src/session/retry.ts

@@ -7,6 +7,9 @@ export namespace SessionRetry {
   export const RETRY_BACKOFF_FACTOR = 2
   export const RETRY_MAX_DELAY_NO_HEADERS = 30_000 // 30 seconds
   export const RETRY_MAX_DELAY = 2_147_483_647 // max 32-bit signed integer for setTimeout
+  // altimate_change start — max retry attempts to prevent infinite retry loops
+  export const RETRY_MAX_ATTEMPTS = 5
+  // altimate_change end
 
   export async function sleep(ms: number, signal: AbortSignal): Promise<void> {
     return new Promise((resolve, reject) => {

packages/opencode/test/provider/provider.test.ts

@@ -2282,3 +2282,52 @@ test("cloudflare-ai-gateway forwards config metadata options", async () => {
     },
   })
 })
+
+// altimate_change start — test Codespace GITHUB_TOKEN skip logic
+test("github-models is excluded when CODESPACES=true and only GITHUB_TOKEN is set", async () => {
+  await using tmp = await tmpdir({
+    init: async (dir) => {
+      await Bun.write(
+        path.join(dir, "opencode.json"),
+        JSON.stringify({
+          $schema: "https://altimate.ai/config.json",
+        }),
+      )
+    },
+  })
+  await Instance.provide({
+    directory: tmp.path,
+    init: async () => {
+      Env.set("GITHUB_TOKEN", "ghu_fake_codespace_token")
+      Env.set("CODESPACES", "true")
+    },
+    fn: async () => {
+      const providers = await Provider.list()
+      expect(providers["github-models"]).toBeUndefined()
+    },
+  })
+})
+
+test("github-models is available when GITHUB_TOKEN set without CODESPACES", async () => {
+  await using tmp = await tmpdir({
+    init: async (dir) => {
+      await Bun.write(
+        path.join(dir, "opencode.json"),
+        JSON.stringify({
+          $schema: "https://altimate.ai/config.json",
+        }),
+      )
+    },
+  })
+  await Instance.provide({
+    directory: tmp.path,
+    init: async () => {
+      Env.set("GITHUB_TOKEN", "ghp_real_personal_token")
+    },
+    fn: async () => {
+      const providers = await Provider.list()
+      expect(providers["github-models"]).toBeDefined()
+    },
+  })
+})
+// altimate_change end