fix

Signed-off-by: Roman Nikitenko <rnikiten@redhat.com>

Author: RomanNikitenko

code/extensions/che-github-authentication/src/extension.ts

@@ -47,9 +47,30 @@ export async function activate(context: vscode.ExtensionContext): Promise<void>
     const deviceAuthentication = container.get(DeviceAuthentication);
     authenticationProvider.setDeviceAuthentication(deviceAuthentication);
 
-    await authenticationProvider.hydrateFromK8sToken();
+    const { hydratedFromPat } = await authenticationProvider.hydrateFromK8sToken();
 
     vscode.authentication.registerAuthenticationProvider('github', 'GitHub', authenticationProvider);
+
+    if (hydratedFromPat && vscode.extensions.getExtension('github.copilot')) {
+        promptCopilotSignIn(authenticationProvider);
+    }
+}
+
+const COPILOT_SCOPES = ['read:user', 'user:email', 'repo', 'workflow'];
+
+async function promptCopilotSignIn(provider: GitHubAuthProvider): Promise<void> {
+    const signIn = 'Sign in';
+    const action = await vscode.window.showInformationMessage(
+        'GitHub Copilot requires OAuth sign-in to function. Your current token (PAT) cannot be used for Copilot.',
+        signIn,
+    );
+    if (action === signIn) {
+        try {
+            await provider.createSession(COPILOT_SCOPES);
+        } catch {
+            // User cancelled Device Flow or it failed — already logged by createSession
+        }
+    }
 }
 
 export function deactivate(): void {

code/extensions/che-github-authentication/src/github.ts

@@ -60,7 +60,7 @@ export class GitHubAuthProvider implements vscode.AuthenticationProvider {
     this.deviceAuthentication = deviceAuthentication;
   }
 
-  async hydrateFromK8sToken(): Promise<void> {
+  async hydrateFromK8sToken(): Promise<{ hydratedFromPat: boolean }> {
     this.logger.info('GitHubAuthProvider: hydrateFromK8sToken started');
     let sessions = await this.sessionsPromise;
     this.logger.info(`GitHubAuthProvider: found ${sessions.length} stored session(s)`);
@@ -69,7 +69,7 @@ export class GitHubAuthProvider implements vscode.AuthenticationProvider {
       try {
         await this.githubService.getTokenScopes(sessions[0].accessToken);
         this.logger.info('GitHubAuthProvider: existing session token is valid, hydration not needed');
-        return;
+        return { hydratedFromPat: false };
       } catch (error) {
         if (isUnauthorizedError(error)) {
           this.logger.warn('GitHubAuthProvider: existing session token is not valid, clearing sessions');
@@ -79,7 +79,7 @@ export class GitHubAuthProvider implements vscode.AuthenticationProvider {
           sessions = [];
         } else {
           this.logger.info(`GitHubAuthProvider: session validation skipped: ${(error as Error).message}`);
-          return;
+          return { hydratedFromPat: false };
         }
       }
     }
@@ -92,7 +92,7 @@ export class GitHubAuthProvider implements vscode.AuthenticationProvider {
       this.hydrationAttempted = true;
       if (tokenScopes.length === 0) {
         this.logger.info('GitHubAuthProvider: hydrate skipped, token has no scopes');
-        return;
+        return { hydratedFromPat: false };
       }
 
       const githubUser = await this.githubService.getUser();
@@ -101,7 +101,7 @@ export class GitHubAuthProvider implements vscode.AuthenticationProvider {
       this.logger.info(`GitHubAuthProvider: matching hydration bundles: ${matchingBundles.length}`);
       if (matchingBundles.length === 0) {
         this.logger.info('GitHubAuthProvider: hydrate skipped, token scopes match no known bundle');
-        return;
+        return { hydratedFromPat: false };
       }
 
       const account = { label: githubUser.login, id: githubUser.id.toString() };
@@ -115,13 +115,15 @@ export class GitHubAuthProvider implements vscode.AuthenticationProvider {
       await this.storeSessions(hydratedSessions);
       this.sessionChangeEmitter.fire({ added: hydratedSessions, removed: [], changed: [] });
       this.logger.info(`GitHubAuthProvider: hydrated ${hydratedSessions.length} session(s) from K8s token`);
+      return { hydratedFromPat: true };
     } catch (error) {
       if (isUnauthorizedError(error)) {
         this.hydrationAttempted = true;
         this.logger.warn('GitHubAuthProvider: hydrate failed, token is not valid');
       } else {
         this.logger.warn(`GitHubAuthProvider: hydrate failed with transient error (will retry on next getSessions): ${(error as Error).message}`);
       }
+      return { hydratedFromPat: false };
     }
   }
 
@@ -138,7 +140,7 @@ export class GitHubAuthProvider implements vscode.AuthenticationProvider {
 
     if (filteredSessions.length === 0 && sortedScopes.length > 0 && !this.hydrationAttempted) {
       this.logger.info('GitHubAuthProvider: no sessions found, attempting lazy hydration');
-      await this.hydrateFromK8sToken();
+      await this.hydrateFromK8sToken(); // return value intentionally ignored for lazy hydration
       const retried = await this.sessionsPromise;
       const retriedFiltered = retried.filter(session => arrayEquals([...session.scopes].sort(), sortedScopes));
       this.logger.info(`GitHubAuthProvider: GET sessions (after lazy hydration) - found ${retriedFiltered.length} sessions for scopes: ${JSON.stringify(sessionScopes)}`);

code/extensions/che-github-authentication/src/utils.ts

@@ -38,7 +38,6 @@ export function hasAllScopes(existingScopes: string[], requestedScopes: string[]
   return requestedScopes.every(scope => existingScopes.includes(scope));
 }
 
-/** Scope bundles used by Copilot / github / GHPRI / Agent Host — session keys match vanilla createSession. */
 export const HYDRATION_SCOPE_BUNDLES: readonly string[][] = [
   ['read:user', 'user:email', 'repo', 'workflow', 'project', 'read:org'],
   ['read:user', 'user:email', 'repo', 'workflow'],