fix

Signed-off-by: Roman Nikitenko <rnikiten@redhat.com>

Author: RomanNikitenko

code/extensions/che-github-authentication/src/github.ts

@@ -199,15 +199,28 @@ export class GitHubAuthProvider implements vscode.AuthenticationProvider {
       const token = await this.githubService.getToken();
       const existingScopes = await this.githubService.getTokenScopes(token);
       if (!hasAllScopes(existingScopes, sortedScopes)) {
-        this.logger.info(`GitHubAuthProvider: token lacks required scopes, starting device flow`);
+        this.logger.info('GitHubAuthProvider: token lacks required scopes, starting device flow');
         return await this.getDeviceAuthentication().runInteractiveFlow(sortedScopes);
       }
+
+      const isDeviceAuth = await this.githubService.isDeviceAuthToken();
+      if (!isDeviceAuth) {
+        const sessions = await this.sessionsPromise;
+        const hasExistingSession = sessions.some(s =>
+          sessionMatchesRequestedScopes(s.scopes, sortedScopes)
+        );
+        if (hasExistingSession) {
+          this.logger.info('GitHubAuthProvider: PAT session already exists for requested scopes, starting device auth flow');
+          return await this.getDeviceAuthentication().runInteractiveFlow(sortedScopes);
+        }
+      }
+
       return token;
     } catch (error) {
       if (isUnauthorizedError(error)) {
-        this.logger.info(`GitHubAuthProvider: token is not valid, starting device flow`);
+        this.logger.info('GitHubAuthProvider: token is not valid, starting device flow');
       } else {
-        this.logger.info(`GitHubAuthProvider: no token available, starting device flow`);
+        this.logger.info('GitHubAuthProvider: no token available, starting device flow');
       }
       return await this.getDeviceAuthentication().runInteractiveFlow(sortedScopes);
     }

code/extensions/copilot/src/platform/authentication/vscode-node/copilotTokenManager.ts

@@ -21,14 +21,6 @@ import { getAnyAuthSession } from './session';
 //Flag if we've shown message about broken oauth token.
 let shown401Message = false;
 
-const CHE_WORKSPACE_PAT_SCOPE = 'che:workspace-pat';
-
-/** Sessions hydrated from a workspace PAT carry the che:workspace-pat marker scope. */
-function isWorkspacePatSession(session: { accessToken: string; scopes: readonly string[] }): boolean {
-	return session.scopes?.includes(CHE_WORKSPACE_PAT_SCOPE) ||
-		session.accessToken.startsWith('ghp_') || session.accessToken.startsWith('github_pat_');
-}
-
 export class NotSignedUpError extends Error { }
 export class SubscriptionExpiredError extends Error { }
 export class ContactSupportError extends Error { }
@@ -86,21 +78,19 @@ export class VSCodeCopilotTokenManager extends BaseCopilotTokenManager {
 			return { kind: 'failure', reason: 'GitHubLoginFailed' };
 		}
 		if (session) {
-			if (isWorkspacePatSession(session)) {
-				this._logService.info('Copilot token exchange skipped (workspace PAT session detected via scope marker; device authentication is required)');
-				this._telemetryService.sendGHTelemetryErrorEvent('auth.github_login_failed');
-				return { kind: 'failure', reason: 'GitHubLoginFailed' };
-			}
 			// Log the steps by default, but only log actual token values when the log level is set to debug.
 			this._logService.info(`Logged in as ${session.account.label}`);
 			const tokenResult = await this.authFromGitHubToken(session.accessToken, session.account.label);
 			if (tokenResult.kind === 'success') {
 				this._logService.info(`Got Copilot token for ${session.account.label}`);
 				this._logService.info(`Copilot Chat: ${this._envService.getVersion()}, VS Code: ${this._envService.vscodeVersion}`);
-			} else if (tokenResult.kind === 'failure' && (tokenResult.reason === 'ParseFailed' || tokenResult.reason === 'RequestFailed' || tokenResult.reason === 'NotAuthorized')) {
+			}
+
+			if (tokenResult.kind === 'failure' && tokenResult.reason === 'NotAuthorized' && !tokenResult.notification_id) {
 				this._logService.info('Copilot token exchange failed (workspace token cannot be exchanged for Copilot token), triggering sign-in flow');
 				return { kind: 'failure', reason: 'GitHubLoginFailed' };
 			}
+
 			return tokenResult;
 		} else {
 			this._logService.info(`Allowing anonymous access with devDeviceId`);

code/src/vs/workbench/contrib/chat/browser/chatSetup/chatSetupContributions.ts

@@ -136,29 +136,29 @@ export class ChatSetupContribution extends Disposable implements IWorkbenchContr
 									panelAgentDisposables.dispose();
 								}
 							}));
-					}
+						}
 
-					// Proactively clear panel agents when Copilot reports GitHub login failure
-					// (e.g. workspace PAT cannot be exchanged for a Copilot token)
-					const gitHubLoginFailedKey = 'github.copilot.interactiveSession.gitHubLoginFailed';
-					const checkGitHubLoginFailed = () => {
-						if (this.contextKeyService.getContextKeyValue<boolean>(gitHubLoginFailedKey)) {
-							const panelAgentHasGuidance = chatViewsWelcomeRegistry.get().some(descriptor => this.contextKeyService.contextMatchesRules(descriptor.when));
-							if (panelAgentHasGuidance) {
-								this.logService.error('[chat setup] GitHub login failed detected, clearing panel agent registration to show welcome view.');
-								panelAgentDisposables.dispose();
+						// Proactively clear panel agents when Copilot reports GitHub login failure
+						// (e.g. workspace PAT cannot be exchanged for a Copilot token)
+						const gitHubLoginFailedKey = 'github.copilot.interactiveSession.gitHubLoginFailed';
+						const checkGitHubLoginFailed = () => {
+							if (this.contextKeyService.getContextKeyValue<boolean>(gitHubLoginFailedKey)) {
+								const panelAgentHasGuidance = chatViewsWelcomeRegistry.get().some(descriptor => this.contextKeyService.contextMatchesRules(descriptor.when));
+								if (panelAgentHasGuidance) {
+									this.logService.error('[chat setup] GitHub login failed detected, clearing panel agent registration to show welcome view.');
+									panelAgentDisposables.dispose();
+								}
 							}
-						}
-					};
-					panelAgentDisposables.add(this.contextKeyService.onDidChangeContext(e => {
-						if (e.affectsSome(new Set([gitHubLoginFailedKey]))) {
-							checkGitHubLoginFailed();
-						}
-					}));
-					checkGitHubLoginFailed();
+						};
+						panelAgentDisposables.add(this.contextKeyService.onDidChangeContext(e => {
+							if (e.affectsSome(new Set([gitHubLoginFailedKey]))) {
+								checkGitHubLoginFailed();
+							}
+						}));
+						checkGitHubLoginFailed();
 
-					// Inline Agents
-					disposables.add(SetupAgent.registerDefaultAgents(this.instantiationService, ChatAgentLocation.Terminal, ChatModeKind.Ask, context, controller).disposable);
+						// Inline Agents
+						disposables.add(SetupAgent.registerDefaultAgents(this.instantiationService, ChatAgentLocation.Terminal, ChatModeKind.Ask, context, controller).disposable);
 						disposables.add(SetupAgent.registerDefaultAgents(this.instantiationService, ChatAgentLocation.Notebook, ChatModeKind.Ask, context, controller).disposable);
 						disposables.add(SetupAgent.registerDefaultAgents(this.instantiationService, ChatAgentLocation.EditorInline, ChatModeKind.Ask, context, controller).disposable);
 					}