feat: Implement GitHub Copilot authentication and integrate with LangChain

- Added CopilotAuthenticator for OAuth device-flow authentication with GitHub Copilot API.
- Created functions to manage access tokens and API keys, including caching mechanisms.
- Developed Copilot LLM factory to build LangChain clients for GitHub Copilot.
- Introduced SSE connection management with a singleton pattern for real-time event handling.
- Refactored activity and run management to utilize new SSE connection for improved event handling.
- Updated frontend components to handle connection states and errors more effectively.
- Cleaned up setup script by removing unnecessary instructions related to LLM backend configuration.

Signed-off-by: Andre Bossard <anbossar@microsoft.com>

Author: abossard

.claude/settings.local.json

@@ -16,7 +16,11 @@
       "Bash(npx playwright test --project=chromium --reporter=line)",
       "Bash(npx playwright test:*)",
       "Bash(find:*)",
-      "Bash(python:*)"
+      "Bash(python:*)",
+      "WebFetch(domain:github.com)",
+      "WebFetch(domain:pypi.org)",
+      "WebFetch(domain:deepwiki.com)",
+      "Bash(pip list:*)"
     ],
     "deny": [],
     "ask": []

.env.example

@@ -1,15 +1,15 @@
-# LiteLLM Configuration (Default LLM backend)
-# Works out of the box with GitHub Copilot — no API keys needed.
-# Supports 100+ providers: GitHub Copilot, Ollama, Anthropic, etc.
-# Docs: https://docs.litellm.ai/docs/providers
+# GitHub Copilot Configuration (Default LLM backend)
+# Authentication: on first run, you'll be prompted to authenticate via device flow.
+# Tokens are cached at ~/.config/copilot-llm/ and auto-refresh.
+# Note: Regular GitHub PATs do NOT work with the Copilot Chat API.
 
-# Primary model (default: github_copilot/gpt-4o)
-# LITELLM_MODEL=github_copilot/gpt-4o
+# Primary model (default: gpt-4o)
+# COPILOT_MODEL=gpt-4o
 
 # Fallback chain (comma-separated, tried in order if primary fails)
-# LITELLM_FALLBACK_MODELS=github_copilot/claude-sonnet-4,github_copilot/gpt-4o,github_copilot/gpt-4o-mini
+# COPILOT_FALLBACK_MODELS=claude-sonnet-4,gpt-4o,gpt-4o-mini
 
-# OpenAI Configuration (Optional — overrides LiteLLM when set)
+# OpenAI Configuration (Optional — overrides Copilot when AGENT_BACKEND=openai)
 # Get your API key from: https://platform.openai.com/api-keys
 # If set, uses OpenAI SDK directly with beta.chat.completions.parse()
 

CLAUDE.md

@@ -76,7 +76,7 @@ The `@operation` decorator auto-generates: REST endpoint, MCP JSON-RPC method, J
 - `agent_builder/` — Full agent lifecycle: `service.py` (WorkbenchService), `engine/` (ReAct loop), `persistence/` (SQLite repos), `tools/` (ToolRegistry, MCP adapters), `routes.py` (Blueprint at `/api/workbench/*`)
 - `kba_service.py` — Knowledge Base Article generation pipeline
 
-**LLM config**: LiteLLM is default (works with GitHub Copilot, no key needed); OpenAI is optional override. Config via `.env`.
+**LLM config**: GitHub Copilot is default (uses device flow or GITHUB_TOKEN); OpenAI is optional override. Config via `.env`.
 
 **MCP**: Backend exposes both REST and MCP JSON-RPC from the same `@operation` handlers. `mcp_handler.py` routes JSON-RPC to operations.
 
@@ -105,8 +105,8 @@ Backend tests use pytest. `agent_builder/tests/` has 132 tests covering the agen
 
 Copy `.env.example` to `.env`. Key variables:
 ```
-# LiteLLM (default — no key required if using GitHub Copilot)
-LITELLM_MODEL=github_copilot/gpt-4o
+# GitHub Copilot (default — uses GITHUB_TOKEN or device flow)
+COPILOT_MODEL=gpt-4o
 
 # OpenAI (optional override)
 OPENAI_API_KEY=sk-proj-...

backend/agent_builder/chat_service.py

@@ -37,7 +37,7 @@ def _default_model(explicit_model: str = "") -> str:
         return explicit_model
     if os.getenv("AGENT_BACKEND", "").strip().lower() == "openai":
         return os.getenv("OPENAI_MODEL", "gpt-4o-mini")
-    return os.getenv("LITELLM_MODEL", "github_copilot/gpt-4o")
+    return os.getenv("COPILOT_MODEL", "gpt-4o")
 
 
 class ChatService:

backend/agent_builder/engine/event_bus.py

@@ -39,12 +39,24 @@ def to_sse_dict(self) -> dict[str, Any]:
 
 
 class AgentEventBus:
-    """Simple in-process pub/sub for agent execution events."""
+    """Simple in-process pub/sub for agent execution events.
+
+    Thread-safe: ``publish()`` can be called from any thread (e.g. LangChain
+    callback handlers running on executor threads).  It uses
+    ``loop.call_soon_threadsafe`` to schedule the actual ``put_nowait`` on
+    the event-loop thread, which is required because ``asyncio.Queue`` is
+    **not** thread-safe.
+    """
 
     def __init__(self, max_history: int = MAX_HISTORY) -> None:
         self._subscribers: list[asyncio.Queue[AgentEvent]] = []
         self._history: list[AgentEvent] = []
         self._max_history = max_history
+        self._loop: asyncio.AbstractEventLoop | None = None
+
+    def set_loop(self, loop: asyncio.AbstractEventLoop) -> None:
+        """Capture the running event loop (call once at startup)."""
+        self._loop = loop
 
     def subscribe(self) -> asyncio.Queue[AgentEvent]:
         q: asyncio.Queue[AgentEvent] = asyncio.Queue(maxsize=500)
@@ -59,21 +71,40 @@ def unsubscribe(self, q: asyncio.Queue[AgentEvent]) -> None:
         except ValueError:
             pass
 
+    def _dispatch(self, event: AgentEvent) -> None:
+        """Put event into all subscriber queues.  MUST run on the event-loop thread."""
+        for q in self._subscribers:
+            try:
+                q.put_nowait(event)
+            except asyncio.QueueFull:
+                logger.warning("EventBus: subscriber queue full, dropping event")
+
     def publish(self, event: AgentEvent) -> None:
         """Publish an event to all subscribers and history buffer.
 
-        Synchronous — safe to call from LangChain BaseCallbackHandler methods
-        because asyncio.Queue.put_nowait() doesn't require awaiting.
+        Thread-safe — can be called from LangChain callback handlers that
+        run on background executor threads.
         """
         self._history.append(event)
         if len(self._history) > self._max_history:
             self._history = self._history[-self._max_history:]
 
-        for q in self._subscribers:
+        loop = self._loop
+        if loop is None:
+            # Fallback: try to get the running loop (works when called from
+            # the event-loop thread itself).
             try:
-                q.put_nowait(event)
-            except asyncio.QueueFull:
-                logger.warning("EventBus: subscriber queue full, dropping event")
+                loop = asyncio.get_running_loop()
+            except RuntimeError:
+                pass
+
+        if loop is not None and loop.is_running():
+            # Schedule queue puts on the event-loop thread so asyncio.Queue
+            # internals are never touched from a foreign thread.
+            loop.call_soon_threadsafe(self._dispatch, event)
+        else:
+            # No loop available (unlikely in production) — direct dispatch.
+            self._dispatch(event)
 
     def get_history(self) -> list[AgentEvent]:
         return list(self._history)

backend/agent_builder/engine/react_runner.py

@@ -40,7 +40,7 @@ def build_llm(
     max_tokens: int = 0,
     reasoning_effort: str = "low",
 ) -> Any:
-    """Construct an LLM instance — LiteLLM by default, OpenAI only when forced."""
+    """Construct an LLM instance — Copilot by default, OpenAI only when forced."""
     if _force_openai_backend() and api_key:
         from langchain_openai import ChatOpenAI
         kwargs: dict[str, Any] = {
@@ -55,9 +55,13 @@ def build_llm(
             kwargs["reasoning_effort"] = reasoning_effort
         return ChatOpenAI(**kwargs)
     else:
-        from langchain_litellm import ChatLiteLLM
-        litellm_model = model or os.getenv("LITELLM_MODEL", "github_copilot/gpt-4o")
-        return ChatLiteLLM(model=litellm_model, temperature=temperature)
+        from copilot_llm import build_copilot_llm
+        return build_copilot_llm(
+            model=model or "",
+            temperature=temperature,
+            max_tokens=max_tokens,
+            reasoning_effort=reasoning_effort,
+        )
 
 
 def build_react_agent(

backend/agent_builder/routes.py

@@ -302,34 +302,48 @@ async def workbench_event_stream():
     """Server-Sent Events endpoint for real-time agent activity.
 
     Supports optional ?run_id=X to filter events for a specific run.
+    Sends periodic heartbeat comments to keep the connection alive
+    through proxies and prevent browser timeouts.
     """
+    from quart import make_response
+
     run_id_filter = request.args.get("run_id")
     queue = agent_event_bus.subscribe()
 
     async def generate():
         try:
+            # Send initial SSE comment so the connection is established immediately
+            yield ": connected\n\n"
+
             # Send history buffer as catch-up
             for event in agent_event_bus.get_history():
                 if run_id_filter and event.run_id != run_id_filter:
                     continue
                 yield f"data: {json.dumps(event.to_sse_dict())}\n\n"
 
-            # Stream new events
+            # Stream new events with periodic heartbeat
             while True:
-                event = await queue.get()
-                if run_id_filter and event.run_id != run_id_filter:
-                    continue
-                yield f"data: {json.dumps(event.to_sse_dict())}\n\n"
+                try:
+                    event = await asyncio.wait_for(queue.get(), timeout=15)
+                    if run_id_filter and event.run_id != run_id_filter:
+                        continue
+                    yield f"data: {json.dumps(event.to_sse_dict())}\n\n"
+                except asyncio.TimeoutError:
+                    # Send SSE comment as keepalive to prevent proxy/browser timeout
+                    yield ": heartbeat\n\n"
         except asyncio.CancelledError:
             pass
         finally:
             agent_event_bus.unsubscribe(queue)
 
-    return generate(), {
+    response = await make_response(generate(), {
         "Content-Type": "text/event-stream",
         "Cache-Control": "no-cache",
+        "Connection": "keep-alive",
         "X-Accel-Buffering": "no",
-    }
+    })
+    response.timeout = None
+    return response
 
 
 # ---------------------------------------------------------------------------

backend/agent_builder/service.py

@@ -55,7 +55,7 @@ def _default_model(explicit_model: str = "") -> str:
         return explicit_model
     if os.getenv("AGENT_BACKEND", "").strip().lower() == "openai":
         return os.getenv("OPENAI_MODEL", "gpt-4o-mini")
-    return os.getenv("LITELLM_MODEL", "github_copilot/gpt-4o")
+    return os.getenv("COPILOT_MODEL", "gpt-4o")
 
 
 # ============================================================================
@@ -766,6 +766,7 @@ async def continue_thread(self, thread_id: str, user_message: str):
         single async generator interface.
         """
         import uuid as uuid_mod
+
         from .engine.ag_ui_events import (
             encode_event,
             run_error_event,
@@ -775,13 +776,13 @@ async def continue_thread(self, thread_id: str, user_message: str):
             step_finished_event,
             step_started_event,
             structured_output_event,
-            text_message_start,
             text_message_content,
             text_message_end,
-            tool_call_start,
+            text_message_start,
             tool_call_args,
             tool_call_end,
             tool_call_result,
+            tool_call_start,
         )
 
         thread = self._repo.get_thread(thread_id)

backend/agent_builder/tests/test_engine.py

@@ -75,16 +75,15 @@ def test_mixed_sources(self):
 
 
 class TestBuildLlmSelection:
-    def test_defaults_to_litellm_even_with_api_key(self, monkeypatch):
+    def test_defaults_to_copilot_even_with_api_key(self, monkeypatch):
         monkeypatch.delenv("AGENT_BACKEND", raising=False)
 
-        with patch("langchain_litellm.ChatLiteLLM") as mock_litellm:
+        with patch("copilot_llm.build_copilot_llm") as mock_copilot:
             from agent_builder.engine.react_runner import build_llm
 
-            build_llm("openai/nvidia/nemotron-3-nano-4b", api_key="test-key")
+            build_llm("gpt-4o", api_key="test-key")
 
-        mock_litellm.assert_called_once()
-        assert mock_litellm.call_args.kwargs["model"] == "openai/nvidia/nemotron-3-nano-4b"
+        mock_copilot.assert_called_once()
 
     def test_uses_openai_when_explicitly_forced(self, monkeypatch):
         monkeypatch.setenv("AGENT_BACKEND", "openai")

backend/agent_builder/tests/test_service.py

@@ -35,9 +35,9 @@ def _make_service(tmp_path: Path) -> WorkbenchService:
 
 
 class TestWorkbenchServiceCRUD:
-    def test_defaults_to_litellm_model_when_not_forced(self, monkeypatch):
+    def test_defaults_to_copilot_model_when_not_forced(self, monkeypatch):
         monkeypatch.delenv("AGENT_BACKEND", raising=False)
-        monkeypatch.setenv("LITELLM_MODEL", "openai/nvidia/nemotron-3-nano-4b")
+        monkeypatch.setenv("COPILOT_MODEL", "gpt-4o")
         monkeypatch.setenv("OPENAI_MODEL", "gpt-4o-mini")
 
         with TemporaryDirectory() as tmp:
@@ -47,7 +47,7 @@ def test_defaults_to_litellm_model_when_not_forced(self, monkeypatch):
                 db_path=Path(tmp) / "test.db",
                 openai_api_key="test-key",
             )
-            assert svc._model == "openai/nvidia/nemotron-3-nano-4b"
+            assert svc._model == "gpt-4o"
 
     def test_create_and_get_agent(self):
         with TemporaryDirectory() as tmp: