Summary

• Problem: Users with GitHub Copilot subscriptions must configure a separate API key (OpenAI, Gemini, etc.) to use memory search embeddings.
• Why it matters: Many developers already have Copilot through their GitHub plan but lack separate embedding API keys, leaving memory search unavailable.
• What changed: Added a MemoryEmbeddingProviderAdapter to the github-copilot plugin that discovers embedding models via the Copilot API and registers at auto-selection priority 15.
• What did NOT change (scope boundary): No changes to core embedding infrastructure, token management, or other providers. The existing createRemoteEmbeddingProvider pattern is not reused because it is not exported through the plugin SDK; the adapter builds its own HTTP client following the Ollama extension pattern.

Change Type (select all)

• Bug fix
• Feature
• Refactor required for the fix
• Docs
• Security hardening
• Chore/infra

Scope (select all touched areas)

• Gateway / orchestration
• Skills / tool execution
• Auth / tokens
• Memory / storage
• Integrations
• API / contracts
• UI / DX
• CI/CD / infra

Linked Issue/PR

• Closes [Feature]: Add GitHub Copilot as memory search embedding provider #61717
• This PR fixes a bug or regression

Root Cause (if applicable)

N/A — new feature.

Regression Test Plan (if applicable)

N/A — new feature, but comprehensive test coverage added.

• Coverage level:
  • Unit test
  • Seam / integration test
  • End-to-end test
  • Existing coverage already sufficient
• Target test or file: extensions/github-copilot/embeddings.test.ts (22 tests)
• Scenario the test should lock in: Model discovery, provider creation, embedQuery/embedBatch, error handling, auto-selection behavior, ID-based model matching
• Existing test that already covers this: extensions/github-copilot/index.test.ts updated with registration test

User-visible / Behavior Changes

• New embedding provider github-copilot available for agents.defaults.memorySearch.provider
• When provider: "auto", GitHub Copilot is tried at priority 15 (after local, before OpenAI) if a GitHub token is available
• Embedding models are auto-discovered from the Copilot /models endpoint (prefers text-embedding-3-small)
• No new config keys required — reuses existing Copilot auth (env vars or openclaw models auth login-github-copilot)

Diagram (if applicable)

User config (provider: "github-copilot" or "auto")
  → resolveFirstGithubToken (env vars / auth profile)
  → resolveCopilotApiToken (GitHub token → Copilot API token)
  → GET {baseUrl}/models (discover embedding models)
  → pickBestModel (text-embedding-3-small preferred)
  → POST {baseUrl}/embeddings (OpenAI-compatible)

Security Impact (required)

• New permissions/capabilities? No
• Secrets/tokens handling changed? No — reuses existing Copilot token infrastructure
• New/changed network calls? Yes — embedding requests to Copilot /embeddings and /models endpoints
• Command/tool execution surface changed? No
• Data access scope changed? No
• Risk + mitigation: New network calls use fetchWithSsrFGuard with SSRF policy scoped to the resolved Copilot API hostname. Tokens are sent only via Authorization header and never logged.

Repro + Verification

Environment

• OS: Linux (Docker)
• Runtime/container: Docker with openclaw-e2e-copilot-embed image
• Model/provider: GitHub Copilot (Enterprise plan)
• Relevant config: agents.defaults.memorySearch.provider: "github-copilot"

Steps

1. Configure GitHub Copilot auth (openclaw models auth login-github-copilot or set GH_TOKEN)
2. Set agents.defaults.memorySearch.provider: "github-copilot" in openclaw.json
3. Write memory notes and run openclaw memory index --force
4. Run openclaw memory search "query"

Expected

• Memory status shows Provider: github-copilot, Model: text-embedding-3-small, Vector: ready
• Memory search returns ranked results using Copilot embeddings

Actual

• Confirmed working: provider detected, model auto-discovered, 2 files indexed, vector search returns matches (score 0.323 for "capital of France", 0.362 for "Copilot embedding")

Evidence

• Failing test/log before + passing after
• Trace/log snippets

Unit tests: 22 passing in embeddings.test.ts, 46 total across extensions/github-copilot/

Docker E2E output:

Provider: github-copilot (requested: github-copilot)
Model: text-embedding-3-small
Indexed: 2/2 files · 2 chunks
Vector: ready
Vector dims: 1536
Embeddings: ready
Embedding cache: enabled (3 entries)

Search "capital of France":
0.323 memory/test-copilot-embedding.md:1-5

Search "Copilot embedding":
0.362 memory/project-notes.md:1-6

Human Verification (required)

• Verified scenarios: Docker E2E with real GitHub Copilot Enterprise subscription — token exchange, model discovery, indexing, and vector search all working
• Edge cases checked: empty supported_endpoints (Copilot API quirk — models matched by ID pattern), missing GitHub token (graceful fallthrough), model discovery HTTP error, malformed response
• What you did not verify: openclaw message send in Docker (pre-existing Node 24 ESM bug on v2026.4.5 tag, unrelated to this PR)

Review Conversations

• I replied to or resolved every bot review conversation I addressed in this PR.
• I left unresolved only the conversations that still need reviewer or maintainer judgment.

Compatibility / Migration

• Backward compatible? Yes
• Config/env changes? No — new optional provider value, existing configs unaffected
• Migration needed? No
• New plugin SDK exports: None

Risks and Mitigations

• Risk: Copilot token is captured at creation time and may expire during long sessions (~30 min TTL)
  • Mitigation: Matches existing pattern across all other embedding providers. Documented in code comment. Token refresh can be added as a follow-up if needed.
• Risk: Copilot API model availability varies by plan
  • Mitigation: Dynamic discovery with graceful fallthrough; auto-selection skips to next provider when no embedding models are available.