diff --git a/apps/desktop/renderer-architecture.json b/apps/desktop/renderer-architecture.json
index 3cad453abf..6f2be12572 100644
--- a/apps/desktop/renderer-architecture.json
+++ b/apps/desktop/renderer-architecture.json
@@ -3555,21 +3555,17 @@
         }
       },
       "src/renderer/settings/provider-connection-detail.tsx": {
-        "bridgePaths": {
-          "window.maka.githubCopilotSubscription.connectExistingLogin": 1
-        },
+        "bridgePaths": {},
         "environmentCapabilities": {},
         "hookCalls": {
-          "useActionGuard": 1,
           "useConnectionDetail": 1,
           "useEffect": 2,
-          "useMountedRef": 3,
+          "useMountedRef": 2,
           "useOAuthLoginFlow": 1,
-          "useRuntimeHostSettingsErrorReporter": 3,
-          "useRuntimeHostSettingsTarget": 1,
+          "useRuntimeHostSettingsErrorReporter": 2,
           "useState": 8,
           "useToast": 2,
-          "useUiLocale": 4
+          "useUiLocale": 3
         },
         "lifecycleMethods": {},
         "unresolvedDependencies": 0,
@@ -3587,7 +3583,6 @@
           "./runtime-host-settings-target.js": 1,
           "./settings-expandable-row": 1,
           "./settings-section": 1,
-          "./use-action-guard": 1,
           "./use-connection-detail": 1,
           "./use-oauth-login-flow": 1,
           "@astryxdesign/core": 1,
@@ -3669,22 +3664,19 @@
       },
       "src/renderer/settings/provider-oauth-section.tsx": {
         "bridgePaths": {
+          "window.maka.githubCopilotSubscription": 1,
           "window.maka.githubCopilotSubscription.connectExistingLogin": 1,
-          "window.maka.githubCopilotSubscription.getAccountState": 2,
-          "window.maka.githubCopilotSubscription.logout": 1,
-          "window.maka.githubCopilotSubscription.refreshTokens": 1,
           "window.maka.openAiCodex": 1,
           "window.maka.xaiOAuth": 1
         },
         "environmentCapabilities": {},
         "hookCalls": {
-          "useEffect": 1,
           "useMountedRef": 1,
           "useOAuthLoginFlow": 2,
-          "useRef": 1,
+          "useRuntimeHostSettingsErrorReporter": 1,
           "useRuntimeHostSettingsGenerationKey": 1,
           "useRuntimeHostSettingsTarget": 3,
-          "useState": 2,
+          "useState": 1,
           "useUiLocale": 3
         },
         "lifecycleMethods": {},
@@ -4474,6 +4466,7 @@
       },
       "src/renderer/settings/use-connection-detail.ts": {
         "bridgePaths": {
+          "window.maka.githubCopilotSubscription": 1,
           "window.maka.openAiCodex": 1,
           "window.maka.xaiOAuth": 1
         },
@@ -4568,7 +4561,7 @@
           "useMountedRef": 1,
           "useRef": 2,
           "useRuntimeHostSettingsErrorReporter": 1,
-          "useState": 5,
+          "useState": 6,
           "useToast": 1,
           "useUiLocale": 1
         },
diff --git a/apps/desktop/src/main/__tests__/github-copilot-local-credential.test.ts b/apps/desktop/src/main/__tests__/github-copilot-local-credential.test.ts
new file mode 100644
index 0000000000..24ac2dad91
--- /dev/null
+++ b/apps/desktop/src/main/__tests__/github-copilot-local-credential.test.ts
@@ -0,0 +1,158 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import assert from 'node:assert/strict';
+import { describe, test } from 'node:test';
+
+import { importGitHubCopilotLocalCredential } from '../oauth/github-copilot-local-credential.js';
+
+describe('importGitHubCopilotLocalCredential', () => {
+  test('prefers an explicit Copilot Requests credential over the generic GitHub CLI login', async () => {
+    const previous = process.env.COPILOT_GITHUB_TOKEN;
+    process.env.COPILOT_GITHUB_TOKEN = 'github_pat_copilot_requests';
+    let authorization = '';
+    try {
+      const imported = await importGitHubCopilotLocalCredential({
+        fetchFn: async (url, init) => {
+          assert.equal(String(url), 'https://api.githubcopilot.com/models');
+          authorization = new Headers(init?.headers).get('authorization') ?? '';
+          return copilotModelsResponse();
+        },
+      });
+
+      assert.equal(imported.result.ok, true);
+      if (imported.result.ok) {
+        assert.deepEqual(
+          imported.result.models.map(({ id }) => id),
+          ['gpt-5.4'],
+        );
+      }
+      assert.equal(authorization, 'Bearer github_pat_copilot_requests');
+    } finally {
+      if (previous === undefined) delete process.env.COPILOT_GITHUB_TOKEN;
+      else process.env.COPILOT_GITHUB_TOKEN = previous;
+    }
+  });
+
+  test('returns the credential to the caller instead of storing it anywhere local', async () => {
+    let requestAuthorization = '';
+    const imported = await importGitHubCopilotLocalCredential({
+      resolveGitHubToken: async () => 'gho_existing_login\n',
+      fetchFn: async (url, init) => {
+        assert.equal(String(url), 'https://api.githubcopilot.com/models');
+        requestAuthorization = new Headers(init?.headers).get('authorization') ?? '';
+        return copilotModelsResponse();
+      },
+    });
+
+    assert.equal(imported.result.ok, true);
+    if (imported.result.ok) {
+      assert.deepEqual(
+        imported.result.models.map(({ id }) => id),
+        ['gpt-5.4'],
+      );
+    }
+    assert.equal(requestAuthorization, 'Bearer gho_existing_login');
+    // The Host vault is the only place this credential is written; the shape is
+    // the one `setRuntimeHostAccountCredential` commits verbatim.
+    assert.deepEqual(JSON.parse(imported.secret ?? ''), {
+      access_token: 'gho_existing_login',
+      refresh_token: 'gho_existing_login',
+      expires_at: Number.MAX_SAFE_INTEGER,
+      token_type: 'Bearer',
+      base_url: 'https://api.githubcopilot.com',
+    });
+  });
+
+  test('rejects classic PATs before any Copilot request', async () => {
+    let requested = false;
+    const imported = await importGitHubCopilotLocalCredential({
+      resolveGitHubToken: async () => 'ghp_classic_pat',
+      fetchFn: async () => {
+        requested = true;
+        return Response.json({});
+      },
+    });
+
+    assert.equal(imported.result.ok, false);
+    if (!imported.result.ok) {
+      assert.equal(imported.result.reason, 'token_exchange_failed');
+      assert.match(imported.result.message, /不支持 classic PAT/);
+      assert.equal(imported.result.message.includes('ghp_classic_pat'), false);
+    }
+    assert.equal(imported.secret, undefined);
+    assert.equal(requested, false);
+  });
+
+  test('explains subscription or Copilot Requests policy rejection without exposing provider details', async () => {
+    const imported = await importGitHubCopilotLocalCredential({
+      resolveGitHubToken: async () => 'gho_without_copilot_permission',
+      fetchFn: async () => new Response(null, { status: 403 }),
+    });
+
+    assert.equal(imported.result.ok, false);
+    if (!imported.result.ok) {
+      assert.match(imported.result.message, /Copilot Requests/);
+      assert.doesNotMatch(imported.result.message, /403|gho_without/);
+    }
+    assert.equal(imported.secret, undefined);
+  });
+
+  test('refuses an account that reaches no Copilot model', async () => {
+    const imported = await importGitHubCopilotLocalCredential({
+      resolveGitHubToken: async () => 'gho_no_entitlement',
+      fetchFn: async () => Response.json({ data: [] }),
+    });
+
+    assert.equal(imported.result.ok, false);
+    assert.equal(imported.secret, undefined);
+  });
+
+  test('distinguishes a transient entitlement failure from account ineligibility', async () => {
+    const imported = await importGitHubCopilotLocalCredential({
+      resolveGitHubToken: async () => 'gho_temporarily_unavailable',
+      fetchFn: async () => new Response(null, { status: 429 }),
+    });
+
+    assert.equal(imported.result.ok, false);
+    if (!imported.result.ok) {
+      assert.equal(imported.result.reason, 'token_exchange_failed');
+      assert.match(imported.result.message, /暂时无法验证/);
+      assert.doesNotMatch(imported.result.message, /没有可用/);
+    }
+    assert.equal(imported.secret, undefined);
+  });
+});
+
+function copilotModelsResponse(): Response {
+  return Response.json({
+    data: [
+      {
+        id: 'gpt-5.4',
+        model_picker_enabled: true,
+        supported_endpoints: ['/responses'],
+        policy: { state: 'enabled' },
+        capabilities: {
+          limits: { max_prompt_tokens: 128_000, max_output_tokens: 16_000 },
+          supports: { tool_calls: true },
+        },
+      },
+    ],
+  });
+}
diff --git a/apps/desktop/src/main/__tests__/github-copilot-subscription-service.test.ts b/apps/desktop/src/main/__tests__/github-copilot-subscription-service.test.ts
deleted file mode 100644
index 1d2742316c..0000000000
--- a/apps/desktop/src/main/__tests__/github-copilot-subscription-service.test.ts
+++ /dev/null
@@ -1,187 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import assert from 'node:assert/strict';
-import { describe, test } from 'node:test';
-
-import { GitHubCopilotSubscriptionService } from '../oauth/github-copilot-subscription-service.js';
-
-describe('GitHubCopilotSubscriptionService', () => {
-  test('prefers an explicit Copilot Requests credential over the generic GitHub CLI login', async () => {
-    const previous = process.env.COPILOT_GITHUB_TOKEN;
-    process.env.COPILOT_GITHUB_TOKEN = 'github_pat_copilot_requests';
-    let stored: string | null = null;
-    let authorization = '';
-    try {
-      const service = new GitHubCopilotSubscriptionService({
-        credentialStore: {
-          getSecret: async () => stored,
-          setSecret: async (_slug, _kind, value) => { stored = value; },
-          deleteSecret: async () => { stored = null; },
-        },
-        fetchFn: async (url, init) => {
-          assert.equal(String(url), 'https://api.githubcopilot.com/models');
-          authorization = new Headers(init?.headers).get('authorization') ?? '';
-          return copilotModelsResponse();
-        },
-      });
-
-      const result = await service.connectExistingLogin();
-      assert.equal(result.ok, true);
-      if (result.ok) assert.deepEqual(result.models.map(({ id }) => id), ['gpt-5.4']);
-      assert.equal(authorization, 'Bearer github_pat_copilot_requests');
-      assert.ok(stored);
-    } finally {
-      if (previous === undefined) delete process.env.COPILOT_GITHUB_TOKEN;
-      else process.env.COPILOT_GITHUB_TOKEN = previous;
-    }
-  });
-
-  test('imports a supported existing gh login into the shared OAuth credential lifecycle', async () => {
-    let stored: string | null = null;
-    let requestAuthorization = '';
-    const service = new GitHubCopilotSubscriptionService({
-      credentialStore: {
-        getSecret: async () => stored,
-        setSecret: async (_slug, _kind, value) => { stored = value; },
-        deleteSecret: async () => { stored = null; },
-      },
-      resolveGitHubToken: async () => 'gho_existing_login\n',
-      fetchFn: async (url, init) => {
-        assert.equal(String(url), 'https://api.githubcopilot.com/models');
-        requestAuthorization = new Headers(init?.headers).get('authorization') ?? '';
-        return copilotModelsResponse();
-      },
-    });
-
-    const result = await service.connectExistingLogin();
-    assert.equal(result.ok, true);
-    if (result.ok) assert.deepEqual(result.models.map(({ id }) => id), ['gpt-5.4']);
-    assert.equal(requestAuthorization, 'Bearer gho_existing_login');
-    assert.deepEqual(JSON.parse(stored ?? ''), {
-      access_token: 'gho_existing_login',
-      refresh_token: 'gho_existing_login',
-      expires_at: Number.MAX_SAFE_INTEGER,
-      token_type: 'Bearer',
-      base_url: 'https://api.githubcopilot.com',
-    });
-    assert.deepEqual(await service.getAccountState(), {
-      provider: 'github-copilot',
-      runtimeState: 'authenticated',
-    });
-  });
-
-  test('rejects classic PATs before any Copilot request', async () => {
-    let requested = false;
-    const service = new GitHubCopilotSubscriptionService({
-      credentialStore: memoryCredentialStore(),
-      resolveGitHubToken: async () => 'ghp_classic_pat',
-      fetchFn: async () => {
-        requested = true;
-        return Response.json({});
-      },
-    });
-
-    const result = await service.connectExistingLogin();
-    assert.equal(result.ok, false);
-    if (!result.ok) {
-      assert.equal(result.reason, 'token_exchange_failed');
-      assert.match(result.message, /不支持 classic PAT/);
-      assert.equal(result.message.includes('ghp_classic_pat'), false);
-    }
-    assert.equal(requested, false);
-  });
-
-  test('explains subscription or Copilot Requests policy rejection without exposing provider details', async () => {
-    const service = new GitHubCopilotSubscriptionService({
-      credentialStore: {
-        getSecret: async () => null,
-        setSecret: async () => {},
-        deleteSecret: async () => {},
-      },
-      resolveGitHubToken: async () => 'gho_without_copilot_permission',
-      fetchFn: async () => new Response(null, { status: 403 }),
-    });
-
-    const result = await service.connectExistingLogin();
-    assert.equal(result.ok, false);
-    assert.match(result.message, /Copilot Requests/);
-    assert.doesNotMatch(result.message, /404|gho_without/);
-  });
-
-  test('refreshes and logs out through the same store without exposing either token in state', async () => {
-    let stored: string | null = JSON.stringify({
-      access_token: 'github_pat_supported',
-      refresh_token: 'github_pat_supported',
-      expires_at: Number.MAX_SAFE_INTEGER,
-      base_url: 'https://api.githubcopilot.com',
-    });
-    let writes = 0;
-    const service = new GitHubCopilotSubscriptionService({
-      credentialStore: {
-        getSecret: async () => stored,
-        setSecret: async (_slug, _kind, value) => {
-          writes += 1;
-          stored = value;
-        },
-        deleteSecret: async () => { stored = null; },
-      },
-      now: () => 10_000,
-      fetchFn: async () => copilotModelsResponse(),
-    });
-
-    const result = await service.refreshTokens();
-    assert.equal(result.ok, true);
-    if (result.ok) assert.deepEqual(result.models.map(({ id }) => id), ['gpt-5.4']);
-    assert.equal(writes, 0, 'validating an unchanged durable token must not rewrite it after network I/O');
-    const state = await service.getAccountState();
-    assert.deepEqual(state, { provider: 'github-copilot', runtimeState: 'authenticated' });
-    assert.equal('access_token' in state, false);
-    assert.equal('refresh_token' in state, false);
-    assert.deepEqual(await service.logout(), { ok: true });
-    assert.deepEqual(await service.getAccountState(), {
-      provider: 'github-copilot',
-      runtimeState: 'not_logged_in',
-    });
-  });
-
-});
-
-function copilotModelsResponse(): Response {
-  return Response.json({
-    data: [{
-      id: 'gpt-5.4',
-      model_picker_enabled: true,
-      supported_endpoints: ['/responses'],
-      policy: { state: 'enabled' },
-      capabilities: {
-        limits: { max_prompt_tokens: 128_000, max_output_tokens: 16_000 },
-        supports: { tool_calls: true },
-      },
-    }],
-  });
-}
-
-function memoryCredentialStore() {
-  return {
-    getSecret: async () => null,
-    setSecret: async () => undefined,
-    deleteSecret: async () => undefined,
-  };
-}
diff --git a/apps/desktop/src/main/__tests__/runtime-host-account-connection.test.ts b/apps/desktop/src/main/__tests__/runtime-host-account-connection.test.ts
index c02770cec1..edb4dfe340 100644
--- a/apps/desktop/src/main/__tests__/runtime-host-account-connection.test.ts
+++ b/apps/desktop/src/main/__tests__/runtime-host-account-connection.test.ts
@@ -119,4 +119,132 @@ describe('synchronizeRuntimeHostAccountConnection', () => {
 
     assert.equal(selectCalls(), 0);
   });
+
+  it("opens on a model the account's live list reported", async () => {
+    // The Connection is created before a credential exists, so its enabled ids
+    // are the curated fallback guess in the order this build ships them. The
+    // first of those may be a model the account never serves.
+    const { client, selected } = discoveringAccountClient(
+      ['fallback-only', 'gpt-5-codex'],
+      [{ id: 'gpt-5-codex' }, { id: 'gpt-5-codex-mini' }],
+    );
+
+    await synchronizeRuntimeHostAccountConnection(client, 'openai-codex');
+
+    assert.deepEqual(selected(), { connectionId: CONNECTION_ID, modelId: 'gpt-5-codex' });
+  });
+
+  it('keeps every enabled id the live response omitted', async () => {
+    // Ordering only. A `/models` answer that cannot see a model is not evidence
+    // the account cannot run it, so nothing is pruned and nothing is rewritten.
+    const { client, catalog, updateCalls } = discoveringAccountClient(
+      ['fallback-only', 'gpt-5-codex'],
+      [{ id: 'gpt-5-codex' }],
+    );
+
+    await synchronizeRuntimeHostAccountConnection(client, 'openai-codex');
+
+    assert.deepEqual(catalog().connections[0]?.enabledModelIds, ['fallback-only', 'gpt-5-codex']);
+    assert.equal(updateCalls(), 0);
+  });
+
+  it('opens on the first enabled id when no live response arrived', async () => {
+    const { client, selected } = discoveringAccountClient(
+      ['fallback-only', 'gpt-5-codex'],
+      [{ id: 'gpt-5-codex' }],
+      'fallback',
+    );
+
+    await synchronizeRuntimeHostAccountConnection(client, 'openai-codex');
+
+    assert.deepEqual(selected(), { connectionId: CONNECTION_ID, modelId: 'fallback-only' });
+  });
+
+  it('opens on the first enabled id when the live list shares none of them', async () => {
+    const { client, selected } = discoveringAccountClient(
+      ['fallback-only'],
+      [{ id: 'gpt-5-codex' }],
+    );
+
+    await synchronizeRuntimeHostAccountConnection(client, 'openai-codex');
+
+    assert.deepEqual(selected(), { connectionId: CONNECTION_ID, modelId: 'fallback-only' });
+  });
 });
+
+/** A client whose discovery commits an inventory, so a live list exists. */
+function discoveringAccountClient(
+  enabledModelIds: readonly string[],
+  models: readonly { id: string }[],
+  modelSource: 'fetched' | 'fallback' = 'fetched',
+): {
+  readonly client: RuntimeHostAccountConnectionClient;
+  catalog(): ConnectionCatalogSnapshot;
+  selected(): ConnectionTarget | null | undefined;
+  updateCalls(): number;
+} {
+  let catalog: ConnectionCatalogSnapshot = {
+    ...catalogWithoutDefault(),
+    connections: [
+      {
+        ...catalogWithoutDefault().connections[0]!,
+        enabledModelIds: [...enabledModelIds],
+        models: [...models],
+        modelSource,
+      },
+    ],
+  };
+  let selected: ConnectionTarget | null | undefined;
+  let updates = 0;
+  const client = {
+    loadConnectionCatalog: async (): Promise<ConnectionCatalogSnapshot> => catalog,
+    fetchConnectionModels: async () => ({
+      kind: 'committed' as const,
+      catalogRevision: catalog.revision,
+      connection: {
+        connectionId: CONNECTION_ID,
+        revision: catalog.connections[0]?.revision ?? 1,
+      },
+      modelCount: models.length,
+      source: modelSource,
+      fetchedAt: 1,
+    }),
+    updateConnection: async (
+      expected: { connectionId: string; revision: number },
+      changes: { enabledModelIds?: string[] },
+    ) => {
+      updates += 1;
+      const current = catalog.connections[0]!;
+      assert.deepEqual(expected, {
+        connectionId: current.connectionId,
+        revision: current.revision,
+      });
+      const updated = {
+        ...current,
+        ...(changes.enabledModelIds ? { enabledModelIds: changes.enabledModelIds } : {}),
+        revision: current.revision + 1,
+      };
+      catalog = { ...catalog, revision: catalog.revision + 1, connections: [updated] };
+      return {
+        kind: 'committed' as const,
+        catalogRevision: catalog.revision,
+        connection: { connectionId: updated.connectionId, revision: updated.revision },
+      };
+    },
+    setDefaultConnectionTarget: async (
+      expectedCatalogRevision: number,
+      target: ConnectionTarget | null,
+    ) => {
+      assert.equal(expectedCatalogRevision, catalog.revision);
+      selected = target;
+      catalog = { ...catalog, revision: catalog.revision + 1, defaultTarget: target };
+      return { kind: 'committed' as const, catalogRevision: catalog.revision };
+    },
+  } as unknown as RuntimeHostAccountConnectionClient;
+  return {
+    client,
+    catalog: () => catalog,
+    selected: () => selected,
+    updateCalls: () => updates,
+  };
+}
diff --git a/apps/desktop/src/main/__tests__/runtime-host-github-copilot-ipc-main.test.ts b/apps/desktop/src/main/__tests__/runtime-host-github-copilot-ipc-main.test.ts
index 517d089756..88742f5dc9 100644
--- a/apps/desktop/src/main/__tests__/runtime-host-github-copilot-ipc-main.test.ts
+++ b/apps/desktop/src/main/__tests__/runtime-host-github-copilot-ipc-main.test.ts
@@ -175,16 +175,11 @@ test('imports a local GitHub credential through the shared Host account path', a
     connectionId: CONNECTION_ID,
     modelId: discoveredModelId,
   });
-  assert.deepEqual(await invoke(handlers, 'github-copilot:get-account-state'), {
-    provider: 'github-copilot',
-    runtimeState: 'authenticated',
-  });
-
-  assert.deepEqual(await invoke(handlers, 'github-copilot:refresh-tokens'), { ok: true });
-  assert.deepEqual(await invoke(handlers, 'github-copilot:logout'), { ok: true });
-  assert.equal(storedSecret, undefined);
-  assert.equal(catalog.connections[0]?.enabled, false);
-  assert.equal(changed, 3);
+  assert.equal(changed, 1);
+  // Interactive enrollment, account state, refresh, and sign-out belong to the
+  // Host OAuth coordinator's shared adapter; Desktop registers the local
+  // credential import and nothing else.
+  assert.deepEqual([...handlers.keys()], ['github-copilot:connect-existing-login']);
 });
 
 async function invoke(
diff --git a/apps/desktop/src/main/__tests__/runtime-host-oauth-ipc-main.test.ts b/apps/desktop/src/main/__tests__/runtime-host-oauth-ipc-main.test.ts
index 84fa6dd386..b2777c4862 100644
--- a/apps/desktop/src/main/__tests__/runtime-host-oauth-ipc-main.test.ts
+++ b/apps/desktop/src/main/__tests__/runtime-host-oauth-ipc-main.test.ts
@@ -22,6 +22,7 @@ import test from 'node:test';
 import type { IpcMainInvokeEvent } from 'electron';
 import { PROVIDER_DEFAULTS } from '@maka/core/llm-connections';
 import type { ConnectionCatalogSnapshot } from '@maka/core/runtime-policy';
+import type { OAuthLoginProvider } from '@maka/runtime-host/protocol';
 import {
   RUNTIME_HOST_OAUTH_IPC_CHANNELS,
   registerRuntimeHostOAuthIpc,
@@ -642,6 +643,30 @@ test('keeps a committed OAuth login successful when model discovery fails withou
   assertNoUnexpectedClientCalls();
 });
 
+test('projects the selected Host answer for whether a provider may enrol', async () => {
+  // The renderer must be able to disable a sign-in the install refuses before
+  // the user clicks it, and the authoritative answer belongs to the selected
+  // Host — a remote Host that enabled Copilot is not bound by this Desktop
+  // process's environment.
+  for (const [enabled, expected] of [[true, true], [false, false]] as const) {
+    const { handlers, assertNoUnexpectedClientCalls } = registerOAuthTestHandlers({
+      clientOverrides: {
+        queryOAuthEnrollment: async (provider: OAuthLoginProvider) => ({ provider, enabled }),
+      },
+      presentation: new RuntimeHostOAuthPresentation(async () => {
+        throw new Error('An enrollment probe must never open a browser');
+      }),
+      emitConnectionListChanged: () => undefined,
+      isProviderEnabled: () => true,
+    });
+
+    assert.deepEqual(await invoke(handlers, 'github-copilot:get-enrollment-state'), {
+      enabled: expected,
+    });
+    assertNoUnexpectedClientCalls();
+  }
+});
+
 function createFailClosedOAuthClient(overrides: Partial<OAuthClient>): {
   readonly client: OAuthClient;
   assertNoUnexpectedClientCalls(): void;
@@ -664,6 +689,7 @@ function createFailClosedOAuthClient(overrides: Partial<OAuthClient>): {
     startOAuthLogin: unexpected('startOAuthLogin'),
     queryOAuthLogin: unexpected('queryOAuthLogin'),
     cancelOAuthLogin: unexpected('cancelOAuthLogin'),
+    queryOAuthEnrollment: unexpected('queryOAuthEnrollment'),
     ...overrides,
   } satisfies OAuthClient;
   return {
diff --git a/apps/desktop/src/main/oauth-connection-identities.ts b/apps/desktop/src/main/oauth-connection-identities.ts
new file mode 100644
index 0000000000..f74938a8f2
--- /dev/null
+++ b/apps/desktop/src/main/oauth-connection-identities.ts
@@ -0,0 +1,29 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import type { OAuthLoginProvider } from '@maka/runtime-host/protocol';
+
+/** Stable Desktop connection identities for Host-supported interactive OAuth providers. */
+export const INTERACTIVE_OAUTH_CONNECTION_SLUGS = {
+  'openai-codex': 'codex-subscription',
+  'xai-oauth': 'xai-oauth',
+  // Shared with the local `gh` credential import so both routes to a Copilot
+  // account land on one Connection instead of two.
+  'github-copilot': 'github-copilot',
+} as const satisfies Readonly<Record<OAuthLoginProvider, string>>;
diff --git a/apps/desktop/src/main/oauth/github-copilot-local-credential.ts b/apps/desktop/src/main/oauth/github-copilot-local-credential.ts
new file mode 100644
index 0000000000..cd43c57950
--- /dev/null
+++ b/apps/desktop/src/main/oauth/github-copilot-local-credential.ts
@@ -0,0 +1,144 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+
+import type { ModelInfo } from '@maka/core/llm-connections';
+import type { SubscriptionActionResult } from '@maka/core/oauth-subscription';
+import {
+  createGitHubCopilotAccountTokens,
+  isSupportedGitHubCopilotAccountToken,
+  serializeOAuthSubscriptionTokens,
+} from '@maka/runtime/subscription-credentials';
+import { fetchGitHubCopilotModels } from '@maka/runtime/model-fetcher';
+import {
+  GitHubCopilotEntitlementError,
+  GitHubCopilotEntitlementUnavailableError,
+  verifyGitHubCopilotModelEntitlement,
+} from '@maka/runtime/github-copilot-oauth-enrollment';
+
+const execFileAsync = promisify(execFile);
+
+export interface ImportedGitHubCopilotCredential {
+  readonly result:
+    | { readonly ok: true; readonly models: ModelInfo[] }
+    | Exclude<SubscriptionActionResult, { ok: true }>;
+  /** Present only on success; the caller commits it to the Host vault. */
+  readonly secret?: string;
+}
+
+export interface ImportGitHubCopilotLocalCredentialDeps {
+  readonly resolveGitHubToken?: () => Promise<string>;
+  readonly fetchFn?: typeof fetch;
+}
+
+/**
+ * Reads a GitHub credential this machine already holds (`gh auth token`, or one
+ * of the `*_TOKEN` environment variables) and validates that it reaches a
+ * Copilot model.
+ *
+ * This is the one Copilot responsibility that genuinely depends on the local
+ * machine, so it is the only one Desktop keeps: interactive enrollment, account
+ * state, refresh, and sign-out all belong to the Host's OAuth coordinator. It
+ * holds no state between calls — the credential is returned to the caller and
+ * never written to disk here.
+ */
+export async function importGitHubCopilotLocalCredential(
+  deps: ImportGitHubCopilotLocalCredentialDeps = {},
+): Promise<ImportedGitHubCopilotCredential> {
+  const resolveToken = deps.resolveGitHubToken ?? resolveGitHubAccountToken;
+  try {
+    const githubToken = (await resolveToken()).trim();
+    if (githubToken.startsWith('ghp_')) {
+      return {
+        result: {
+          ok: false,
+          reason: 'token_exchange_failed',
+          message:
+            'GitHub Copilot 不支持 classic PAT；请使用兼容 OAuth 登录或具有 Copilot Requests 权限的 fine-grained PAT。',
+        },
+      };
+    }
+    if (!isSupportedGitHubCopilotAccountToken(githubToken)) {
+      return {
+        result: {
+          ok: false,
+          reason: 'token_exchange_failed',
+          message: '当前 GitHub 凭据类型不受支持；请使用兼容 OAuth 登录或 fine-grained PAT。',
+        },
+      };
+    }
+    const tokens = createGitHubCopilotAccountTokens(githubToken);
+    let models: ModelInfo[];
+    try {
+      await verifyGitHubCopilotModelEntitlement({
+        tokens,
+        fetchFn: deps.fetchFn ?? fetch,
+      });
+      // The verifier owns classification; this second read only obtains the
+      // model IDs needed by the Host connection catalog.
+      models = await fetchGitHubCopilotModels(tokens.base_url!, tokens.access_token, deps.fetchFn);
+    } catch (error) {
+      if (error instanceof GitHubCopilotEntitlementError) {
+        return {
+          result: {
+            ok: false,
+            reason: 'token_exchange_failed',
+            message:
+              '当前 GitHub 账号没有可用的 Copilot 订阅权限；请确认账号具有 Copilot Requests 权限。',
+          },
+        };
+      }
+      if (error instanceof GitHubCopilotEntitlementUnavailableError) {
+        return {
+          result: {
+            ok: false,
+            reason: 'token_exchange_failed',
+            message: '暂时无法验证 GitHub Copilot 订阅状态，请稍后重试。',
+          },
+        };
+      }
+      throw error;
+    }
+    return { result: { ok: true, models }, secret: serializeOAuthSubscriptionTokens(tokens) };
+  } catch {
+    return {
+      result: {
+        ok: false,
+        reason: 'token_exchange_failed',
+        message:
+          '无法连接 GitHub Copilot。请确认账号具有订阅访问权限，且凭据具有 Copilot Requests 权限；普通 gh auth login 可能不包含该权限。',
+      },
+    };
+  }
+}
+
+async function resolveGitHubAccountToken(): Promise<string> {
+  for (const name of ['COPILOT_GITHUB_TOKEN', 'GH_TOKEN', 'GITHUB_TOKEN'] as const) {
+    const token = process.env[name]?.trim();
+    if (token) return token;
+  }
+  const result = await execFileAsync('gh', ['auth', 'token'], {
+    encoding: 'utf8',
+    timeout: 10_000,
+    maxBuffer: 64 * 1024,
+  });
+  return result.stdout;
+}
diff --git a/apps/desktop/src/main/oauth/github-copilot-subscription-service.ts b/apps/desktop/src/main/oauth/github-copilot-subscription-service.ts
deleted file mode 100644
index 1d6930eed2..0000000000
--- a/apps/desktop/src/main/oauth/github-copilot-subscription-service.ts
+++ /dev/null
@@ -1,209 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
-
-import type { ModelInfo } from '@maka/core/llm-connections';
-
-import type { SubscriptionActionResult } from '@maka/core/oauth-subscription';
-import {
-  createGitHubCopilotAccountTokens,
-  GITHUB_COPILOT_DEFAULT_API_ENDPOINT,
-  isSupportedGitHubCopilotAccountToken,
-  parseOAuthSubscriptionTokens,
-  resolveOAuthSubscriptionTokens,
-  serializeOAuthSubscriptionTokens,
-  type OAuthSubscriptionTokens,
-} from '@maka/runtime/subscription-credentials';
-import { fetchGitHubCopilotModels } from '@maka/runtime/model-fetcher';
-import type { CredentialStore } from '@maka/storage/credential-store';
-
-const GITHUB_COPILOT_CONNECTION_SLUG = 'github-copilot';
-const execFileAsync = promisify(execFile);
-
-export interface GitHubCopilotAccountStateSnapshot {
-  provider: 'github-copilot';
-  runtimeState: 'not_logged_in' | 'authenticated' | 'refreshing' | 'refresh_failed' | 'storage_failed';
-  errorMessage?: string;
-}
-
-export interface GitHubCopilotSubscriptionServiceDeps {
-  credentialStore: Pick<CredentialStore, 'getSecret' | 'setSecret' | 'deleteSecret'>;
-  resolveGitHubToken?: () => Promise<string>;
-  now?: () => number;
-  fetchFn?: typeof fetch;
-}
-
-export type GitHubCopilotValidatedActionResult =
-  | { ok: true; models: ModelInfo[] }
-  | Exclude<SubscriptionActionResult, { ok: true }>;
-
-/** Main-process adapter for importing an existing supported `gh` login. */
-export class GitHubCopilotSubscriptionService {
-  private readonly credentialStore: GitHubCopilotSubscriptionServiceDeps['credentialStore'];
-  private readonly resolveGitHubToken: () => Promise<string>;
-  private readonly now: () => number;
-  private readonly fetchFn: typeof fetch;
-  private refreshing = false;
-  private lastRefreshError: string | null = null;
-  private lastStorageError: string | null = null;
-
-  constructor(deps: GitHubCopilotSubscriptionServiceDeps) {
-    this.credentialStore = deps.credentialStore;
-    this.resolveGitHubToken = deps.resolveGitHubToken ?? resolveGitHubAccountToken;
-    this.now = deps.now ?? (() => Date.now());
-    this.fetchFn = deps.fetchFn ?? fetch;
-  }
-
-  async connectExistingLogin(): Promise<GitHubCopilotValidatedActionResult> {
-    try {
-      const githubToken = (await this.resolveGitHubToken()).trim();
-      if (githubToken.startsWith('ghp_')) {
-        return {
-          ok: false,
-          reason: 'token_exchange_failed',
-          message: 'GitHub Copilot 不支持 classic PAT；请使用兼容 OAuth 登录或具有 Copilot Requests 权限的 fine-grained PAT。',
-        };
-      }
-      if (!isSupportedGitHubCopilotAccountToken(githubToken)) {
-        return {
-          ok: false,
-          reason: 'token_exchange_failed',
-          message: '当前 GitHub 凭据类型不受支持；请使用兼容 OAuth 登录或 fine-grained PAT。',
-        };
-      }
-      const tokens = createGitHubCopilotAccountTokens(githubToken);
-      const models = await fetchGitHubCopilotModels(tokens.base_url!, tokens.access_token, this.fetchFn);
-      if (models.length === 0) throw new Error('GitHub Copilot account returned no usable models.');
-      await this.saveTokens(tokens);
-      this.lastRefreshError = null;
-      return { ok: true, models };
-    } catch {
-      return {
-        ok: false,
-        reason: 'token_exchange_failed',
-        message: '无法连接 GitHub Copilot。请确认账号具有订阅访问权限，且凭据具有 Copilot Requests 权限；普通 gh auth login 可能不包含该权限。',
-      };
-    }
-  }
-
-  async getAccountState(): Promise<GitHubCopilotAccountStateSnapshot> {
-    let tokens: OAuthSubscriptionTokens | null;
-    try {
-      tokens = await this.loadTokens();
-      this.lastStorageError = null;
-    } catch {
-      this.lastStorageError = 'GitHub Copilot 本地凭据读取失败。';
-      tokens = null;
-    }
-    if (this.lastStorageError) {
-      return { provider: 'github-copilot', runtimeState: 'storage_failed', errorMessage: this.lastStorageError };
-    }
-    if (!tokens) return { provider: 'github-copilot', runtimeState: 'not_logged_in' };
-    if (this.refreshing) return { provider: 'github-copilot', runtimeState: 'refreshing' };
-    if (this.lastRefreshError) {
-      return { provider: 'github-copilot', runtimeState: 'refresh_failed', errorMessage: this.lastRefreshError };
-    }
-    return { provider: 'github-copilot', runtimeState: 'authenticated' };
-  }
-
-  async refreshTokens(): Promise<GitHubCopilotValidatedActionResult> {
-    const current = await this.loadTokens().catch(() => null);
-    if (!current) return { ok: false, reason: 'refresh_failed', message: '当前未导入 GitHub Copilot 登录。' };
-    this.refreshing = true;
-    try {
-      const models = await fetchGitHubCopilotModels(
-        current.base_url ?? GITHUB_COPILOT_DEFAULT_API_ENDPOINT,
-        current.access_token,
-        this.fetchFn,
-      );
-      if (models.length === 0) throw new Error('GitHub Copilot account returned no usable models.');
-      this.lastRefreshError = null;
-      return { ok: true, models };
-    } catch {
-      this.lastRefreshError = 'GitHub Copilot 凭据刷新失败，请重新导入 GitHub CLI 登录。';
-      return { ok: false, reason: 'refresh_failed', message: this.lastRefreshError };
-    } finally {
-      this.refreshing = false;
-    }
-  }
-
-  async logout(): Promise<SubscriptionActionResult> {
-    try {
-      await this.credentialStore.deleteSecret(GITHUB_COPILOT_CONNECTION_SLUG, 'oauth_token');
-      this.lastRefreshError = null;
-      this.lastStorageError = null;
-      return { ok: true };
-    } catch {
-      return { ok: false, reason: 'storage_failed', message: '删除 GitHub Copilot 本地凭据失败。' };
-    }
-  }
-
-  async getAccessTokenInternal(): Promise<string | null> {
-    const tokens = await resolveOAuthSubscriptionTokens({
-      providerType: 'github-copilot',
-      slug: GITHUB_COPILOT_CONNECTION_SLUG,
-      credentialStore: this.credentialStore,
-      now: this.now,
-      fetchFn: this.fetchFn,
-    });
-    return tokens?.access_token ?? null;
-  }
-
-  async getTokensInternal(): Promise<OAuthSubscriptionTokens | null> {
-    return resolveOAuthSubscriptionTokens({
-      providerType: 'github-copilot',
-      slug: GITHUB_COPILOT_CONNECTION_SLUG,
-      credentialStore: this.credentialStore,
-      now: this.now,
-      fetchFn: this.fetchFn,
-    });
-  }
-
-  async hasStoredCredential(): Promise<boolean> {
-    return (await this.loadTokens().catch(() => null)) !== null;
-  }
-
-  private async loadTokens(): Promise<OAuthSubscriptionTokens | null> {
-    const raw = await this.credentialStore.getSecret(GITHUB_COPILOT_CONNECTION_SLUG, 'oauth_token');
-    return raw ? parseOAuthSubscriptionTokens(raw) : null;
-  }
-
-  private async saveTokens(tokens: OAuthSubscriptionTokens): Promise<void> {
-    await this.credentialStore.setSecret(
-      GITHUB_COPILOT_CONNECTION_SLUG,
-      'oauth_token',
-      serializeOAuthSubscriptionTokens(tokens),
-    );
-  }
-}
-
-async function resolveGitHubAccountToken(): Promise<string> {
-  for (const name of ['COPILOT_GITHUB_TOKEN', 'GH_TOKEN', 'GITHUB_TOKEN'] as const) {
-    const token = process.env[name]?.trim();
-    if (token) return token;
-  }
-  const result = await execFileAsync('gh', ['auth', 'token'], {
-    encoding: 'utf8',
-    timeout: 10_000,
-    maxBuffer: 64 * 1024,
-  });
-  return result.stdout;
-}
diff --git a/apps/desktop/src/main/runtime-host-account-connection.ts b/apps/desktop/src/main/runtime-host-account-connection.ts
index f561dee5a9..2df04baba2 100644
--- a/apps/desktop/src/main/runtime-host-account-connection.ts
+++ b/apps/desktop/src/main/runtime-host-account-connection.ts
@@ -18,6 +18,7 @@
  */
 
 import {
+  classifyConnectionModelInventory,
   PROVIDER_DEFAULTS,
   type ProviderType,
 } from '@maka/core/llm-connections';
@@ -130,7 +131,7 @@ export async function synchronizeRuntimeHostAccountConnectionById(
   const catalog = await client.loadConnectionCatalog();
   if (catalog.defaultTarget !== null) return;
   const updated = findRuntimeHostAccountConnectionById(catalog, connectionId);
-  const modelId = updated?.enabledModelIds[0];
+  const modelId = updated && firstAccountDefaultModelId(updated);
   if (!updated || !modelId) return;
   const selected = await client.setDefaultConnectionTarget(catalog.revision, {
     connectionId: updated.connectionId,
@@ -141,6 +142,28 @@ export async function synchronizeRuntimeHostAccountConnectionById(
   }
 }
 
+/**
+ * The model this account's first default should name.
+ *
+ * An account Connection is created before anyone can ask the account what it
+ * has — the OAuth login path holds no credential at that point — so its enabled
+ * ids start as the provider's curated fallback list, in the order this build
+ * ships them. Taking the first one names a model the account may never serve,
+ * and every later operation that falls back to the default then fails on a
+ * model the user never chose.
+ *
+ * A live response is the better-informed opinion about which of those ids to
+ * open on, so it picks the order. It does not pick the set: an id the response
+ * omitted stays enabled, because a `/models` answer that cannot see a model is
+ * not evidence the account cannot run it (`authorizeConnectionModel`).
+ */
+function firstAccountDefaultModelId(connection: ConnectionCatalogEntry): string | undefined {
+  const enabled = connection.enabledModelIds;
+  if (classifyConnectionModelInventory(connection) !== 'live') return enabled[0];
+  const live = new Set((connection.models ?? []).map(({ id }) => id));
+  return enabled.find((id) => live.has(id)) ?? enabled[0];
+}
+
 export async function setRuntimeHostAccountCredential(
   client: RuntimeHostAccountConnectionClient &
     Pick<DesktopRuntimeHostClient, 'setCredential'>,
diff --git a/apps/desktop/src/main/runtime-host-client.ts b/apps/desktop/src/main/runtime-host-client.ts
index e2ffc31762..5409d245f0 100644
--- a/apps/desktop/src/main/runtime-host-client.ts
+++ b/apps/desktop/src/main/runtime-host-client.ts
@@ -496,6 +496,12 @@ export class DesktopRuntimeHostClient {
     return this.request("oauth.login.cancel", { attemptId });
   }
 
+  queryOAuthEnrollment(
+    provider: OperationInput<"oauth.enrollment.query">["provider"],
+  ): Promise<OperationOutput<"oauth.enrollment.query">> {
+    return this.request("oauth.enrollment.query", { provider });
+  }
+
   async loadSkillCatalog(
     context: SkillCatalogWorkspaceContext,
     view: SkillCatalogView,
diff --git a/apps/desktop/src/main/runtime-host-github-copilot-ipc-main.ts b/apps/desktop/src/main/runtime-host-github-copilot-ipc-main.ts
index d04224cb16..537d9d307a 100644
--- a/apps/desktop/src/main/runtime-host-github-copilot-ipc-main.ts
+++ b/apps/desktop/src/main/runtime-host-github-copilot-ipc-main.ts
@@ -17,18 +17,14 @@
  * under the License.
  */
 
-import type { ModelInfo } from '@maka/core/llm-connections';
-import type { SubscriptionActionResult } from '@maka/core/oauth-subscription';
 import {
-  handleReconnectableRead,
-  type ReconnectableReadIpcMain,
-} from './ipc-reconnect-policy.js';
-import { GitHubCopilotSubscriptionService } from './oauth/github-copilot-subscription-service.js';
+  importGitHubCopilotLocalCredential,
+  type ImportedGitHubCopilotCredential,
+} from './oauth/github-copilot-local-credential.js';
+import type { ReconnectableReadIpcMain } from './ipc-reconnect-policy.js';
+import { INTERACTIVE_OAUTH_CONNECTION_SLUGS } from './oauth-connection-identities.js';
 import {
-  disableRuntimeHostAccountConnection,
   ensureRuntimeHostAccountConnection,
-  findRuntimeHostAccountConnection,
-  runtimeHostAccountCredential,
   setRuntimeHostAccountCredential,
   synchronizeRuntimeHostAccountConnection,
   type RuntimeHostAccountConnectionClient,
@@ -36,18 +32,11 @@ import {
 import type { DesktopRuntimeHostClient } from './runtime-host-client.js';
 
 const PROVIDER = 'github-copilot';
-const CONNECTION_SLUG = 'github-copilot';
+const CONNECTION_SLUG = INTERACTIVE_OAUTH_CONNECTION_SLUGS[PROVIDER];
 
 type GitHubCopilotClient = RuntimeHostAccountConnectionClient &
   Pick<DesktopRuntimeHostClient, 'setCredential'>;
 
-interface ImportedGitHubCopilotCredential {
-  readonly result:
-    | { readonly ok: true; readonly models: ModelInfo[] }
-    | Exclude<SubscriptionActionResult, { ok: true }>;
-  readonly secret?: string;
-}
-
 export interface RuntimeHostGitHubCopilotIpcDeps {
   readonly ipcMain: ReconnectableReadIpcMain;
   readonly client: GitHubCopilotClient;
@@ -55,11 +44,19 @@ export interface RuntimeHostGitHubCopilotIpcDeps {
   readonly importExistingLogin?: () => Promise<ImportedGitHubCopilotCredential>;
 }
 
-/** Keeps local `gh` discovery in Desktop while committing its credential only to the Host vault. */
-export function registerRuntimeHostGitHubCopilotIpc(
-  deps: RuntimeHostGitHubCopilotIpcDeps,
-): void {
-  const importExistingLogin = deps.importExistingLogin ?? importGitHubCopilotCredential;
+/**
+ * Desktop owns exactly one thing for GitHub Copilot: importing a credential
+ * that already exists on this machine (`gh` / a compatible PAT). Interactive
+ * enrollment is not here — the device grant runs through the Host's OAuth
+ * coordinator like every other account login, so there is one authority that
+ * serializes starts, owns supersede and cancellation, keeps the Host resident
+ * while polling, uses the configured network transport, verifies the account
+ * reaches a Copilot model, and commits the credential atomically. Account
+ * state, refresh, and sign-out ride the same shared `github-copilot:*` channels
+ * the coordinator's IPC adapter registers.
+ */
+export function registerRuntimeHostGitHubCopilotIpc(deps: RuntimeHostGitHubCopilotIpcDeps): void {
+  const importExistingLogin = deps.importExistingLogin ?? importGitHubCopilotLocalCredential;
 
   deps.ipcMain.handle('github-copilot:connect-existing-login', async () => {
     const imported = await importExistingLogin();
@@ -72,80 +69,15 @@ export function registerRuntimeHostGitHubCopilotIpc(
         imported.result.models.map(({ id }) => id),
       );
       await setRuntimeHostAccountCredential(deps.client, connection, imported.secret);
-      await synchronizeRuntimeHostAccountConnection(deps.client, PROVIDER).catch(
-        () => undefined,
-      );
+      await synchronizeRuntimeHostAccountConnection(deps.client, PROVIDER).catch(() => undefined);
       deps.emitConnectionListChanged();
       return { ok: true as const };
     } catch {
       return storageFailure('GitHub Copilot login could not be committed to Runtime Host');
     }
   });
-
-  handleReconnectableRead(deps.ipcMain, 'github-copilot:get-account-state', async () => {
-    const connection = findRuntimeHostAccountConnection(
-      await deps.client.loadConnectionCatalog(),
-      PROVIDER,
-    );
-    const credential = connection
-      ? await deps.client.queryCredential(runtimeHostAccountCredential(connection))
-      : null;
-    return {
-      provider: PROVIDER,
-      runtimeState: credential?.configured ? 'authenticated' : 'not_logged_in',
-    } as const;
-  });
-
-  deps.ipcMain.handle('github-copilot:refresh-tokens', async () => {
-    const connection = findRuntimeHostAccountConnection(
-      await deps.client.loadConnectionCatalog(),
-      PROVIDER,
-    );
-    if (!connection) return refreshFailure('GitHub Copilot is not connected');
-    const credential = await deps.client.queryCredential(
-      runtimeHostAccountCredential(connection),
-    );
-    if (!credential?.configured) return refreshFailure('GitHub Copilot is not connected');
-    const refreshed = await deps.client.fetchConnectionModels(connection.connectionId);
-    if (refreshed.kind !== 'committed') {
-      return refreshFailure(`GitHub Copilot refresh failed: ${refreshed.kind}`);
-    }
-    deps.emitConnectionListChanged();
-    return { ok: true as const };
-  });
-
-  deps.ipcMain.handle('github-copilot:logout', async () => {
-    try {
-      await disableRuntimeHostAccountConnection(deps.client, PROVIDER);
-    } catch {
-      return storageFailure('GitHub Copilot account could not be removed from Runtime Host');
-    }
-    deps.emitConnectionListChanged();
-    return { ok: true as const };
-  });
-}
-
-async function importGitHubCopilotCredential(): Promise<ImportedGitHubCopilotCredential> {
-  let secret: string | undefined;
-  const service = new GitHubCopilotSubscriptionService({
-    credentialStore: {
-      getSecret: async () => secret ?? null,
-      setSecret: async (_slug, _kind, value) => {
-        secret = value;
-      },
-      deleteSecret: async () => {
-        secret = undefined;
-      },
-    },
-  });
-  const result = await service.connectExistingLogin();
-  return { result, ...(result.ok && secret ? { secret } : {}) };
 }
 
 function storageFailure(message: string) {
   return { ok: false as const, reason: 'storage_failed' as const, message };
 }
-
-function refreshFailure(message: string) {
-  return { ok: false as const, reason: 'refresh_failed' as const, message };
-}
diff --git a/apps/desktop/src/main/runtime-host-oauth-ipc-main.ts b/apps/desktop/src/main/runtime-host-oauth-ipc-main.ts
index 6fd139b3b3..0d80875891 100644
--- a/apps/desktop/src/main/runtime-host-oauth-ipc-main.ts
+++ b/apps/desktop/src/main/runtime-host-oauth-ipc-main.ts
@@ -23,6 +23,7 @@ import {
   type ConnectionCatalogEntry,
 } from '@maka/core/runtime-policy';
 import { isOAuthEnrollmentProviderEnabled } from '@maka/runtime/oauth-provider-contracts';
+import { RuntimeHostOperationError } from '@maka/runtime-host/client';
 import {
   OAUTH_LOGIN_PROVIDERS,
   type OAuthConnectionIdentity,
@@ -54,6 +55,7 @@ const SHARED_OAUTH_IPC_OPERATIONS = [
   'complete-authorization',
   'cancel-authorization',
   'get-account-state',
+  'get-enrollment-state',
   'refresh-tokens',
   'logout',
 ] as const;
@@ -67,6 +69,7 @@ export const RUNTIME_HOST_OAUTH_IPC_CHANNELS = Object.freeze([
 type OAuthClient = RuntimeHostAccountConnectionClient & Pick<
   DesktopRuntimeHostClient,
   | 'cancelOAuthLogin'
+  | 'queryOAuthEnrollment'
   | 'queryOAuthLogin'
   | 'startOAuthLogin'
 >;
@@ -145,9 +148,26 @@ export function registerRuntimeHostOAuthIpc(deps: RuntimeHostOAuthIpcDeps): void
           error instanceof Error && error.message.trim().length > 0
             ? error.message
             : 'Unable to start OAuth authorization';
-        return actionFailure(detail);
+        // The selected Host refuses an enrollment that install has not opted
+        // into with `operation_unavailable`. Keep that as its own reason so the
+        // renderer can say the path is off rather than that authorization
+        // failed — a remote Host may gate differently from this Desktop process.
+        return actionFailure(
+          detail,
+          error instanceof RuntimeHostOperationError && error.code === 'operation_unavailable'
+            ? 'experimental_disabled'
+            : 'unknown',
+        );
       }
     });
+    handleReconnectableRead(deps.ipcMain, channel('get-enrollment-state'), async () => {
+      // The renderer asks the selected Host whether this provider may enrol, so
+      // it can avoid presenting a primary sign-in that the install refuses. The
+      // authoritative answer is the Host's; the local flag above only fails
+      // fast before a round trip.
+      const enrollment = await deps.client.queryOAuthEnrollment(provider);
+      return { enabled: enrollment.enabled };
+    });
     deps.ipcMain.handle(channel('open-auth-url'), (_event, attemptId: unknown) => {
       return isProviderAttempt(activeAttempts, attemptId, provider)
         ? { ok: true as const }
diff --git a/apps/desktop/src/preload/bridge-contract.d.ts b/apps/desktop/src/preload/bridge-contract.d.ts
index 1525a4c34e..bbdb80cad2 100644
--- a/apps/desktop/src/preload/bridge-contract.d.ts
+++ b/apps/desktop/src/preload/bridge-contract.d.ts
@@ -1498,6 +1498,7 @@ export interface MakaBridge {
         }
       | Exclude<SubscriptionActionResult, { readonly ok: true }>
     >;
+    getEnrollmentState(host?: DesktopRuntimeHostRef): Promise<{ enabled: boolean }>;
     refreshTokens(host: DesktopRuntimeHostRef | undefined, connectionId: string): Promise<SubscriptionActionResult>;
     logout(host: DesktopRuntimeHostRef | undefined, connectionId: string): Promise<SubscriptionActionResult>;
   };
@@ -1520,18 +1521,46 @@ export interface MakaBridge {
         }
       | Exclude<SubscriptionActionResult, { readonly ok: true }>
     >;
+    getEnrollmentState(host?: DesktopRuntimeHostRef): Promise<{ enabled: boolean }>;
     refreshTokens(host: DesktopRuntimeHostRef | undefined, connectionId: string): Promise<SubscriptionActionResult>;
     logout(host: DesktopRuntimeHostRef | undefined, connectionId: string): Promise<SubscriptionActionResult>;
   };
   githubCopilotSubscription: {
     connectExistingLogin(host?: DesktopRuntimeHostRef): Promise<SubscriptionActionResult>;
-    getAccountState(host?: DesktopRuntimeHostRef): Promise<{
-      provider: 'github-copilot';
-      runtimeState: 'not_logged_in' | 'authenticated' | 'refreshing' | 'refresh_failed' | 'storage_failed';
-      errorMessage?: string;
-    }>;
-    refreshTokens(host?: DesktopRuntimeHostRef): Promise<SubscriptionActionResult>;
-    logout(host?: DesktopRuntimeHostRef): Promise<SubscriptionActionResult>;
+    isExperimentalEnabled(host?: DesktopRuntimeHostRef): Promise<boolean>;
+    getAuthUrl(
+      host: DesktopRuntimeHostRef | undefined,
+      target: DesktopOAuthLoginTarget,
+    ): Promise<DesktopOAuthAuthorizationStartResult>;
+    openAuthUrl(
+      authRequestId: string,
+      host?: DesktopRuntimeHostRef,
+    ): Promise<SubscriptionActionResult>;
+    completeAuthorization(
+      authRequestId: string,
+      host?: DesktopRuntimeHostRef,
+    ): Promise<DesktopOAuthAuthorizationResult>;
+    cancelAuthorization(
+      authRequestId?: string,
+      host?: DesktopRuntimeHostRef,
+    ): Promise<{ ok: true }>;
+    getAccountState(host: DesktopRuntimeHostRef | undefined, connectionId: string): Promise<
+      | {
+          provider: 'github-copilot';
+          runtimeState:
+            | 'not_logged_in'
+            | 'authorizing'
+            | 'authenticated'
+            | 'refreshing'
+            | 'refresh_failed'
+            | 'storage_failed';
+          errorMessage?: string;
+        }
+      | Exclude<SubscriptionActionResult, { readonly ok: true }>
+    >;
+    getEnrollmentState(host?: DesktopRuntimeHostRef): Promise<{ enabled: boolean }>;
+    refreshTokens(host: DesktopRuntimeHostRef | undefined, connectionId: string): Promise<SubscriptionActionResult>;
+    logout(host: DesktopRuntimeHostRef | undefined, connectionId: string): Promise<SubscriptionActionResult>;
   };
   scheduledTasks: {
     list(host?: DesktopRuntimeHostRef): Promise<ScheduledTask[]>;
diff --git a/apps/desktop/src/preload/preload.ts b/apps/desktop/src/preload/preload.ts
index 5a64dd317a..2ef012cbd0 100644
--- a/apps/desktop/src/preload/preload.ts
+++ b/apps/desktop/src/preload/preload.ts
@@ -2853,6 +2853,9 @@ const makaBridge = {
     }> {
       return invokeSelectedRuntimeHost(host, 'openai-codex:get-account-state', connectionId);
     },
+    getEnrollmentState(host?: DesktopRuntimeHostRef): Promise<{ enabled: boolean }> {
+      return invokeSelectedRuntimeHost(host, 'openai-codex:get-enrollment-state');
+    },
     refreshTokens(host: DesktopRuntimeHostRef | undefined, connectionId: string): Promise<SubscriptionActionResult> {
       return invokeSelectedRuntimeHost(host, 'openai-codex:refresh-tokens', connectionId);
     },
@@ -2886,6 +2889,9 @@ const makaBridge = {
     }> {
       return invokeSelectedRuntimeHost(host, 'xai-oauth:get-account-state', connectionId);
     },
+    getEnrollmentState(host?: DesktopRuntimeHostRef): Promise<{ enabled: boolean }> {
+      return invokeSelectedRuntimeHost(host, 'xai-oauth:get-enrollment-state');
+    },
     refreshTokens(host: DesktopRuntimeHostRef | undefined, connectionId: string): Promise<SubscriptionActionResult> {
       return invokeSelectedRuntimeHost(host, 'xai-oauth:refresh-tokens', connectionId);
     },
@@ -2897,18 +2903,36 @@ const makaBridge = {
     connectExistingLogin(host?: DesktopRuntimeHostRef): Promise<SubscriptionActionResult> {
       return invokeSelectedRuntimeHost(host, 'github-copilot:connect-existing-login');
     },
-    getAccountState(host?: DesktopRuntimeHostRef): Promise<{
+    isExperimentalEnabled(host?: DesktopRuntimeHostRef): Promise<boolean> {
+      return invokeSelectedRuntimeHost(host, 'github-copilot:is-experimental-enabled');
+    },
+    getAuthUrl(host: DesktopRuntimeHostRef | undefined, target: DesktopOAuthLoginTarget) {
+      return invokeSelectedRuntimeHost(host, 'github-copilot:get-auth-url', target);
+    },
+    openAuthUrl(authRequestId: string, host?: DesktopRuntimeHostRef): Promise<SubscriptionActionResult> {
+      return invokeSelectedRuntimeHost(host, 'github-copilot:open-auth-url', authRequestId);
+    },
+    completeAuthorization(authRequestId: string, host?: DesktopRuntimeHostRef): Promise<DesktopOAuthAuthorizationResult> {
+      return invokeSelectedRuntimeHost(host, 'github-copilot:complete-authorization', authRequestId);
+    },
+    cancelAuthorization(authRequestId?: string, host?: DesktopRuntimeHostRef): Promise<{ ok: true }> {
+      return invokeSelectedRuntimeHost(host, 'github-copilot:cancel-authorization', authRequestId);
+    },
+    getAccountState(host: DesktopRuntimeHostRef | undefined, connectionId: string): Promise<{
       provider: 'github-copilot';
-      runtimeState: 'not_logged_in' | 'authenticated' | 'refreshing' | 'refresh_failed' | 'storage_failed';
+      runtimeState: 'not_logged_in' | 'authorizing' | 'authenticated' | 'refreshing' | 'refresh_failed' | 'storage_failed';
       errorMessage?: string;
     }> {
-      return invokeSelectedRuntimeHost(host, 'github-copilot:get-account-state');
+      return invokeSelectedRuntimeHost(host, 'github-copilot:get-account-state', connectionId);
+    },
+    getEnrollmentState(host?: DesktopRuntimeHostRef): Promise<{ enabled: boolean }> {
+      return invokeSelectedRuntimeHost(host, 'github-copilot:get-enrollment-state');
     },
-    refreshTokens(host?: DesktopRuntimeHostRef): Promise<SubscriptionActionResult> {
-      return invokeSelectedRuntimeHost(host, 'github-copilot:refresh-tokens');
+    refreshTokens(host: DesktopRuntimeHostRef | undefined, connectionId: string): Promise<SubscriptionActionResult> {
+      return invokeSelectedRuntimeHost(host, 'github-copilot:refresh-tokens', connectionId);
     },
-    logout(host?: DesktopRuntimeHostRef): Promise<SubscriptionActionResult> {
-      return invokeSelectedRuntimeHost(host, 'github-copilot:logout');
+    logout(host: DesktopRuntimeHostRef | undefined, connectionId: string): Promise<SubscriptionActionResult> {
+      return invokeSelectedRuntimeHost(host, 'github-copilot:logout', connectionId);
     },
   },
   scheduledTasks: {
diff --git a/apps/desktop/src/renderer/locales/settings-provider-copy.ts b/apps/desktop/src/renderer/locales/settings-provider-copy.ts
index c2ad504ded..cc8ee53af5 100644
--- a/apps/desktop/src/renderer/locales/settings-provider-copy.ts
+++ b/apps/desktop/src/renderer/locales/settings-provider-copy.ts
@@ -126,10 +126,8 @@ const zhCopy = {
     endpointCredentialsMasked: '已保存的地址内嵌凭据,编辑时默认隐藏',
     modelManagement: '模型',
     disconnectAndDelete: '退出账号并删除',
-    copilotImportFailed: '导入 GitHub Copilot 登录失败', copilotLoggedIn: 'GitHub Copilot 已登录', copilotWaiting: '等待兼容 GitHub 凭据',
-    copilotLoggedInDetail: '若账号或组织策略变化，可重新导入兼容凭据。', copilotWaitingDetail: '配置具有 Copilot Requests 权限的凭据后从本机安全导入。',
-    reimport: '重新导入', importCredential: '导入兼容凭据', login: '登录', loggingIn: '登录中…', relogin: '重新登录',
-    oauthReloginDetail: '若请求提示需要重新登录，点这里重新走一遍授权。',
+    login: '登录', loggingIn: '登录中…', relogin: '重新登录',
+    oauthReloginDetail: '若请求提示需要重新登录，点这里重新走一遍授权。', deviceCode: '登录码：',
     oauthStartDetail: '点下方按钮打开浏览器完成登录，授权成功后会自动刷新这里的状态。',
     enabledModels: '启用的模型',
     searchModels: '搜索模型', selectAllModels: '全部启用',
@@ -224,8 +222,10 @@ const zhCopy = {
     codexDetail: '点击下方按钮打开设备授权页，并在页面中输入这里显示的登录码。', xaiDetail: '点击下方按钮打开浏览器登录，授权完成后会自动回写。', deviceCode: '登录码：',
     openingBrowser: '打开浏览器…', waitingAuthorization: '等待浏览器授权…', logout: '退出登录', loggingOut: '退出中…',
     copilotSubtitle: '导入兼容的 GitHub 登录；token 不会暴露给渲染进程。', copilotImported: '已导入 GitHub Copilot 订阅账号。',
-    copilotSetup: '请配置具有 Copilot Requests 权限的 fine-grained PAT；普通 gh auth login 可能不包含该权限。', importing: '导入中…',
-    reimport: '重新导入', importCredential: '导入兼容凭据', verifying: '验证中…', reverify: '重新验证', removing: '移除中…', removeLocal: '移除本地登录',
+    copilotSetup: '使用 GitHub 登录以连接 Copilot，或导入已有的 gh 凭据。', importing: '导入中…',
+    copilotSignIn: '使用 GitHub 登录', copilotActionFailed: 'GitHub Copilot 账号操作失败',
+    copilotSignInDisabledHint: '本机未启用 GitHub 登录；请改用导入兼容凭据，或由管理员启用后重试。',
+    importCredential: '导入兼容凭据',
     loadingAccount: '正在加载账号状态…', authorizing: '请在弹出的浏览器窗口完成登录。', refreshing: '正在刷新访问令牌…', refreshTokenFailed: '令牌刷新失败，请重新登录。',
     cardAria: (intent: 'add' | 'import' | 'manage', name: string, status: string | undefined, description: string) => `${intent === 'add' ? '添加' : intent === 'import' ? '导入' : '管理'}账号连接：${name}${status ? `，状态：${status}` : ''}，${description.replace(/[。.!！？?]+$/u, '')}`,
     connectTitle: (name: string) => `连接 ${name}`, addAccountTitle: (name: string) => `添加 ${name} 账号`, login: (name: string) => `登录 ${name}`, loginAndAdd: '登录并添加', signedOut: (name: string) => `${name} 尚未登录。`,
@@ -282,10 +282,8 @@ const enCopy: ProviderSettingsCopy = {
     endpointCredentialsMasked: 'The saved URL embeds credentials and stays masked while editing',
     modelManagement: 'Models',
     disconnectAndDelete: 'Sign out and delete',
-    copilotImportFailed: 'Failed to import GitHub Copilot sign-in', copilotLoggedIn: 'GitHub Copilot signed in', copilotWaiting: 'Waiting for compatible GitHub credentials',
-    copilotLoggedInDetail: 'Reimport compatible credentials if the account or organization policy changes.', copilotWaitingDetail: 'Configure credentials with Copilot Requests permission, then import them securely from this device.',
-    reimport: 'Reimport', importCredential: 'Import compatible credentials', login: 'Sign in', loggingIn: 'Signing in…', relogin: 'Sign in again',
-    oauthReloginDetail: 'If a request asks you to sign in again, restart authorization here.',
+    login: 'Sign in', loggingIn: 'Signing in…', relogin: 'Sign in again',
+    oauthReloginDetail: 'If a request asks you to sign in again, restart authorization here.', deviceCode: 'Sign-in code:',
     oauthStartDetail: 'Open the browser below to sign in. This status refreshes automatically after authorization.',
     enabledModels: 'Enabled models',
     searchModels: 'Search models', selectAllModels: 'Enable all',
@@ -380,8 +378,10 @@ const enCopy: ProviderSettingsCopy = {
     codexDetail: 'Open the device page below and enter the sign-in code shown here.', xaiDetail: 'Open the browser below to sign in. Authorization is written back automatically.', deviceCode: 'Sign-in code:',
     openingBrowser: 'Opening browser…', waitingAuthorization: 'Waiting for browser authorization…', logout: 'Sign out', loggingOut: 'Signing out…',
     copilotSubtitle: 'Import a compatible GitHub sign-in. The token is never exposed to the renderer.', copilotImported: 'GitHub Copilot subscription account imported.',
-    copilotSetup: 'Configure a fine-grained PAT with Copilot Requests permission. A normal gh auth login may not include it.', importing: 'Importing…',
-    reimport: 'Reimport', importCredential: 'Import compatible credentials', verifying: 'Verifying…', reverify: 'Verify again', removing: 'Removing…', removeLocal: 'Remove local sign-in',
+    copilotSetup: 'Sign in with GitHub to connect Copilot, or import an existing gh credential.', importing: 'Importing…',
+    copilotSignIn: 'Sign in with GitHub', copilotActionFailed: 'GitHub Copilot account action failed',
+    copilotSignInDisabledHint: 'GitHub sign-in is not enabled on this install. Import a compatible credential instead, or ask an operator to enable it.',
+    importCredential: 'Import compatible credentials',
     loadingAccount: 'Loading account status…', authorizing: 'Complete sign-in in the browser window.', refreshing: 'Refreshing access token…', refreshTokenFailed: 'Token refresh failed. Sign in again.',
     cardAria: (intent: 'add' | 'import' | 'manage', name: string, status: string | undefined, description: string) => `${intent === 'add' ? 'Add' : intent === 'import' ? 'Import' : 'Manage'} account connection: ${name}${status ? `; status: ${status}` : ''}; ${description.replace(/[。.!！？?]+$/u, '')}`,
     connectTitle: (name: string) => `Connect ${name}`, addAccountTitle: (name: string) => `Add ${name} account`, login: (name: string) => `Sign in to ${name}`, loginAndAdd: 'Sign in and add', signedOut: (name: string) => `${name} is signed out.`,
diff --git a/apps/desktop/src/renderer/settings/provider-connection-detail.tsx b/apps/desktop/src/renderer/settings/provider-connection-detail.tsx
index c3d69a8627..0aa9eb1565 100644
--- a/apps/desktop/src/renderer/settings/provider-connection-detail.tsx
+++ b/apps/desktop/src/renderer/settings/provider-connection-detail.tsx
@@ -56,11 +56,9 @@ import { getProviderSettingsCopy } from '../locales/settings-provider-copy';
 import { providerDisplay } from './provider-display';
 import { AddModelDialog } from './provider-add-model-dialog';
 import { EnabledModelManager } from './provider-enabled-model-manager';
-import { useActionGuard } from './use-action-guard';
 import {
   RuntimeHostSettingsGenerationBoundary,
   useRuntimeHostSettingsErrorReporter,
-  useRuntimeHostSettingsTarget,
 } from './runtime-host-settings-target.js';
 import { useOAuthLoginFlow } from './use-oauth-login-flow';
 import {
@@ -170,7 +168,6 @@ function ConnectionDetailInner(props: ConnectionDetailProps) {
     supportsApiKey,
     needsOAuth,
     retired,
-    usesGitHubCopilotLogin,
     oauthLoginService,
     supportsRemoteDiscovery,
     credentialProbePending,
@@ -408,8 +405,6 @@ function ConnectionDetailInner(props: ConnectionDetailProps) {
         {needsOAuth && (
           retired ? (
             <Banner status="error" role="alert" title={copy.oauthRetired} description={copy.oauthRetiredDetail} />
-          ) : usesGitHubCopilotLogin ? (
-            <GitHubCopilotReloginNotice hasSecret={hasSecret} onRelogin={refreshAfterRelogin} />
           ) : oauthLoginService ? (
             <OAuthReloginNotice
               service={oauthLoginService}
@@ -1020,70 +1015,6 @@ function connectionIssueStatus(tone: StatusSemantic): 'error' | 'success' | 'inf
   return 'info';
 }
 
-function GitHubCopilotReloginNotice(props: {
-  hasSecret: CredentialPresenceStatus;
-  onRelogin(): Promise<void>;
-}) {
-  return (
-    <RuntimeHostSettingsGenerationBoundary>
-      <GitHubCopilotReloginNoticeForCurrentGeneration {...props} />
-    </RuntimeHostSettingsGenerationBoundary>
-  );
-}
-
-function GitHubCopilotReloginNoticeForCurrentGeneration(props: {
-  hasSecret: CredentialPresenceStatus;
-  onRelogin(): Promise<void>;
-}) {
-  const host = useRuntimeHostSettingsTarget();
-  const locale = useUiLocale();
-  const copy = getProviderSettingsCopy(locale).detail;
-  // connectGuard stays: it survives this component's renders and is the
-  // cross-render "one connect at a time" record. The `busy` state it used to
-  // mirror is gone — one button, so clickAction's own disable and spinner are
-  // the whole visible story.
-  const connectGuard = useActionGuard<'connect'>();
-  const mountedRef = useMountedRef();
-  const reportHostError = useRuntimeHostSettingsErrorReporter();
-  const loggedIn = props.hasSecret === true;
-  const loading = props.hasSecret === 'loading';
-
-  async function connect() {
-    if (!connectGuard.begin('connect')) return;
-    try {
-      const result = await window.maka.githubCopilotSubscription.connectExistingLogin(host);
-      // A same-key Runtime Host replacement remounts this controller through
-      // the generation boundary above. The old import cannot report into, or
-      // refresh, the connection detail now owned by the replacement Host.
-      if (!mountedRef.current) return;
-      if (!result.ok) {
-        reportHostError(copy.copilotImportFailed, result.message);
-        return;
-      }
-      await props.onRelogin();
-    } catch (error) {
-      if (mountedRef.current) {
-        reportHostError(
-          copy.copilotImportFailed,
-          providerPanelActionErrorMessage(error, locale),
-        );
-      }
-    } finally {
-      connectGuard.finish();
-    }
-  }
-
-  return (
-    <Banner
-      status="info"
-      title={loggedIn ? copy.copilotLoggedIn : loading ? copy.oauthLoading : copy.copilotWaiting}
-      description={loggedIn ? copy.copilotLoggedInDetail : copy.copilotWaitingDetail}
-      endContent={!loading ? (
-          <Button variant="primary" size="sm" clickAction={() => connect()} label={loggedIn ? copy.reimport : copy.importCredential} />
-      ) : undefined} />
-  );
-}
-
 // The OAuth notice for a re-loginable connection. The 重新登录 button drives
 // the SAME shared browser-assisted OAuth flow the catalog cards use, so an
 // expired connection can be re-authorized right where the problem surfaces.
@@ -1135,8 +1066,7 @@ function OAuthReloginNoticeForCurrentGeneration(props: {
       : errored
         ? copy.oauthUnknownDetail
         : copy.oauthStartDetail;
-  // Codex's device page has no code in its URL — the user must type the
-  // code shown here, so hiding it makes the re-login impossible to finish.
+  // Device pages without the code in their URL require the surface to show it.
   const deviceCode = props.service.showsDeviceCode ? flow.stateHint : null;
   return (
     <Banner
diff --git a/apps/desktop/src/renderer/settings/provider-oauth-section.tsx b/apps/desktop/src/renderer/settings/provider-oauth-section.tsx
index d1eb34de33..07c9d96031 100644
--- a/apps/desktop/src/renderer/settings/provider-oauth-section.tsx
+++ b/apps/desktop/src/renderer/settings/provider-oauth-section.tsx
@@ -31,11 +31,13 @@ import { getProviderSettingsCopy, type ProviderSettingsCopy } from '../locales/s
 import {
   useOAuthLoginFlow,
   subscriptionActionErrorMessage,
+  subscriptionResultMessage,
   type OAuthConnectionIdentity,
   type SubscriptionSnapshot,
 } from './use-oauth-login-flow';
 import {
   RuntimeHostSettingsGenerationBoundary,
+  useRuntimeHostSettingsErrorReporter,
   useRuntimeHostSettingsGenerationKey,
   useRuntimeHostSettingsTarget,
 } from './runtime-host-settings-target.js';
@@ -56,17 +58,10 @@ export interface OAuthCard {
   isLoggedIn: boolean;
 }
 
-function emptyOAuthCardStates(): Record<OAuthCardId, SubscriptionSnapshot | null> {
-  return {
-    codex: null,
-    'github-copilot': null,
-    xai: null,
-  };
-}
-
 /**
- * Account enrollment rows for the provider catalog. Codex and xAI are pure
- * add intents; only the singleton Copilot import retains aggregate state.
+ * Account enrollment rows for the provider catalog. Every OAuth provider is
+ * now a connection-scoped add intent, so each row derives its state from the
+ * Connection catalog rather than from a provider-wide account snapshot.
  *
  * This used to be a self-contained `ModelOAuthSection` that rendered both the
  * rows and a Dialog per service. The rows and the login body are now two
@@ -86,13 +81,6 @@ export function useOAuthCards(props: {
   const locale = useUiLocale();
   const copy = getProviderSettingsCopy(locale).oauthSection;
   const cards = modelOAuthCards(copy);
-  const mountedRef = useMountedRef();
-  const refreshTicketRef = useRef(0);
-  // Copilot remains a singleton local import, so its catalog row retains live
-  // account state. Codex and xAI are pure enrollment intents and derive only
-  // their Connection counts from the catalog.
-  const [cardStates, setCardStates] = useState(emptyOAuthCardStates);
-  const [refreshError, setRefreshError] = useState<string | null>(null);
   const normalizedQuery = props.query?.trim().toLocaleLowerCase() ?? '';
 
   function matchesQuery(card: { id: string; name: string; description: string }): boolean {
@@ -101,86 +89,23 @@ export function useOAuthCards(props: {
       .some((value) => value.toLocaleLowerCase().includes(normalizedQuery));
   }
 
-  async function refreshAllCards() {
-    const ticket = refreshTicketRef.current + 1;
-    refreshTicketRef.current = ticket;
-    const results = await Promise.all(
-      cards.filter((card) => card.id === 'github-copilot').map(async (card) => {
-        try {
-          const snapshot = await getSubscriptionSnapshot(card.id, host);
-          return { id: card.id, snapshot } as const;
-        } catch (error) {
-          return { id: card.id, error } as const;
-        }
-      }),
-    );
-    if (!mountedRef.current || refreshTicketRef.current !== ticket) return false;
-    const failures = results.filter((result) => 'error' in result);
-    setCardStates((prev) => {
-      const next = { ...prev };
-      for (const result of results) {
-        if ('snapshot' in result && result.snapshot !== undefined) next[result.id] = result.snapshot;
-      }
-      return next;
-    });
-    if (failures.length > 0) {
-      const firstFailure = failures[0];
-      const error = firstFailure && 'error' in firstFailure ? firstFailure.error : undefined;
-      const message = error
-        ? subscriptionActionErrorMessage(error, locale)
-        : copy.serviceUnavailable;
-      // Reported once, in the Banner above the rows. This refresh runs on
-      // mount, before the user has done anything, so a toast for it would be a
-      // second report of a failure they did not ask for.
-      setRefreshError(message);
-      return false;
-    }
-    setRefreshError(null);
-    return true;
-  }
-
-  useEffect(() => {
-    // A same-key Host replacement keeps the catalog mounted to preserve its
-    // route, query, scroll, and focus. Retire only the account snapshots: the
-    // outer Settings fence may lift before these independent OAuth reads do,
-    // so the previous generation must never remain visible as current state.
-    setCardStates(emptyOAuthCardStates());
-    setRefreshError(null);
-    void refreshAllCards();
-    return () => {
-      refreshTicketRef.current += 1;
-    };
-  }, [generationKey]);
-
   const visibleCards: OAuthCard[] = cards
     .map((card) => {
-      const snapshot = cardStates[card.id];
       const connectionCount = props.connections.filter(
         (connection) => connection.providerType === card.providerType,
       ).length;
-      const runtimeState = snapshot?.runtimeState ?? 'unknown';
-      const isLoggedIn = card.id === 'github-copilot' && (
-        runtimeState === 'authenticated' ||
-        runtimeState === 'refreshing' ||
-        runtimeState === 'quota_unavailable' ||
-        runtimeState === 'provider_rejected'
-      );
+      const isLoggedIn = connectionCount > 0;
       return {
         id: card.id,
         providerType: card.providerType,
         name: card.name,
-        description: card.id !== 'github-copilot' && connectionCount > 0
-          ? copy.configuredConnections(connectionCount)
-          : isLoggedIn && snapshot?.email
-            ? snapshot.email
-            : card.description,
-        ...(isLoggedIn ? { status: copy.signedIn } : {}),
+        description: isLoggedIn ? copy.configuredConnections(connectionCount) : card.description,
         isLoggedIn,
       };
     })
     .filter(matchesQuery);
 
-  return { cards: visibleCards, refreshError };
+  return { cards: visibleCards, refreshError: null as string | null };
 }
 
 /**
@@ -282,61 +207,88 @@ function SubscriptionLoginPanel(props: {
   );
 }
 
-function GitHubCopilotLoginPanel(props: { onLoginSuccess(): void | Promise<void> }) {
+function GitHubCopilotLoginPanel(props: {
+  onLoginSuccess(connection?: OAuthConnectionIdentity): void | Promise<void>;
+}) {
   const host = useRuntimeHostSettingsTarget();
-  const copy = getProviderSettingsCopy(useUiLocale()).oauthSection;
-  // The shared login-flow controller owns the snapshot refresh, the
-  // synchronous one-shot pending guard, and the unmount safety; Copilot
-  // rides it through the direct account flow (one bridge call per action,
-  // no browser handoff, no logout confirm) instead of owning a separate
-  // pending-action state machine here (#1042).
+  const locale = useUiLocale();
+  const copy = getProviderSettingsCopy(locale).oauthSection;
+  const reportHostError = useRuntimeHostSettingsErrorReporter();
+  const mountedRef = useMountedRef();
+  // Copilot now enrolls through the same Host-owned device grant as Codex and
+  // xAI, so it drives the shared browser-assisted controller rather than a
+  // Desktop-owned state machine. Importing a credential this machine already
+  // holds stays available beside it as the secondary route to the same account.
   const flow = useOAuthLoginFlow({
-    mode: 'direct',
-    accountBridge: {
-      getAccountState: () => window.maka.githubCopilotSubscription.getAccountState(host),
-      logout: () => window.maka.githubCopilotSubscription.logout(host),
-    },
+    mode: 'create',
+    authorizationBridge: runtimeHostOAuthAuthorizationBridge(
+      window.maka.githubCopilotSubscription,
+      host,
+      { kind: 'create' },
+    ),
     display: { name: 'GitHub Copilot', shortName: 'GitHub Copilot' },
     onLoginSuccess: props.onLoginSuccess,
-    direct: {
-      login: () => window.maka.githubCopilotSubscription.connectExistingLogin(host),
-      refreshTokens: () => window.maka.githubCopilotSubscription.refreshTokens(host),
-    },
   });
-  const refreshTokens = flow.refreshTokens;
-  const loggedIn = flow.state?.runtimeState === 'authenticated' || flow.state?.runtimeState === 'refreshing';
+  const [importing, setImporting] = useState(false);
+  const actionBusy = flow.actionBusy || importing;
+  // The Host answers whether Copilot may enrol on this install. Until it does
+  // (undefined) sign-in stays offered; once it says no, Import becomes the
+  // primary action — a disabled sign-in is not a working primary button.
+  const enrollmentDisabled = flow.enrollmentEnabled === false;
+
+  const importLocalCredential = async () => {
+    if (actionBusy) return;
+    setImporting(true);
+    try {
+      const result = await window.maka.githubCopilotSubscription.connectExistingLogin(host);
+      if (!mountedRef.current) return;
+      if (!result.ok) {
+        reportHostError(
+          copy.copilotActionFailed,
+          subscriptionResultMessage(result.message, copy.copilotActionFailed, locale, result.reason),
+        );
+        return;
+      }
+      await props.onLoginSuccess();
+    } catch (error) {
+      if (mountedRef.current) {
+        reportHostError(copy.copilotActionFailed, subscriptionActionErrorMessage(error, locale));
+      }
+    } finally {
+      if (mountedRef.current) setImporting(false);
+    }
+  };
+
   return (
     <VStack gap={3} data-status={flow.runtimeState}>
-      <Text type="body">
-        {loggedIn
-          ? copy.copilotImported
-          : flow.state?.runtimeState === 'refresh_failed' || flow.state?.runtimeState === 'storage_failed'
-            ? flow.state.errorMessage
-            : copy.copilotSetup}
-      </Text>
+      <Text type="body">{copy.copilotSetup}</Text>
+      {flow.authRequestId && (
+        <Text type="supporting" color="secondary" role="status" aria-live="polite" data-testid="github-copilot-device-code">
+          {flow.stateHint ? <>{copy.deviceCode} {flow.stateHint}</> : copy.waitingAuthorization}
+        </Text>
+      )}
+      {flow.errorMessage && <Banner status="error" role="alert" title={flow.errorMessage} />}
       <HStack gap={2} hAlign="end">
-        <Button variant="primary" onClick={() => void flow.startLogin()} isDisabled={flow.actionBusy} label={flow.pendingAction === 'login' ? copy.importing : loggedIn ? copy.reimport : copy.importCredential} />
-        {loggedIn && (
-          <>
-            <Button variant="secondary" onClick={() => void refreshTokens?.()} isDisabled={flow.actionBusy} label={flow.pendingAction === 'refresh' ? copy.verifying : copy.reverify} />
-            <Button variant="ghost" onClick={() => void flow.logout?.()} isDisabled={flow.actionBusy} label={flow.pendingAction === 'logout' ? copy.removing : copy.removeLocal} />
-          </>
-        )}
+        <Button
+          variant={enrollmentDisabled ? 'secondary' : 'primary'}
+          onClick={() => void flow.startLogin()}
+          isDisabled={actionBusy || enrollmentDisabled}
+          tooltip={enrollmentDisabled ? copy.copilotSignInDisabledHint : undefined}
+          label={flow.pendingAction === 'login'
+            ? flow.authRequestId ? copy.waitingAuthorization : copy.openingBrowser
+            : copy.copilotSignIn}
+        />
+        <Button
+          variant={enrollmentDisabled ? 'primary' : 'secondary'}
+          onClick={() => void importLocalCredential()}
+          isDisabled={actionBusy}
+          label={importing ? copy.importing : copy.importCredential}
+        />
       </HStack>
     </VStack>
   );
 }
 
-async function getSubscriptionSnapshot(
-  serviceId: OAuthCardId,
-  host: DesktopRuntimeHostRef,
-): Promise<SubscriptionSnapshot> {
-  if (serviceId === 'github-copilot') {
-    return window.maka.githubCopilotSubscription.getAccountState(host);
-  }
-  throw new Error(`Aggregate OAuth state is not available for ${serviceId}`);
-}
-
 interface SubscriptionDisplay {
   name: string;
   shortName: string;
diff --git a/apps/desktop/src/renderer/settings/runtime-host-settings-bridge.ts b/apps/desktop/src/renderer/settings/runtime-host-settings-bridge.ts
index 041bd4d09c..da7bc5eef2 100644
--- a/apps/desktop/src/renderer/settings/runtime-host-settings-bridge.ts
+++ b/apps/desktop/src/renderer/settings/runtime-host-settings-bridge.ts
@@ -53,7 +53,10 @@ export function runtimeHostConnectionsBridge(
   };
 }
 
-type RuntimeHostOAuthBridge = MakaBridge['openAiCodex'] | MakaBridge['xaiOAuth'];
+type RuntimeHostOAuthBridge =
+  | MakaBridge['openAiCodex']
+  | MakaBridge['xaiOAuth']
+  | MakaBridge['githubCopilotSubscription'];
 
 export function runtimeHostOAuthAuthorizationBridge(
   bridge: RuntimeHostOAuthBridge,
@@ -65,6 +68,9 @@ export function runtimeHostOAuthAuthorizationBridge(
     openAuthUrl: (authRequestId) => bridge.openAuthUrl(authRequestId, host),
     completeAuthorization: (authRequestId) => bridge.completeAuthorization(authRequestId, host),
     cancelAuthorization: (authRequestId) => bridge.cancelAuthorization(authRequestId, host),
+    // Whether this provider may enrol on the selected Host is the Host's
+    // answer, so the surface asks it rather than keeping a second local copy.
+    getEnrollmentState: () => bridge.getEnrollmentState(host),
   };
 }
 
diff --git a/apps/desktop/src/renderer/settings/use-connection-detail.ts b/apps/desktop/src/renderer/settings/use-connection-detail.ts
index 8e24f0ac8e..bc70c81d79 100644
--- a/apps/desktop/src/renderer/settings/use-connection-detail.ts
+++ b/apps/desktop/src/renderer/settings/use-connection-detail.ts
@@ -78,10 +78,7 @@ export interface OAuthLoginService {
   authorizationBridge: OAuthAuthorizationFlowBridge;
   accountBridge: OAuthAccountFlowBridge;
   display: { name: string; shortName: string };
-  // Codex's device-authorization page requires the user to type the code the
-  // flow surfaces as `stateHint` — the verification URL does not embed it, so
-  // the notice must show it or the login cannot be completed. xAI's page
-  // needs no manual code, mirroring the catalog panel's `!isXai` guard.
+  // OAuth device pages that require manual code entry expose it as stateHint.
   showsDeviceCode: boolean;
 }
 
@@ -112,6 +109,19 @@ export function oauthLoginServiceFor(
         display: { name: connectionLabel ?? 'xAI Grok', shortName: 'SuperGrok / X Premium' },
         showsDeviceCode: false,
       };
+    // Copilot re-login is the same Host-owned device grant the catalog drives;
+    // importing a local `gh` credential stays a catalog action, so an expired
+    // connection is re-authorized here exactly like every other OAuth account.
+    case 'github-copilot':
+      return {
+        ...runtimeHostOAuthExistingLoginBridges(
+          window.maka.githubCopilotSubscription,
+          host,
+          connectionId,
+        ),
+        display: { name: connectionLabel ?? 'GitHub Copilot', shortName: 'GitHub Copilot' },
+        showsDeviceCode: true,
+      };
     default:
       return null;
   }
@@ -186,7 +196,6 @@ export function useConnectionDetail(props: ConnectionDetailProps) {
         `${connection.name} · ${connection.slug}`,
       )
     : null;
-  const usesGitHubCopilotLogin = connection.providerType === 'github-copilot';
   const supportsRemoteDiscovery = providerSupportsModelDiscovery(connection.providerType);
   const requiresCredential = providerAuthRequiresSecret(connection.providerType);
   const probesCredential = supportsApiKey || needsOAuth;
@@ -842,7 +851,6 @@ export function useConnectionDetail(props: ConnectionDetailProps) {
     supportsApiKey,
     needsOAuth,
     retired,
-    usesGitHubCopilotLogin,
     oauthLoginService,
     supportsRemoteDiscovery,
     credentialProbePending,
diff --git a/apps/desktop/src/renderer/settings/use-oauth-login-flow.ts b/apps/desktop/src/renderer/settings/use-oauth-login-flow.ts
index 42ab18ee47..3f6cda2ee5 100644
--- a/apps/desktop/src/renderer/settings/use-oauth-login-flow.ts
+++ b/apps/desktop/src/renderer/settings/use-oauth-login-flow.ts
@@ -78,6 +78,8 @@ export interface OAuthAuthorizationFlowBridge {
     | { ok: false; reason: string; message: string }
   >;
   cancelAuthorization(authRequestId?: string): Promise<{ ok: true }>;
+  // The selected Host's answer to whether this provider may enrol at all.
+  getEnrollmentState(): Promise<{ enabled: boolean }>;
 }
 
 export interface OAuthAccountFlowBridge {
@@ -115,6 +117,10 @@ export interface OAuthLoginFlowController {
   stateHint: string | null;
   errorMessage: string | null;
   actionBusy: boolean;
+  // The Host's answer to whether this provider may begin an interactive login.
+  // Undefined until the probe resolves; surfaces read unknown as enabled so a
+  // slow Host never hides an action that would in fact succeed.
+  enrollmentEnabled: boolean | undefined;
   startLogin(): Promise<void>;
   logout: (() => Promise<void>) | undefined;
   refresh(): Promise<boolean>;
@@ -160,6 +166,7 @@ export function useOAuthLoginFlow(params: OAuthLoginFlowParams): OAuthLoginFlowC
   const [stateHint, setStateHint] = useState<string | null>(null);
   const [pendingAction, setPendingAction] = useState<OAuthLoginPendingAction | null>(null);
   const [errorMessage, setErrorMessage] = useState<string | null>(null);
+  const [enrollmentEnabled, setEnrollmentEnabled] = useState<boolean | undefined>(undefined);
   const pendingGuard = useRef(createOneShotActionGuard<OAuthLoginPendingAction>()).current;
   const authRequestIdRef = useRef<string | null>(null);
   const oauthLoginFlowMountedRef = useMountedRef();
@@ -183,6 +190,14 @@ export function useOAuthLoginFlow(params: OAuthLoginFlowParams): OAuthLoginFlowC
 
   useEffect(() => {
     if (accountBridge) void refresh();
+    // Ask the Host whether this provider may enrol. A probe failure leaves the
+    // answer unknown, which surfaces read as enabled rather than hiding sign-in.
+    void authorizationBridge
+      ?.getEnrollmentState()
+      .then((result) => {
+        if (oauthLoginFlowMountedRef.current) setEnrollmentEnabled(result.enabled);
+      })
+      .catch(() => undefined);
     return () => {
       pendingGuard.finish();
       if (authorizationBridge) {
@@ -242,7 +257,7 @@ export function useOAuthLoginFlow(params: OAuthLoginFlowParams): OAuthLoginFlowC
       const payload = await authorizationBridge.getAuthUrl();
       if ('ok' in payload) {
         if (!oauthLoginFlowMountedRef.current) return;
-        const failureMessage = payload.ok ? copy.retry : subscriptionResultMessage(payload.message, copy.startFailedRetry, locale);
+        const failureMessage = payload.ok ? copy.retry : subscriptionResultMessage(payload.message, copy.startFailedRetry, locale, payload.reason);
         reportHostError(copy.startFailed, failureMessage);
         setErrorMessage(failureMessage);
         return;
@@ -258,7 +273,7 @@ export function useOAuthLoginFlow(params: OAuthLoginFlowParams): OAuthLoginFlowC
       const opened = await authorizationBridge.openAuthUrl(payload.authRequestId);
       if (!oauthLoginFlowMountedRef.current) return;
       if (!opened.ok) {
-        const message = subscriptionResultMessage(opened.message, copy.openFailedRetry, locale);
+        const message = subscriptionResultMessage(opened.message, copy.openFailedRetry, locale, opened.reason);
         reportHostError(copy.openFailed, message);
         setErrorMessage(message);
         void authorizationBridge.cancelAuthorization(payload.authRequestId);
@@ -281,7 +296,7 @@ export function useOAuthLoginFlow(params: OAuthLoginFlowParams): OAuthLoginFlowC
         if (!oauthLoginFlowMountedRef.current) return;
         if (params.onLoginSuccess) await params.onLoginSuccess(result.connection);
       } else {
-        const message = subscriptionResultMessage(result.message, copy.incompleteRetry, locale);
+        const message = subscriptionResultMessage(result.message, copy.incompleteRetry, locale, result.reason);
         reportHostError(copy.incomplete, message);
         setErrorMessage(message);
       }
@@ -395,6 +410,7 @@ export function useOAuthLoginFlow(params: OAuthLoginFlowParams): OAuthLoginFlowC
     stateHint,
     errorMessage,
     actionBusy,
+    enrollmentEnabled,
     startLogin,
     logout: accountBridge ? logout : undefined,
     refresh,
@@ -411,8 +427,17 @@ export function subscriptionActionErrorMessage(error: unknown, locale: UiLocale
   return subscriptionResultMessage(message, getProviderSettingsCopy(locale).oauthFlow.serviceUnavailable, locale);
 }
 
-export function subscriptionResultMessage(message: string | undefined, fallback: string, locale: UiLocale = 'zh'): string {
+export function subscriptionResultMessage(message: string | undefined, fallback: string, locale: UiLocale = 'zh', reason?: string): string {
   const raw = redactSecrets(message ?? '').trim();
+  // The Host refuses an enrollment this install has not opted into and says so
+  // with a typed reason. Read the reason, not the English message: a reworded
+  // string or an added locale must not silently disable this branch. The
+  // message match stays only as a fallback for callers without a typed reason.
+  if (reason === 'experimental_disabled' || /enrollment is disabled for this provider/i.test(raw)) {
+    return locale === 'zh'
+      ? '本机未启用该账号登录方式；可改用导入兼容凭据，或由管理员启用后重试。'
+      : 'This sign-in is not enabled on this install. Import a compatible credential instead, or ask an operator to enable it.';
+  }
   if (!raw) return fallback;
   // Host conflict / supersede copy before the coarse keyword classifier turns
   // "authorization" into a generic 鉴权失败 that does not tell the user what to do.
diff --git a/apps/desktop/stories/settings/provider-settings.stories.tsx b/apps/desktop/stories/settings/provider-settings.stories.tsx
index d8b9b296ec..859be0ee90 100644
--- a/apps/desktop/stories/settings/provider-settings.stories.tsx
+++ b/apps/desktop/stories/settings/provider-settings.stories.tsx
@@ -415,6 +415,7 @@ function xaiDeviceSubscriptionFixture() {
   };
   return {
     getAccountState: async () => ({ provider: 'xai-oauth', runtimeState: 'authorizing' }),
+    getEnrollmentState: async () => ({ enabled: true }),
     getAuthUrl: async () => ({ authRequestId: 'storybook-xai', stateHint: 'ABCD-EFGH', connection }),
     openAuthUrl: async () => ({ ok: true }),
     completeAuthorization: async () => new Promise<never>(() => undefined),
@@ -436,6 +437,7 @@ function browserSubscriptionFixture(state: {
   };
   return {
     getAccountState: async () => state,
+    getEnrollmentState: async () => ({ enabled: true }),
     getAuthUrl: async () => ({ authRequestId: 'storybook-oauth', stateHint: 'storybook', connection }),
     openAuthUrl: async () => ({ ok: true }),
     completeAuthorization: async () => {
diff --git a/apps/desktop/stories/settings/settings-pages.stories.tsx b/apps/desktop/stories/settings/settings-pages.stories.tsx
index 7fcfa3af03..a5a03bc24a 100644
--- a/apps/desktop/stories/settings/settings-pages.stories.tsx
+++ b/apps/desktop/stories/settings/settings-pages.stories.tsx
@@ -796,12 +796,15 @@ const makaBridge = {
       email: 'codex@example.com',
       plan: 'Plus',
     }),
+    getEnrollmentState: async () => ({ enabled: true }),
   },
   githubCopilotSubscription: {
     getAccountState: async () => ({ runtimeState: 'not_logged_in' }),
+    getEnrollmentState: async () => ({ enabled: true }),
   },
   xaiOAuth: {
     getAccountState: async () => ({ runtimeState: 'not_logged_in' }),
+    getEnrollmentState: async () => ({ enabled: true }),
   },
   app: {
     info: async () => ({
@@ -969,9 +972,9 @@ let generationStoryCopilotEmail = 'old-generation@example.com';
 let generationStoryCopilotAccountReads = 0;
 let generationStoryOpenedAuthIds: string[] = [];
 let generationStoryCancelledAuthIds: string[] = [];
-let generationStoryCopilotImportAttempts = 0;
+let generationStoryCopilotLoginAttempts = 0;
 let generationStoryCopilotSecretReads = 0;
-let generationStoryCopilotImportResolve:
+let generationStoryCopilotLoginResolve:
   | ((result: { ok: true }) => void)
   | undefined;
 let generationStoryProfileListener:
@@ -988,9 +991,9 @@ function resetGenerationStoryBridge(
   generationStoryCopilotAccountReads = 0;
   generationStoryOpenedAuthIds = [];
   generationStoryCancelledAuthIds = [];
-  generationStoryCopilotImportAttempts = 0;
+  generationStoryCopilotLoginAttempts = 0;
   generationStoryCopilotSecretReads = 0;
-  generationStoryCopilotImportResolve = undefined;
+  generationStoryCopilotLoginResolve = undefined;
   generationStoryProfileListener = undefined;
 }
 
@@ -1077,7 +1080,7 @@ const withModelsOAuthAuthorizationGenerationBridge = withScopedMakaBridge({
   },
 } satisfies Record<string, unknown>);
 
-const withModelsCopilotReimportGenerationBridge = withScopedMakaBridge({
+const withModelsCopilotReloginGenerationBridge = withScopedMakaBridge({
   ...makaBridge,
   runtimeHostProfiles: generationStoryRuntimeHostProfilesBridge,
   connections: {
@@ -1094,15 +1097,28 @@ const withModelsCopilotReimportGenerationBridge = withScopedMakaBridge({
   },
   githubCopilotSubscription: {
     ...makaBridge.githubCopilotSubscription,
-    connectExistingLogin: () => {
-      generationStoryCopilotImportAttempts += 1;
-      if (generationStoryCopilotImportAttempts > 1) {
+    getAccountState: async () => ({ runtimeState: 'authenticated' as const }),
+    getAuthUrl: async () => {
+      generationStoryCopilotLoginAttempts += 1;
+      return {
+        authRequestId: `copilot-from-generation-${generationStoryCopilotLoginAttempts}`,
+        stateHint: 'GEN1-CODE',
+      };
+    },
+    openAuthUrl: async () => ({ ok: true as const }),
+    // The Host polls GitHub for the whole device window, so the first attempt
+    // stays unsettled until this story releases it — after the replacement Host
+    // has already taken over.
+    completeAuthorization: () => {
+      if (generationStoryCopilotLoginAttempts > 1) {
         return Promise.resolve({ ok: true as const });
       }
       return new Promise<{ ok: true }>((resolve) => {
-        generationStoryCopilotImportResolve = resolve;
+        generationStoryCopilotLoginResolve = resolve;
       });
     },
+    cancelAuthorization: async () => ({ ok: true as const }),
+    logout: async () => ({ ok: true as const }),
   },
 } satisfies Record<string, unknown>);
 
@@ -2363,12 +2379,14 @@ export const ModelsOAuthAuthorizationHostGenerationRevalidation: Story = {
   },
 };
 
-// The connection-detail Copilot import owns an action guard and a late
+// The connection-detail Copilot sign-in owns an action guard and a late
 // success callback independently of the catalog login panel. A same-key Host
 // replacement retires that controller without throwing away the detail route
-// or its surrounding Settings state.
-export const ModelsCopilotReimportHostGenerationRevalidation: Story = {
-  decorators: [withModelsCopilotReimportGenerationBridge],
+// or its surrounding Settings state. The detail surface offers the device
+// sign-in rather than a local import: the Host owns enrollment, and Desktop
+// discovers an existing credential from the catalog panel instead.
+export const ModelsCopilotReloginHostGenerationRevalidation: Story = {
+  decorators: [withModelsCopilotReloginGenerationBridge],
   render: () => {
     resetGenerationStoryBridge();
     return (
@@ -2381,11 +2399,11 @@ export const ModelsCopilotReimportHostGenerationRevalidation: Story = {
   },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    const firstImport = await canvas.findByRole('button', { name: '重新导入' });
-    await userEvent.click(firstImport);
+    const firstLogin = await canvas.findByRole('button', { name: '重新登录' });
+    await userEvent.click(firstLogin);
     await waitForStoryCondition(
-      () => generationStoryCopilotImportAttempts === 1,
-      'GitHub Copilot reimport did not start',
+      () => generationStoryCopilotLoginAttempts === 1,
+      'GitHub Copilot sign-in did not start',
     );
 
     const listener = generationStoryProfileListener;
@@ -2402,22 +2420,22 @@ export const ModelsCopilotReimportHostGenerationRevalidation: Story = {
     });
 
     await waitForStoryCondition(
-      () => canvas.queryByRole('button', { name: '重新导入' })?.hasAttribute('disabled') === false,
-      'Replacement Host kept the previous generation import guard',
+      () => canvas.queryByRole('button', { name: '重新登录' })?.hasAttribute('disabled') === false,
+      'Replacement Host kept the previous generation sign-in guard',
     );
     const readsAfterReplacement = generationStoryCopilotSecretReads;
-    generationStoryCopilotImportResolve?.({ ok: true });
+    generationStoryCopilotLoginResolve?.({ ok: true });
     await new Promise((resolve) => globalThis.setTimeout(resolve, 50));
     await expect(generationStoryCopilotSecretReads).toBe(readsAfterReplacement);
 
-    await userEvent.click(canvas.getByRole('button', { name: '重新导入' }));
+    await userEvent.click(canvas.getByRole('button', { name: '重新登录' }));
     await waitForStoryCondition(
-      () => generationStoryCopilotImportAttempts === 2,
-      'Replacement Host could not start a fresh GitHub Copilot reimport',
+      () => generationStoryCopilotLoginAttempts === 2,
+      'Replacement Host could not start a fresh GitHub Copilot sign-in',
     );
     await waitForStoryCondition(
       () => generationStoryCopilotSecretReads > readsAfterReplacement,
-      'Replacement Host reimport did not refresh the current credential state',
+      'Replacement Host sign-in did not refresh the current credential state',
     );
     await expect(
       canvasElement.querySelector('[data-maka-contract="connection-detail"]'),
diff --git a/docs/github-copilot-oauth-identity.md b/docs/github-copilot-oauth-identity.md
new file mode 100644
index 0000000000..8e9ee82687
--- /dev/null
+++ b/docs/github-copilot-oauth-identity.md
@@ -0,0 +1,79 @@
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one
+  or more contributor license agreements.  See the NOTICE file
+  distributed with this work for additional information
+  regarding copyright ownership.  The ASF licenses this file
+  to you under the Apache License, Version 2.0 (the
+  "License"); you may not use this file except in compliance
+  with the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing,
+  software distributed under the License is distributed on an
+  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+  KIND, either express or implied.  See the License for the
+  specific language governing permissions and limitations
+  under the License.
+-->
+
+# GitHub Copilot OAuth app identity
+
+Records where the GitHub Copilot device-flow client identity comes from, whose
+consent screen a user sees, and what authorization basis Maka has for using it.
+This exists because Maka does not own that identity.
+
+## The identity
+
+- Client ID: `Iv1.b507a08c87ecfe98`
+- Declared in: `packages/runtime/src/oauth-provider-contracts.ts`
+  (`OAUTH_PROVIDER_CONTRACTS['github-copilot'].clientId`)
+- Endpoints: `https://github.com/login/device/code`,
+  `https://github.com/login/oauth/access_token`
+- Requested scope: `read:user`
+
+## Source
+
+The identity is GitHub's own Copilot editor/CLI OAuth app. It is embedded in
+GitHub's first-party editor integrations and is widely reused by third-party
+Copilot clients; Maka did not obtain it from GitHub through any registration or
+grant of its own.
+
+Maka already presents the matching editor compatibility headers
+(`GITHUB_COPILOT_COMPAT_HEADERS` in `packages/runtime/src/subscription-credentials.ts`)
+when calling the Copilot API, for the same reason: Copilot entitlement is
+granted to editor clients, not to arbitrary OAuth apps.
+
+## Consent identity
+
+The user is shown GitHub's device-authorization screen naming **that editor
+application**, not Maka. Maka then receives and stores the resulting GitHub
+user token in the Workspace vault. The application a user believes they
+authorized and the application that holds the credential are therefore not the
+same.
+
+## Authorization basis
+
+**Not established.** There is no published GitHub authorization, compatibility
+statement, or exemption permitting third-party reuse of this identity, and none
+has been requested. Reuse rests only on the observation that other clients do
+the same.
+
+Because that basis is missing, the interactive device flow does not ship on:
+
+- The sign-in is **off by default**, per install. An operator opts in by setting
+  `MAKA_GITHUB_COPILOT_DEVICE_LOGIN_EXPERIMENTAL=1`; anything else leaves the
+  Host refusing `oauth.login.start` for this provider
+  (`isOAuthEnrollmentProviderEnabled` in
+  `packages/runtime/src/oauth-provider-contracts.ts`). The flag records an
+  operator's decision to accept the consent mismatch above for their own
+  install. It is not the authorization basis, and turning it on does not create
+  one.
+- Importing a credential the user already holds locally (`gh auth token` or a
+  fine-grained PAT with Copilot Requests permission) needs no opt-in and stays
+  available beside it. That credential is issued to an identity the user chose,
+  so it raises none of the questions above and is the supported default route.
+- Resolving this entry requires either a public GitHub authorization or
+  compatibility basis for reusing this identity — linked from this file — or an
+  OAuth app identity registered to and authorized for Maka, replacing the client
+  ID above. Only then should the sign-in default to on.
diff --git a/package-lock.json b/package-lock.json
index bb1e604af8..51a9c3e2b9 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -24,7 +24,7 @@
       "devDependencies": {
         "@ai-sdk/provider-utils": "5.0.28",
         "@astryxdesign/cli": "0.4.5",
-        "@astryxdesign/core": "0.5.0",
+        "@astryxdesign/core": "^0.5.0",
         "@babel/parser": "7.29.7",
         "@biomejs/biome": "2.5.9",
         "@electron/asar": "4.3.0",
@@ -1094,9 +1094,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT OR Apache-2.0",
       "optional": true,
       "os": [
@@ -1114,9 +1111,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT OR Apache-2.0",
       "optional": true,
       "os": [
@@ -1134,9 +1128,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT OR Apache-2.0",
       "optional": true,
       "os": [
@@ -1154,9 +1145,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT OR Apache-2.0",
       "optional": true,
       "os": [
@@ -3172,9 +3160,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3189,9 +3174,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3206,9 +3188,6 @@
         "ppc64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3223,9 +3202,6 @@
         "riscv64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3240,9 +3216,6 @@
         "riscv64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3257,9 +3230,6 @@
         "s390x"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3274,9 +3244,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3291,9 +3258,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3596,9 +3560,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3616,9 +3577,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3636,9 +3594,6 @@
         "ppc64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3656,9 +3611,6 @@
         "s390x"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3676,9 +3628,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3696,9 +3645,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -9669,9 +9615,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -9689,9 +9632,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -9709,9 +9649,6 @@
         "ppc64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -9729,9 +9666,6 @@
         "riscv64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -9749,9 +9683,6 @@
         "riscv64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -9769,9 +9700,6 @@
         "s390x"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -9789,9 +9717,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -9809,9 +9734,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -10091,9 +10013,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -10115,9 +10034,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -10139,9 +10055,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -10163,9 +10076,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -13042,9 +12952,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -13059,9 +12966,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -13076,9 +12980,6 @@
         "ppc64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -13093,9 +12994,6 @@
         "riscv64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -13110,9 +13008,6 @@
         "riscv64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -13127,9 +13022,6 @@
         "s390x"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -13144,9 +13036,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -13161,9 +13050,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
diff --git a/package.json b/package.json
index 6125bccec8..57934350ae 100644
--- a/package.json
+++ b/package.json
@@ -99,12 +99,12 @@
     "smoke:windows:dist": "node scripts/windows-smoke.mjs"
   },
   "devDependencies": {
-    "@babel/parser": "7.29.7",
     "@ai-sdk/provider-utils": "5.0.28",
-    "@electron/asar": "4.3.0",
     "@astryxdesign/cli": "0.4.5",
-    "@astryxdesign/core": "0.5.0",
+    "@astryxdesign/core": "^0.5.0",
+    "@babel/parser": "7.29.7",
     "@biomejs/biome": "2.5.9",
+    "@electron/asar": "4.3.0",
     "@types/node": "^26.2.0",
     "esbuild": "^0.28.1",
     "knip": "^6.32.2",
diff --git a/packages/core/src/llm-connections.ts b/packages/core/src/llm-connections.ts
index a7445bd091..a904a28938 100644
--- a/packages/core/src/llm-connections.ts
+++ b/packages/core/src/llm-connections.ts
@@ -563,7 +563,10 @@ export function deriveConnectionSlug(
   }
 }
 
-export type InteractiveOAuthProviderType = Extract<ProviderType, 'openai-codex' | 'xai-oauth'>;
+export type InteractiveOAuthProviderType = Extract<
+  ProviderType,
+  'openai-codex' | 'xai-oauth' | 'github-copilot'
+>;
 
 /** Stable human-facing slug base for one interactive OAuth Connection. */
 export function interactiveOAuthConnectionSlugBase(
@@ -574,6 +577,10 @@ export function interactiveOAuthConnectionSlugBase(
       return 'codex-subscription';
     case 'xai-oauth':
       return 'xai-oauth';
+    // Shared with the local `gh` credential import so both routes to a Copilot
+    // account land on one Connection instead of two.
+    case 'github-copilot':
+      return 'github-copilot';
   }
 }
 
diff --git a/packages/runtime-host/src/__tests__/host-kernel.test.ts b/packages/runtime-host/src/__tests__/host-kernel.test.ts
index 4be6c3ea39..e589b82a68 100644
--- a/packages/runtime-host/src/__tests__/host-kernel.test.ts
+++ b/packages/runtime-host/src/__tests__/host-kernel.test.ts
@@ -2134,8 +2134,11 @@ describe('non-serving Runtime Host kernel', () => {
           { sessionId: 'late-session' },
           50,
         );
-        await lateEntered;
-        await assert.rejects(
+        // Claim the rejection before awaiting anything else. The deadline above
+        // is shorter than the gate below can take to open on a loaded machine,
+        // so attaching the handler later leaves a window where the timeout is
+        // an unhandled rejection and fails the test on timing alone.
+        const locallyTimedRejected = assert.rejects(
           locallyTimed,
           (error: unknown) =>
             error instanceof RuntimeHostRequestInterruptedError &&
@@ -2144,6 +2147,8 @@ describe('non-serving Runtime Host kernel', () => {
             error.cause instanceof RuntimeHostTransportError &&
             error.cause.code === 'read_timeout',
         );
+        await lateEntered;
+        await locallyTimedRejected;
         assert.equal(
           (await connected.connection.status()).hostEpoch,
           connected.connection.hostEpoch,
diff --git a/packages/runtime-host/src/__tests__/oauth-coordinator.test.ts b/packages/runtime-host/src/__tests__/oauth-coordinator.test.ts
index 69e222d419..062e875ff4 100644
--- a/packages/runtime-host/src/__tests__/oauth-coordinator.test.ts
+++ b/packages/runtime-host/src/__tests__/oauth-coordinator.test.ts
@@ -25,6 +25,10 @@ import { join } from 'node:path';
 import { test } from 'node:test';
 import type { ConnectionCatalogEntry } from '@maka/core/runtime-policy';
 import { OAuthDeviceAuthorizationExpiredError } from '@maka/runtime/oauth-provider-contracts';
+import {
+  GitHubCopilotEntitlementError,
+  GitHubCopilotEntitlementUnavailableError,
+} from '@maka/runtime/github-copilot-oauth-enrollment';
 import {
   parseOAuthSubscriptionTokens,
   type OAuthSubscriptionTokens,
@@ -805,6 +809,205 @@ test('OAuth login rejects an experimentally disabled provider before presentatio
   }
 });
 
+test('GitHub Copilot enrollment runs its device grant on the Host, not in a Client', async () => {
+  await withFixture('github-copilot', async (fixture) => {
+    const presentationCalls: string[] = [];
+    const client = await attachPresentation(
+      fixture.capabilities,
+      'client-copilot',
+      presentationCalls,
+    );
+    const tokens = tokenFixture('gho_account_token', {
+      base_url: 'https://api.githubcopilot.com',
+    });
+    let polls = 0;
+    const entitlementChecks: string[] = [];
+    const coordinator = new HostOAuthCoordinator({
+      runtimePolicy: fixture.stores,
+      activation: fixture.activation,
+      clientCapabilities: fixture.capabilities,
+      isProviderEnabled: () => true,
+      acquireResidency: fixture.acquireResidency,
+      invalidateBackends: async () => {
+        fixture.invalidations += 1;
+      },
+      onFatal: (error) => {
+        throw error;
+      },
+      now: () => NOW,
+      startGitHubCopilotAuthorization: async () => ({
+        deviceCode: 'host-only-device-code',
+        userCode: 'ABCD-1234',
+        verificationUrl: 'https://github.com/login/device',
+        expiresAt: NOW + 900_000,
+        intervalMs: 5_000,
+      }),
+      pollGitHubCopilotAuthorization: async () => {
+        polls += 1;
+        return tokens;
+      },
+      verifyGitHubCopilotEntitlement: async (input) => {
+        entitlementChecks.push(input.tokens.access_token);
+      },
+    });
+
+    const started = await coordinator.handlers['oauth.login.start'](
+      oauthStart('attempt-copilot', fixture.connection.connectionId),
+      operationContext('client-copilot', fixture.acquireResidency),
+    );
+    assert.equal(started.ok, true);
+    const terminal = await waitForTerminal(coordinator, 'attempt-copilot');
+    assert.equal(terminal.phase, 'authenticated');
+    assert.equal(terminal.connection.providerType, 'github-copilot');
+    // The one-time code reaches the user through the Host's presentation seam,
+    // so no Client ever holds the grant or the credential it produces.
+    assert.deepEqual(presentationCalls, ['client-copilot']);
+    assert.equal(polls, 1);
+    // The account was adopted only after the provider confirmed it reaches a model.
+    assert.deepEqual(entitlementChecks, ['gho_account_token']);
+    assert.equal(fixture.invalidations, 1);
+    await coordinator.close();
+    client.close();
+  });
+});
+
+test('GitHub Copilot enrollment refuses an account that reaches no Copilot model', async () => {
+  await withFixture('github-copilot', async (fixture) => {
+    const client = await attachPresentation(fixture.capabilities, 'client-copilot-entitlement', []);
+    const coordinator = new HostOAuthCoordinator({
+      runtimePolicy: fixture.stores,
+      activation: fixture.activation,
+      clientCapabilities: fixture.capabilities,
+      isProviderEnabled: () => true,
+      acquireResidency: fixture.acquireResidency,
+      invalidateBackends: async () => {
+        fixture.invalidations += 1;
+      },
+      onFatal: (error) => {
+        throw error;
+      },
+      now: () => NOW,
+      startGitHubCopilotAuthorization: async () => ({
+        deviceCode: 'host-only-device-code',
+        userCode: 'ABCD-1234',
+        verificationUrl: 'https://github.com/login/device',
+        expiresAt: NOW + 900_000,
+        intervalMs: 5_000,
+      }),
+      pollGitHubCopilotAuthorization: async () =>
+        tokenFixture('gho_account_token', { base_url: 'https://api.githubcopilot.com' }),
+      // A GitHub account without a live Copilot subscription authorizes the
+      // grant and then reaches nothing.
+      verifyGitHubCopilotEntitlement: async () => {
+        throw new GitHubCopilotEntitlementError();
+      },
+    });
+
+    const started = await coordinator.handlers['oauth.login.start'](
+      oauthStart('attempt-copilot-entitlement', fixture.connection.connectionId),
+      operationContext('client-copilot-entitlement', fixture.acquireResidency),
+    );
+    assert.equal(started.ok, true);
+    const terminal = await waitForTerminal(coordinator, 'attempt-copilot-entitlement');
+    assert.equal(terminal.phase, 'failed');
+    // The account is what was refused, not the authorization the user completed.
+    assert.equal(terminal.failure, 'provider_rejected');
+    // Nothing was adopted: no credential, no backend invalidation, no residency.
+    const resolved = await fixture.stores.operations.resolveExecutionConnection({
+      kind: 'catalog_slug',
+      connectionSlug: fixture.connection.slug,
+    });
+    assert.equal(
+      resolved.kind === 'ready' ? resolved.secretMaterial.connection : undefined,
+      undefined,
+    );
+    assert.equal(fixture.invalidations, 0);
+    assert.equal(fixture.activeResidencies, 0);
+    await coordinator.close();
+    client.close();
+  });
+});
+
+test('GitHub Copilot enrollment reports an unanswered entitlement check as retryable', async () => {
+  await withFixture('github-copilot', async (fixture) => {
+    const client = await attachPresentation(fixture.capabilities, 'client-copilot-unavailable', []);
+    const coordinator = new HostOAuthCoordinator({
+      runtimePolicy: fixture.stores,
+      activation: fixture.activation,
+      clientCapabilities: fixture.capabilities,
+      isProviderEnabled: () => true,
+      acquireResidency: fixture.acquireResidency,
+      invalidateBackends: async () => {
+        fixture.invalidations += 1;
+      },
+      onFatal: (error) => {
+        throw error;
+      },
+      now: () => NOW,
+      startGitHubCopilotAuthorization: async () => ({
+        deviceCode: 'host-only-device-code',
+        userCode: 'ABCD-1234',
+        verificationUrl: 'https://github.com/login/device',
+        expiresAt: NOW + 900_000,
+        intervalMs: 5_000,
+      }),
+      pollGitHubCopilotAuthorization: async () =>
+        tokenFixture('gho_account_token', { base_url: 'https://api.githubcopilot.com' }),
+      // The Copilot API never answered — a 429, a 5xx, or a dropped
+      // connection. Nothing was learned about the subscription.
+      verifyGitHubCopilotEntitlement: async () => {
+        throw new GitHubCopilotEntitlementUnavailableError(503);
+      },
+    });
+
+    const started = await coordinator.handlers['oauth.login.start'](
+      oauthStart('attempt-copilot-unavailable', fixture.connection.connectionId),
+      operationContext('client-copilot-unavailable', fixture.acquireResidency),
+    );
+    assert.equal(started.ok, true);
+    const terminal = await waitForTerminal(coordinator, 'attempt-copilot-unavailable');
+    assert.equal(terminal.phase, 'failed');
+    // Not provider_rejected: telling a subscribed user their account is
+    // ineligible sends them after a plan they already have.
+    assert.equal(terminal.failure, 'authorization_failed');
+    assert.equal(fixture.invalidations, 0);
+    assert.equal(fixture.activeResidencies, 0);
+    await coordinator.close();
+    client.close();
+  });
+});
+
+test('OAuth enrollment query reports the Host gate answer per provider', async () => {
+  await withFixture('github-copilot', async (fixture) => {
+    const coordinator = new HostOAuthCoordinator({
+      runtimePolicy: fixture.stores,
+      activation: fixture.activation,
+      clientCapabilities: fixture.capabilities,
+      isProviderEnabled: (candidate) => candidate === 'github-copilot',
+      acquireResidency: fixture.acquireResidency,
+      invalidateBackends: async () => undefined,
+      onFatal: (error) => {
+        throw error;
+      },
+    });
+    assert.deepEqual(
+      await coordinator.handlers['oauth.enrollment.query'](
+        { provider: 'github-copilot' },
+        operationContext('client-enrollment', fixture.acquireResidency),
+      ),
+      { ok: true, result: { provider: 'github-copilot', enabled: true } },
+    );
+    assert.deepEqual(
+      await coordinator.handlers['oauth.enrollment.query'](
+        { provider: 'openai-codex' },
+        operationContext('client-enrollment', fixture.acquireResidency),
+      ),
+      { ok: true, result: { provider: 'openai-codex', enabled: false } },
+    );
+    await coordinator.close();
+  });
+});
+
 test('OAuth credential commit excludes overlapping backend activations in both directions', async () => {
   await withFixture('openai-codex', async (fixture) => {
     const client = await attachPresentation(fixture.capabilities, 'client-activation', []);
@@ -980,7 +1183,7 @@ function operationContext(connectionId: string, acquireResidency: () => { releas
 }
 
 async function withFixture(
-  providerType: 'openai-codex' | 'xai-oauth',
+  providerType: 'openai-codex' | 'xai-oauth' | 'github-copilot',
   run: (fixture: {
     root: string;
     stores: RuntimePolicyStoresWriter;
diff --git a/packages/runtime-host/src/__tests__/oauth-execution-authority.test.ts b/packages/runtime-host/src/__tests__/oauth-execution-authority.test.ts
index d075670942..ec06a9f28d 100644
--- a/packages/runtime-host/src/__tests__/oauth-execution-authority.test.ts
+++ b/packages/runtime-host/src/__tests__/oauth-execution-authority.test.ts
@@ -26,6 +26,7 @@ import { join } from 'node:path';
 import { mock, test } from 'node:test';
 import type { RuntimeExecutionConnection } from '@maka/core/llm-connections';
 import {
+  GITHUB_COPILOT_NON_EXPIRING_AT,
   serializeOAuthSubscriptionTokens,
   type OAuthSubscriptionTokens,
 } from '@maka/runtime/subscription-credentials';
@@ -46,26 +47,56 @@ import {
 const CONNECTION_SLUG = 'host-oauth-execution';
 const MODEL_ID = 'gpt-5';
 const CODEX_TOKEN_ENDPOINT = 'https://auth.openai.com/oauth/token';
+const COPILOT_TOKEN_ENDPOINT = 'https://github.com/login/oauth/access_token';
 const FIXED_NOW = 1_785_600_000_000;
 
 test('one OAuth generation singleflights refresh and persists its lease with canonical CAS', async () => {
-  await withCopilotCredential(expiredTokens('access-v1'), async (fixture) => {
+  await withCopilotCredential(expiredTokens('gho_access_v1'), async (fixture) => {
     const before = fixture.material;
+    let refreshes = 0;
     const binding = fixture.authority.bind({
       providerType: 'github-copilot',
       connectionId: connectionId(before),
       connectionSlug: CONNECTION_SLUG,
       material: before,
-      createRefreshTransport: () => testRefreshTransport(unexpectedFetch),
+      createRefreshTransport: () =>
+        testRefreshTransport(async () => {
+          refreshes += 1;
+          return Response.json({
+            access_token: 'gho_access_v2',
+            refresh_token: 'ghr_renewal_v2',
+            expires_in: 28_800,
+          });
+        }),
     });
 
     const [first, second] = await Promise.all([binding.resolve(), binding.resolve()]);
 
-    assert.deepEqual(first, expiredTokens('access-v1'));
+    // Two resolves, one refresh grant spent: the second rides the first.
+    assert.equal(refreshes, 1);
+    assert.equal(first.access_token, 'gho_access_v2');
+    assert.equal(first.refresh_token, 'ghr_renewal_v2');
     assert.deepEqual(second, first);
     const after = await readMaterial(fixture.stores);
     assert.equal(after.credentialId, before.credentialId);
     assert.equal(after.revision, before.revision + 2);
+    assert.notEqual(after.secret, before.secret);
+  });
+});
+
+test('a GitHub account token with no declared lifetime refreshes without provider I/O', async () => {
+  await withCopilotCredential(nonExpiringCopilotTokens('gho_durable'), async (fixture) => {
+    const before = fixture.material;
+    const binding = fixture.authority.bind({
+      providerType: 'github-copilot',
+      connectionId: connectionId(before),
+      connectionSlug: CONNECTION_SLUG,
+      material: before,
+      createRefreshTransport: () => testRefreshTransport(unexpectedFetch),
+    });
+
+    assert.deepEqual(await binding.resolve(), nonExpiringCopilotTokens('gho_durable'));
+    const after = await readMaterial(fixture.stores);
     assert.equal(after.secret, before.secret);
   });
 });
@@ -424,6 +455,182 @@ test('concurrent forced refreshes join one Host credential refresh', async () =>
   });
 });
 
+test('a GitHub Copilot 401 force-refreshes canonical credentials and replays once', async () => {
+  const staleAccess = 'gho_account_v1';
+  const refreshedAccess = 'gho_account_v2';
+  await withSeededOAuthCredential(
+    'github-copilot',
+    expiringCopilotTokens(staleAccess),
+    async (fixture) => {
+      let refreshCalls = 0;
+      const modelHeaders: Headers[] = [];
+      const providerFetch: typeof fetch = async (url, init) => {
+        if (String(url) === COPILOT_TOKEN_ENDPOINT) {
+          refreshCalls += 1;
+          return Response.json({
+            access_token: refreshedAccess,
+            refresh_token: 'ghr_rotated',
+            expires_in: 28_800,
+          });
+        }
+        modelHeaders.push(new Headers(init?.headers));
+        return modelHeaders.length === 1
+          ? Response.json({ message: 'Bad credentials' }, { status: 401 })
+          : Response.json({ ok: true });
+      };
+      const binding = fixture.authority.bind({
+        providerType: 'github-copilot',
+        connectionId: connectionId(fixture.material),
+        connectionSlug: CONNECTION_SLUG,
+        material: fixture.material,
+        createRefreshTransport: () => testRefreshTransport(providerFetch),
+      });
+      const initialTokens = await binding.resolve();
+      const modelFetch = createHostOAuthModelFetch({
+        binding,
+        initialTokens,
+        connection: {
+          slug: CONNECTION_SLUG,
+          providerType: 'github-copilot',
+          defaultModel: MODEL_ID,
+        },
+        sessionId: 'copilot-401-session',
+        modelId: MODEL_ID,
+        fetchFn: providerFetch,
+      });
+
+      const response = await modelFetch('https://api.githubcopilot.com/chat/completions', {
+        method: 'POST',
+        body: JSON.stringify({ messages: [] }),
+      });
+
+      assert.equal(response.ok, true);
+      assert.equal(refreshCalls, 1);
+      assert.equal(modelHeaders.length, 2);
+      assert.equal(modelHeaders[1]?.get('authorization'), `Bearer ${refreshedAccess}`);
+      // The replay is the same Copilot request, editor headers included.
+      assert.equal(modelHeaders[1]?.get('copilot-integration-id'), 'vscode-chat');
+      const canonical = JSON.parse(
+        (await readMaterial(fixture.stores)).secret,
+      ) as OAuthSubscriptionTokens;
+      assert.equal(canonical.access_token, refreshedAccess);
+      assert.equal(canonical.refresh_token, 'ghr_rotated');
+    },
+  );
+});
+
+test('a caller who cancels during the post-401 refresh is released, not made to wait', async () => {
+  await withSeededOAuthCredential(
+    'github-copilot',
+    expiringCopilotTokens('gho_account_v1'),
+    async (fixture) => {
+      const refreshBlocked = deferred<Response>();
+      let refreshRequests = 0;
+      const modelHeaders: Headers[] = [];
+      const providerFetch: typeof fetch = async (url, init) => {
+        if (String(url) === COPILOT_TOKEN_ENDPOINT) {
+          refreshRequests += 1;
+          return refreshBlocked.promise;
+        }
+        modelHeaders.push(new Headers(init?.headers));
+        return Response.json({ message: 'Bad credentials' }, { status: 401 });
+      };
+      const binding = fixture.authority.bind({
+        providerType: 'github-copilot',
+        connectionId: connectionId(fixture.material),
+        connectionSlug: CONNECTION_SLUG,
+        material: fixture.material,
+        createRefreshTransport: () => testRefreshTransport(providerFetch),
+      });
+      const modelFetch = createHostOAuthModelFetch({
+        binding,
+        initialTokens: await binding.resolve(),
+        connection: {
+          slug: CONNECTION_SLUG,
+          providerType: 'github-copilot',
+          defaultModel: MODEL_ID,
+        },
+        sessionId: 'copilot-401-cancel-session',
+        modelId: MODEL_ID,
+        fetchFn: providerFetch,
+      });
+
+      const controller = new AbortController();
+      const reason = new Error('run stopped');
+      const request = modelFetch('https://api.githubcopilot.com/chat/completions', {
+        method: 'POST',
+        signal: controller.signal,
+        body: JSON.stringify({ messages: [] }),
+      });
+      // Let the 401 land and the refresh begin before the user gives up.
+      await waitFor(() => refreshRequests === 1);
+      controller.abort(reason);
+
+      await assert.rejects(request, (error) => error === reason);
+      // One model request: the replay never went out on a cancelled turn.
+      assert.equal(modelHeaders.length, 1);
+      // The refresh is left to settle rather than stranding a spent grant.
+      refreshBlocked.resolve(
+        Response.json({
+          access_token: 'gho_account_v2',
+          refresh_token: 'ghr_rotated',
+          expires_in: 28_800,
+        }),
+      );
+      await waitFor(async () => {
+        const canonical = JSON.parse(
+          (await readMaterial(fixture.stores)).secret,
+        ) as OAuthSubscriptionTokens;
+        return canonical.access_token === 'gho_account_v2';
+      });
+    },
+  );
+});
+
+test('a GitHub 401 on a non-expiring account token is not replayed with the same token', async () => {
+  await withSeededOAuthCredential(
+    'github-copilot',
+    nonExpiringCopilotTokens('gho_durable'),
+    async (fixture) => {
+      const modelHeaders: Headers[] = [];
+      const providerFetch: typeof fetch = async (url, init) => {
+        // GitHub issues no refresh grant for this record, so any call to the
+        // token endpoint here would be a request that cannot help.
+        assert.notEqual(String(url), COPILOT_TOKEN_ENDPOINT);
+        modelHeaders.push(new Headers(init?.headers));
+        return Response.json({ message: 'Bad credentials' }, { status: 401 });
+      };
+      const binding = fixture.authority.bind({
+        providerType: 'github-copilot',
+        connectionId: connectionId(fixture.material),
+        connectionSlug: CONNECTION_SLUG,
+        material: fixture.material,
+        createRefreshTransport: () => testRefreshTransport(providerFetch),
+      });
+      const modelFetch = createHostOAuthModelFetch({
+        binding,
+        initialTokens: await binding.resolve(),
+        connection: {
+          slug: CONNECTION_SLUG,
+          providerType: 'github-copilot',
+          defaultModel: MODEL_ID,
+        },
+        sessionId: 'copilot-401-durable-session',
+        modelId: MODEL_ID,
+        fetchFn: providerFetch,
+      });
+
+      const response = await modelFetch('https://api.githubcopilot.com/chat/completions', {
+        method: 'POST',
+        body: JSON.stringify({ messages: [] }),
+      });
+
+      assert.equal(response.status, 401);
+      assert.equal(modelHeaders.length, 1);
+    },
+  );
+});
+
 interface CopilotCredentialFixture {
   readonly root: string;
   readonly stores: RuntimePolicyStoresWriter;
@@ -483,7 +690,7 @@ async function withCopilotCredential(
 }
 
 async function withSeededOAuthCredential(
-  providerType: 'openai-codex' | 'openai-codex',
+  providerType: 'openai-codex' | 'github-copilot',
   tokens: OAuthSubscriptionTokens,
   run: (fixture: CopilotCredentialFixture) => Promise<void>,
 ): Promise<void> {
@@ -588,6 +795,25 @@ function currentTokens(accessToken: string, accountUuid?: string): OAuthSubscrip
   };
 }
 
+/** What GitHub returns when its OAuth app issues expiring user tokens. */
+function expiringCopilotTokens(accessToken: string): OAuthSubscriptionTokens {
+  return {
+    access_token: accessToken,
+    refresh_token: `ghr_${accessToken}`,
+    expires_at: FIXED_NOW + 8 * 60 * 60 * 1_000,
+    base_url: 'https://api.githubcopilot.com',
+  };
+}
+
+/** What GitHub returns when its OAuth app does not issue expiring user tokens. */
+function nonExpiringCopilotTokens(accessToken: string): OAuthSubscriptionTokens {
+  return {
+    access_token: accessToken,
+    refresh_token: accessToken,
+    expires_at: GITHUB_COPILOT_NON_EXPIRING_AT,
+  };
+}
+
 function claudeConnection(): RuntimeExecutionConnection {
   return {
     slug: CONNECTION_SLUG,
@@ -672,3 +898,15 @@ const unexpectedFetch: typeof fetch = async () => {
 function testRefreshTransport(fetchFn: typeof fetch): ProxiedFetchTransport {
   return { fetch: fetchFn, close: async () => undefined };
 }
+
+/** Polls until a condition holds, so a test never races a background settle. */
+async function waitFor(
+  predicate: () => boolean | Promise<boolean>,
+  timeoutMs = 2_000,
+): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  while (!(await predicate())) {
+    if (Date.now() >= deadline) throw new Error('Timed out waiting for OAuth execution state');
+    await new Promise((resolve) => setTimeout(resolve, 10));
+  }
+}
diff --git a/packages/runtime-host/src/__tests__/oauth-protocol.test.ts b/packages/runtime-host/src/__tests__/oauth-protocol.test.ts
index 0981c6eade..f51c58d280 100644
--- a/packages/runtime-host/src/__tests__/oauth-protocol.test.ts
+++ b/packages/runtime-host/src/__tests__/oauth-protocol.test.ts
@@ -121,6 +121,46 @@ test('OAuth login protocol binds attempt identity and closes terminal projection
   );
 });
 
+test('OAuth enrollment query carries the provider and its Host gate answer', () => {
+  assert.deepEqual(
+    decodeClientFrame({
+      requestId: 'request',
+      operation: 'oauth.enrollment.query',
+      input: { provider: 'github-copilot' },
+    }),
+    {
+      requestId: 'request',
+      operation: 'oauth.enrollment.query',
+      input: { provider: 'github-copilot' },
+    },
+  );
+  assert.deepEqual(
+    decodeHostFrame({
+      requestId: 'request',
+      operation: 'oauth.enrollment.query',
+      ok: true,
+      result: { provider: 'github-copilot', enabled: false },
+    }),
+    {
+      requestId: 'request',
+      operation: 'oauth.enrollment.query',
+      ok: true,
+      result: { provider: 'github-copilot', enabled: false },
+    },
+  );
+  // A missing or non-boolean `enabled` is refused rather than coerced.
+  assert.throws(
+    () =>
+      decodeHostFrame({
+        requestId: 'request',
+        operation: 'oauth.enrollment.query',
+        ok: true,
+        result: { provider: 'github-copilot' },
+      }),
+    (error: unknown) => error instanceof RuntimeHostProtocolError,
+  );
+});
+
 test('OAuth account usage is no longer an operation on the wire', () => {
   // Reporting subscription usage required the retired provider's own client
   // identity, so the operation went with it rather than staying as a call that
diff --git a/packages/runtime-host/src/__tests__/oauth-two-client-uds.test.ts b/packages/runtime-host/src/__tests__/oauth-two-client-uds.test.ts
index 9e0ad0a09e..435af790b6 100644
--- a/packages/runtime-host/src/__tests__/oauth-two-client-uds.test.ts
+++ b/packages/runtime-host/src/__tests__/oauth-two-client-uds.test.ts
@@ -192,17 +192,21 @@ test('two OAuth creates bind distinct entities and present only on their initiat
   }
 });
 
-test('OAuth enrollment honors the Codex opt-out flag over the real endpoint', {
+test('OAuth enrollment refuses providers this install has not enabled', {
   timeout: 30_000,
 }, async () => {
-  const cases = [['openai-codex', { MAKA_CODEX_SUBSCRIPTION_EXPERIMENTAL: '0' }]] as const;
+  const cases = [
+    ['openai-codex', { MAKA_CODEX_SUBSCRIPTION_EXPERIMENTAL: '0' }],
+    // GitHub Copilot is opt-in: an install that says nothing gets no sign-in.
+    ['github-copilot', {}],
+  ] as const;
   for (const [provider, environment] of cases) {
     await assertProviderDisabledOverUds(provider, environment);
   }
 });
 
 async function assertProviderDisabledOverUds(
-  provider: 'openai-codex',
+  provider: 'openai-codex' | 'github-copilot',
   environment: Readonly<Record<string, string | undefined>>,
 ): Promise<void> {
   const base = await mkdtemp(join(tmpdir(), `maka-oauth-disabled-${provider}-`));
diff --git a/packages/runtime-host/src/__tests__/protocol.test.ts b/packages/runtime-host/src/__tests__/protocol.test.ts
index 2503c28655..a88b06d471 100644
--- a/packages/runtime-host/src/__tests__/protocol.test.ts
+++ b/packages/runtime-host/src/__tests__/protocol.test.ts
@@ -244,6 +244,12 @@ describe('Runtime Host bootstrap protocol', () => {
     assert.ok(RUNTIME_HOST_COMPATIBILITY_EPOCH > 47);
   });
 
+  test('publishes a new compatibility epoch for GitHub Copilot logins', () => {
+    // The epoch on `main` at merge time is the floor; adding the new OAuth
+    // provider and the enrollment query changes the closed wire vocabulary.
+    assert.ok(RUNTIME_HOST_COMPATIBILITY_EPOCH > 79);
+  });
+
   test('publishes a new compatibility epoch for context-budget failure detail', () => {
     // Epoch 50 is already used by WorkHub coordination summaries on main.
     // The context-budget detail therefore needs its own strictly newer
diff --git a/packages/runtime-host/src/protocol/index.ts b/packages/runtime-host/src/protocol/index.ts
index a90738397c..0416dc6c48 100644
--- a/packages/runtime-host/src/protocol/index.ts
+++ b/packages/runtime-host/src/protocol/index.ts
@@ -95,7 +95,11 @@ export const RUNTIME_HOST_REGISTRATION_SCHEMA_VERSION = 1 as const;
 export const RUNTIME_HOST_PROTOCOL_VERSION = 0 as const;
 // Increment when the same protocol version no longer guarantees safe Client-Host
 // interoperability. Mismatches are rejected before domain commands are admitted.
-export const RUNTIME_HOST_COMPATIBILITY_EPOCH = 79 as const;
+export const RUNTIME_HOST_COMPATIBILITY_EPOCH = 80 as const;
+// 80: `github-copilot` joins `OAUTH_LOGIN_PROVIDERS` and the Host answers a
+// closed `oauth.enrollment.query`. An older Host rejects both wire values, so
+// the pair must be refused at the handshake rather than fail mid-flow.
+// Re-derived from `main` on each rebase rather than reserved in advance.
 // 79: Every `turn.message.submit` disposition carries the exact Skill
 // invocation outcome. Durable queued replays may omit the previous Host
 // Epoch's transient queue revision; older strict peers reject either shape.
diff --git a/packages/runtime-host/src/protocol/oauth.ts b/packages/runtime-host/src/protocol/oauth.ts
index 86e2ec55f4..472487fc5c 100644
--- a/packages/runtime-host/src/protocol/oauth.ts
+++ b/packages/runtime-host/src/protocol/oauth.ts
@@ -32,7 +32,7 @@ export const OAUTH_PRESENTATION_SERVICE_ID = 'oauth_presentation';
 export const OAUTH_PRESENTATION_SERVICE_VERSION = '1';
 export const OAUTH_PRESENTATION_URL_MAX_LENGTH = 8_192;
 export const OAUTH_PRESENTATION_STATE_HINT_MAX_LENGTH = 1_024;
-export const OAUTH_LOGIN_PROVIDERS = ['openai-codex', 'xai-oauth'] as const;
+export const OAUTH_LOGIN_PROVIDERS = ['openai-codex', 'xai-oauth', 'github-copilot'] as const;
 export const OAUTH_LOGIN_PHASES = [
   'awaiting_authorization',
   'exchanging',
@@ -90,6 +90,17 @@ export interface OAuthLoginProjection {
   readonly failure?: OAuthLoginFailureCode;
 }
 
+export interface OAuthEnrollmentQueryInput {
+  readonly provider: OAuthLoginProvider;
+}
+
+// The Host is the sole authority on whether a provider may enrol on this
+// install; the renderer asks rather than keeping a second copy of the gate.
+export interface OAuthEnrollmentProjection {
+  readonly provider: OAuthLoginProvider;
+  readonly enabled: boolean;
+}
+
 export interface OAuthLoginStartInput {
   readonly attemptId: string;
   readonly target: OAuthLoginTarget;
@@ -146,6 +157,17 @@ export const OAUTH_OPERATION_SPECS = {
     decodeOutput: decodeOAuthLoginProjection,
     assertOutputForInput: assertOAuthAttemptOutput,
   }),
+  'oauth.enrollment.query': defineOperation<
+    OAuthEnrollmentQueryInput,
+    OAuthEnrollmentProjection,
+    (typeof COMMON_ERRORS)[number]
+  >({
+    mode: 'query',
+    availability: 'ready',
+    errors: COMMON_ERRORS,
+    decodeInput: decodeOAuthEnrollmentQueryInput,
+    decodeOutput: decodeOAuthEnrollmentProjection,
+  }),
 } as const;
 
 export function decodeOAuthLoginStartInput(value: unknown): OAuthLoginStartInput {
@@ -161,6 +183,25 @@ export function decodeOAuthLoginAttemptInput(value: unknown): OAuthLoginAttemptI
   return { attemptId: requireEntityId(input.attemptId, 'attemptId') };
 }
 
+export function decodeOAuthEnrollmentQueryInput(value: unknown): OAuthEnrollmentQueryInput {
+  const input = requireExactRecord(value, 'OAuth enrollment query input', ['provider']);
+  return { provider: oauthLoginProvider(input.provider) };
+}
+
+export function decodeOAuthEnrollmentProjection(value: unknown): OAuthEnrollmentProjection {
+  const projection = requireExactRecord(value, 'OAuth enrollment projection', [
+    'provider',
+    'enabled',
+  ]);
+  if (typeof projection.enabled !== 'boolean') {
+    throw invalidProtocolFrame('Invalid OAuth enrollment projection');
+  }
+  return {
+    provider: oauthLoginProvider(projection.provider),
+    enabled: projection.enabled,
+  };
+}
+
 export function decodeOAuthLoginProjection(value: unknown): OAuthLoginProjection {
   const projection = requireRecord(value, 'OAuth login projection');
   const phase = oauthLoginPhase(projection.phase);
diff --git a/packages/runtime-host/src/protocol/operations.ts b/packages/runtime-host/src/protocol/operations.ts
index 8476927962..758ce0045b 100644
--- a/packages/runtime-host/src/protocol/operations.ts
+++ b/packages/runtime-host/src/protocol/operations.ts
@@ -276,6 +276,7 @@ export const REMOTE_OWNER_OPERATION_GRANTS = Object.freeze([
   'memory.mutate',
   'memory.query',
   'network-proxy.test',
+  'oauth.enrollment.query',
   'oauth.login.cancel',
   'oauth.login.query',
   'oauth.login.start',
diff --git a/packages/runtime-host/src/server/oauth-coordinator.ts b/packages/runtime-host/src/server/oauth-coordinator.ts
index 12e5721b3a..d8997a8df1 100644
--- a/packages/runtime-host/src/server/oauth-coordinator.ts
+++ b/packages/runtime-host/src/server/oauth-coordinator.ts
@@ -25,6 +25,13 @@ import {
   startCodexDeviceAuthorization,
 } from '@maka/runtime/codex-oauth-enrollment';
 import { OAuthDeviceAuthorizationExpiredError } from '@maka/runtime/oauth-provider-contracts';
+import {
+  GitHubCopilotEntitlementError,
+  GitHubCopilotEntitlementUnavailableError,
+  pollGitHubCopilotDeviceAuthorization,
+  startGitHubCopilotDeviceAuthorization,
+  verifyGitHubCopilotModelEntitlement,
+} from '@maka/runtime/github-copilot-oauth-enrollment';
 import {
   pollXaiDeviceAuthorization,
   startXaiDeviceAuthorization,
@@ -83,6 +90,9 @@ export interface HostOAuthCoordinatorInput {
   readonly now?: () => number;
   readonly startXaiAuthorization?: typeof startXaiDeviceAuthorization;
   readonly pollXaiAuthorization?: typeof pollXaiDeviceAuthorization;
+  readonly startGitHubCopilotAuthorization?: typeof startGitHubCopilotDeviceAuthorization;
+  readonly pollGitHubCopilotAuthorization?: typeof pollGitHubCopilotDeviceAuthorization;
+  readonly verifyGitHubCopilotEntitlement?: typeof verifyGitHubCopilotModelEntitlement;
   readonly startCodexAuthorization?: typeof startCodexDeviceAuthorization;
   readonly pollCodexAuthorization?: typeof pollCodexDeviceAuthorization;
   readonly exchangeCodexCode?: typeof exchangeCodexDeviceAuthorizationCode;
@@ -125,6 +135,7 @@ export class HostOAuthCoordinator {
     'oauth.login.start': (input, context) => this.#start(input, context.connectionId),
     'oauth.login.query': (input) => this.#query(input.attemptId),
     'oauth.login.cancel': (input) => this.#cancel(input.attemptId),
+    'oauth.enrollment.query': (input) => this.#enrollment(input.provider),
   };
 
   readonly #runtimePolicy: RuntimePolicyStoresWriter;
@@ -138,6 +149,9 @@ export class HostOAuthCoordinator {
   readonly #now: () => number;
   readonly #startXaiAuthorization: typeof startXaiDeviceAuthorization;
   readonly #pollXaiAuthorization: typeof pollXaiDeviceAuthorization;
+  readonly #startGitHubCopilotAuthorization: typeof startGitHubCopilotDeviceAuthorization;
+  readonly #pollGitHubCopilotAuthorization: typeof pollGitHubCopilotDeviceAuthorization;
+  readonly #verifyGitHubCopilotEntitlement: typeof verifyGitHubCopilotModelEntitlement;
   readonly #startCodexAuthorization: typeof startCodexDeviceAuthorization;
   readonly #pollCodexAuthorization: typeof pollCodexDeviceAuthorization;
   readonly #exchangeCodexCode: typeof exchangeCodexDeviceAuthorizationCode;
@@ -165,6 +179,12 @@ export class HostOAuthCoordinator {
     this.#now = input.now ?? Date.now;
     this.#startXaiAuthorization = input.startXaiAuthorization ?? startXaiDeviceAuthorization;
     this.#pollXaiAuthorization = input.pollXaiAuthorization ?? pollXaiDeviceAuthorization;
+    this.#startGitHubCopilotAuthorization =
+      input.startGitHubCopilotAuthorization ?? startGitHubCopilotDeviceAuthorization;
+    this.#pollGitHubCopilotAuthorization =
+      input.pollGitHubCopilotAuthorization ?? pollGitHubCopilotDeviceAuthorization;
+    this.#verifyGitHubCopilotEntitlement =
+      input.verifyGitHubCopilotEntitlement ?? verifyGitHubCopilotModelEntitlement;
     this.#startCodexAuthorization = input.startCodexAuthorization ?? startCodexDeviceAuthorization;
     this.#pollCodexAuthorization = input.pollCodexAuthorization ?? pollCodexDeviceAuthorization;
     this.#exchangeCodexCode = input.exchangeCodexCode ?? exchangeCodexDeviceAuthorizationCode;
@@ -348,6 +368,16 @@ export class HostOAuthCoordinator {
     return { ok: true, result: projection(attempt) };
   }
 
+  // The Host owns the enrollment gate: whether a provider may begin an
+  // interactive login is this Host's answer, and only the Host has it. Surfaces
+  // read it to avoid presenting a primary action that a default install refuses.
+  #enrollment(provider: OAuthLoginProvider): Promise<OperationOutcome<'oauth.enrollment.query'>> {
+    return Promise.resolve({
+      ok: true,
+      result: { provider, enabled: this.#isProviderEnabled(provider) },
+    });
+  }
+
   #requestCancellation(attempt: ActiveLoginAttempt, reason: Error): void {
     attempt.cancelRequested = true;
     if (attempt.cancellationDeferred) return;
@@ -364,9 +394,8 @@ export class HostOAuthCoordinator {
           attempt.ticket.secretMaterial.networkProxy?.secret,
         ),
       );
-      // Switched rather than defaulted: with the retired provider gone the
-      // union is two wide, and a ternary would route any future third member
-      // into the Codex device flow without a compiler error.
+      // Switched rather than defaulted: routing any future provider into an
+      // unrelated device flow must be a compiler error, not a silent default.
       const tokens = await this.#runProviderLogin(attempt, transport.fetch);
       attempt.abort.signal.throwIfAborted();
       attempt.cancellationDeferred = true;
@@ -452,9 +481,48 @@ export class HostOAuthCoordinator {
         return this.#runXaiLogin(attempt, fetchFn);
       case 'openai-codex':
         return this.#runCodexDeviceLogin(attempt, fetchFn);
+      case 'github-copilot':
+        return this.#runGitHubCopilotLogin(attempt, fetchFn);
     }
   }
 
+  async #runGitHubCopilotLogin(attempt: ActiveLoginAttempt, fetchFn: typeof fetch) {
+    const authorization = await this.#startGitHubCopilotAuthorization({
+      fetchFn,
+      signal: attempt.abort.signal,
+      now: this.#now,
+    });
+    await this.#present(attempt, {
+      method: 'open_external',
+      url: authorization.verificationUrl,
+      stateHint: authorization.userCode,
+    });
+    attempt.phase = 'exchanging';
+    const tokens = await this.#pollGitHubCopilotAuthorization({
+      authorization,
+      fetchFn,
+      signal: attempt.abort.signal,
+      now: this.#now,
+      onPollAdmission: () => {
+        attempt.cancellationDeferred = true;
+      },
+      onPollRetry: () => {
+        attempt.cancellationDeferred = false;
+        if (attempt.cancelRequested) {
+          this.#requestCancellation(
+            attempt,
+            new DOMException('OAuth login cancelled', 'AbortError'),
+          );
+        }
+      },
+    });
+    // A GitHub account is not a Copilot subscription. Adopt the account only
+    // once the provider says it can reach a model, so the commit below never
+    // stores a credential the connection cannot use.
+    await this.#verifyGitHubCopilotEntitlement({ tokens, fetchFn });
+    return tokens;
+  }
+
   async #runXaiLogin(attempt: ActiveLoginAttempt, fetchFn: typeof fetch) {
     const authorization = await this.#startXaiAuthorization({
       fetchFn,
@@ -596,6 +664,13 @@ function sameOAuthLoginTarget(actual: OAuthLoginTarget, expected: OAuthLoginTarg
 function loginFailureCode(error: unknown): OAuthLoginFailureCode {
   if (error instanceof LoginFailure) return error.code;
   if (error instanceof RuntimePolicyStoreError) return 'persistence_failed';
+  // The account authorized the grant and the provider then refused it: the
+  // login worked, the subscription behind it did not.
+  if (error instanceof GitHubCopilotEntitlementError) return 'provider_rejected';
+  // The provider never answered the entitlement question. Nothing is known
+  // about the subscription, so this is a login that did not complete — the
+  // user retries, they do not go looking for a plan they already have.
+  if (error instanceof GitHubCopilotEntitlementUnavailableError) return 'authorization_failed';
   // A local device window that elapsed without approval is a timeout, not
   // a provider rejection of the account.
   if (error instanceof OAuthDeviceAuthorizationExpiredError) return 'authorization_failed';
diff --git a/packages/runtime-host/src/server/oauth-execution-authority.ts b/packages/runtime-host/src/server/oauth-execution-authority.ts
index e5ac20c544..ed1a718af0 100644
--- a/packages/runtime-host/src/server/oauth-execution-authority.ts
+++ b/packages/runtime-host/src/server/oauth-execution-authority.ts
@@ -363,11 +363,23 @@ export function createHostOAuthModelFetch(input: {
       sessionId: input.sessionId,
       modelId: input.modelId,
       fetchFn: authenticatedFetch,
-      ...(input.binding.forceRefresh &&
-      (input.binding.providerType === 'openai-codex' || input.binding.providerType === 'xai-oauth')
+      ...(input.binding.forceRefresh
         ? {
-            refreshOAuthAccessToken: async () =>
-              (tokens = await input.binding.forceRefresh!()).access_token,
+            refreshOAuthAccessToken: async (signal) => {
+              const rejected = tokens.access_token;
+              const refreshing = input.binding.forceRefresh!();
+              // The refresh is left to settle on its own: it may already have
+              // spent the grant, and a CAS-persisted newer generation is worth
+              // keeping even though this request no longer wants it. What the
+              // caller must not do is wait out its timeout after giving up.
+              observeSettled(refreshing);
+              tokens = await waitForCaller(refreshing, signal);
+              // A record with no refresh grant behind it (a GitHub account
+              // token GitHub declared no lifetime for) resolves to the token
+              // the provider just rejected. Replaying it would spend a second
+              // request to be told the same thing.
+              return tokens.access_token === rejected ? null : tokens.access_token;
+            },
           }
         : {}),
     });
@@ -382,6 +394,11 @@ function effectiveRequestSignal(
   return init?.signal !== undefined ? init.signal : url instanceof Request ? url.signal : undefined;
 }
 
+/** Keeps a promise the caller stopped awaiting from surfacing as unhandled. */
+function observeSettled(pending: Promise<unknown>): void {
+  void pending.catch(() => undefined);
+}
+
 async function waitForCaller<T>(pending: Promise<T>, signal?: AbortSignal | null): Promise<T> {
   if (!signal) return pending;
   signal.throwIfAborted();
diff --git a/packages/runtime/package.json b/packages/runtime/package.json
index a5ac78b2e7..97d4daddea 100644
--- a/packages/runtime/package.json
+++ b/packages/runtime/package.json
@@ -53,6 +53,7 @@
     "./conversation-copy": "./dist/conversation-copy.js",
     "./cua-frame-state": "./dist/cua-frame-state.js",
     "./execution-inspect": "./dist/execution-inspect.js",
+    "./github-copilot-oauth-enrollment": "./dist/github-copilot-oauth-enrollment.js",
     "./goal-continuation": "./dist/goal-continuation.js",
     "./goal-evaluator": "./dist/goal-evaluator.js",
     "./goal-state": "./dist/goal-state.js",
diff --git a/packages/runtime/src/__tests__/github-copilot-oauth-enrollment.test.ts b/packages/runtime/src/__tests__/github-copilot-oauth-enrollment.test.ts
new file mode 100644
index 0000000000..4bbdea4e7a
--- /dev/null
+++ b/packages/runtime/src/__tests__/github-copilot-oauth-enrollment.test.ts
@@ -0,0 +1,327 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { OAuthTokenEndpointError } from '../oauth-login.js';
+import { OAuthDeviceAuthorizationExpiredError } from '../oauth-provider-contracts.js';
+import {
+  GitHubCopilotEntitlementError,
+  GitHubCopilotEntitlementUnavailableError,
+  pollGitHubCopilotDeviceAuthorization,
+  startGitHubCopilotDeviceAuthorization,
+  verifyGitHubCopilotModelEntitlement,
+  type GitHubCopilotDeviceAuthorization,
+} from '../github-copilot-oauth-enrollment.js';
+
+const NOW = 1_800_000_000_000;
+
+function authorization(
+  overrides: Partial<GitHubCopilotDeviceAuthorization> = {},
+): GitHubCopilotDeviceAuthorization {
+  return {
+    deviceCode: 'device-code',
+    userCode: 'ABCD-1234',
+    verificationUrl: 'https://github.com/login/device',
+    expiresAt: NOW + 900_000,
+    intervalMs: 5_000,
+    ...overrides,
+  };
+}
+
+const immediateSleep = async () => {};
+
+test('device authorization decodes the GitHub grant and bounds its window', async () => {
+  const requests: Array<{ url: string; body: string }> = [];
+  const fetchFn: typeof fetch = async (url, init) => {
+    requests.push({ url: String(url), body: String(init?.body ?? '') });
+    return Response.json({
+      device_code: 'device-code',
+      user_code: 'ABCD-1234',
+      verification_uri: 'https://github.com/login/device',
+      expires_in: 900,
+      interval: 5,
+      // Additive provider fields must not close the decoder.
+      verification_uri_complete: 'https://github.com/login/device?user_code=ABCD-1234',
+    });
+  };
+
+  const result = await startGitHubCopilotDeviceAuthorization({
+    fetchFn,
+    signal: new AbortController().signal,
+    now: () => NOW,
+  });
+
+  assert.equal(requests.length, 1);
+  assert.equal(requests[0]?.url, 'https://github.com/login/device/code');
+  assert.match(requests[0]?.body ?? '', /client_id=Iv1\.b507a08c87ecfe98/);
+  // Only read:user is requested: the grant must not be able to reach code.
+  assert.match(requests[0]?.body ?? '', /scope=read%3Auser/);
+  assert.deepEqual(result, {
+    deviceCode: 'device-code',
+    userCode: 'ABCD-1234',
+    verificationUrl: 'https://github.com/login/device',
+    expiresAt: NOW + 900_000,
+    intervalMs: 5_000,
+  });
+});
+
+test('device authorization rejects an error body returned with HTTP 200', async () => {
+  const fetchFn: typeof fetch = async () => Response.json({ error: 'unauthorized_client' });
+  await assert.rejects(
+    startGitHubCopilotDeviceAuthorization({
+      fetchFn,
+      signal: new AbortController().signal,
+      now: () => NOW,
+    }),
+    (error: unknown) =>
+      error instanceof OAuthTokenEndpointError && error.category === 'provider_rejected',
+  );
+});
+
+test('device authorization refuses a verification URL outside github.com', async () => {
+  const fetchFn: typeof fetch = async () =>
+    Response.json({
+      device_code: 'device-code',
+      user_code: 'ABCD-1234',
+      verification_uri: 'https://github.com.evil.example/login/device',
+      expires_in: 900,
+    });
+  await assert.rejects(
+    startGitHubCopilotDeviceAuthorization({
+      fetchFn,
+      signal: new AbortController().signal,
+      now: () => NOW,
+    }),
+    (error: unknown) =>
+      error instanceof OAuthTokenEndpointError && error.category === 'invalid_response',
+  );
+});
+
+test('polling treats HTTP 200 authorization_pending and slow_down as retries', async () => {
+  const delays: number[] = [];
+  let polls = 0;
+  const fetchFn: typeof fetch = async () => {
+    polls += 1;
+    if (polls === 1) return Response.json({ error: 'authorization_pending' });
+    if (polls === 2) return Response.json({ error: 'slow_down', interval: 10 });
+    return Response.json({ access_token: 'gho_account_token', token_type: 'bearer' });
+  };
+
+  const tokens = await pollGitHubCopilotDeviceAuthorization({
+    authorization: authorization(),
+    fetchFn,
+    signal: new AbortController().signal,
+    now: () => NOW,
+    sleep: async (delayMs) => {
+      delays.push(delayMs);
+    },
+  });
+
+  assert.equal(polls, 3);
+  // The advertised slow_down interval replaces the previous cadence.
+  assert.deepEqual(delays, [5_000, 5_000, 10_000]);
+  assert.equal(tokens.access_token, 'gho_account_token');
+  assert.equal(tokens.refresh_token, 'gho_account_token');
+  assert.equal(tokens.base_url, 'https://api.githubcopilot.com');
+});
+
+test('polling rejects a token that is not a GitHub account credential', async () => {
+  const fetchFn: typeof fetch = async () => Response.json({ access_token: 'ghp_classic_pat' });
+  await assert.rejects(
+    pollGitHubCopilotDeviceAuthorization({
+      authorization: authorization(),
+      fetchFn,
+      signal: new AbortController().signal,
+      now: () => NOW,
+      sleep: immediateSleep,
+    }),
+    (error: unknown) =>
+      error instanceof OAuthTokenEndpointError && error.category === 'invalid_response',
+  );
+});
+
+test('polling separates a user denial from an elapsed authorization window', async () => {
+  const denied: typeof fetch = async () => Response.json({ error: 'access_denied' });
+  await assert.rejects(
+    pollGitHubCopilotDeviceAuthorization({
+      authorization: authorization(),
+      fetchFn: denied,
+      signal: new AbortController().signal,
+      now: () => NOW,
+      sleep: immediateSleep,
+    }),
+    (error: unknown) =>
+      error instanceof OAuthTokenEndpointError && error.category === 'invalid_grant',
+  );
+
+  const expired: typeof fetch = async () => Response.json({ error: 'expired_token' });
+  await assert.rejects(
+    pollGitHubCopilotDeviceAuthorization({
+      authorization: authorization(),
+      fetchFn: expired,
+      signal: new AbortController().signal,
+      now: () => NOW,
+      sleep: immediateSleep,
+    }),
+    (error: unknown) => error instanceof OAuthDeviceAuthorizationExpiredError,
+  );
+});
+
+test('polling stops before issuing a request once the local window elapsed', async () => {
+  let polls = 0;
+  const fetchFn: typeof fetch = async () => {
+    polls += 1;
+    return Response.json({ access_token: 'gho_account_token' });
+  };
+  await assert.rejects(
+    pollGitHubCopilotDeviceAuthorization({
+      authorization: authorization({ expiresAt: NOW }),
+      fetchFn,
+      signal: new AbortController().signal,
+      now: () => NOW,
+      sleep: immediateSleep,
+    }),
+    (error: unknown) => error instanceof OAuthDeviceAuthorizationExpiredError,
+  );
+  assert.equal(polls, 0);
+});
+
+test('polling records the lifetime GitHub returned instead of a non-expiring token', async () => {
+  const fetchFn: typeof fetch = async () =>
+    Response.json({
+      access_token: 'gho_expiring_token',
+      expires_in: 28_800,
+      refresh_token: 'ghr_renewal_token',
+      refresh_token_expires_in: 15_897_600,
+      token_type: 'bearer',
+    });
+
+  const tokens = await pollGitHubCopilotDeviceAuthorization({
+    authorization: authorization(),
+    fetchFn,
+    signal: new AbortController().signal,
+    now: () => NOW,
+    sleep: immediateSleep,
+  });
+
+  assert.equal(tokens.access_token, 'gho_expiring_token');
+  // The renewal credential must be the refresh token, not a copy of the access
+  // token: without it the connection would die at expiry.
+  assert.equal(tokens.refresh_token, 'ghr_renewal_token');
+  assert.equal(tokens.expires_at, NOW + 28_800_000);
+});
+
+test('polling rejects an expiring grant that carries no refresh token', async () => {
+  const fetchFn: typeof fetch = async () =>
+    Response.json({ access_token: 'gho_expiring_token', expires_in: 28_800 });
+  await assert.rejects(
+    pollGitHubCopilotDeviceAuthorization({
+      authorization: authorization(),
+      fetchFn,
+      signal: new AbortController().signal,
+      now: () => NOW,
+      sleep: immediateSleep,
+    }),
+    (error: unknown) =>
+      error instanceof OAuthTokenEndpointError && error.category === 'invalid_response',
+  );
+});
+
+const ENTITLED_TOKENS = {
+  access_token: 'gho_account_token',
+  refresh_token: 'gho_account_token',
+  expires_at: Number.MAX_SAFE_INTEGER,
+  base_url: 'https://api.githubcopilot.com',
+};
+
+function copilotModelsResponse(models: readonly { id: string }[]): Response {
+  return Response.json({
+    data: models.map((model) => ({
+      ...model,
+      model_picker_enabled: true,
+      supported_endpoints: ['/responses'],
+      policy: { state: 'enabled' },
+      capabilities: {
+        limits: { max_prompt_tokens: 128_000, max_output_tokens: 16_000 },
+        supports: { tool_calls: true },
+      },
+    })),
+  });
+}
+
+test('entitlement accepts an account whose catalog lists a usable model', async () => {
+  await verifyGitHubCopilotModelEntitlement({
+    tokens: ENTITLED_TOKENS,
+    fetchFn: async () => copilotModelsResponse([{ id: 'gpt-5.4' }]),
+  });
+});
+
+test('entitlement refuses an account the provider proved ineligible', async () => {
+  // An empty catalog the account could read, and the two statuses that are the
+  // provider refusing this account rather than failing to answer.
+  const proofs: ReadonlyArray<() => Response> = [
+    () => copilotModelsResponse([]),
+    () => new Response(null, { status: 401 }),
+    () => new Response(null, { status: 403 }),
+  ];
+  for (const respond of proofs) {
+    await assert.rejects(
+      verifyGitHubCopilotModelEntitlement({
+        tokens: ENTITLED_TOKENS,
+        fetchFn: async () => respond(),
+      }),
+      (error: unknown) => error instanceof GitHubCopilotEntitlementError,
+    );
+  }
+});
+
+test('entitlement does not call a subscribed account ineligible when it cannot ask', async () => {
+  // None of these say anything about the subscription. Reporting them as
+  // ineligibility would send a paying user back through a device login that
+  // was never the problem.
+  const unanswered: ReadonlyArray<{ readonly status?: number; readonly fetchFn: typeof fetch }> = [
+    { status: 429, fetchFn: async () => new Response(null, { status: 429 }) },
+    { status: 500, fetchFn: async () => new Response(null, { status: 500 }) },
+    { status: 503, fetchFn: async () => new Response(null, { status: 503 }) },
+    {
+      fetchFn: async () => {
+        throw new DOMException('The operation was aborted', 'TimeoutError');
+      },
+    },
+    {
+      fetchFn: async () => {
+        throw new TypeError('fetch failed');
+      },
+    },
+    {
+      fetchFn: async () =>
+        new Response('not json', { headers: { 'content-type': 'application/json' } }),
+    },
+  ];
+  for (const { status, fetchFn } of unanswered) {
+    await assert.rejects(
+      verifyGitHubCopilotModelEntitlement({ tokens: ENTITLED_TOKENS, fetchFn }),
+      (error: unknown) =>
+        error instanceof GitHubCopilotEntitlementUnavailableError &&
+        !(error instanceof GitHubCopilotEntitlementError) &&
+        error.status === status,
+    );
+  }
+});
diff --git a/packages/runtime/src/__tests__/oauth-login.test.ts b/packages/runtime/src/__tests__/oauth-login.test.ts
index d25d2a9c5a..15c4bfd168 100644
--- a/packages/runtime/src/__tests__/oauth-login.test.ts
+++ b/packages/runtime/src/__tests__/oauth-login.test.ts
@@ -79,6 +79,30 @@ describe('OAuth enrollment policy', () => {
     assert.equal(isOAuthEnrollmentProviderEnabled('xai-oauth', environment), true);
     assert.equal(isOAuthEnrollmentProviderEnabled('openai-codex', {}), true);
   });
+
+  it('keeps the GitHub Copilot device sign-in off until an install opts in', () => {
+    // Maka has no published authorization for the editor OAuth identity this
+    // grant presents, so absence of a decision must read as "off".
+    assert.equal(isOAuthEnrollmentProviderEnabled('github-copilot', {}), false);
+    assert.equal(
+      isOAuthEnrollmentProviderEnabled('github-copilot', {
+        MAKA_GITHUB_COPILOT_DEVICE_LOGIN_EXPERIMENTAL: '0',
+      }),
+      false,
+    );
+    assert.equal(
+      isOAuthEnrollmentProviderEnabled('github-copilot', {
+        MAKA_GITHUB_COPILOT_DEVICE_LOGIN_EXPERIMENTAL: 'true',
+      }),
+      false,
+    );
+    assert.equal(
+      isOAuthEnrollmentProviderEnabled('github-copilot', {
+        MAKA_GITHUB_COPILOT_DEVICE_LOGIN_EXPERIMENTAL: '1',
+      }),
+      true,
+    );
+  });
 });
 
 const TOKEN_ENDPOINT = 'https://auth.example/oauth/token';
diff --git a/packages/runtime/src/__tests__/subscription-credentials.test.ts b/packages/runtime/src/__tests__/subscription-credentials.test.ts
index 404f84f90f..d0cbd8ee8b 100644
--- a/packages/runtime/src/__tests__/subscription-credentials.test.ts
+++ b/packages/runtime/src/__tests__/subscription-credentials.test.ts
@@ -161,6 +161,59 @@ describe('GitHub Copilot subscription credentials', () => {
     assert.equal(tokens?.refresh_token, 'github-account-token');
     assert.equal(tokens?.base_url, 'https://api.githubcopilot.com');
   });
+
+  test('renews an expiring GitHub account token through the device-flow refresh grant', async () => {
+    let requestUrl = '';
+    let requestBody = '';
+    const tokens = await refreshOAuthSubscriptionTokens({
+      providerType: 'github-copilot',
+      tokens: createGitHubCopilotAccountTokens('gho_expiring', {
+        expiresAt: 5_000,
+        refreshToken: 'ghr_renewal',
+      }),
+      now: () => 10_000,
+      fetchFn: async (url, init) => {
+        requestUrl = String(url);
+        requestBody = String(init?.body ?? '');
+        return {
+          ok: true,
+          status: 200,
+          json: async () => ({
+            access_token: 'gho_renewed',
+            refresh_token: 'ghr_rotated',
+            expires_in: 28_800,
+          }),
+        } as unknown as Response;
+      },
+    });
+
+    assert.equal(requestUrl, 'https://github.com/login/oauth/access_token');
+    assert.match(requestBody, /grant_type=refresh_token/);
+    assert.match(requestBody, /refresh_token=ghr_renewal/);
+    assert.equal(tokens.access_token, 'gho_renewed');
+    assert.equal(tokens.refresh_token, 'ghr_rotated');
+    assert.equal(tokens.expires_at, 10_000 + 28_800_000);
+    assert.equal(tokens.base_url, 'https://api.githubcopilot.com');
+  });
+
+  test('refuses a refresh GitHub reported as an error body under HTTP 200', async () => {
+    await assert.rejects(
+      refreshOAuthSubscriptionTokens({
+        providerType: 'github-copilot',
+        tokens: createGitHubCopilotAccountTokens('gho_expiring', {
+          expiresAt: 5_000,
+          refreshToken: 'ghr_renewal',
+        }),
+        now: () => 10_000,
+        fetchFn: async () =>
+          ({
+            ok: true,
+            status: 200,
+            json: async () => ({ error: 'bad_refresh_token' }),
+          }) as unknown as Response,
+      }),
+    );
+  });
 });
 
 describe('OAuth refresh response validation', () => {
diff --git a/packages/runtime/src/github-copilot-oauth-enrollment.ts b/packages/runtime/src/github-copilot-oauth-enrollment.ts
new file mode 100644
index 0000000000..c917614c44
--- /dev/null
+++ b/packages/runtime/src/github-copilot-oauth-enrollment.ts
@@ -0,0 +1,346 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import {
+  createGitHubCopilotAccountTokens,
+  GITHUB_COPILOT_DEFAULT_API_ENDPOINT,
+  isSupportedGitHubCopilotAccountToken,
+  type OAuthSubscriptionTokens,
+} from './subscription-credentials.js';
+import { fetchGitHubCopilotModels } from './model-fetcher.js';
+import { ConnectionEffectHttpError } from './connection-effect-outcome.js';
+import {
+  OAUTH_LOGIN_MAX_TOKEN_CHARS,
+  OAuthTokenEndpointError,
+  requestOAuthEndpointJson,
+} from './oauth-login.js';
+import {
+  OAUTH_PROVIDER_CONTRACTS,
+  OAuthDeviceAuthorizationExpiredError,
+  oauthExpiresAt,
+  requireOAuthBoundedString,
+  requireOAuthDataRecord,
+  requireOAuthPositiveInteger,
+} from './oauth-provider-contracts.js';
+
+const COPILOT = OAUTH_PROVIDER_CONTRACTS['github-copilot'];
+const MAX_TOKEN_LIFETIME_SECONDS = 366 * 24 * 60 * 60;
+
+/**
+ * A GitHub account authorized the grant, and the Copilot API then refused it —
+ * an account without a live subscription, or one whose organization withholds
+ * Copilot. The credential is real and the authorization succeeded, so this is
+ * the provider refusing the account rather than a failed login. Only a proven
+ * refusal reaches here: a catalog the account can read but that lists nothing,
+ * or a deterministic 401/403 from the Copilot API.
+ */
+export class GitHubCopilotEntitlementError extends Error {
+  constructor(options?: ErrorOptions) {
+    super('GitHub account exposes no usable Copilot model', options);
+    this.name = 'GitHubCopilotEntitlementError';
+  }
+}
+
+/**
+ * The entitlement question could not be answered — a timeout, a dropped
+ * connection, a rate limit, a 5xx, or a response the client could not read.
+ *
+ * This must never be reported as an ineligible account: nothing about the
+ * subscription was learned, no credential was committed, and the same login
+ * will usually succeed on the next attempt. The provider status is preserved
+ * for diagnosis, and the Host maps this to a retryable authorization failure.
+ */
+export class GitHubCopilotEntitlementUnavailableError extends Error {
+  constructor(
+    readonly status: number | undefined,
+    options?: ErrorOptions,
+  ) {
+    super(
+      status === undefined
+        ? 'GitHub Copilot entitlement could not be verified'
+        : `GitHub Copilot entitlement could not be verified (${status})`,
+      options,
+    );
+    this.name = 'GitHubCopilotEntitlementUnavailableError';
+  }
+}
+
+/**
+ * RFC 8628 device authorization for a GitHub account that carries a Copilot
+ * subscription. The account token this yields is what
+ * `createGitHubCopilotAccountTokens` already expects — the enrollment replaces
+ * where that token comes from (previously `gh auth token` or a fine-grained
+ * PAT), not what is done with it.
+ */
+export interface GitHubCopilotDeviceAuthorization {
+  readonly deviceCode: string;
+  readonly userCode: string;
+  readonly verificationUrl: string;
+  readonly expiresAt: number;
+  readonly intervalMs: number;
+}
+
+export interface StartGitHubCopilotDeviceAuthorizationInput {
+  readonly fetchFn: typeof fetch;
+  readonly signal: AbortSignal;
+  readonly now?: () => number;
+  readonly timeoutMs?: number;
+}
+
+export interface PollGitHubCopilotDeviceAuthorizationInput
+  extends StartGitHubCopilotDeviceAuthorizationInput {
+  readonly authorization: GitHubCopilotDeviceAuthorization;
+  readonly sleep?: (delayMs: number, signal: AbortSignal) => Promise<void>;
+  /** Runs immediately before one token request becomes non-cancellable. */
+  readonly onPollAdmission?: () => void;
+  /** Runs after a retryable response restores the cancellation boundary. */
+  readonly onPollRetry?: () => void;
+}
+
+export async function startGitHubCopilotDeviceAuthorization(
+  input: StartGitHubCopilotDeviceAuthorizationInput,
+): Promise<GitHubCopilotDeviceAuthorization> {
+  const response = await requestOAuthEndpointJson({
+    endpoint: COPILOT.deviceEndpoint,
+    init: {
+      method: 'POST',
+      headers: {
+        Accept: 'application/json',
+        'Content-Type': 'application/x-www-form-urlencoded',
+      },
+      body: new URLSearchParams({
+        client_id: COPILOT.clientId,
+        scope: COPILOT.scope,
+      }).toString(),
+    },
+    fetchFn: input.fetchFn,
+    signal: input.signal,
+    timeoutMs: input.timeoutMs,
+  });
+  if (!response.ok) throw new OAuthTokenEndpointError('provider_rejected', response.status);
+  const payload = requireOAuthDataRecord(response.payload);
+  // GitHub answers a malformed device request with HTTP 200 and an `error`
+  // body, so an ok status alone does not mean an authorization was issued.
+  const rejection = providerErrorCode(payload);
+  if (rejection) throw new OAuthTokenEndpointError('provider_rejected', response.status);
+  const deviceCode = requireOAuthBoundedString(payload.device_code, OAUTH_LOGIN_MAX_TOKEN_CHARS);
+  const userCode = requireOAuthBoundedString(payload.user_code, 1_024);
+  const verificationUrl = requireOAuthBoundedString(payload.verification_uri, 8_192);
+  assertGitHubVerificationUrl(verificationUrl);
+  const now = input.now?.() ?? Date.now();
+  const expiresIn = requireOAuthPositiveInteger(payload.expires_in, 24 * 60 * 60);
+  const intervalSeconds =
+    payload.interval === undefined ? 5 : requireOAuthPositiveInteger(payload.interval, 300);
+  return {
+    deviceCode,
+    userCode,
+    verificationUrl,
+    expiresAt: oauthExpiresAt(now, expiresIn, response.status),
+    intervalMs: intervalSeconds * 1_000,
+  };
+}
+
+export async function pollGitHubCopilotDeviceAuthorization(
+  input: PollGitHubCopilotDeviceAuthorizationInput,
+): Promise<OAuthSubscriptionTokens> {
+  const now = input.now ?? (() => Date.now());
+  const sleep = input.sleep ?? abortableSleep;
+  let intervalMs = input.authorization.intervalMs;
+  for (;;) {
+    // Sleep at most until the window elapses, then re-check so no request is
+    // issued after the device code expired locally.
+    const remaining = input.authorization.expiresAt - now();
+    if (remaining <= 0) throw new OAuthDeviceAuthorizationExpiredError();
+    await sleep(Math.min(intervalMs, remaining), input.signal);
+    input.signal.throwIfAborted();
+    if (now() >= input.authorization.expiresAt) {
+      throw new OAuthDeviceAuthorizationExpiredError();
+    }
+    input.onPollAdmission?.();
+    const response = await requestOAuthEndpointJson({
+      endpoint: COPILOT.tokenEndpoint,
+      init: {
+        method: 'POST',
+        headers: {
+          Accept: 'application/json',
+          'Content-Type': 'application/x-www-form-urlencoded',
+        },
+        body: new URLSearchParams({
+          client_id: COPILOT.clientId,
+          device_code: input.authorization.deviceCode,
+          grant_type: COPILOT.deviceGrant,
+        }).toString(),
+      },
+      fetchFn: input.fetchFn,
+      // One token request is not cancellable: an abort between the grant being
+      // spent and the token being read would strand a usable credential.
+      signal: new AbortController().signal,
+      timeoutMs: input.timeoutMs,
+    });
+    if (!response.ok) throw new OAuthTokenEndpointError('provider_rejected', response.status);
+    const payload = requireOAuthDataRecord(response.payload);
+    // Unlike xAI, GitHub reports pending/slow_down as HTTP 200 with an `error`
+    // body, so the error code must be read before the success shape.
+    const code = providerErrorCode(payload);
+    if (code === 'authorization_pending') {
+      input.onPollRetry?.();
+      input.signal.throwIfAborted();
+      continue;
+    }
+    if (code === 'slow_down') {
+      const advertised = payload.interval;
+      intervalMs =
+        advertised === undefined
+          ? Math.min(intervalMs + 5_000, 5 * 60 * 1_000)
+          : requireOAuthPositiveInteger(advertised, 300) * 1_000;
+      input.onPollRetry?.();
+      input.signal.throwIfAborted();
+      continue;
+    }
+    // A denial is the account refusing; `expired_token` only means the user did
+    // not finish in time, which the host maps to authorization_failed instead.
+    if (code === 'access_denied')
+      throw new OAuthTokenEndpointError('invalid_grant', response.status);
+    if (code === 'expired_token') throw new OAuthDeviceAuthorizationExpiredError();
+    if (code) throw new OAuthTokenEndpointError('provider_rejected', response.status);
+    return decodeGitHubCopilotAccountToken(payload, now);
+  }
+}
+
+/**
+ * The device grant proves a GitHub account, not a Copilot subscription: the
+ * token endpoint issues the same account token whether or not Copilot is
+ * entitled. Ask the Copilot API what that account can actually reach, so an
+ * unusable credential is refused while the login is still in flight instead of
+ * being committed and failing later on the first request.
+ *
+ * Runs on the caller's transport — the same one the grant was obtained over.
+ */
+export async function verifyGitHubCopilotModelEntitlement(input: {
+  readonly tokens: OAuthSubscriptionTokens;
+  readonly fetchFn: typeof fetch;
+}): Promise<void> {
+  let models: Awaited<ReturnType<typeof fetchGitHubCopilotModels>>;
+  try {
+    models = await fetchGitHubCopilotModels(
+      input.tokens.base_url ?? GITHUB_COPILOT_DEFAULT_API_ENDPOINT,
+      input.tokens.access_token,
+      input.fetchFn,
+    );
+  } catch (error) {
+    // Only the provider refusing this account is an entitlement answer. A
+    // timeout, a dropped connection, a rate limit, a 5xx, or an unreadable
+    // body tell us nothing about the subscription, and reporting them as
+    // ineligibility would send a paying user back through a device login that
+    // was never the problem.
+    if (
+      error instanceof ConnectionEffectHttpError &&
+      (error.status === 401 || error.status === 403)
+    ) {
+      throw new GitHubCopilotEntitlementError({ cause: error });
+    }
+    throw new GitHubCopilotEntitlementUnavailableError(
+      error instanceof ConnectionEffectHttpError ? error.status : undefined,
+      { cause: error },
+    );
+  }
+  // A catalog the account could read, listing nothing it may use.
+  if (models.length === 0) throw new GitHubCopilotEntitlementError();
+}
+
+/**
+ * The device grant must yield a GitHub OAuth user token (`gho_`/`ghu_`). A
+ * classic PAT shape here would mean the flow resolved to something other than
+ * the account that authorized it, so it is rejected rather than stored.
+ *
+ * GitHub returns `expires_in`/`refresh_token` only when the OAuth app has
+ * expiring user tokens enabled. That lifetime is carried through verbatim so
+ * the credential can be renewed; an expiring token recorded as non-expiring
+ * would silently stop working and force another interactive login. An
+ * expiring response without a refresh token is unusable for the same reason
+ * and is rejected instead of stored.
+ */
+function decodeGitHubCopilotAccountToken(
+  payload: Record<string, unknown>,
+  now: () => number,
+): OAuthSubscriptionTokens {
+  const accessToken = requireOAuthBoundedString(payload.access_token, OAUTH_LOGIN_MAX_TOKEN_CHARS);
+  if (!isSupportedGitHubCopilotAccountToken(accessToken)) {
+    throw new OAuthTokenEndpointError('invalid_response');
+  }
+  if (payload.expires_in === undefined) return createGitHubCopilotAccountTokens(accessToken);
+  const expiresInSeconds = requireOAuthPositiveInteger(
+    payload.expires_in,
+    MAX_TOKEN_LIFETIME_SECONDS,
+  );
+  const refreshToken = requireOAuthBoundedString(
+    payload.refresh_token,
+    OAUTH_LOGIN_MAX_TOKEN_CHARS,
+  );
+  return createGitHubCopilotAccountTokens(accessToken, {
+    expiresAt: oauthExpiresAt(now(), expiresInSeconds),
+    refreshToken,
+  });
+}
+
+function providerErrorCode(value: unknown): string | undefined {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return;
+  const error = (value as Record<string, unknown>).error;
+  return typeof error === 'string' ? error.toLowerCase() : undefined;
+}
+
+/**
+ * The verification URL is handed to the presentation layer, which opens it in
+ * the user's browser. Pin it to github.com so a malformed response cannot
+ * redirect the user somewhere else to type a code that looks legitimate.
+ */
+function assertGitHubVerificationUrl(value: string): void {
+  let url: URL;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new OAuthTokenEndpointError('invalid_response');
+  }
+  if (
+    url.protocol !== 'https:' ||
+    url.username ||
+    url.password ||
+    (url.hostname !== 'github.com' && !url.hostname.endsWith('.github.com'))
+  ) {
+    throw new OAuthTokenEndpointError('invalid_response');
+  }
+}
+
+function abortableSleep(delayMs: number, signal: AbortSignal): Promise<void> {
+  return new Promise((resolve, reject) => {
+    if (signal.aborted) {
+      reject(signal.reason ?? new DOMException('OAuth login cancelled', 'AbortError'));
+      return;
+    }
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(signal.reason ?? new DOMException('OAuth login cancelled', 'AbortError'));
+    };
+    const timer = setTimeout(() => {
+      signal.removeEventListener('abort', onAbort);
+      resolve();
+    }, delayMs);
+    signal.addEventListener('abort', onAbort, { once: true });
+  });
+}
diff --git a/packages/runtime/src/oauth-provider-contracts.ts b/packages/runtime/src/oauth-provider-contracts.ts
index 6746e0ed5f..f98b1a4791 100644
--- a/packages/runtime/src/oauth-provider-contracts.ts
+++ b/packages/runtime/src/oauth-provider-contracts.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-export type OAuthEnrollmentProvider = 'openai-codex' | 'xai-oauth';
+export type OAuthEnrollmentProvider = 'openai-codex' | 'xai-oauth' | 'github-copilot';
 
 export type OAuthTokenEndpointErrorCategory =
   | 'invalid_grant'
@@ -71,6 +71,25 @@ export const OAUTH_PROVIDER_CONTRACTS = {
     deviceRedirectUri: 'https://auth.openai.com/deviceauth/callback',
     experimentalEnvironmentVariable: 'MAKA_CODEX_SUBSCRIPTION_EXPERIMENTAL',
   },
+  'github-copilot': {
+    // Borrowed identity, not Maka's. This is the GitHub Copilot editor OAuth
+    // app: GitHub's consent screen names that application while Maka receives
+    // and stores the credential. Copilot entitlement is granted to editor
+    // clients only, so no Maka-owned app can reach a user's own subscription
+    // today — but GitHub has not published an authorization for third-party
+    // reuse of this identity either. Because that basis is missing, the device
+    // sign-in ships off and an operator opts in per install with the variable
+    // below. Provenance, consent identity, and what would settle the question
+    // are recorded in `docs/github-copilot-oauth-identity.md`.
+    clientId: 'Iv1.b507a08c87ecfe98',
+    deviceEndpoint: 'https://github.com/login/device/code',
+    tokenEndpoint: 'https://github.com/login/oauth/access_token',
+    // `read:user` is what the Copilot token endpoint checks; no repository or
+    // workflow scope is requested, so the grant cannot reach a user's code.
+    scope: 'read:user',
+    deviceGrant: 'urn:ietf:params:oauth:grant-type:device_code',
+    experimentalEnvironmentVariable: 'MAKA_GITHUB_COPILOT_DEVICE_LOGIN_EXPERIMENTAL',
+  },
   'xai-oauth': {
     clientId: 'b1a00492-073a-47ea-816f-4c329264a828',
     // xAI device-code flow: request a user code at `deviceEndpoint`, then
@@ -90,7 +109,14 @@ export function isOAuthEnrollmentProviderEnabled(
   environment: Readonly<Record<string, string | undefined>> = process.env,
 ): boolean {
   if (provider === 'xai-oauth') return true;
-  return environment[OAUTH_PROVIDER_CONTRACTS[provider].experimentalEnvironmentVariable] !== '0';
+  const flag = environment[OAUTH_PROVIDER_CONTRACTS[provider].experimentalEnvironmentVariable];
+  // GitHub Copilot is opt-in, not kill-switched: the device grant presents an
+  // OAuth identity Maka has no published authorization to use, so the sign-in
+  // stays off until an operator turns it on for their own install. The flag is
+  // how that choice is expressed; it is not the authorization basis.
+  if (provider === 'github-copilot') return flag === '1';
+  // Codex enrollment ships on, with the flag as its kill switch.
+  return flag !== '0';
 }
 
 /**
diff --git a/packages/runtime/src/subscription-credentials.ts b/packages/runtime/src/subscription-credentials.ts
index b536744184..0965bbaeb5 100644
--- a/packages/runtime/src/subscription-credentials.ts
+++ b/packages/runtime/src/subscription-credentials.ts
@@ -140,6 +140,7 @@ export type ResolveAndPersistOAuthSubscriptionTokensInput =
   RefreshAndPersistOAuthSubscriptionTokensInput & { refreshSkewMs?: number };
 
 const CODEX = OAUTH_PROVIDER_CONTRACTS['openai-codex'];
+const COPILOT = OAUTH_PROVIDER_CONTRACTS['github-copilot'];
 const XAI = OAUTH_PROVIDER_CONTRACTS['xai-oauth'];
 
 const OAUTH_REFRESH_LEASE_MS = 30_000;
@@ -464,7 +465,7 @@ export async function refreshOAuthSubscriptionTokens(input: {
     case 'openai-codex':
       return refreshOpenAiCodexTokens(input.tokens, now, fetchFn, input.signal);
     case 'github-copilot':
-      return input.tokens;
+      return refreshGitHubCopilotTokens(input.tokens, now, fetchFn, input.signal);
     case 'xai-oauth':
       return refreshXaiOAuthTokens(input.tokens, now, fetchFn, input.signal);
   }
@@ -479,11 +480,29 @@ export const GITHUB_COPILOT_COMPAT_HEADERS = {
   'Copilot-Integration-Id': 'vscode-chat',
 } as const;
 
-export function createGitHubCopilotAccountTokens(githubToken: string): OAuthSubscriptionTokens {
+/**
+ * A GitHub account token GitHub declared no lifetime for. Recorded as an
+ * explicit sentinel because it is the one thing that distinguishes a
+ * non-refreshable record from one carrying a real `expires_in`.
+ */
+export const GITHUB_COPILOT_NON_EXPIRING_AT = Number.MAX_SAFE_INTEGER;
+
+/** The lifetime GitHub returned, when the account token is an expiring one. */
+export interface GitHubCopilotAccountTokenLifetime {
+  readonly expiresAt: number;
+  readonly refreshToken: string;
+}
+
+export function createGitHubCopilotAccountTokens(
+  githubToken: string,
+  lifetime?: GitHubCopilotAccountTokenLifetime,
+): OAuthSubscriptionTokens {
   return {
     access_token: githubToken,
-    refresh_token: githubToken,
-    expires_at: Number.MAX_SAFE_INTEGER,
+    // A non-expiring token has no refresh grant behind it, so it stands in as
+    // its own refresh token; `expires_at` is what tells the two records apart.
+    refresh_token: lifetime?.refreshToken ?? githubToken,
+    expires_at: lifetime?.expiresAt ?? GITHUB_COPILOT_NON_EXPIRING_AT,
     token_type: 'Bearer',
     base_url: GITHUB_COPILOT_DEFAULT_API_ENDPOINT,
   };
@@ -554,6 +573,49 @@ async function refreshOpenAiCodexTokens(
   };
 }
 
+async function refreshGitHubCopilotTokens(
+  tokens: OAuthSubscriptionTokens,
+  now: () => number,
+  fetchFn: typeof fetch,
+  signal?: AbortSignal,
+): Promise<OAuthSubscriptionTokens> {
+  // A non-expiring account token is its own authority: GitHub issues no
+  // refresh grant for it, so returning it unchanged IS the refresh.
+  if (tokens.expires_at === GITHUB_COPILOT_NON_EXPIRING_AT) return tokens;
+  const response = await fetchFn(COPILOT.tokenEndpoint, {
+    method: 'POST',
+    headers: {
+      Accept: 'application/json',
+      'Content-Type': 'application/x-www-form-urlencoded',
+    },
+    body: new URLSearchParams({
+      grant_type: 'refresh_token',
+      client_id: COPILOT.clientId,
+      refresh_token: tokens.refresh_token,
+    }).toString(),
+    signal,
+  });
+  if (!response.ok) {
+    throw new Error(`GitHub Copilot OAuth token refresh failed (${response.status}).`);
+  }
+  const payload = requireOAuthDataRecord(await response.json());
+  // GitHub reports a rejected refresh as HTTP 200 with an `error` body, so an
+  // ok status alone must not be allowed to replace the stored authority.
+  if (typeof payload.error === 'string') {
+    throw new Error('GitHub Copilot OAuth token refresh was rejected.');
+  }
+  const { record, accessToken, expiresInSeconds } = requireRefreshedTokenFields(payload);
+  if (!isSupportedGitHubCopilotAccountToken(accessToken)) {
+    throw new Error('GitHub Copilot OAuth token refresh returned an unsupported token.');
+  }
+  return {
+    ...tokens,
+    access_token: accessToken,
+    refresh_token: nextRefreshToken(record.refresh_token, tokens.refresh_token),
+    expires_at: oauthExpiresAt(now(), expiresInSeconds),
+  };
+}
+
 async function refreshXaiOAuthTokens(
   tokens: OAuthSubscriptionTokens,
   now: () => number,
diff --git a/packages/runtime/src/subscription-model-fetch.ts b/packages/runtime/src/subscription-model-fetch.ts
index 31520e7520..26b2a8cfce 100644
--- a/packages/runtime/src/subscription-model-fetch.ts
+++ b/packages/runtime/src/subscription-model-fetch.ts
@@ -30,8 +30,14 @@ export interface SubscriptionModelFetchInput {
   sessionId: string;
   modelId: string;
   fetchFn?: typeof fetch;
-  /** Force-refreshes a remotely invalidated OAuth token for one safe 401 replay. */
-  refreshOAuthAccessToken?: () => Promise<string | null>;
+  /**
+   * Force-refreshes a remotely invalidated OAuth token for one safe 401 replay.
+   *
+   * Receives the request's own signal: a caller who cancels during the refresh
+   * is released then, instead of waiting out the refresh timeout for a replay
+   * that will never be sent.
+   */
+  refreshOAuthAccessToken?: (signal?: AbortSignal | null) => Promise<string | null>;
 }
 
 export function buildSubscriptionModelFetch(
@@ -45,7 +51,12 @@ export function buildSubscriptionModelFetch(
     );
   }
   if (input.connection.providerType === 'github-copilot') {
-    return buildGitHubCopilotFetch(input.fetchFn ?? fetch);
+    const copilotFetch = buildGitHubCopilotFetch(input.fetchFn ?? fetch);
+    // The editor headers stay innermost so a replayed request carries them
+    // exactly as the first attempt did.
+    return input.refreshOAuthAccessToken
+      ? buildOAuth401ReplayFetch(copilotFetch, input.refreshOAuthAccessToken)
+      : copilotFetch;
   }
   if (input.connection.providerType === 'xai-oauth' && input.refreshOAuthAccessToken) {
     return buildOAuth401ReplayFetch(input.fetchFn ?? fetch, input.refreshOAuthAccessToken);
@@ -117,7 +128,7 @@ function containsGitHubCopilotImage(value: unknown): boolean {
 function buildOpenAiCodexFetch(
   sessionId: string,
   fetchFn: typeof fetch,
-  refreshOAuthAccessToken?: () => Promise<string | null>,
+  refreshOAuthAccessToken?: (signal?: AbortSignal | null) => Promise<string | null>,
 ): typeof fetch {
   return async (url: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => {
     const headers = new Headers(init?.headers);
@@ -175,7 +186,7 @@ async function checkedOpenAiCodexFetch(
   fetchFn: typeof fetch,
   url: Parameters<typeof fetch>[0],
   init?: Parameters<typeof fetch>[1],
-  refreshOAuthAccessToken?: () => Promise<string | null>,
+  refreshOAuthAccessToken?: (signal?: AbortSignal | null) => Promise<string | null>,
 ): Promise<Response> {
   const edgeRetryDelaysMs = [2_000, 10_000, 30_000] as const;
   let authorizationReplayUsed = false;
@@ -195,7 +206,17 @@ async function checkedOpenAiCodexFetch(
       isReplayableOpenAiCodexRequest(url, requestInit)
     ) {
       authorizationReplayUsed = true;
-      const accessToken = await refreshOAuthAccessToken().catch(() => null);
+      const refreshSignal = effectiveOpenAiCodexRequestSignal(url, requestInit);
+      let accessToken: string | null;
+      try {
+        accessToken = await refreshOAuthAccessToken(refreshSignal);
+      } catch (error) {
+        // Same rule as the shared replay path: an abandoned turn is cancelled,
+        // not reported as a provider rejection.
+        if (refreshSignal?.aborted) await abandonForCaller(response, refreshSignal);
+        accessToken = null;
+      }
+      if (refreshSignal?.aborted) await abandonForCaller(response, refreshSignal);
       if (accessToken) {
         await response.body?.cancel().catch(() => undefined);
         requestInit = withRefreshedOAuthAuthorization(requestInit, accessToken, true);
@@ -225,18 +246,41 @@ async function checkedOpenAiCodexFetch(
 
 function buildOAuth401ReplayFetch(
   fetchFn: typeof fetch,
-  refreshOAuthAccessToken: () => Promise<string | null>,
+  refreshOAuthAccessToken: (signal?: AbortSignal | null) => Promise<string | null>,
 ): typeof fetch {
   return async (url, init) => {
     const response = await fetchFn(url, init);
     if (response.status !== 401 || !isReplayableOpenAiCodexRequest(url, init)) return response;
-    const accessToken = await refreshOAuthAccessToken().catch(() => null);
+    const signal = effectiveOpenAiCodexRequestSignal(url, init);
+    // A caller who gave up is cancelled, not told their credential was
+    // rejected: once the turn is abandoned the 401 answers nothing, and
+    // reporting it would read as an auth failure the user has to act on.
+    if (signal?.aborted) await abandonForCaller(response, signal);
+    let accessToken: string | null;
+    try {
+      accessToken = await refreshOAuthAccessToken(signal);
+    } catch (error) {
+      if (signal?.aborted) await abandonForCaller(response, signal);
+      throw error;
+    }
+    if (signal?.aborted) await abandonForCaller(response, signal);
     if (!accessToken) return response;
     await response.body?.cancel().catch(() => undefined);
     return fetchFn(url, withRefreshedOAuthAuthorization(init, accessToken, false));
   };
 }
 
+/**
+ * Ends a request the caller abandoned: releases the provider body, then throws
+ * the abort reason so the turn settles as cancelled rather than as whatever
+ * status happened to be in flight.
+ */
+async function abandonForCaller(response: Response, signal: AbortSignal): Promise<never> {
+  await response.body?.cancel().catch(() => undefined);
+  signal.throwIfAborted();
+  throw new DOMException('Request aborted', 'AbortError');
+}
+
 function withRefreshedOAuthAuthorization(
   init: RequestInit | undefined,
   accessToken: string,
diff --git a/packages/storage/src/__tests__/runtime-policy-stores.test.ts b/packages/storage/src/__tests__/runtime-policy-stores.test.ts
index 5918c2d858..e6a437d703 100644
--- a/packages/storage/src/__tests__/runtime-policy-stores.test.ts
+++ b/packages/storage/src/__tests__/runtime-policy-stores.test.ts
@@ -4023,16 +4023,16 @@ describe('runtime policy stores', () => {
         (await stores.connectionCatalog.getSnapshot()).revision,
         connectionDraft('copilot-import', 'github-copilot', 'Copilot import'),
       );
-      assert.deepEqual(
-        await stores.operations.beginInteractiveOAuthLogin({
-          attemptId: 'copilot-login',
-          target: { kind: 'existing', connectionId: copilot.connectionId },
-        }),
-        {
-          kind: 'provider_action_unavailable',
-          availability: 'hidden',
-        },
-      );
+      // GitHub Copilot enrolls through the Host OAuth seam like every other
+      // account login, so its admission must be a real ticket, not 'hidden'.
+      const copilotAdmission = await stores.operations.beginInteractiveOAuthLogin({
+        attemptId: 'copilot-login',
+        target: { kind: 'existing', connectionId: copilot.connectionId },
+      });
+      assert.equal(copilotAdmission.kind, 'ready');
+      if (copilotAdmission.kind === 'ready') {
+        assert.equal(copilotAdmission.identity.providerType, 'github-copilot');
+      }
 
       // A retired provider keeps its stored connection, so the login entry
       // point is reachable and has to refuse on its own.
diff --git a/packages/storage/src/runtime-policy/coordinator.ts b/packages/storage/src/runtime-policy/coordinator.ts
index bf38c04217..8a0d434831 100644
--- a/packages/storage/src/runtime-policy/coordinator.ts
+++ b/packages/storage/src/runtime-policy/coordinator.ts
@@ -2116,7 +2116,11 @@ function requiresNetworkProxyCredential(networkProxy: RuntimePolicy['networkProx
 function isInteractiveOAuthLoginProvider(
   providerType: ProviderType,
 ): providerType is InteractiveOAuthLoginProvider {
-  return providerType === 'openai-codex' || providerType === 'xai-oauth';
+  return (
+    providerType === 'openai-codex' ||
+    providerType === 'xai-oauth' ||
+    providerType === 'github-copilot'
+  );
 }
 
 function normalizeInteractiveOAuthLoginInput(
diff --git a/packages/storage/src/runtime-policy/oauth-login-receipt-document.ts b/packages/storage/src/runtime-policy/oauth-login-receipt-document.ts
index 5a5d12974b..ffc43870b8 100644
--- a/packages/storage/src/runtime-policy/oauth-login-receipt-document.ts
+++ b/packages/storage/src/runtime-policy/oauth-login-receipt-document.ts
@@ -224,7 +224,11 @@ function decodeIdentity(value: unknown): InteractiveOAuthConnectionIdentity {
 
 function decodeOAuthProvider(value: unknown): InteractiveOAuthLoginProvider {
   const providerType = decodePersistedDomain(() => decodeProviderType(value));
-  if (providerType !== 'openai-codex' && providerType !== 'xai-oauth') {
+  if (
+    providerType !== 'openai-codex' &&
+    providerType !== 'xai-oauth' &&
+    providerType !== 'github-copilot'
+  ) {
     throw codecError('invalid_document', 'OAuth login receipt provider is invalid');
   }
   return providerType;
diff --git a/packages/storage/src/runtime-policy/onboarding-transaction.ts b/packages/storage/src/runtime-policy/onboarding-transaction.ts
index 7d3786f864..0379855c11 100644
--- a/packages/storage/src/runtime-policy/onboarding-transaction.ts
+++ b/packages/storage/src/runtime-policy/onboarding-transaction.ts
@@ -381,7 +381,11 @@ function decodeOAuthTarget(value: unknown): InteractiveOAuthLoginTarget {
 function isOAuthProvider(
   providerType: ProviderType,
 ): providerType is InteractiveOAuthLoginProvider {
-  return providerType === 'openai-codex' || providerType === 'xai-oauth';
+  return (
+    providerType === 'openai-codex' ||
+    providerType === 'xai-oauth' ||
+    providerType === 'github-copilot'
+  );
 }
 
 function decodeOAuthAttemptId(
diff --git a/packages/storage/src/runtime-policy/operations.ts b/packages/storage/src/runtime-policy/operations.ts
index 6d3b157e66..5e73c8be53 100644
--- a/packages/storage/src/runtime-policy/operations.ts
+++ b/packages/storage/src/runtime-policy/operations.ts
@@ -142,7 +142,7 @@ export interface InteractiveOAuthLoginTicket {
 
 export type InteractiveOAuthLoginProvider = Extract<
   ConnectionCatalogEntry['providerType'],
-  'openai-codex' | 'xai-oauth'
+  'openai-codex' | 'xai-oauth' | 'github-copilot'
 >;
 
 export type InteractiveOAuthLoginTarget =