AI Gateway Phase 1.b: Copilot token minting with auto-refresh plugin #719

Original author: Cedric Vidal (@cedricvidal)

Context

With the AI Gateway validated via Phase 1.a (HAR collection plugin, PR #702), the next step is to solve the Copilot token expiration issue (#669) by implementing a token minting and auto-refresh plugin.

Problem

Copilot tokens expire mid-session causing worker failures (see #669). The current workaround (PR #700, reducing reuse threshold) buys time but doesn't solve the root cause.

Requirements

• Implement a gateway plugin that mints Copilot tokens on behalf of workers
• Auto-refresh tokens before expiration (proactive renewal)
• Transparently inject fresh tokens into outbound requests (workers never see expired credentials)
• Plugin should be configurable per-worker or globally

Risk

Medium: modifies auth headers on live traffic

Dependencies

• Phase 1.a merged (PR AI gateway phase 1 - HAR plugin, VS Code Electron worker integration, Rust CI with CTRF #702)

Acceptance Criteria

• Gateway plugin intercepts outbound requests to Copilot endpoints
• Plugin mints and caches tokens with proactive refresh before expiry
• Workers no longer encounter token expiration errors
• Integration tests covering token refresh flow
• VS Code Electron worker uses the new plugin in staging