feat(analytics): add GitHub Copilot CLI sessions to the analytics report

[pigorv]

Summary

Adds GitHub Copilot CLI as an analytics-only agent, so codemie analytics reports Copilot usage alongside Claude, Codex, Gemini, Kimi and OpenCode. Sessions are discovered from local disk, priced with the existing pricing table, and surfaced as a first-class agent in the HTML and terminal reports.

Scope is the agentic copilot command (@github/copilot) only — not gh copilot, not the VS Code/JetBrains extensions, and not GitHub's cloud metrics APIs. CodeMie does not gain the ability to install, launch or manage Copilot; this is ingestion only.

Changes

New agent plugin — src/agents/plugins/copilot-cli/

• Discovery from ~/.copilot/session-state/<uuid>/workspace.yaml (honors COPILOT_HOME). The manifest is present in every session directory and carries project path, repo, branch and timestamps in a few hundred bytes, so discovery never opens a multi-megabyte transcript.
• Tolerant JSONL parsing of events.jsonl into the unified ParsedSession — unparseable lines are dropped, never thrown, since the schema is undocumented and varies across CLI versions.
• Metrics: tool calls with success/failure, file operations, code churn, user prompts, and skill invocations.

Token extraction, in three tiers

1. session.shutdown.modelMetrics — the authoritative per-model rollup
2. Per-turn assistant.message — recovers output tokens and request counts, marked partial
3. Neither — the session is listed unpriced with a reason, not hidden

Pricing — readCopilotCli in cost/usage-readers.ts

Copilot reports inputTokens inclusive of cacheReadTokens (OpenAI convention, applied even to Anthropic models), while this repo's costBreakdown bills input at full rate and cacheRead separately. The reader decomposes rather than passing through:

freshInput    = inputTokens − cacheReadTokens
cacheCreation = min(cacheWriteTokens, freshInput)   // cache writes price above base input
input         = freshInput − cacheCreation

On a real session this yields input = 406,071 rather than the raw 14,076,695 a pass-through would bill — a ~36× over-count on the input component. reasoningTokens is a subset of outputTokens and is never billed separately.

No pricing.json or model-normalizer.ts changes: all observed model strings (gpt-5.2, gpt-5.4, gpt-5-mini, claude-sonnet-4.5, claude-sonnet-4.6) already resolve via the existing lowercase + dot→dash fold.

Ownership gate — native-loader.ts

Natively-discovered sessions without a CodeMie ownership marker are tagged native-external and filtered out by default. A Copilot session can never carry that marker, so without an exemption 100% would be dropped and the feature would ship displaying nothing. Analytics-only agents are now tagged native-unmanaged, which passes the default filter while staying honest that CodeMie did not launch them.

Management surfaces — AgentRegistry.getManageableAgents()

Registering an unmanageable agent broke the invariant that every getAllAgents() entry is installable and launchable. codemie update in particular never calls the adapter — it reads metadata.npmPackage and runs npm install -g <pkg> --force, which would have overwritten a user's own Copilot install. The nine management call sites (update, install, uninstall, list, first-time) now use getManageableAgents(); getAllAgents() still returns analytics-only agents so the analytics pipeline can resolve their session adapters. Copilot's npmPackage is null as defense in depth.

Report UI

• Brand colour for Copilot, plus a new agent display-label mechanism (the report had none — raw keys were rendered, and text-transform: capitalize would have shown "Copilot-cli"). Capitalize is retained for unmapped keys so other agents look unchanged.
• Optional premiumRequests, usagePartial and usageUnavailableReason on ReportSessionRecord, rendered in the existing session modal. All spread conditionally, so no other agent's payload changes shape.
• Terminal output prints GitHub Copilot CLI (copilot-cli) — label for readability, key because it is the token --agent accepts.

Note on cost semantics: Copilot bills in premium requests, not tokens (434 API requests cost 3 premium requests; 60 claude-sonnet-4.5 requests cost 0). The USD figure is a token-derived estimate for cross-agent comparison, not GitHub's invoice. totalPremiumRequests is surfaced separately rather than conflated with it.

Testing

• Tests added/updated — 63 new unit tests across discovery, parsing, token extraction, pricing, registry wiring and the ownership gate
• Manual testing done — verified against 41 real local Copilot sessions: 746 turns, 1454 tool calls (97.7% success), correct per-model attribution, and Copilot absent from list/install/uninstall/doctor/update

Guards worth keeping on any future change here:

• cache decomposition (12 tests) — asserts input === 406071, the exact value that exposes the over-billing bug
• ownership gate (4 tests) — asserts a Copilot session survives the default path with no --include-external
• management surfaces (4 tests) — asserts Copilot cannot reach codemie update

Checklist

• Code follows project standards — ESM .js extensions, no any, explicit return types, logger.* not console.*
• Lint clean (zero warnings), typecheck clean, build clean
• CI is green (npm run ci) — see note below
• No merge conflicts with main

Known issues, disclosed

Source-column classification does not fire for Copilot. Skill invocations are captured correctly, but session-source-detector.ts matches the superpowers: prefix while Copilot writes skill names un-namespaced. Loosening a shared detector would change how Claude and Codex sessions classify, so it is deliberately left alone; Copilot sessions read "Pure chat".

Sessions from Copilot CLI < 1.0 carry no token telemetry at all — verified across 48 shutdown-less local sessions, none of which record per-turn output tokens. They are listed with an explanatory reason rather than hidden or shown as $0.