FEAT: Add browser-session authentication for M365 Copilot

[Adrian Gavrila (adrian-gavrila)]

Description

Adds interactive browser-session authentication for the M365 Copilot WebSocket target.

The new BrowserSessionCopilotAuthenticator:

• Uses a persistent Microsoft Edge profile for user-driven authentication.
• Supports MFA, Conditional Access, passwordless authentication, and account selection.
• Captures Copilot tokens without storing user credentials.
• Keeps tokens in memory and refreshes them on use near expiry.
• Retains a minimized browser session for automatic token recapture.
• Supports standalone scripts and Windows Jupyter notebooks.
• Isolates personas through separate browser profile paths.
• Preserves the existing automated-credential and manual-token authenticators.

This also updates the default M365 Copilot ChatHub endpoint to substrate.svc.cloud.microsoft while leaving the separate image-upload endpoint unchanged.

The M365 Copilot WebSocket protocol remains undocumented and may change.

Tests and Documentation

• Added unit coverage for token validation, expiry handling, concurrent capture, cancellation cleanup, browser lifecycle, URL filtering, persona isolation, and event-loop ownership.
• Existing Copilot authenticator and WebSocket target tests pass.
• Ruff, ty, and repository pre-commit checks pass.
• Live-tested text, multi-turn, parallel, image, standalone browser-session, Jupyter, and explicit token-recapture flows.
• Added an executable browser-session authentication example to the paired Jupytext documentation.
• Jupytext strict synchronization passes.
• Natural near-expiry renewal soak test is pending.

[Behnam (behnam-o)]

Looks good to me and works great (except the minor comment on URI, I had to change it to get it working locally.)

[Behnam (behnam-o)]

I've noticed sometimes the websocket base URL ends with StreamHub , and this won't pick those up ... good idea to allow for multiple URIs here, or look for just the wss://substrate.svc.cloud.microsoft/m365Copilot part?

[Behnam (behnam-o)]

oh also, this is case sensitive? I accidentally typed Streamhub and it didn't work ... do we need to be that strict?

[Behnam (behnam-o)]

nit: [discussed offline] maybe a good idea to explore: can we intercept the oauth calls and extract the auth tokens from those? that has the pro of being way more likely to still happen regardless of the websocket, even if copilot moves away from websockets, it still needs to get a token to authorize.

it looks like the copilot authenticator (username+password) does a similar thing? can they both share the same logic for extracting the token? one just drives the login automatically using username+password, and the other expects the user to login when username+password is not enough

but not a blocker at all, and just a suggestion/exploration.