feat: platform-default GitHub Copilot connection + first-run AI lockout

.changeset/green-crabs-arrive.md

@@ -0,0 +1,5 @@
+---
+"agentweaver": minor
+---
+
+Platform admins can now connect a single platform-wide GitHub Copilot account for GitHub Copilot mode, separate from per-project Copilot connections. Agentweaver now blocks app access behind a setup screen until either BYOK or the platform-default Copilot connection is configured.

apps/Agentweaver.Api.Data/Memory/GitHubConnectionsPersistenceRecords.cs

@@ -1,7 +1,7 @@
 namespace Agentweaver.Api.Memory;
 
 public enum GitHubAppKind { Repo, Copilot }
-public enum GitHubAuthorizationPurpose { InteractiveRepository, InteractiveCopilot, UnattendedRepository, UnattendedCopilot }
+public enum GitHubAuthorizationPurpose { InteractiveRepository, InteractiveCopilot, UnattendedRepository, UnattendedCopilot, PlatformDefaultCopilot }
 public enum GitHubCapabilityPurpose { InteractiveRepository, InteractiveCopilot, UnattendedRepository, UnattendedCopilot }
 public enum GitHubCapabilitySnapshotSourceKind { UserAuthorization, RepositoryGrant, CopilotBinding }
 public enum GitHubAuthorizationStatus { Pending, Redeeming, Completed, Failed, Expired }
@@ -141,6 +141,21 @@ public sealed class ProjectCopilotBindingRecord
     public DateTimeOffset? DeactivatedAt { get; set; }
 }
 
+public sealed class PlatformDefaultCopilotBindingRecord
+{
+    public const string SingletonId = "platform-default";
+
+    public string Id { get; set; } = SingletonId;
+    public string EntraObjectId { get; set; } = "";
+    public string CredentialReference { get; set; } = "";
+    /// <summary>Stable identity of the authorization grant, not an access-token version.</summary>
+    public string CredentialVersion { get; set; } = "";
+    public string GrantDigest { get; set; } = "";
+    public GitHubBindingStatus Status { get; set; }
+    public DateTimeOffset BoundAt { get; set; }
+    public DateTimeOffset? DeactivatedAt { get; set; }
+}
+
 public sealed class AutomationActivationRecord
 {
     public string Id { get; set; } = "";

apps/Agentweaver.Api.Data/Memory/MemoryDbContext.cs

@@ -32,6 +32,7 @@ public sealed class MemoryDbContext(DbContextOptions<MemoryDbContext> options) :
     public DbSet<GitHubRepositoryGrantRecord> GitHubRepositoryGrants => Set<GitHubRepositoryGrantRecord>();
     public DbSet<GitHubRepositorySelectionCodeRecord> GitHubRepositorySelectionCodes => Set<GitHubRepositorySelectionCodeRecord>();
     public DbSet<ProjectCopilotBindingRecord> ProjectCopilotBindings => Set<ProjectCopilotBindingRecord>();
+    public DbSet<PlatformDefaultCopilotBindingRecord> PlatformDefaultCopilotBindings => Set<PlatformDefaultCopilotBindingRecord>();
     public DbSet<AutomationActivationRecord> AutomationActivations => Set<AutomationActivationRecord>();
     public DbSet<AutomationInvocationRecord> AutomationInvocations => Set<AutomationInvocationRecord>();
     public DbSet<GitHubLifecycleDeliveryRecord> GitHubLifecycleDeliveries => Set<GitHubLifecycleDeliveryRecord>();
@@ -630,6 +631,19 @@ private void ConfigureGitHubConnectionsPersistence(ModelBuilder model)
             ConfigureProjectForeignKey(e, "FK_project_copilot_bindings_projects_project_id");
         });
 
+        model.Entity<PlatformDefaultCopilotBindingRecord>(e =>
+        {
+            e.ToTable("platform_default_copilot_bindings").HasKey(x => x.Id);
+            e.Property(x => x.Id).HasColumnName("id");
+            e.Property(x => x.EntraObjectId).HasColumnName("entra_object_id");
+            e.Property(x => x.CredentialReference).HasColumnName("credential_reference");
+            e.Property(x => x.CredentialVersion).HasColumnName("credential_version");
+            e.Property(x => x.GrantDigest).HasColumnName("grant_digest");
+            e.Property(x => x.Status).HasColumnName("status");
+            e.Property(x => x.BoundAt).HasColumnName("bound_at");
+            e.Property(x => x.DeactivatedAt).HasColumnName("deactivated_at");
+        });
+
         model.Entity<AutomationActivationRecord>(e =>
         {
             e.ToTable("automation_activations").HasKey(x => x.Id);