Repository navigation
feat: align with Copilot CLI 1.0.105 - #30
Merged
Merged
Conversation
added 6 commits
November 1, 2026 18:55
The CLI now forwards the user's reasoning effort. When a provider rejected it with 400, the retry replayed the same payload and resent the rejected level, so the router looped. Pass the stepped-down level into the retry, cap the attempts, and attach the close listener once per client request. Add regression tests for caller-sent efforts, including the case where every level is rejected.
…fault Current Copilot CLIs forward the chosen level to BYOK providers, so the selector is meaningful by default. reasoningEffortPicker: false remains the opt-out, and the shared budget and level helpers are exported for the native registry.
Derive the Copilot API origin for GHEC data residency tenants (copilot-api.<tenant>.ghe.com) from COPILOT_GH_HOST/GH_HOST. Legacy mode now passes COPILOT_PROVIDER_MODEL_ID, COPILOT_PROVIDER_HEADERS and COPILOT_PROVIDER_API_KEY_COMMAND, and validates apiKeyCommand plus header values that would smuggle a second header.
--native-byok publishes the discovered models through the CLI's supported providers.json registry: a private temporary file is passed with COPILOT_PROVIDERS_CONFIG and removed when the session ends. doctor diagnoses the installation without starting Copilot, and models prints discovery output; both support --json. Legacy mode now isolates itself from a user providers.json that would override COPILOT_PROVIDER_*.
Correct the built-in BYOK comparison now that providers.json exists, document native registry mode, doctor and models, data residency, the reasoning-effort fix and the new provider variables. Update verification evidence, CHANGELOG, AGENTS and SECURITY, and drop the stale echo-config fixture.
Correct the reasoning-effort verification claim to match what was tested (router and the CLI's own provider variables, not the native registry). Use the inspected registry path in doctor's error detail, and keep the new command tests hermetic with temporary keystore and model-cache paths.
10 of 12 tasks
TheStreamCode
added a commit
that referenced
this pull request
Nov 1, 2026
## Summary Follow-up to #30, addressing the findings from the delayed review of that PR. The merge landed before the review finished; this branch fixes the valid points on top of `main`. ## Change - Native registry lifecycle: the temporary directory is made owner-only before the file exists, a failed restriction aborts the session instead of leaving keys readable, cleanup covers SIGINT/SIGTERM/SIGHUP, cleanup failures are reported, and stale registries older than a week are swept at the next native startup for the uncatchable cases. - `--native-byok --dry-run` no longer writes provider keys to disk. With no active provider it returns the native shape (`mode: native-byok`, empty arrays) instead of falling back to the stock dry-run shape. - `--legacy` accepts a provider that only has `apiKeyCommand` (Copilot CLI 1.0.84+). `--list-providers` and `doctor` mark it as legacy-only, because the CLI's `providers.json` registry has no credential-command equivalent. - The reasoning-effort ladder steps down only when a `400` body mentions the reasoning effort. Ordinary context, schema or content-policy `400`s are forwarded unchanged instead of consuming seven retries and polluting the rejection memory. - `doctor` sanitizes the environment of the Copilot version probe, reports discovery failures in `--online` instead of an empty success, and distinguishes keyed providers, authless providers and credential-command providers. - `COPILOT_PROVIDER_HEADERS` is redacted in dry-run output, and `headers` must be an object of strings like `modelsHeaders`. - The published schema descriptions no longer describe the old reasoning-effort behavior. - Tests: registry permission failure and mode checks, stale sweep, real native session with a fake Copilot, unrelated-400 passthrough, per-test effort state reset, doctor sanitization and discovery failure, command-only provider, live discovery in `models`, headers validation. ## Verification - `npm run check`: lint clean; 235 tests, 233 pass, 2 skipped (POSIX-only), 0 fail. - `npm pack --dry-run`: 43 files, 79.3 kB. - `npm audit --omit=dev --audit-level=high`: 0 vulnerabilities. - markdownlint on the root documents: 0 issues. - No real provider account or live data residency tenant was available; those remain unverified and are labelled as such in the verification matrix. ## Checklist - [x] `npm run check` passes - [x] `npm pack --dry-run` passes - [x] `npm audit --omit=dev --audit-level=high` passes - [x] Tests added or updated for behavior changes - [x] Cross-platform behavior considered for Windows, macOS, and Linux - [ ] Verified with at least one real provider when provider behavior changed (unit and mock only; the native session path is exercised with a fake Copilot) - [ ] Required CI checks pass (waiting for the PR run) - [x] Focused change, one problem per pull request - [x] Public behavior documented in the README or the relevant `docs/` file - [x] `CHANGELOG.md` updated when user-visible behavior changed - [x] No credentials, inline secret examples, or secret-bearing URLs are included - [x] No dependency added without a stated reason --------- Co-authored-by: Michael Gasperini <michael@mikesoft.it>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Aligns the project with GitHub Copilot CLI 1.0.105 and corrects claims that the current CLI has outgrown. The re-verification showed three things that mattered: the CLI now forwards reasoning effort to BYOK providers, it loads the supported
providers.jsonregistry with multiple providers, andCOPILOT_API_URLstill works but remains undocumented.Closes nothing; this is a compatibility and maintenance change.
Change
400was replayed unchanged. The retry now carries the stepped-down level, attempts are capped, and the close listener is attached once per request.--native-byok: discovery runs as usual, a private temporaryproviders.jsonis written and passed withCOPILOT_PROVIDERS_CONFIG, and the file is removed when the session ends. No router, noCOPILOT_API_URLdependency.copilot-byok doctorandcopilot-byok models, both with--json;modelsalso supports--offline.--legacynow isolates itself from a userproviders.json(which takes precedence overCOPILOT_PROVIDER_*) with an empty temporary registry, and passesCOPILOT_PROVIDER_MODEL_ID,COPILOT_PROVIDER_HEADERS, andCOPILOT_PROVIDER_API_KEY_COMMAND.copilot-api.<tenant>.ghe.com) fromCOPILOT_GH_HOST/GH_HOST.reasoningEffortPicker: falseas the opt-out.echo-config.jsonfixture and theAGENTS.mdstructure drift.Verification
npm run check: lint clean; 224 tests, 222 pass, 2 skipped (POSIX-only), 0 fail.npm run test:coverage: 84.09% lines, 82.72% branches.npm pack --dry-run: 43 files, 75.4 kB, only the documented package contents.npm audit --omit=dev --audit-level=high: 0 vulnerabilities.--native-byokon Copilot CLI 1.0.105 with an isolatedCOPILOT_HOMEand a local OpenAI-compatible mock: the generated registry was accepted, Copilot calledPOST /v1/chat/completionswith the pinned model, used the reply, and the temporary registry was removed.providers.jsonsupport were checked against 1.0.79 (absent) and 1.0.105 (present) with mock providers. No real provider credential was used, so a real-account provider run was not performed.Checklist
npm run checkpassesnpm pack --dry-runpassesnpm audit --omit=dev --audit-level=highpassesdocs/fileCHANGELOG.mdupdated when user-visible behavior changed