@capagents/forgeqe 2.2.5 → 2.2.7

package/HOW_TO_USE.md

@@ -170,7 +170,7 @@ forgeqe start                         # the shell
 With GitHub Copilot licences instead of a model key, sign in rather than exporting one, and set `llm.active: copilot` in `forgeqe.yaml` (or `"default": "copilot"` in `llms.json`). The browser engine then runs on your Copilot seat; ForgeQE's agent and Scribe need another profile for now:
 
 ```bash
-forgeqe auth login copilot            # a fine-grained token with Copilot Requests, or the GitHub CLI's sign-in
+forgeqe auth login copilot            # opens GitHub in your browser to sign in
 forgeqe models                        # the copilot profile is active
 ```
 
@@ -320,22 +320,24 @@ With GitHub Copilot licences (Pro, Pro+, Business or Enterprise), a `github_copi
 |---|---|
 | `model` | The Copilot model, as the Copilot SDK names it (`gpt-4.1`, `claude-sonnet-4.6`). It must take screenshots. The sign-in lists your seat's models and which of them take images. |
 | `engine_model` | Optional. Another Copilot model for the browser engine and the desktop agent. |
-| `api_key_env` | Optional. The variable holding the GitHub token; without it ForgeQE reads `COPILOT_GITHUB_TOKEN`, then the token `forgeqe auth login copilot` saved, then the GitHub CLI's sign-in. |
+| `api_key_env` | Optional. A variable that must hold the GitHub token for this profile. Without it ForgeQE uses `COPILOT_GITHUB_TOKEN`, then a token `forgeqe auth login copilot` saved, then the browser sign-in. |
 
-Sign in once per machine:
+Sign in once per machine (Windows, macOS or Linux):
 
 ```bash
 forgeqe auth login copilot
 ```
 
-It offers two ways:
+It offers two ways, the ones GitHub's Copilot SDK recommends:
 
-- **A fine-grained token** (recommended). ForgeQE opens GitHub's token page: set **Resource owner** to your personal account and add the **Copilot Requests** permission, then paste the token (`github_pat_...`). The token goes to your system's credential store like ForgeQE's other secrets. Classic tokens (`ghp_`) do not work with Copilot.
-- **The GitHub CLI's sign-in**, when `gh` is signed in.
+- **Sign in with GitHub in the browser** (recommended on your own computer). ForgeQE runs GitHub's own Copilot sign-in (`copilot login` from GitHub's Copilot CLI, downloaded once into `~/.forgeqe/tools` and checked against GitHub's checksums). Your browser opens GitHub; approve **GitHub Copilot CLI** there and you are signed in. GitHub's CLI keeps the sign-in in your system's credential store (Windows Credential Manager, the macOS Keychain); ForgeQE never sees a token. On a remote machine it shows a code to enter at github.com/login/device instead.
+- **A fine-grained token**, for machines without a browser. ForgeQE opens GitHub's token page: set **Resource owner** to your personal account and add the **Copilot Requests** permission, then paste the token (`github_pat_...`). Each character shows as `*`, and ForgeQE confirms what it got (`github_pat_11AB…Wz9Q (93 characters)`). The token goes to your system's credential store like ForgeQE's other secrets. Classic tokens (`ghp_`) do not work with Copilot.
 
-Either way ForgeQE checks the token by asking Copilot for your seat's models and lists them; the first time, the Copilot SDK downloads Copilot's runtime from GitHub (checked against GitHub's checksums). `forgeqe auth` shows the sign-in on its `Copilot` line; `forgeqe auth logout copilot` forgets a saved token.
+Either way ForgeQE checks the sign-in by asking Copilot for your seat's models and lists them; the first time, the Copilot SDK downloads Copilot's runtime from GitHub (checked against GitHub's checksums). `forgeqe auth` shows the sign-in on its `Copilot` line; `forgeqe auth logout copilot` makes ForgeQE stop using it (GitHub keeps a browser sign-in until you revoke **GitHub Copilot CLI** at github.com/settings/applications).
 
-The token reaches only the gateway's process. The engine gets the gateway's address and a one-time key that works nowhere else; the gateway refuses requests without that key and any request a web page sends. Model-run shell commands never see the token or the key.
+If your organization uses SAML single sign-on, GitHub asks you to authorize the organization during the browser sign-in. A Copilot Business or Enterprise seat needs your organization to allow **Copilot CLI** in its Copilot policies.
+
+A token reaches only the gateway's process. The engine gets the gateway's address and a one-time key that works nowhere else; the gateway refuses requests without that key and any request a web page sends. Model-run shell commands never see the token or the key.
 
 Which part uses what:
 
@@ -355,8 +357,9 @@ GitHub Models, which ForgeQE used for the engine before, was [retired by GitHub]
 
 | ForgeQE says | What to do |
 |---|---|
-| `GitHub Copilot needs a GitHub token, and there is none` | Run `forgeqe auth login copilot` (or `/auth copilot` in the shell), or set `COPILOT_GITHUB_TOKEN`. |
-| `GitHub Copilot does not take classic tokens (ghp_)` | Make a fine-grained token with the Copilot Requests permission, owned by your personal account. |
+| `GitHub Copilot is not signed in` | Run `forgeqe auth login copilot` (or `/auth copilot` in the shell) and sign in in the browser, or set `COPILOT_GITHUB_TOKEN`. |
+| `The GitHub sign-in did not finish` | The browser sign-in was cancelled or denied. Run `forgeqe auth login copilot` again; with SAML single sign-on, authorize your organization when GitHub asks. |
+| `GitHub Copilot does not take classic tokens (ghp_)` | Sign in in the browser instead, or make a fine-grained token with the Copilot Requests permission, owned by your personal account. |
 | `GitHub Copilot did not accept the token` | The token has no Copilot Requests permission, has expired, or the account has no Copilot seat. |
 | `… must be a Copilot model id`, `engine_model must be a Copilot model id` | Fix that field in `llms.json`: the sign-in lists the seat's models. A GitHub Models id such as `openai/gpt-4.1` is not a Copilot id; use `gpt-4.1`. |
 | `ForgeQE's agent and Scribe cannot run on a github_copilot profile yet` | Pick another profile for them (`--profile`, or Tab in the shell), or set `code.model`. |
@@ -440,7 +443,7 @@ In the shell, type `/auth jira` (or `/auth` alone for the status). Tokens are ty
 |--------|-----------------|
 | Azure DevOps | **Sign in with Microsoft in the browser** through the Azure CLI (`az login`); ForgeQE saves nothing, and the Azure CLI renews the sign-in. Or paste a personal access token: the token page opens with the scopes to tick. Azure DevOps Server (on-premises) uses a personal access token. |
 | GitHub | **Sign in with GitHub in the browser** through the GitHub CLI (`gh auth login`): ForgeQE shows the one-time code and opens the page. Or paste a token. Needs `gh` installed. `forgeqe auth login copilot` can use this sign-in for a `github_copilot` profile. |
-| GitHub Copilot | `forgeqe auth login copilot`: **Paste a fine-grained token** with the Copilot Requests permission (ForgeQE opens GitHub's token page), or use the GitHub CLI's sign-in. ForgeQE checks it with Copilot and lists the models your seat has. No other app is authorized on your GitHub account. For a `github_copilot` profile; see [GitHub Copilot seats as the model](#github-copilot-seats-as-the-model). |
+| GitHub Copilot | `forgeqe auth login copilot`: **Sign in with GitHub in the browser** (GitHub's own Copilot sign-in), or paste a fine-grained token with the Copilot Requests permission. ForgeQE checks it with Copilot and lists the models your seat has. For a `github_copilot` profile; see [GitHub Copilot seats as the model](#github-copilot-seats-as-the-model). |
 | Jira, Confluence | Your Atlassian API tokens page opens (Cloud) or your personal access tokens page (Server/Data Center); create one and paste it. Confluence on the same Cloud site as Jira reuses the Jira sign-in. |
 | TestRail, Zephyr Scale, qTest, Xray Cloud | The page with your API key opens, or ForgeQE says where to find it; paste it. |
 | Anything else | `forgeqe auth login OPENAI_API_KEY` (any variable name) saves that one secret: a model key, a Teams webhook URL, an SMTP or saved-login password. |
@@ -2800,7 +2803,7 @@ the list again. For a client that ignores it, `forgeqe mcp --all-tools` lists ev
 | `WP_LLMS_JSON` | Path to `llms.json` |
 | `WP_LLM_PROFILE` | Active profile, unless `--profile` is set |
 | `WP_AZURE_API_KEY` / `OPENAI_API_KEY` / `WP_API_KEY` | Keys referenced by profiles |
-| `COPILOT_GITHUB_TOKEN` | A `github_copilot` profile's GitHub token (fine-grained, with the Copilot Requests permission), unless the profile's `api_key_env` names another; else the saved token, then the GitHub CLI's sign-in |
+| `COPILOT_GITHUB_TOKEN` | A `github_copilot` profile's GitHub token (fine-grained, with the Copilot Requests permission), unless the profile's `api_key_env` names another; else the saved token, then the browser sign-in (`forgeqe auth login copilot`) |
 | `FORGEQE_COPILOT_TOKEN` | The token `forgeqe auth login copilot` saves; set by ForgeQE from the credential store, not by hand |
 | `FORGEQE_CONFIG_DIR` | Global config folder (default `~/.config/forgeqe`): `forgeqe.yaml`, `llms.json` and `.env` used when a project has none |
 | `FORGEQE_PYTHON` | A Python that already has the engine's libraries, used instead of the managed venv (skipped, with a note, when it cannot run the engine) |

package/README.md

@@ -44,6 +44,22 @@ One-shot release (same version on both registries; assumes `npm` and `twine` are
 ./scripts/publish.sh --dry-run # pack only
 ```
 
+Or let CI publish: merge a version bump (the same version in `package.json`, `pyproject.toml` and
+`py/forgeqe_cli/__init__.py`) to `main`, and [`forgeqe-release.yml`](../.github/workflows/forgeqe-release.yml) runs the
+release tests and publishes it to npm and PyPI. It publishes only a version newer than the one each registry has. Run it
+by hand from the Actions tab for a dry run.
+
+It needs no token: both registries trust the workflow (trusted publishing). Set that up once, as the package owner:
+
+```bash
+npm install -g npm@^11.15.0 && npm login
+npm trust github @capagents/forgeqe --file forgeqe-release.yml --repo javed0211/cli-agents --allow-publish
+```
+
+and on pypi.org, under `forgeqe-cli` → Publishing, add a GitHub trusted publisher: owner `javed0211`, repository
+`cli-agents`, workflow `forgeqe-release.yml`, no environment. A new npm trust that has not published within 2 days
+expires, so do it just before the first release.
+
 ## Privacy
 
 ForgeQE sends no telemetry and turns it off in everything it starts:

package/THIRD_PARTY_NOTICES.md

@@ -18,7 +18,7 @@ Most of these libraries are inside `dist/forgeqe.js`, the bundle ForgeQE ships;
 | strip-ansi | 7.1.2 | MIT | string-width |
 | ansi-regex | 6.4.0 | MIT | strip-ansi |
 | @opentui/core-darwin-x64 | 0.5.12 | MIT | A build of @opentui/core for another platform, installed there in its place; same licence. |
-| @opentui/core-darwin-arm64 | 0.5.12 | MIT | @opentui/core |
+| @opentui/core-darwin-arm64 | 0.5.12 | MIT | A build of @opentui/core for another platform, installed there in its place; same licence. |
 | @opentui/core-linux-x64 | 0.5.12 | MIT | A build of @opentui/core for another platform, installed there in its place; same licence. |
 | @opentui/core-linux-arm64 | 0.5.12 | MIT | A build of @opentui/core for another platform, installed there in its place; same licence. |
 | @opentui/core-win32-x64 | 0.5.12 | MIT | A build of @opentui/core for another platform, installed there in its place; same licence. |
@@ -61,7 +61,7 @@ ForgeQE downloads these onto the machine it runs on, from their own sources, whe
 | OpenCode | the agent runtime for ForgeQE's agent and Scribe (src/code/runtime.ts) | MIT | https://opencode.ai |
 | uv and Python | the browser engine's interpreter (src/engine/setup.ts) | MIT or Apache-2.0; PSF | https://github.com/astral-sh/uv |
 | browser-use, Playwright, PyYAML, azure-identity, github-copilot-sdk, truststore | the browser engine's libraries and Chromium (src/engine/setup.ts) | MIT; Apache-2.0; MIT; MIT; MIT; MIT | https://pypi.org |
-| GitHub Copilot CLI runtime | downloaded by GitHub's Copilot SDK for github_copilot profiles (src/copilot.ts) | GitHub Copilot CLI license (GitHub) | https://github.com/github/copilot-cli |
+| GitHub Copilot CLI and its runtime | the runtime downloaded by GitHub's Copilot SDK for github_copilot profiles (src/copilot.ts), and the CLI for the browser sign-in (src/auth/copilotLogin.ts) | GitHub Copilot CLI license (GitHub) | https://github.com/github/copilot-cli |
 
 ## Licence texts
 
@@ -258,34 +258,6 @@ The above copyright notice and this permission notice shall be included in all c
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ```
 
-### @opentui/core-darwin-arm64 0.5.12
-
-MIT. https://github.com/anomalyco/opentui
-
-```text
-MIT License
-
-Copyright (c) 2025 opentui
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-```
-
 ### cross-spawn 7.0.6
 
 MIT. https://github.com/moxystudio/node-cross-spawn