@openhoo/hoopilot 0.2.3 → 0.3.0

package/dist/cli.js

@@ -5,17 +5,14 @@ import { execFileSync } from "child_process";
 var DEFAULT_COPILOT_API_BASE_URL = "https://api.individual.githubcopilot.com";
 var DEFAULT_TOKEN_EXCHANGE_URL = "https://api.github.com/copilot_internal/v2/token";
 var REFRESH_SKEW_MS = 6e4;
-var defaultLogger = {
-  info: () => void 0,
-  warn: () => void 0,
-  error: () => void 0
-};
 var CopilotAuthError = class extends Error {
   constructor(message) {
     super(message);
     this.name = "CopilotAuthError";
   }
 };
+var CopilotTokenExchangeHttpError = class extends CopilotAuthError {
+};
 var CopilotAuth = class {
   #authMode;
   #copilotApiBaseUrl;
@@ -37,7 +34,7 @@ var CopilotAuth = class {
     this.#fetch = options.fetch ?? fetch;
     this.#githubToken = options.githubToken;
     this.#githubTokenCommand = options.githubTokenCommand ?? "gh auth token";
-    this.#logger = options.logger ?? defaultLogger;
+    this.#logger = options.logger;
     this.#tokenExchangeUrl = options.tokenExchangeUrl ?? options.env?.COPILOT_TOKEN_EXCHANGE_URL ?? DEFAULT_TOKEN_EXCHANGE_URL;
   }
   async getAccess() {
@@ -45,17 +42,6 @@ var CopilotAuth = class {
       return this.#cachedAccess;
     }
     const directCopilotToken = this.#resolveDirectCopilotToken();
-    if (this.#authMode === "copilot-token") {
-      if (!directCopilotToken) {
-        throw new CopilotAuthError("COPILOT_API_TOKEN or GITHUB_COPILOT_API_TOKEN is required.");
-      }
-      return this.#cacheAccess({
-        apiBaseUrl: this.#copilotApiBaseUrl,
-        expiresAtMs: Date.now() + 10 * 6e4,
-        source: "copilot-token",
-        token: directCopilotToken
-      });
-    }
     if (directCopilotToken) {
       return this.#cacheAccess({
         apiBaseUrl: this.#copilotApiBaseUrl,
@@ -64,29 +50,30 @@ var CopilotAuth = class {
         token: directCopilotToken
       });
     }
+    if (this.#authMode === "copilot-token") {
+      throw new CopilotAuthError("COPILOT_API_TOKEN or GITHUB_COPILOT_API_TOKEN is required.");
+    }
     const githubToken = this.#resolveGithubToken();
     if (!githubToken) {
       throw new CopilotAuthError(
-        "No Copilot credential found. Set COPILOT_GITHUB_TOKEN, GITHUB_TOKEN, or sign in with gh auth login."
+        "No Copilot credential found. Set COPILOT_API_TOKEN, set COPILOT_GITHUB_TOKEN from gh auth token, or sign in with gh auth login."
       );
     }
-    if (this.#authMode === "direct-github-token") {
-      return this.#cacheAccess({
-        apiBaseUrl: this.#copilotApiBaseUrl,
-        expiresAtMs: Date.now() + 10 * 6e4,
-        source: "direct-github-token",
-        token: githubToken
-      });
+    if (isPersonalAccessToken(githubToken)) {
+      throw new CopilotAuthError(
+        "GitHub personal access tokens are not supported for Copilot authentication. Use gh auth login or COPILOT_API_TOKEN."
+      );
     }
     try {
-      const exchanged = await this.#exchangeGithubToken(githubToken);
-      return this.#cacheAccess(exchanged);
+      return this.#cacheAccess(await this.#exchangeGithubToken(githubToken));
     } catch (error) {
-      if (this.#authMode === "github-token") {
+      if (!(error instanceof CopilotTokenExchangeHttpError)) {
         throw error;
       }
-      this.#logger.warn(
-        `Copilot token exchange failed; falling back to direct GitHub token mode: ${errorMessage(error)}`
+      this.#logger?.warn(
+        `Copilot token exchange failed; falling back to GitHub CLI token mode: ${errorMessage(
+          error
+        )}`
       );
       return this.#cacheAccess({
         apiBaseUrl: this.#copilotApiBaseUrl,
@@ -112,7 +99,7 @@ var CopilotAuth = class {
       method: "GET"
     });
     if (!response.ok) {
-      throw new CopilotAuthError(
+      throw new CopilotTokenExchangeHttpError(
         `GitHub Copilot token exchange failed with ${response.status}: ${await safeResponseText(
           response
         )}`
@@ -143,8 +130,6 @@ var CopilotAuth = class {
       this.#githubToken,
       this.#env.COPILOT_GITHUB_TOKEN,
       this.#env.GITHUB_COPILOT_GITHUB_TOKEN,
-      this.#env.GH_TOKEN,
-      this.#env.GITHUB_TOKEN,
       this.#readGithubTokenCommand()
     );
   }
@@ -259,6 +244,9 @@ async function safeResponseText(response) {
   const text = await response.text();
   return text.slice(0, 500);
 }
+function isPersonalAccessToken(token) {
+  return token.startsWith("github_pat_") || token.startsWith("ghp_");
+}
 function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
@@ -1022,21 +1010,516 @@ function errorMessage2(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
+// src/update.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import {
+  chmodSync,
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+  realpathSync,
+  renameSync,
+  rmSync
+} from "fs";
+import { readFile, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { dirname, join } from "path";
+
+// src/update-core.ts
+var REPO_OWNER = "openhoo";
+var REPO_NAME = "hoopilot";
+var REPO = `${REPO_OWNER}/${REPO_NAME}`;
+var NPM_PACKAGE = "@openhoo/hoopilot";
+var UPDATE_CHECK_INTERVAL_MS = 1e3 * 60 * 60 * 24;
+function parseSemver(input) {
+  const value = String(input).trim().replace(/^[v=]+/, "");
+  const match = value.match(/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/);
+  if (!match) {
+    return null;
+  }
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3]),
+    // Build metadata (everything after "+") is intentionally dropped.
+    prerelease: match[4] ? match[4].split(".") : []
+  };
+}
+function comparePrerelease(a, b) {
+  if (a.length === 0 && b.length === 0) {
+    return 0;
+  }
+  if (a.length === 0) {
+    return 1;
+  }
+  if (b.length === 0) {
+    return -1;
+  }
+  const len = Math.max(a.length, b.length);
+  for (let i = 0; i < len; i++) {
+    const x = a[i];
+    const y = b[i];
+    if (x === void 0) {
+      return -1;
+    }
+    if (y === void 0) {
+      return 1;
+    }
+    const xNumeric = /^\d+$/.test(x);
+    const yNumeric = /^\d+$/.test(y);
+    if (xNumeric && yNumeric) {
+      const diff = Number(x) - Number(y);
+      if (diff !== 0) {
+        return diff < 0 ? -1 : 1;
+      }
+    } else if (xNumeric) {
+      return -1;
+    } else if (yNumeric) {
+      return 1;
+    } else if (x !== y) {
+      return x < y ? -1 : 1;
+    }
+  }
+  return 0;
+}
+function compareSemver(a, b) {
+  const pa = parseSemver(a);
+  const pb = parseSemver(b);
+  if (!pa || !pb) {
+    if (!pa && !pb) {
+      return 0;
+    }
+    return pa ? 1 : -1;
+  }
+  if (pa.major !== pb.major) {
+    return pa.major < pb.major ? -1 : 1;
+  }
+  if (pa.minor !== pb.minor) {
+    return pa.minor < pb.minor ? -1 : 1;
+  }
+  if (pa.patch !== pb.patch) {
+    return pa.patch < pb.patch ? -1 : 1;
+  }
+  return comparePrerelease(pa.prerelease, pb.prerelease);
+}
+function isOutdated(current, latest) {
+  return compareSemver(current, latest) < 0;
+}
+function versionFromTag(tag) {
+  return tag.trim().replace(/^v/, "");
+}
+function assetSuffixFor(platform, arch, isMusl) {
+  const os = platform === "win32" ? "windows" : platform === "darwin" ? "darwin" : "linux";
+  const cpu = arch === "arm64" || arch === "aarch64" ? "arm64" : "x64";
+  const libc = os === "linux" && isMusl ? "-musl" : "";
+  return `${os}-${cpu}${libc}`;
+}
+function assetNameFor(suffix) {
+  const name = `hoopilot-${suffix}`;
+  return suffix.startsWith("windows-") ? `${name}.exe` : name;
+}
+function isUpdateCheckDisabled(env, isTty) {
+  if (env.HOOPILOT_NO_UPDATE_CHECK || env.NO_UPDATE_NOTIFIER) {
+    return true;
+  }
+  if (env.NODE_ENV === "test") {
+    return true;
+  }
+  if (!isTty) {
+    return true;
+  }
+  if (env.CI && env.CI !== "false" || env.CONTINUOUS_INTEGRATION || env.GITHUB_ACTIONS || env.BUILD_NUMBER || env.RUN_ID) {
+    return true;
+  }
+  return false;
+}
+function shouldRefresh(lastCheck, now, intervalMs = UPDATE_CHECK_INTERVAL_MS) {
+  return now - lastCheck >= intervalMs;
+}
+function upgradeCommandFor(kind) {
+  return kind === "binary" ? "hoopilot update" : `npm install -g ${NPM_PACKAGE}@latest  (or: bun add -g ${NPM_PACKAGE})`;
+}
+function shouldCleanupOldBinary(platform, isStandaloneBinary) {
+  return platform === "win32" && isStandaloneBinary;
+}
+function formatUpdateNotice(current, latest, kind) {
+  return `
+Update available for hoopilot: ${current} \u2192 ${latest}
+Run: ${upgradeCommandFor(kind)}
+
+`;
+}
+function parseState(text) {
+  try {
+    const data = JSON.parse(text);
+    return {
+      lastCheck: typeof data.lastCheck === "number" ? data.lastCheck : 0,
+      latestVersion: typeof data.latestVersion === "string" ? data.latestVersion : null,
+      etag: typeof data.etag === "string" ? data.etag : null
+    };
+  } catch {
+    return { lastCheck: 0, latestVersion: null, etag: null };
+  }
+}
+function parseLatestRelease(json) {
+  if (!json || typeof json !== "object") {
+    return null;
+  }
+  const record = json;
+  const tag = typeof record.tag_name === "string" ? record.tag_name : void 0;
+  if (!tag) {
+    return null;
+  }
+  const assets = [];
+  if (Array.isArray(record.assets)) {
+    for (const item of record.assets) {
+      if (item && typeof item === "object") {
+        const asset = item;
+        if (typeof asset.name === "string" && typeof asset.browser_download_url === "string") {
+          assets.push({ name: asset.name, url: asset.browser_download_url });
+        }
+      }
+    }
+  }
+  return { version: versionFromTag(tag), tag, assets };
+}
+function checksumFor(sumsText, fileName) {
+  for (const line of sumsText.split(/\r?\n/)) {
+    const match = line.trim().match(/^([0-9a-fA-F]{64})\s+\*?(.+)$/);
+    if (match?.[1] && match[2]?.trim() === fileName) {
+      return match[1].toLowerCase();
+    }
+  }
+  return void 0;
+}
+function resolveCacheDir(env, platform, homedir2, join2) {
+  if (platform === "win32") {
+    const base2 = env.LOCALAPPDATA || join2(homedir2, "AppData", "Local");
+    return join2(base2, "hoopilot");
+  }
+  if (platform === "darwin") {
+    return join2(homedir2, "Library", "Caches", "hoopilot");
+  }
+  const base = env.XDG_CACHE_HOME || join2(homedir2, ".cache");
+  return join2(base, "hoopilot");
+}
+function latestReleaseApiUrl() {
+  return `https://api.github.com/repos/${REPO}/releases/latest`;
+}
+
+// src/version.ts
+var BAKED_VERSION = typeof HOOPILOT_VERSION !== "undefined" ? HOOPILOT_VERSION : void 0;
+var BAKED_TARGET = typeof HOOPILOT_TARGET !== "undefined" ? HOOPILOT_TARGET : void 0;
+var IS_STANDALONE_BINARY = BAKED_VERSION !== void 0;
+var cachedVersion;
+async function getVersion() {
+  if (cachedVersion !== void 0) {
+    return cachedVersion;
+  }
+  let resolved;
+  if (BAKED_VERSION) {
+    resolved = BAKED_VERSION;
+  } else {
+    try {
+      const manifest = await Bun.file(new URL("../package.json", import.meta.url)).json();
+      resolved = typeof manifest.version === "string" ? manifest.version : "0.0.0";
+    } catch {
+      resolved = "0.0.0";
+    }
+  }
+  cachedVersion = resolved;
+  return resolved;
+}
+
+// src/update.ts
+var REQUEST_TIMEOUT_MS = 8e3;
+var SHA256SUMS = "SHA256SUMS";
+function userAgent(version) {
+  return `hoopilot/${version}`;
+}
+function cacheDir() {
+  return resolveCacheDir(process.env, process.platform, homedir(), join);
+}
+function stateFilePath() {
+  return join(cacheDir(), "update-check.json");
+}
+async function readStateSafe() {
+  try {
+    return parseState(await readFile(stateFilePath(), "utf8"));
+  } catch {
+    return { lastCheck: 0, latestVersion: null, etag: null };
+  }
+}
+async function writeStateSafe(state) {
+  try {
+    mkdirSync(cacheDir(), { recursive: true });
+    await writeFile(stateFilePath(), JSON.stringify(state), "utf8");
+  } catch {
+  }
+}
+async function fetchLatest(version, etag) {
+  try {
+    const headers = {
+      Accept: "application/vnd.github+json",
+      "User-Agent": userAgent(version),
+      "X-GitHub-Api-Version": "2022-11-28"
+    };
+    if (etag) {
+      headers["If-None-Match"] = etag;
+    }
+    const response = await fetch(latestReleaseApiUrl(), {
+      headers,
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+    });
+    if (response.status === 304) {
+      return { status: 304, etag: etag ?? null, release: null };
+    }
+    if (!response.ok) {
+      return { status: response.status, etag: null, release: null };
+    }
+    return {
+      status: response.status,
+      etag: response.headers.get("etag"),
+      release: parseLatestRelease(await response.json())
+    };
+  } catch {
+    return null;
+  }
+}
+async function maybeNotifyUpdate(currentVersion, kind) {
+  if (isUpdateCheckDisabled(process.env, Boolean(process.stderr.isTTY))) {
+    return;
+  }
+  const state = await readStateSafe();
+  if (state.latestVersion && isOutdated(currentVersion, state.latestVersion)) {
+    process.stderr.write(formatUpdateNotice(currentVersion, state.latestVersion, kind));
+  }
+  if (shouldRefresh(state.lastCheck, Date.now())) {
+    void refreshState(currentVersion, state.etag ?? null).catch(() => {
+    });
+  }
+}
+async function refreshState(currentVersion, etag) {
+  const result = await fetchLatest(currentVersion, etag);
+  if (!result) {
+    return;
+  }
+  if (result.status === 304) {
+    const prev = await readStateSafe();
+    await writeStateSafe({ ...prev, lastCheck: Date.now() });
+    return;
+  }
+  if (result.release) {
+    await writeStateSafe({
+      lastCheck: Date.now(),
+      latestVersion: result.release.version,
+      etag: result.etag
+    });
+  }
+}
+function detectInstallKind() {
+  return IS_STANDALONE_BINARY ? "binary" : "npm";
+}
+function detectMusl() {
+  if (process.platform !== "linux") {
+    return false;
+  }
+  try {
+    const report = process.report?.getReport?.();
+    if (report?.header && "glibcVersionRuntime" in report.header) {
+      return !report.header.glibcVersionRuntime;
+    }
+  } catch {
+  }
+  try {
+    if (existsSync("/etc/alpine-release")) {
+      return true;
+    }
+    const ldd = execFileSync2("ldd", ["--version"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 2e3
+    });
+    return /musl/i.test(ldd);
+  } catch {
+    return false;
+  }
+}
+async function downloadToFile(url, dest, version) {
+  const response = await fetch(url, {
+    headers: { "User-Agent": userAgent(version) },
+    redirect: "follow",
+    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS * 10)
+  });
+  if (!response.ok || !response.body) {
+    throw new Error(`Download failed (${response.status}) for ${url}`);
+  }
+  await Bun.write(dest, response);
+}
+async function sha256File(path) {
+  const hasher = new Bun.CryptoHasher("sha256");
+  hasher.update(await Bun.file(path).arrayBuffer());
+  return hasher.digest("hex");
+}
+async function verifyChecksum(release, assetName, file, version) {
+  const sums = release.assets.find((asset) => asset.name === SHA256SUMS);
+  if (!sums) {
+    throw new Error(
+      `Release ${release.tag} has no ${SHA256SUMS}; refusing to install an unverified binary.`
+    );
+  }
+  const response = await fetch(sums.url, {
+    headers: { "User-Agent": userAgent(version) },
+    redirect: "follow",
+    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+  });
+  if (!response.ok) {
+    throw new Error(`Could not download ${SHA256SUMS} (${response.status}).`);
+  }
+  const expected = checksumFor(await response.text(), assetName);
+  if (!expected) {
+    throw new Error(`No checksum for ${assetName} in ${SHA256SUMS}.`);
+  }
+  const actual = await sha256File(file);
+  if (actual.toLowerCase() !== expected) {
+    throw new Error(`Checksum mismatch for ${assetName}: expected ${expected}, got ${actual}.`);
+  }
+}
+function swapBinary(tmpFile, exePath) {
+  if (process.platform === "win32") {
+    const oldExe = `${exePath}.old`;
+    try {
+      rmSync(oldExe, { force: true });
+    } catch {
+    }
+    renameSync(exePath, oldExe);
+    const restore = () => {
+      try {
+        renameSync(oldExe, exePath);
+      } catch {
+      }
+    };
+    try {
+      renameSync(tmpFile, exePath);
+    } catch (error) {
+      if (error.code === "EXDEV") {
+        try {
+          copyFileSync(tmpFile, exePath);
+        } catch (copyError) {
+          restore();
+          throw copyError;
+        }
+      } else {
+        restore();
+        throw error;
+      }
+    }
+    return;
+  }
+  try {
+    renameSync(tmpFile, exePath);
+  } catch (error) {
+    const code = error.code;
+    if (code === "EXDEV") {
+      copyFileSync(tmpFile, exePath);
+      chmodSync(exePath, 493);
+    } else if (code === "EACCES" || code === "EPERM") {
+      throw new Error(
+        `No permission to update ${exePath}. Re-run with sudo, or reinstall to a writable directory.`
+      );
+    } else {
+      throw error;
+    }
+  }
+}
+function cleanupOldBinary() {
+  if (!shouldCleanupOldBinary(process.platform, IS_STANDALONE_BINARY)) {
+    return;
+  }
+  try {
+    rmSync(`${realpathSync(process.execPath)}.old`, { force: true });
+  } catch {
+  }
+}
+async function runUpdate(currentVersion) {
+  cleanupOldBinary();
+  const kind = detectInstallKind();
+  if (kind !== "binary") {
+    console.log(`hoopilot ${currentVersion} was installed via npm.`);
+    console.log(`Update with: ${upgradeCommandFor("npm")}`);
+    return;
+  }
+  console.log(`hoopilot ${currentVersion} \u2014 checking for updates...`);
+  const result = await fetchLatest(currentVersion);
+  const release = result?.release ?? null;
+  if (!release) {
+    throw new Error("Could not reach GitHub to check for the latest release.");
+  }
+  if (!isOutdated(currentVersion, release.version)) {
+    console.log(`Already up to date (latest: ${release.version}).`);
+    return;
+  }
+  const suffix = BAKED_TARGET ?? assetSuffixFor(process.platform, process.arch, detectMusl());
+  const assetName = assetNameFor(suffix);
+  const asset = release.assets.find((entry) => entry.name === assetName);
+  if (!asset) {
+    const available = release.assets.map((entry) => entry.name).join(", ") || "none";
+    throw new Error(`Release ${release.tag} has no asset "${assetName}". Available: ${available}.`);
+  }
+  console.log(`Updating ${currentVersion} \u2192 ${release.version} (${assetName})...`);
+  const exePath = realpathSync(process.execPath);
+  const tmpFile = join(dirname(exePath), `.hoopilot-update-${process.pid}.tmp`);
+  try {
+    await downloadToFile(asset.url, tmpFile, currentVersion);
+    await verifyChecksum(release, assetName, tmpFile, currentVersion);
+    if (process.platform !== "win32") {
+      chmodSync(tmpFile, 493);
+    }
+    swapBinary(tmpFile, exePath);
+  } catch (error) {
+    const code = error.code;
+    if (code === "EACCES" || code === "EPERM") {
+      throw new Error(
+        `No permission to update ${exePath}. Re-run with sudo, or reinstall to a writable directory (e.g. set HOOPILOT_INSTALL_DIR).`
+      );
+    }
+    throw error;
+  } finally {
+    try {
+      rmSync(tmpFile, { force: true });
+    } catch {
+    }
+  }
+  console.log(`Updated hoopilot to ${release.version}.`);
+  if (process.platform === "win32") {
+    console.log("Restart hoopilot to run the new version.");
+  }
+}
+
 // src/cli.ts
 async function main(argv = Bun.argv.slice(2)) {
+  cleanupOldBinary();
+  const command = argv[0];
+  if (command === "update" || command === "upgrade") {
+    await runUpdate(await getVersion());
+    return;
+  }
   const args = parseArgs(argv);
   if (args.help) {
-    console.log(helpText(await packageVersion()));
+    console.log(helpText(await getVersion()));
     return;
   }
   if (args.version) {
-    console.log(await packageVersion());
+    console.log(await getVersion());
     return;
   }
   const started = startHoopilotServer(args);
   console.log(`hoopilot listening on ${started.url}`);
   console.log(`OpenAI base URL: ${started.url}/v1`);
   console.log("Use Ctrl+C to stop.");
+  if (!args.noUpdateCheck) {
+    void maybeNotifyUpdate(await getVersion(), IS_STANDALONE_BINARY ? "binary" : "npm");
+  }
 }
 function parseArgs(argv) {
   const args = {};
@@ -1065,6 +1548,10 @@ function parseArgs(argv) {
       args.githubTokenCommand = false;
       continue;
     }
+    if (arg === "--no-update-check") {
+      args.noUpdateCheck = true;
+      continue;
+    }
     const [name, inlineValue] = arg.split("=", 2);
     const value = inlineValue ?? rest.shift();
     if (!value) {
@@ -1106,19 +1593,11 @@ function parseArgs(argv) {
   return args;
 }
 function parseAuthMode(value) {
-  if (value === "auto" || value === "copilot-token" || value === "github-token" || value === "direct-github-token") {
+  if (value === "auto" || value === "copilot-token") {
     return value;
   }
   throw new Error(`Invalid auth mode: ${value}.`);
 }
-async function packageVersion() {
-  try {
-    const manifest = await Bun.file(new URL("../package.json", import.meta.url)).json();
-    return typeof manifest.version === "string" ? manifest.version : "0.0.0";
-  } catch {
-    return "0.0.0";
-  }
-}
 function helpText(version) {
   return `hoopilot ${version}
 
@@ -1126,27 +1605,34 @@ OpenAI-compatible proxy for GitHub Copilot.
 
 Usage:
   hoopilot [serve] [options]
+  hoopilot update
   npx @openhoo/hoopilot [options]
 
+Commands:
+  serve                             Start the proxy server (default)
+  update, upgrade                   Update hoopilot to the latest release
+
 Options:
   -p, --port <port>                 Port to listen on. Default: 4141
       --host <host>                 Host to listen on. Default: 127.0.0.1
       --api-key <key>               Require clients to send Authorization: Bearer <key>
-      --auth-mode <mode>            auto, github-token, direct-github-token, copilot-token
-      --github-token <token>        GitHub OAuth token for a Copilot account
+      --auth-mode <mode>            auto, copilot-token
+      --github-token <token>        GitHub CLI OAuth token for a Copilot account. PATs are rejected.
       --github-token-command <cmd>  Command used to read a GitHub token. Default: gh auth token
       --copilot-token <token>       Short-lived Copilot API bearer token
       --copilot-api-base-url <url>  Copilot API base URL override
       --no-gh                       Do not try gh auth token
+      --no-update-check             Do not check GitHub for a newer release
       --allow-unauthenticated       Allow non-loopback bind without --api-key
   -h, --help                        Show help
   -v, --version                     Show version
 
 Environment:
   HOOPILOT_API_KEY
-  COPILOT_GITHUB_TOKEN, GITHUB_TOKEN, GH_TOKEN
+  COPILOT_GITHUB_TOKEN
   COPILOT_API_TOKEN, GITHUB_COPILOT_API_TOKEN
   COPILOT_API_BASE_URL
+  HOOPILOT_NO_UPDATE_CHECK          Set to disable update checks (also NO_UPDATE_NOTIFIER)
 `;
 }
 if (import.meta.main) {