@openhoo/hoopilot 0.9.2 → 0.10.0

package/README.md

@@ -58,17 +58,17 @@ Run Hoopilot as a long-lived service from the published multi-arch image on the
 # 1. Sign in once; the OAuth credential is written to the persisted /data volume.
 docker run --rm -it -v hoopilot-data:/data ghcr.io/openhoo/hoopilot login
 
-# 2. Run the proxy. An API key is required because the container binds 0.0.0.0.
+# 2. Run the proxy on localhost.
 docker run -d --name hoopilot --restart unless-stopped \
-  -p 4141:4141 -e HOOPILOT_API_KEY=local-key \
+  -p 127.0.0.1:4141:4141 \
   -v hoopilot-data:/data ghcr.io/openhoo/hoopilot
 ```
 
-Tags follow the release version (e.g. `ghcr.io/openhoo/hoopilot:0.8`, `:0.8.3`) plus `:latest`. The image listens on `0.0.0.0:4141`, runs as a non-root user, and stores its OAuth credential at `/data/auth.json` (override with `HOOPILOT_AUTH_FILE`). A `docker-compose.yml` is provided in the repository:
+Tags follow the release version (e.g. `ghcr.io/openhoo/hoopilot:0.8`, `:0.8.3`) plus `:latest`. The image listens on `0.0.0.0:4141`, runs as a non-root user, and stores its OAuth credential at `/data/auth.json` (override with `HOOPILOT_AUTH_FILE`). The Docker image allows unauthenticated local clients by default; set `HOOPILOT_API_KEY` if you publish the port beyond localhost. A `docker-compose.yml` is provided in the repository:
 
 ```sh
 docker compose run --rm hoopilot login   # one-time GitHub OAuth
-HOOPILOT_API_KEY=local-key docker compose up -d
+docker compose up -d
 ```
 
 ## Update
@@ -91,6 +91,37 @@ npx @openhoo/hoopilot login
 
 The login command prints a one-time code, opens `https://github.com/login/device` best-effort, verifies that the returned OAuth token can reach the Copilot API, and stores it in Hoopilot's auth file. Re-run `npx @openhoo/hoopilot login` after upgrading Hoopilot if Copilot reports a supported model as unavailable; older stored tokens can have a reduced model set.
 
+Add `--print-key` to print the received OAuth token after verification. Login status stays on stderr, so stdout contains only the token. To append the token to a `.env` file, use one of these copyable examples.
+
+Local CLI, sh:
+
+```sh
+hoopilot login --print-key | sed 's/^/COPILOT_OAUTH_TOKEN=/' >> .env
+```
+
+Local CLI, PowerShell:
+
+```powershell
+hoopilot login --print-key |
+  ForEach-Object { "COPILOT_OAUTH_TOKEN=$_" } |
+  Add-Content -Encoding utf8 .env
+```
+
+Docker, sh:
+
+```sh
+docker run --rm -v hoopilot-data:/data ghcr.io/openhoo/hoopilot login --print-key \
+  | sed 's/^/COPILOT_OAUTH_TOKEN=/' >> .env
+```
+
+Docker, PowerShell:
+
+```powershell
+docker run --rm -v hoopilot-data:/data ghcr.io/openhoo/hoopilot login --print-key |
+  ForEach-Object { "COPILOT_OAUTH_TOKEN=$_" } |
+  Add-Content -Encoding utf8 .env
+```
+
 Then start the proxy:
 
 ```powershell
@@ -280,6 +311,7 @@ Options:
     --api-key-file <path>         Read the local API key from a file instead of argv
     --auth-file <path>            OAuth credential store path
     --copilot-api-base-url <url>  Copilot API base URL override
+    --print-key                   Login: print the received OAuth token to stdout
     --log-level <level>           trace, debug, info, warn, error, fatal, or silent
     --log-format <format>         json or pretty. Default: pretty
     --no-update-check             Do not check GitHub for a newer release

package/dist/cli.js

@@ -3473,7 +3473,7 @@ async function main2(argv = Bun.argv.slice(2)) {
     if (await printMetaOption(args2)) {
       return;
     }
-    args2.logger = commandLogger(args2, "login");
+    args2.logger = commandLogger(args2, "login", args2.printToken ? process.stderr : void 0);
     await runLogin(args2);
     return;
   }
@@ -3556,6 +3556,10 @@ function parseArgs(argv) {
       args.noUpdateCheck = true;
       continue;
     }
+    if (arg === "--print-key" || arg === "--print-token") {
+      args.printToken = true;
+      continue;
+    }
     if (!arg.startsWith("-")) {
       throw new Error(`Unknown argument: ${arg}.`);
     }
@@ -3629,14 +3633,16 @@ function readApiKeyFile(path) {
 }
 async function runLogin(options = {}) {
   const logger = options.logger?.child({ component: "auth" }) ?? noopLogger;
+  const status = loginStatusLogger(Boolean(options.printToken));
   logger.debug({ event: "auth.login.started" }, "starting github copilot browser login");
-  console.log("Starting GitHub Copilot browser login...");
-  const login = await githubCopilotDeviceLogin({
+  status.info("Starting GitHub Copilot browser login...");
+  const deviceLogin = options.deviceLogin ?? githubCopilotDeviceLogin;
+  const login = await deviceLogin({
     env: options.env,
-    logger: console,
+    logger: status,
     openBrowser: openBrowserBestEffort
   });
-  console.log("Checking GitHub Copilot access...");
+  status.info("Checking GitHub Copilot access...");
   const access = await verifyCopilotOAuthToken(login.token, options);
   logger.debug(
     { apiBaseUrl: access.apiBaseUrl, event: "auth.login.verified" },
@@ -3653,8 +3659,11 @@ async function runLogin(options = {}) {
     path
   );
   logger.debug({ authStorePath: path, event: "auth.login.stored" }, "copilot credential stored");
-  console.log(`Copilot OAuth credential stored at ${path}`);
-  console.log("Copilot authentication ready.");
+  status.info(`Copilot OAuth credential stored at ${path}`);
+  status.info("Copilot authentication ready.");
+  if (options.printToken) {
+    console.log(login.token);
+  }
 }
 async function runModels(options = {}) {
   const logger = options.logger?.child({ component: "models" }) ?? noopLogger;
@@ -3790,15 +3799,17 @@ async function verifyCopilotOAuthToken(token, options = {}) {
     token
   };
 }
-function openBrowserBestEffort(url) {
+function openBrowserBestEffort(url, spawnOpener = spawn) {
   const platform = process.platform;
   const command = platform === "win32" ? "cmd" : platform === "darwin" ? "open" : "xdg-open";
   const args = platform === "win32" ? ["/c", "start", "", url] : [url];
   try {
-    const child = spawn(command, args, {
+    const child = spawnOpener(command, args, {
       detached: true,
       stdio: "ignore"
     });
+    child.on("error", () => {
+    });
     child.unref();
   } catch {
   }
@@ -3821,13 +3832,28 @@ function modelIdsFromResponse(body) {
 function withRuntimeEnv(args) {
   return { ...args, env: process.env };
 }
-function commandLogger(args, command) {
+function commandLogger(args, command, stream) {
   return createHoopilotLogger({
     env: args.env,
     format: args.logFormat,
-    level: args.logLevel
+    level: args.logLevel,
+    stream
   }).child({ command, component: "cli" });
 }
+function loginStatusLogger(writeSecretsToStdout) {
+  if (writeSecretsToStdout) {
+    return {
+      error: (message) => console.error(message),
+      info: (message) => console.error(message),
+      warn: (message) => console.error(message)
+    };
+  }
+  return {
+    error: (message) => console.error(message),
+    info: (message) => console.log(message),
+    warn: (message) => console.warn(message)
+  };
+}
 function helpText(version) {
   return `hoopilot ${version}
 
@@ -3861,6 +3887,7 @@ Options:
       --api-key-file <path>         Read the local API key from a file instead of argv
       --auth-file <path>            OAuth credential store path
       --copilot-api-base-url <url>  Copilot API base URL override
+      --print-key                   Login: print the received OAuth token to stdout
       --log-level <level>           trace, debug, info, warn, error, fatal, or silent
       --log-format <format>         json or pretty. Default: pretty
       --stream-mode <mode>          auto, live, or buffer. Auto buffers Windows standalone streams.
@@ -3891,7 +3918,9 @@ if (import.meta.main) {
 }
 export {
   main2 as main,
+  openBrowserBestEffort,
   parseArgs,
+  runLogin,
   runModels,
   runUsage,
   verifyCopilotOAuthToken