@semanticist14/clco 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 semanticist21
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,279 @@
+# clco
+
+Run Claude Code on your GitHub Copilot subscription. It starts a local adapter that translates Anthropic Messages ↔ GitHub Copilot, and runs claude against a config directory of its own — so **a `/model` pick inside clco never changes the model your plain `claude` uses**.
+
+```
+$ clco
+│
+◇  Checking GitHub token ✓ 0.0s
+│
+◇  Fetching Copilot token and model list ✓ 1.8s
+│
+◆  Pick a model - type to search
+│  Search models...
+│  ● Claude Sonnet 5   claude-sonnet-5 · native · 200k
+│  ○ GPT-5.6 Luna      gpt-5.6-luna · responses · 200k
+│  ○ Kimi K3           kimi-k3 · chat · 918k
+└
++ adapter: http://127.0.0.1:56844
++ model: claude-sonnet-5 (sonnet=claude-sonnet-5 opus=claude-opus-5 haiku=claude-haiku-4.5)
++ browser: @playwright/mcp@latest
+```
+
+## Install
+
+From npm (Bun is still required at runtime):
+
+```sh
+npm install --global @semanticist14/clco
+```
+
+Update npm installs with `npm install --global @semanticist14/clco@latest`.
+
+Or use the GitHub installer:
+
+```sh
+curl -fsSL https://raw.githubusercontent.com/semanticist21/clco/main/install.sh | bash
+```
+
+Installs to `~/.local/share/clco`, launcher at `~/.local/bin/clco`.
+For custom paths: `curl -fsSL ... | CLCO_DIR=~/somewhere BIN_DIR=~/bin bash`.
+The same `CLCO_DIR` and `BIN_DIR` values can be passed to `uninstall.sh`.
+
+Needs the [claude CLI](https://claude.com/claude-code), a GitHub account with
+Copilot, and [Bun](https://bun.sh). npm installs the package, but clco still
+runs on Bun because the adapter uses Bun's server and process APIs; Node is not
+a runtime fallback yet.
+
+If you need to install Bun yourself:
+
+```sh
+curl -fsSL https://bun.sh/install | bash
+```
+
+Reopen your terminal afterwards so `bun` is on your `PATH`.
+
+## First run
+
+```sh
+clco
+```
+
+1. **GitHub login**, once — a device-flow code to paste in your browser. The
+   token is stored at `~/.config/clco/auth.json` (mode 600).
+2. **Three questions**, once. Re-run them any time with `clco setup`:
+
+   | Question | Default | What it does |
+   |---|---|---|
+   | Run without permission prompts? | **Yes** | Passes `--dangerously-skip-permissions`, so claude edits files and runs commands without asking. `clco --no-bypass` for one session. |
+   | Enable Playwright MCP for browser control? | **Yes** | Registers the Playwright MCP server for clco sessions only. **Also needs a Chrome extension you install yourself** — see [Browser control](#browser-control). `clco --no-browser` for one session. |
+   | Pick a model each time clco starts? | **Yes** | Shows the model prompt at launch. Answering No reuses your last pick. `clco --no-select` for one session. |
+
+3. **Pick a model**, then claude starts. Switch mid-session with `/model`.
+
+   Answering yes to the first two together is worth understanding: claude runs
+   without permission prompts, and each session resolves the current
+   `@playwright/mcp` release from npm (`bunx -y @playwright/mcp@latest`) and runs
+   it with access to the browser tab you share. The version is re-resolved every
+   session, so a release published today runs on your machine today; nothing in
+   this path checks an integrity hash. Either answer is reasonable alone; both at
+   once is a lot of trust in one command. `clco setup` changes them,
+   `--no-bypass` / `--no-browser` skip them for a single run, and
+   `CLCO_MCP_PACKAGE` pins or redirects the package — see
+   [Browser control](#browser-control).
+
+## Usage
+
+```sh
+clco                   # a session
+clco -p "question"     # anything clco doesn't own goes straight to claude
+clco status            # account, plan, and every model's route/policy/context
+clco setup             # change the three answers above
+clco help              # all commands and environment variables
+```
+
+## Models
+
+`/model` lists every conversational model your Copilot account offers, not just
+the Claude ones. Each row shows the upstream id, its route, its real context
+window, and whether it supports `/effort`.
+
+What your plan actually allows is a separate matter, and Copilot's metadata does
+not predict it — a model can be marked `enabled` and still refuse. Picking one
+your plan does not cover answers `400 The requested model is not supported`.
+
+Pin a model instead of choosing: `clco --model kimi-k3`, or per slot with
+`CLCO_OPUS` / `CLCO_SONNET` / `CLCO_HAIKU` / `CLCO_FABLE` — the four model
+slots Claude Code asks for by name.
+
+## Browser control
+
+Claude's own Chrome extension cannot work here: Claude Code gates it on the
+session's OAuth scope, and clco authenticates with `ANTHROPIC_AUTH_TOKEN`, which
+is always `user:inference`. Passing `--chrome` registers nothing.
+
+Playwright MCP has no such gate, and in `--extension` mode it drives the tab you
+share from your own browser — logins and cookies intact — rather than a fresh
+profile.
+
+**It needs a Chrome extension, and clco cannot install it for you.** Without it
+there is no browser control at all — clco registers no server and no tools
+appear. Install [Playwright
+Extension](https://chromewebstore.google.com/detail/mmlmfjhmonkocbjadbfplnigmagldckm)
+(listed under that name, not "Playwright MCP"), then answer yes at `clco setup`.
+Tools arrive as `mcp__playwright__*` once you click the extension to share a tab.
+
+The extension shows a `PLAYWRIGHT_MCP_EXTENSION_TOKEN`; storing it skips the
+connect dialog every session:
+
+```sh
+pbpaste | clco token       # clco token --clear to remove it
+```
+
+Started with `bunx` (or `npx`) and fetched from npm each session. If that fails,
+clco says which way it failed at startup rather than leaving you with tools that
+silently never appear — unless `CLCO_MCP_PACKAGE` names a different package, in
+which case clco cannot say whose registry serves it and reports that instead:
+
+```
+! browser: cannot reach registry.npmjs.org - browser tools will not appear
+! browser: registry.npmjs.org is slow to answer - browser tools may be slow to appear
+! browser: TLS rejected by registry.npmjs.org - browser tools will not appear. Set CLCO_CA_BUNDLE to your company CA.
+! browser: registry.npmjs.org presented an expired certificate - browser tools will not appear. ...
++ browser: @corp/playwright-mcp@1.2.3 (not the default package, so the registry check was skipped)
+```
+
+That check only knows about `registry.npmjs.org`, so it cannot speak for an
+internal mirror. `CLCO_MCP_PACKAGE` overrides the package spec for one — or to
+pin a version, or roll back past a bad release:
+
+```sh
+CLCO_MCP_PACKAGE=@playwright/mcp@0.0.80 clco
+```
+
+Pinning is not an offline mode: browser control needs npm either way.
+
+## What clco reads
+
+Nothing clco reads from your disk leaves the machine. Its outbound requests are
+GitHub login, the Copilot token exchange, the model list, your chat itself,
+plus — with browser control on — resolving `@playwright/mcp` against npm each
+session, and checking GitHub for a staged update when you run `clco update`.
+
+`clco update` installs and smoke-tests the new revision in a temporary checkout,
+then swaps it in only after those checks pass. Local changes or a non-fast-forward
+branch stop the update before the live install is touched.
+
+It first tries `bun install --frozen-lockfile`. If the installed Bun cannot read
+this lockfile format, it falls back to `bun install --no-save`, which installs
+dependencies without rewriting `bun.lock`; using a current Bun release is still
+recommended.
+
+If you installed with custom `CLCO_DIR` or `BIN_DIR` values before launcher v4,
+re-run the installer once with those same values so the launcher can migrate.
+
+- **Chrome, Chromium and Edge profile directories** — directory *names* only, to
+  see whether the Playwright extension is installed.
+- **The claude binary** — scanned once per claude version for the model ids it
+  knows, cached in `~/.config/clco/catalog.json`. Without it clco cannot tell
+  which ids `/model` will accept.
+- **`~/.claude`** — every entry is symlinked into `~/.config/clco/claude-home`
+  except `settings.json`, `settings.local.json` and `backups`, which are
+  private copies. So plugins, skills, agents, projects, history and shell
+  snapshots stay shared and are written into `~/.claude` exactly as a plain
+  `claude` run would; only the settings file, where a `/model` pick would land,
+  is clco's own.
+- **`~/.claude.json`** — copied into clco's config dir, since it holds trust
+  decisions and MCP servers, and it carries account identifiers and any secrets
+  your MCP servers declare. Your MCP servers and per-project trust are re-read
+  from the real file on every launch, so deleting a server or withdrawing trust
+  there applies to clco too; everything else in the copy is clco's own.
+  `uninstall.sh --full` removes it; a plain uninstall leaves it.
+
+## Corporate networks
+
+Behind a TLS-inspecting proxy, export your company CA and point clco at it:
+
+```sh
+security find-certificate -a -p -c "<CA name>" > ~/ca.pem   # macOS
+CLCO_CA_BUNDLE=~/ca.pem clco
+```
+
+clco **adds** it to the OS trust store rather than replacing it, so everything
+that worked before still does. Several paths can be joined with `:`.
+
+Prefer this to `NODE_EXTRA_CA_CERTS`, which has been reported to supplant the
+system store on macOS and break trust that already worked. `NODE_USE_SYSTEM_CA`
+does nothing on Bun — its default set already includes the system roots.
+
+## Uninstall
+
+```sh
+# app + launcher (keeps your GitHub token)
+curl -fsSL https://raw.githubusercontent.com/semanticist21/clco/main/uninstall.sh | bash
+
+# also wipe ~/.config/clco, token included
+curl -fsSL https://raw.githubusercontent.com/semanticist21/clco/main/uninstall.sh | bash -s -- --full
+
+# custom installation paths
+curl -fsSL https://raw.githubusercontent.com/semanticist21/clco/main/uninstall.sh \
+  | CLCO_DIR="$HOME/somewhere" BIN_DIR="$HOME/bin" bash
+```
+
+## How it works
+
+1. One-time GitHub OAuth device flow → a long-lived token stored locally.
+2. That token mints short-lived Copilot tokens while a local adapter
+   (127.0.0.1, ephemeral port) runs.
+3. claude is launched against that adapter with `--settings`, and against a
+   private `CLAUDE_CONFIG_DIR` at `~/.config/clco/claude-home`. Your plugins,
+   skills, agents and commands are symlinked in, so they stay shared and live;
+   the files claude writes back — including the model a `/model` pick saves as
+   your default — stay inside clco's directory and never reach `~/.claude`.
+4. The adapter picks a route per model from Copilot's own `/models`:
+   - **native** — Copilot serves Claude models on `/v1/messages`, the real
+     Anthropic endpoint, so those requests pass through untranslated: thinking,
+     `cache_control`, `/effort` and tool blocks stay intact.
+   - **translated** — everything else becomes `chat/completions`, or the
+     Responses API where a model requires it (the GPT-5.x family). SSE
+     streaming, tool calling, images and parallel tool calls work on both.
+
+   A rejected native attempt falls back to the translated path. Only an
+   unsupported model/endpoint rejection (including HTTP 404) is remembered;
+   other request errors leave native routing available on the next turn.
+   Route changes are recorded in the adapter log (`CLCO_DEBUG=1` in run mode).
+   `CLCO_NO_PASSTHROUGH=1` forces translation everywhere.
+
+   Input token counts are approximate. Near the discovered limit, the adapter
+   logs a warning and forwards the request; the upstream decides whether it
+   fits. Catalog-known Claude rows use Claude Code's own per-model context
+   handling after `/model` switches. If the lineup contains a non-catalog row,
+   clco applies a conservative session ceiling based on the exact selectable
+   rows.
+
+## Development
+
+```sh
+bun install
+bun test          # unit + mock-upstream integration tests
+bun run check     # tsc --noEmit
+CLCO_UPSTREAM=http://127.0.0.1:9099 bun run scripts/mock-upstream.ts
+```
+
+## Caveats
+
+- Using Copilot outside official clients is a gray area of GitHub's terms. clco
+  authenticates with the VS Code Copilot OAuth client id and sends the same
+  editor headers, so its requests are indistinguishable from the official
+  client — that is what makes it work, and what makes it a gray area. Heavy use
+  may flag your account, and Claude models consume premium quota. Intended for
+  personal use.
+- Extended thinking works on the native route only; it stays disabled on
+  translated routes. `stop_sequences` are not enforced on Responses-API models.
+- `/effort` is forwarded when the selected model declares that level, and
+  dropped otherwise — rows in `/model` say which do not support it.
+- Catalog-known Claude rows recalculate their context handling when `/model`
+  switches. Non-catalog rows use a conservative session ceiling because
+  Claude Code cannot inspect their upstream context limit; this can compact
+  earlier than a larger model requires.
+- License: [MIT](LICENSE)

package/bin/clco

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+CLCO_LAUNCHER="${BASH_SOURCE[0]}"
+while [ -L "$CLCO_LAUNCHER" ]; do
+  CLCO_LAUNCHER_DIR="$(cd -P -- "$(dirname -- "$CLCO_LAUNCHER")" && pwd)"
+  CLCO_LAUNCHER="$(readlink -- "$CLCO_LAUNCHER")"
+  case "$CLCO_LAUNCHER" in
+    /*) ;;
+    *) CLCO_LAUNCHER="$CLCO_LAUNCHER_DIR/$CLCO_LAUNCHER" ;;
+  esac
+done
+CLCO_PACKAGE_DIR="$(cd -P -- "$(dirname -- "$CLCO_LAUNCHER")/.." && pwd)"
+export CLCO_NPM_INSTALL=1
+CLCO_BUN_BIN="${CLCO_BUN_BIN:-$(command -v bun || true)}"
+if [ -z "$CLCO_BUN_BIN" ]; then
+  printf '%s\n' "Bun is required to run clco. Install it with: curl -fsSL https://bun.sh/install | bash" >&2
+  printf '%s\n' "Node is not a runtime fallback yet; see https://bun.sh/docs/installation" >&2
+  exit 1
+fi
+
+if [ "${1:-}" = "--" ]; then
+  shift
+  set -- "__clco_passthrough__" "$@"
+fi
+
+exec "$CLCO_BUN_BIN" run --no-install "$CLCO_PACKAGE_DIR/src/cli.ts" "$@"

package/bun.lock

@@ -0,0 +1,39 @@
+{
+  "lockfileVersion": 2,
+  "configVersion": 1,
+  "workspaces": {
+    "": {
+      "name": "clcopilot",
+      "dependencies": {
+        "@clack/prompts": "^1.8.0",
+      },
+      "devDependencies": {
+        "@types/bun": "latest",
+        "typescript": "^5",
+      },
+    },
+  },
+  "packages": {
+    "@clack/core": ["@clack/core@1.5.0", "", { "dependencies": { "fast-wrap-ansi": "^0.2.0", "sisteransi": "^1.0.5" } }, "sha512-zNikCcd8BbcEvzzG1sbXFrRHFk5kHPrpwZwksPvf9qyQO1Teb7JaXaOAxXZei9nZLDW0gaZawiuTCji88bTBhw=="],
+
+    "@clack/prompts": ["@clack/prompts@1.8.0", "", { "dependencies": { "@clack/core": "1.5.0", "fast-string-width": "^3.0.2", "fast-wrap-ansi": "^0.2.0", "sisteransi": "^1.0.5" } }, "sha512-PXzLZ8N34rxmuo4dJg3xtOXhcBse94qGjDqsteoEYrFrrZ5FSjIGwMAuOcv64ln8rHVBBD06XeVGr+/JX+plcA=="],
+
+    "@types/bun": ["@types/bun@1.4.2", "", { "dependencies": { "bun-types": "1.4.2" } }, "sha512-GimotNn7+ZV0uVArItBbriZsR1oNf0+WTzPkdcFrzShI7k2norL0uzEaJT8T33dWr7O/c9ZDuAFQrctKCi72oQ=="],
+
+    "@types/node": ["@types/node@22.20.2", "", { "dependencies": { "undici-types": "~6.21.0" } }, "sha512-xlvWf4Vs9n1PEVYwP1n4vvG07M6y8WgvJ2t0vbrWTmijsIHp1cS+uJ2kMIRdY3nHZK0nCYKrPeD171+SzF4/zw=="],
+
+    "bun-types": ["bun-types@1.4.2", "", { "dependencies": { "@types/node": "*" } }, "sha512-bxV1FgK7yBIzjRe5zBozIM4Bem11ZJcCXSrjWRG3YWLt8yFDePu4cLjpebO8OvPeIE9trbyPF4fuj3Cia4Fj3w=="],
+
+    "fast-string-truncated-width": ["fast-string-truncated-width@3.0.3", "", {}, "sha512-0jjjIEL6+0jag3l2XWWizO64/aZVtpiGE3t0Zgqxv0DPuxiMjvB3M24fCyhZUO4KomJQPj3LTSUnDP3GpdwC0g=="],
+
+    "fast-string-width": ["fast-string-width@3.0.2", "", { "dependencies": { "fast-string-truncated-width": "^3.0.2" } }, "sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg=="],
+
+    "fast-wrap-ansi": ["fast-wrap-ansi@0.2.2", "", { "dependencies": { "fast-string-width": "^3.0.2" } }, "sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q=="],
+
+    "sisteransi": ["sisteransi@1.0.5", "", {}, "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg=="],
+
+    "typescript": ["typescript@5.9.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw=="],
+
+    "undici-types": ["undici-types@6.21.0", "", {}, "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ=="],
+  }
+}

package/install.sh

@@ -0,0 +1,161 @@
+#!/usr/bin/env bash
+# clco installer — GitHub Copilot-backed Claude Code wrapper.
+#   curl -fsSL https://raw.githubusercontent.com/semanticist21/clco/main/install.sh | bash
+set -euo pipefail
+
+REPO="https://github.com/semanticist21/clco.git"
+CLCO_DIR="${CLCO_DIR:-$HOME/.local/share/clco}"
+BIN_DIR="${BIN_DIR:-$HOME/.local/bin}"
+
+log() { printf '\033[1;36m==>\033[0m %s\n' "$*"; }
+fail() { printf '\033[1;31mError:\033[0m %s\n' "$*" >&2; exit 1; }
+
+command -v git >/dev/null 2>&1 || fail "git is required - please install it first"
+
+install_dependencies() {
+  local target="$1"
+  local frozen_output
+  log "Installing dependencies (bun install)"
+  if frozen_output="$(cd "$target" && bun install --frozen-lockfile 2>&1)"; then
+    return 0
+  fi
+  if [[ "$frozen_output" != *"Unknown lockfile version"* &&
+    "$frozen_output" != *"UnknownLockfileVersion"* &&
+    "$frozen_output" != *"failed to parse lockfile"* ]]; then
+    printf '%s\n' "$frozen_output" >&2
+    return 1
+  fi
+  if (cd "$target" && bun install --no-save >/dev/null 2>&1); then
+    return 0
+  fi
+  log "bun install failed - full output:"
+  printf '%s\n' "$frozen_output" >&2
+  (cd "$target" && bun install --no-save) || return 1
+}
+
+# --- Bun --------------------------------------------------------------------
+if ! command -v bun >/dev/null 2>&1; then
+  fail "Bun is not installed. Please install using: curl -fsSL https://bun.sh/install | bash. Or visit https://bun.sh/docs/installation to install it."
+fi
+
+# --- Source ------------------------------------------------------------------
+if [ ! -e "$CLCO_DIR" ] && [ -d "$CLCO_DIR.previous/.git" ]; then
+  log "Recovering the previous install after an interrupted update"
+  mv "$CLCO_DIR.previous" "$CLCO_DIR" \
+    || fail "Could not recover the previous clco install"
+fi
+if [ -d "$CLCO_DIR/.git" ]; then
+  log "Updating the existing install: $CLCO_DIR"
+  grep -Eq '^[[:space:]]*"name"[[:space:]]*:[[:space:]]*"(@semanticist14/)?clco"[[:space:]]*,?[[:space:]]*$' \
+    "$CLCO_DIR/package.json" \
+    || fail "$CLCO_DIR is a git repo, but not a clco install"
+  CURRENT_URL="$(git -C "$CLCO_DIR" remote get-url origin 2>/dev/null || true)"
+  case "$CURRENT_URL" in
+    "$REPO"|git@github.com:semanticist21/clco.git) ;;
+    *) fail "$CLCO_DIR does not point to the canonical clco repository" ;;
+  esac
+  [ -z "$(git -C "$CLCO_DIR" status --porcelain)" ] \
+    || fail "Update aborted - local changes exist in $CLCO_DIR; commit or stash them first"
+  CURRENT_HEAD="$(git -C "$CLCO_DIR" rev-parse HEAD)" \
+    || fail "Could not read the current revision in $CLCO_DIR"
+  BRANCH="$(git -C "$CLCO_DIR" rev-parse --abbrev-ref HEAD)" \
+    || fail "Could not read the current branch in $CLCO_DIR"
+  [ "$BRANCH" != HEAD ] || fail "Update requires a checked-out branch in $CLCO_DIR"
+
+  UPDATE_LOCK="$CLCO_DIR.update.lock"
+  mkdir "$UPDATE_LOCK" \
+    || fail "Another clco update is already running (or left an update lock; remove it after verifying)"
+  STAGE_ROOT="$(mktemp -d "$(dirname "$CLCO_DIR")/.clco-install.XXXXXX")" \
+    || fail "Could not create a temporary update directory"
+  STAGE="$STAGE_ROOT/app"
+  trap 'rm -rf "$STAGE_ROOT" "$UPDATE_LOCK"' EXIT
+  git clone --local "$CLCO_DIR" "$STAGE" >/dev/null \
+    || fail "Could not create a staged update checkout"
+  git -C "$STAGE" remote set-url origin "$REPO" 2>/dev/null \
+    || git -C "$STAGE" remote add origin "$REPO" \
+    || fail "Could not set the canonical clco origin"
+  git -C "$STAGE" fetch --quiet origin "$BRANCH" \
+    || fail "Could not fetch the latest clco revision"
+  git -C "$STAGE" merge-base --is-ancestor "$CURRENT_HEAD" "origin/$BRANCH" \
+    || fail "Update is not a fast-forward - resolve the branch manually first"
+  git -C "$STAGE" checkout --quiet -B "$BRANCH" "origin/$BRANCH" \
+    || fail "Could not check out the staged clco revision"
+  install_dependencies "$STAGE" \
+    || fail "bun install failed - the previous revision is still active"
+  (cd "$STAGE" && bun run --no-install src/cli.ts version >/dev/null) \
+    || fail "Updated checkout failed its smoke test - the previous revision is still active"
+
+  LIVE_HEAD="$(git -C "$CLCO_DIR" rev-parse HEAD)" \
+    || fail "Could not re-check the live revision before activation"
+  LIVE_STATUS="$(git -C "$CLCO_DIR" status --porcelain)" \
+    || fail "Could not re-check the live checkout before activation"
+  [ "$LIVE_HEAD" = "$CURRENT_HEAD" ] && [ -z "$LIVE_STATUS" ] \
+    || fail "The live checkout changed while it was being updated"
+  git -C "$CLCO_DIR" config --replace-all remote.origin.url "$REPO" \
+    || fail "Could not sanitize the clco origin before activation"
+  git -C "$CLCO_DIR" config --unset-all remote.origin.pushurl 2>/dev/null || true
+  [ -z "$(git -C "$CLCO_DIR" config --get-all remote.origin.pushurl 2>/dev/null || true)" ] \
+    || fail "Could not remove credentials from the clco origin before activation"
+  if [ -e "$CLCO_DIR.previous" ]; then
+    [ -d "$CLCO_DIR.previous/.git" ] \
+      || fail "$CLCO_DIR.previous is not a clco rollback directory - refusing to replace it"
+    rm -rf "$CLCO_DIR.previous"
+  fi
+  mv "$CLCO_DIR" "$CLCO_DIR.previous" \
+    || fail "Could not prepare the existing install for activation"
+  if ! mv "$STAGE" "$CLCO_DIR"; then
+    mv "$CLCO_DIR.previous" "$CLCO_DIR" || true
+    fail "Could not activate the staged install"
+  fi
+  trap - EXIT
+  rm -rf "$STAGE_ROOT"
+  rmdir "$UPDATE_LOCK" 2>/dev/null || true
+  NEEDS_INSTALL=0
+else
+  [ -e "$CLCO_DIR" ] && fail "$CLCO_DIR already exists and is not a git repo - remove it and retry"
+  log "Cloning into $CLCO_DIR"
+  git clone --depth 1 "$REPO" "$CLCO_DIR"
+  NEEDS_INSTALL=1
+fi
+
+if [ "$NEEDS_INSTALL" = 1 ]; then
+  install_dependencies "$CLCO_DIR" || fail "bun install failed"
+fi
+
+# --- claude CLI (required by clco; offer to install) -------------------------
+CLAUDE_WARN="Install it later with: curl -fsSL https://claude.ai/install.sh | bash"
+if command -v claude >/dev/null 2>&1; then
+  log "Found the claude CLI"
+else
+  log "The claude CLI is missing (clco needs it)"
+  INSTALL_CLAUDE=n
+  if [ -e /dev/tty ]; then
+    printf 'Install it now? [y/N] '
+    answer=n
+    read -r answer < /dev/tty || answer=n
+    case "$answer" in y|Y|yes|Yes) INSTALL_CLAUDE=y ;; esac
+  fi
+  if [ "$INSTALL_CLAUDE" = y ]; then
+    log "Installing the claude CLI (official script)"
+    curl -fsSL https://claude.ai/install.sh | bash
+    export PATH="$HOME/.local/bin:$PATH"
+    command -v claude >/dev/null 2>&1 \
+      || log "! Could not verify the claude install - reopen your terminal and check. $CLAUDE_WARN"
+  else
+    log "! Skipped - clco needs the claude CLI before it can run. $CLAUDE_WARN"
+  fi
+fi
+
+# --- Launcher ----------------------------------------------------------------
+# Generated by a script the repo owns, so `clco update` refreshes it too.
+bash "$CLCO_DIR/scripts/write-launcher.sh" "$CLCO_DIR" "$BIN_DIR"
+
+
+
+case ":$PATH:" in
+  *":$BIN_DIR:"*) ;;
+  *) printf '\033[1;33mNote:\033[0m %s is not on your PATH. Add it to ~/.zshrc or similar:\n  export PATH="%s:$PATH"\n' "$BIN_DIR" "$BIN_DIR" ;;
+esac
+
+log "Installed: $BIN_DIR/clco"
+printf '\nGetting started:\n  clco          first run: GitHub device login, pick a model, launch claude\n  clco setup    set your startup defaults\n  clco --help   full usage\n\nUninstall:\n  curl -fsSL https://raw.githubusercontent.com/semanticist21/clco/main/uninstall.sh | bash\n'

package/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "@semanticist14/clco",
+  "version": "0.1.0",
+  "private": false,
+  "type": "module",
+  "description": "Run Claude Code on a GitHub Copilot subscription",
+  "bin": {
+    "clco": "bin/clco"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "bin",
+    "src",
+    "scripts",
+    "install.sh",
+    "uninstall.sh",
+    "README.md",
+    "LICENSE",
+    "bun.lock"
+  ],
+  "scripts": {
+    "start": "bun run src/cli.ts",
+    "test": "bun test",
+    "check": "tsc --noEmit"
+  },
+  "devDependencies": {
+    "@types/bun": "latest",
+    "typescript": "^5"
+  },
+  "dependencies": {
+    "@clack/prompts": "^1.8.0"
+  }
+}