copillm 0.1.4 → 0.2.0

package/dist/cli.js

@@ -16,7 +16,7 @@ import { acquireLock, inspectLock, LockAlreadyRunningError, releaseLock } from "
 import { startProxyServer } from "./server/proxy.js";
 import { defaultOutputDir, generateCodexHome } from "./codex/init.js";
 import { defaultOutputDir as defaultPiOutputDir, generatePiHome } from "./pi/init.js";
-import { getCopillmHome } from "./config/home.js";
+import { debugLogPath, getCopillmHome } from "./config/home.js";
 import { clearClaudeGatewayCache } from "./claude/cache.js";
 import { detectClaudeSettingsConflicts, formatSettingsConflictWarning } from "./claude/settingsConflict.js";
 import { buildClaudeExportCommand as buildClaudeExport, computeAnthropicDefaults, readModelIdsFromCache } from "./models/anthropicDefaults.js";
@@ -25,10 +25,12 @@ import { buildClaudeEnvBundle, buildCodexEnvBundle, buildPiEnvBundle } from "./c
 import { launchAgent } from "./cli/launchAgent.js";
 import { applyAgentConfig, formatApplyNotes } from "./agentconfig/apply.js";
 import { registerConfigCommands } from "./cli/configCommands.js";
+import { installProcessSafetyNet } from "./cli/processSafetyNet.js";
 const logger = createLogger();
 const program = new Command();
 program.name("copillm").description("Local Copilot proxy").version("0.1.0");
 program.enablePositionalOptions();
+program.option("--debug", "Enable copillm debug mode (debug endpoint plus verbose daemon diagnostics)");
 program
     .command("login")
     .description("[deprecated] Use `copillm auth login`")
@@ -128,6 +130,8 @@ program
     .option("--no-pi", "Skip generating ~/.pi/agent/models.json for pi coding agent")
     .option("--json", "JSON output")
     .action(async (opts) => {
+    const debug = resolveCopillmDebug(opts.debug);
+    enableRuntimeDebug(debug);
     if (opts.detach) {
         // Fail fast on missing credentials rather than letting the detached
         // child die silently and surface as a generic "start timed out" error.
@@ -137,6 +141,7 @@ program
         }
         const existingLock = await readLiveLock();
         if (existingLock) {
+            const activeDebug = await warnIfDebugRequestedButInactive(debug, existingLock.port);
             const codex = opts.codex === false ? null : await refreshCodexHome(existingLock.port, opts.codexModel ?? null);
             const pi = opts.pi === false ? null : await refreshPiHome(existingLock.port);
             const claude = buildClaudeExportCommand(existingLock.port, null);
@@ -144,7 +149,8 @@ program
                 port: existingLock.port,
                 pid: existingLock.pid,
                 mode: "already_running",
-                debug: false,
+                debug: activeDebug,
+                debugLogPath: null,
                 codex,
                 pi
             });
@@ -152,6 +158,7 @@ program
                 status: "already_running",
                 pid: existingLock.pid,
                 port: existingLock.port,
+                debug: activeDebug,
                 url: `http://127.0.0.1:${existingLock.port}`,
                 codex_home: codex?.outDir ?? null,
                 codex_export_command: codex?.exportCommand ?? null,
@@ -168,12 +175,13 @@ program
             return;
         }
         const daemonArgs = [process.argv[1], "daemon"];
-        if (opts.debug) {
+        if (debug) {
             daemonArgs.push("--debug");
         }
         const child = spawn(process.execPath, daemonArgs, {
             detached: true,
-            stdio: "ignore"
+            stdio: "ignore",
+            env: daemonSpawnEnv(debug)
         });
         child.unref();
         const started = await waitForDaemonReady(child.pid ?? null, 8_000);
@@ -187,7 +195,8 @@ program
             port: started.port,
             pid: started.pid,
             mode: "detached",
-            debug: Boolean(opts.debug),
+            debug,
+            debugLogPath: currentDebugLogPath(debug),
             codex,
             pi
         });
@@ -196,7 +205,8 @@ program
             mode: "detached",
             pid: started.pid,
             port: started.port,
-            debug: Boolean(opts.debug),
+            debug,
+            debug_log_path: currentDebugLogPath(debug),
             url: `http://127.0.0.1:${started.port}`,
             codex_home: codex?.outDir ?? null,
             codex_export_command: codex?.exportCommand ?? null,
@@ -216,8 +226,9 @@ program
     }
     // Foreground path: interactively prompt for login if needed.
     await ensureAuthenticatedInteractive();
-    const started = await runDaemon({ debug: Boolean(opts.debug) });
+    const started = await runDaemon({ debug });
     if (started.kind === "already_running") {
+        const activeDebug = await warnIfDebugRequestedButInactive(debug, started.lock.port);
         const codex = opts.codex === false ? null : await refreshCodexHome(started.lock.port, opts.codexModel ?? null);
         const pi = opts.pi === false ? null : await refreshPiHome(started.lock.port);
         const claude = buildClaudeExportCommand(started.lock.port, null);
@@ -225,7 +236,8 @@ program
             port: started.lock.port,
             pid: started.lock.pid,
             mode: "already_running",
-            debug: false,
+            debug: activeDebug,
+            debugLogPath: null,
             codex,
             pi
         });
@@ -233,6 +245,7 @@ program
             status: "already_running",
             pid: started.lock.pid,
             port: started.lock.port,
+            debug: activeDebug,
             url: `http://127.0.0.1:${started.lock.port}`,
             codex_home: codex?.outDir ?? null,
             codex_export_command: codex?.exportCommand ?? null,
@@ -255,7 +268,8 @@ program
         port: started.port,
         pid: process.pid,
         mode: "foreground",
-        debug: Boolean(opts.debug),
+        debug,
+        debugLogPath: currentDebugLogPath(debug),
         codex,
         pi
     });
@@ -264,7 +278,8 @@ program
         mode: "foreground",
         pid: process.pid,
         port: started.port,
-        debug: Boolean(opts.debug),
+        debug,
+        debug_log_path: currentDebugLogPath(debug),
         url: `http://127.0.0.1:${started.port}`,
         caller_secret: started.callerSecret,
         codex_home: codex?.outDir ?? null,
@@ -287,11 +302,13 @@ program
     .description("Internal background command")
     .option("--debug", "Enable debug endpoints")
     .action(async (opts) => {
-    const started = await runDaemon({ debug: Boolean(opts.debug) });
+    const debug = resolveCopillmDebug(opts.debug);
+    enableRuntimeDebug(debug);
+    const started = await runDaemon({ debug });
     if (started.kind === "already_running") {
         process.exit(0);
     }
-    process.stdout.write(`copillm listening on http://127.0.0.1:${started.port}${opts.debug ? " [debug]" : ""}\n`);
+    process.stdout.write(`copillm listening on http://127.0.0.1:${started.port}${debug ? " [debug]" : ""}\n`);
 });
 program
     .command("stop")
@@ -654,7 +671,9 @@ program
     .helpOption(false)
     .argument("[args...]", "Args forwarded to codex")
     .action(async (forwardedArgs, opts) => {
-    const lock = await ensureDaemonRunningForLauncher({ debug: Boolean(opts.copillmDebug) });
+    const debug = resolveCopillmDebug(opts.copillmDebug);
+    enableRuntimeDebug(debug);
+    const lock = await ensureDaemonRunningForLauncher({ debug });
     const codex = await refreshCodexHome(lock.port, null);
     if (!codex) {
         throw new Error("Failed to prepare Codex home (see warning above).");
@@ -692,7 +711,9 @@ program
     .helpOption(false)
     .argument("[args...]", "Args forwarded to claude")
     .action(async (forwardedArgs, opts) => {
-    const lock = await ensureDaemonRunningForLauncher({ debug: Boolean(opts.copillmDebug) });
+    const debug = resolveCopillmDebug(opts.copillmDebug);
+    enableRuntimeDebug(debug);
+    const lock = await ensureDaemonRunningForLauncher({ debug });
     const claude = buildClaudeExportCommand(lock.port, null);
     const pinnedSpec = opts.copillmUse ?? process.env.COPILLM_CLAUDE_VERSION ?? undefined;
     const conflicts = detectClaudeSettingsConflicts(claude.bundle.env);
@@ -729,7 +750,9 @@ program
     .helpOption(false)
     .argument("[args...]", "Args forwarded to pi")
     .action(async (forwardedArgs, opts) => {
-    const lock = await ensureDaemonRunningForLauncher({ debug: Boolean(opts.copillmDebug) });
+    const debug = resolveCopillmDebug(opts.copillmDebug);
+    enableRuntimeDebug(debug);
+    const lock = await ensureDaemonRunningForLauncher({ debug });
     const pi = await refreshPiHome(lock.port);
     if (!pi) {
         throw new Error("Failed to prepare pi models.json (see warning above).");
@@ -754,6 +777,49 @@ program
     });
     process.exit(exitCode);
 });
+program
+    .command("copilot")
+    .description("Launch GitHub Copilot CLI reusing copillm's stored GitHub token (no second device flow)")
+    .option("--copillm-use <spec>", "Pin copilot package version (e.g. 1.0.52 or @github/copilot@1.0.52)")
+    .option("--copillm-profile <name>", "Override active profile from ~/.copillm/agent.toml for this launch")
+    .option("--copillm-no-config", "Skip agent.toml fan-out for this launch", false)
+    .allowUnknownOption(true)
+    .passThroughOptions()
+    .helpOption(false)
+    .argument("[args...]", "Args forwarded to copilot")
+    .action(async (forwardedArgs, opts) => {
+    const credential = await loadStoredCredential();
+    if (!credential) {
+        process.stderr.write("copillm: no stored GitHub credential — run `copillm auth login` first.\n");
+        process.exit(1);
+        return;
+    }
+    const pinnedSpec = opts.copillmUse ?? process.env.COPILLM_COPILOT_VERSION ?? undefined;
+    const applyResult = applyAgentConfig({
+        agent: "copilot",
+        cwd: process.cwd(),
+        profileOverride: opts.copillmProfile ?? process.env.COPILLM_PROFILE ?? null,
+        skip: Boolean(opts.copillmNoConfig)
+    });
+    for (const line of formatApplyNotes(applyResult, "copilot")) {
+        process.stderr.write(`${line}\n`);
+    }
+    // Inject the stored GitHub OAuth token into the child env only — never
+    // export to the parent shell and never persist. Copilot CLI honours
+    // COPILOT_GITHUB_TOKEN ahead of its own stored credentials, so this
+    // short-circuits its device-flow login when copillm already has a token.
+    const env = {
+        ...applyResult.envOverlay,
+        COPILOT_GITHUB_TOKEN: credential.token
+    };
+    const exitCode = await launchAgent({
+        agent: "copilot",
+        args: [...(forwardedArgs ?? []), ...applyResult.cliArgs],
+        env,
+        pinnedSpec
+    });
+    process.exit(exitCode);
+});
 registerConfigCommands(program);
 program.parseAsync(process.argv).catch((error) => {
     if (error instanceof Error) {
@@ -814,6 +880,7 @@ async function runDaemon(options) {
         tokenManager.clear();
         throw new Error(`No available port in configured range (${ports[0]}-${ports[ports.length - 1]}).`);
     }
+    installProcessSafetyNet(logger);
     let shuttingDown = false;
     const shutdown = async () => {
         if (shuttingDown) {
@@ -940,6 +1007,32 @@ function writeCommandOutput(opts, humanLine, payload) {
     }
     process.stdout.write(`${humanLine}\n`);
 }
+function resolveCopillmDebug(commandDebug) {
+    return Boolean(commandDebug) || Boolean(program.opts().debug);
+}
+function enableRuntimeDebug(debug) {
+    if (!debug) {
+        return;
+    }
+    process.env.COPILLM_LOG_LEVEL = "debug";
+    logger.level = "debug";
+}
+function currentDebugLogPath(debug) {
+    if (!debug) {
+        return null;
+    }
+    return process.env.COPILLM_LOG_FILE ?? debugLogPath();
+}
+function daemonSpawnEnv(debug) {
+    if (!debug) {
+        return process.env;
+    }
+    return {
+        ...process.env,
+        COPILLM_LOG_LEVEL: "debug",
+        COPILLM_LOG_FILE: currentDebugLogPath(true) ?? debugLogPath()
+    };
+}
 function formatStopHumanLine(primary, cache) {
     if (cache.cleared) {
         return `${primary} Cleared Claude Code gateway cache.`;
@@ -1012,6 +1105,9 @@ function formatStartBanner(input) {
     if (input.codex) {
         lines.push(`   ${input.codex.modelCount} Copilot models discovered \u00B7 default: ${input.codex.defaultModel}`);
     }
+    if (input.debugLogPath) {
+        lines.push(`   debug log: ${displayHomePath(input.debugLogPath)}`);
+    }
     if (input.pi) {
         lines.push(`   pi: wrote ${input.pi.modelCount} models to ${displayHomePath(input.pi.configPath)}${input.pi.backupPath ? ` (backed up prior config to ${displayHomePath(input.pi.backupPath)})` : ""}`);
     }
@@ -1051,6 +1147,25 @@ async function probeLivez(port) {
         return false;
     }
 }
+async function warnIfDebugRequestedButInactive(debugRequested, port) {
+    if (!debugRequested) {
+        return false;
+    }
+    const active = await probeDebugEndpoint(port);
+    if (!active) {
+        process.stderr.write(`warning: copillm is already running without debug mode; run \`copillm stop\` then \`copillm --debug start --detach\` to enable daemon diagnostics.\n`);
+    }
+    return active;
+}
+async function probeDebugEndpoint(port) {
+    try {
+        const response = await fetch(`http://127.0.0.1:${port}/_debug`, { signal: AbortSignal.timeout(1_200) });
+        return response.ok;
+    }
+    catch {
+        return false;
+    }
+}
 async function probeHealth(port) {
     try {
         const response = await fetch(`http://127.0.0.1:${port}/healthz`, { signal: AbortSignal.timeout(1_500) });
@@ -1155,15 +1270,21 @@ function parseAgentName(raw) {
 }
 async function ensureDaemonRunningForLauncher(opts) {
     const live = await readLiveLock();
-    if (live)
+    if (live) {
+        await warnIfDebugRequestedButInactive(opts.debug, live.port);
         return live;
-    process.stderr.write(`Starting copillm in background...\n`);
+    }
+    const debugLog = currentDebugLogPath(opts.debug);
+    process.stderr.write(opts.debug && debugLog
+        ? `Starting copillm in background with debug logging at ${displayHomePath(debugLog)}...\n`
+        : `Starting copillm in background...\n`);
     const daemonArgs = [process.argv[1], "daemon"];
     if (opts.debug)
         daemonArgs.push("--debug");
     const child = spawn(process.execPath, daemonArgs, {
         detached: true,
-        stdio: "ignore"
+        stdio: "ignore",
+        env: daemonSpawnEnv(opts.debug)
     });
     child.unref();
     const started = await waitForDaemonReady(child.pid ?? null, 10_000);

package/dist/config/home.js

@@ -32,6 +32,9 @@ export function modelsCachePath() {
 export function modelsCacheReadPath() {
     return resolveReadablePath("models.cache.json");
 }
+export function debugLogPath() {
+    return path.join(getCopillmHome(), "debug.log");
+}
 function resolveReadablePath(fileName) {
     const canonical = path.join(getCopillmHome(), fileName);
     if (fs.existsSync(canonical)) {

package/dist/config/logging.js

@@ -1,7 +1,11 @@
 import pino from "pino";
-export function createLogger() {
-    return pino({
-        level: process.env.COPILLM_LOG_LEVEL ?? "info",
+import fs from "node:fs";
+import path from "node:path";
+import { applyModeIfSupported } from "./fsSecurity.js";
+export function createLogger(input) {
+    const destinationPath = input?.destinationPath ?? process.env.COPILLM_LOG_FILE;
+    const options = {
+        level: input?.level ?? process.env.COPILLM_LOG_LEVEL ?? "info",
         redact: {
             paths: [
                 "req.headers.authorization",
@@ -27,7 +31,25 @@ export function createLogger() {
             remove: true
         },
         transport: process.env.COPILLM_LOG_PRETTY === "1"
-            ? { target: "pino-pretty", options: { colorize: true } }
+            ? { target: "pino-pretty", options: { colorize: destinationPath ? false : true, destination: destinationPath ?? 2 } }
             : undefined
-    });
+    };
+    if (process.env.COPILLM_LOG_PRETTY === "1") {
+        if (destinationPath) {
+            prepareLogFile(destinationPath);
+        }
+        return pino(options);
+    }
+    if (destinationPath) {
+        prepareLogFile(destinationPath);
+        return pino(options, pino.destination(destinationPath));
+    }
+    return pino(options, pino.destination(2));
+}
+function prepareLogFile(filePath) {
+    const resolvedPath = path.resolve(filePath);
+    fs.mkdirSync(path.dirname(resolvedPath), { recursive: true, mode: 0o700 });
+    const fd = fs.openSync(resolvedPath, "a", 0o600);
+    fs.closeSync(fd);
+    applyModeIfSupported(resolvedPath, 0o600);
 }

package/dist/models/anthropicDefaults.js

@@ -8,6 +8,7 @@ const SUFFIX_BLOCKLIST = [
     "-low",
     "-min",
     "-1m",
+    "[1m]",
     "-internal",
     "-preview",
     "-beta",