copillm 0.2.4 → 0.2.6

package/dist/cli/commands/daemon.js

@@ -16,6 +16,7 @@ import { refreshPiHome } from "../integrations/refreshPi.js";
 import { writeAuthStatusLine } from "../shared/backends.js";
 import { currentDebugLogPath, enableRuntimeDebug, getRootLogger, resolveCopillmDebug } from "../shared/debug.js";
 import { writeCommandOutput, writeHealthOutput } from "../shared/output.js";
+import { buildSelfSpawnCommand } from "../daemon/selfSpawn.js";
 export function register(program) {
     program
         .command("start")
@@ -71,11 +72,11 @@ export function register(program) {
                 });
                 return;
             }
-            const daemonArgs = [process.argv[1], "daemon"];
+            const daemonCommand = buildSelfSpawnCommand("daemon");
             if (debug) {
-                daemonArgs.push("--debug");
+                daemonCommand.args.push("--debug");
             }
-            const child = spawn(process.execPath, daemonArgs, {
+            const child = spawn(daemonCommand.command, daemonCommand.args, {
                 detached: true,
                 stdio: "ignore",
                 env: daemonSpawnEnv(debug)

package/dist/cli/copillmFlags.js

@@ -18,6 +18,7 @@
 export const COPILLM_FLAGS = [
     {
         flag: "--copillm-use",
+        aliases: ["--use"],
         takesValue: true,
         dest: "copillmUse",
         kind: "swallow",
@@ -25,6 +26,7 @@ export const COPILLM_FLAGS = [
     },
     {
         flag: "--copillm-debug",
+        aliases: ["--debug"],
         takesValue: false,
         dest: "copillmDebug",
         kind: "swallow",
@@ -32,6 +34,7 @@ export const COPILLM_FLAGS = [
     },
     {
         flag: "--copillm-profile",
+        aliases: ["--profile"],
         takesValue: true,
         dest: "copillmProfile",
         kind: "swallow",
@@ -39,6 +42,7 @@ export const COPILLM_FLAGS = [
     },
     {
         flag: "--copillm-no-config",
+        aliases: ["--no-config"],
         takesValue: false,
         dest: "copillmNoConfig",
         kind: "swallow",
@@ -52,7 +56,13 @@ export const COPILLM_FLAGS = [
         description: "Skip approvals (translated per-agent)"
     }
 ];
-const SPEC_BY_FLAG = new Map(COPILLM_FLAGS.map((spec) => [spec.flag, spec]));
+const SPEC_BY_FLAG = new Map();
+for (const spec of COPILLM_FLAGS) {
+    SPEC_BY_FLAG.set(spec.flag, spec);
+    for (const alias of spec.aliases ?? []) {
+        SPEC_BY_FLAG.set(alias, spec);
+    }
+}
 /**
  * Extract copillm-owned flags from a raw arg tail, returning the parsed opts
  * plus everything else to forward to the agent.

package/dist/cli/daemon/ensureRunning.js

@@ -6,6 +6,7 @@ import { displayHomePath } from "../integrations/banner.js";
 import { isPidAlive } from "./lifecycle.js";
 import { readLiveLock, waitForDaemonReady, warnIfDebugRequestedButInactive } from "./probes.js";
 import { daemonSpawnEnv } from "./spawnEnv.js";
+import { buildSelfSpawnCommand } from "./selfSpawn.js";
 export async function ensureDaemonRunningForLauncher(opts) {
     const live = await readLiveLock();
     if (live) {
@@ -22,10 +23,8 @@ export async function ensureDaemonRunningForLauncher(opts) {
     process.stderr.write(opts.debug && debugLog
         ? `Starting copillm in background with debug logging at ${displayHomePath(debugLog)}...\n`
         : `Starting copillm in background...\n`);
-    const daemonArgs = [process.argv[1], "daemon"];
-    if (opts.debug)
-        daemonArgs.push("--debug");
-    const child = spawn(process.execPath, daemonArgs, {
+    const daemonCommand = buildSelfSpawnCommand("daemon", opts.debug ? ["--debug"] : []);
+    const child = spawn(daemonCommand.command, daemonCommand.args, {
         detached: true,
         stdio: ["ignore", "ignore", "pipe"],
         env: daemonSpawnEnv(opts.debug)

package/dist/cli/daemon/selfSpawn.js

@@ -0,0 +1,15 @@
+import path from "node:path";
+export function buildSelfSpawnCommand(subcommand, extraArgs = [], runtime = process) {
+    const entryPoint = runtime.argv[1];
+    if (!entryPoint || sameExecutable(entryPoint, runtime.execPath)) {
+        return { command: runtime.execPath, args: [subcommand, ...extraArgs] };
+    }
+    return { command: runtime.execPath, args: [entryPoint, subcommand, ...extraArgs] };
+}
+function sameExecutable(left, right) {
+    const normalizedLeft = path.resolve(left);
+    const normalizedRight = path.resolve(right);
+    return process.platform === "win32"
+        ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase()
+        : normalizedLeft === normalizedRight;
+}

package/dist/cli/index.js

@@ -1,4 +1,3 @@
-import { createRequire } from "node:module";
 import { Command } from "commander";
 import { createLogger } from "../config/logging.js";
 import { registerConfigCommands } from "./configCommands.js";
@@ -11,19 +10,18 @@ import * as claudeCmd from "./commands/agents/claude.js";
 import * as piCmd from "./commands/agents/pi.js";
 import * as copilotCmd from "./commands/agents/copilot.js";
 import { setRootLogger, setRootProgram } from "./shared/debug.js";
+import { getPackageInfo } from "./packageInfo.js";
+import { maybeNotifyAboutUpdate } from "./updateNotifier.js";
 const logger = createLogger();
 const program = new Command();
 setRootProgram(program);
 setRootLogger(logger);
-// Resolve the package version from package.json at runtime so `--version` stays
-// in sync with whatever was published. Using createRequire keeps this working
-// under NodeNext ESM without needing an import-assertion syntax flag, and
-// resolves the same file in both `dist/cli.js` (one level deep) and `src/cli.ts`
-// when invoked via tsx.
-const pkgVersion = createRequire(import.meta.url)("../../package.json").version;
-program.name("copillm").description("Local Copilot proxy").version(pkgVersion);
+const pkg = getPackageInfo();
+await maybeNotifyAboutUpdate({ packageInfo: pkg });
+program.name("copillm").description("Local Copilot proxy").version(pkg.version);
 program.enablePositionalOptions();
 program.option("--debug", "Enable copillm debug mode (debug endpoint plus verbose daemon diagnostics)");
+program.option("--no-update-notifier", "Skip the npm registry update check for this run");
 authCmd.register(program);
 daemonCmd.register(program);
 modelsCmd.register(program);

package/dist/cli/launchAgent.js

@@ -1,10 +1,14 @@
-import { spawn } from "node:child_process";
 import { resolveAgent } from "./resolveAgent.js";
+import { spawnAgent } from "./windowsSpawn.js";
 export async function launchAgent(opts) {
     const log = opts.log ?? ((line) => process.stderr.write(`${line}\n`));
     let resolved;
     try {
-        resolved = await resolveAgent(opts.agent, { pinnedSpec: opts.pinnedSpec, log });
+        resolved = await resolveAgent(opts.agent, {
+            pinnedSpec: opts.pinnedSpec,
+            preferPath: useSystemAgentOptIn(),
+            log
+        });
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
@@ -14,11 +18,9 @@ export async function launchAgent(opts) {
     }
     log(resolved.displayLine);
     const childEnv = { ...process.env, ...opts.env };
-    const useShell = process.platform === "win32" && /\.(cmd|bat)$/i.test(resolved.binPath);
-    const child = spawn(resolved.binPath, opts.args, {
+    const child = spawnAgent(resolved.binPath, opts.args, {
         stdio: "inherit",
-        env: childEnv,
-        shell: useShell
+        env: childEnv
     });
     return new Promise((resolve, reject) => {
         child.once("error", reject);
@@ -65,3 +67,17 @@ function installHint(agent) {
         "    npm i -g @anthropic-ai/claude-code"
     ].join("\n");
 }
+/**
+ * Whether the user has opted in to letting copillm fall back to a system-installed
+ * coding-agent binary on PATH. Off by default — copillm uses its own cache and
+ * downloads on demand so the executed version is deterministic.
+ *
+ * Opt in by setting `COPILLM_USE_SYSTEM_AGENT` to `1`, `true`, or `yes`
+ * (case-insensitive).
+ */
+function useSystemAgentOptIn() {
+    const raw = process.env.COPILLM_USE_SYSTEM_AGENT;
+    if (!raw)
+        return false;
+    return /^(1|true|yes)$/i.test(raw.trim());
+}

package/dist/cli/packageInfo.js

@@ -0,0 +1,29 @@
+import { createRequire } from "node:module";
+const FALLBACK_PACKAGE_INFO = {
+    name: "copillm",
+    version: "0.2.6"
+};
+export function getPackageInfo() {
+    const envName = cleanPackageValue(process.env.COPILLM_PACKAGE_NAME);
+    const envVersion = cleanPackageValue(process.env.COPILLM_PACKAGE_VERSION);
+    if (envName && envVersion) {
+        return { name: envName, version: envVersion };
+    }
+    try {
+        const pkg = createRequire(import.meta.url)("../../package.json");
+        if (typeof pkg.name === "string" && pkg.name.length > 0 && typeof pkg.version === "string" && pkg.version.length > 0) {
+            return { name: pkg.name, version: pkg.version };
+        }
+    }
+    catch {
+        // Standalone bundles may not have package.json on disk.
+    }
+    return FALLBACK_PACKAGE_INFO;
+}
+export function fallbackPackageInfo() {
+    return FALLBACK_PACKAGE_INFO;
+}
+function cleanPackageValue(value) {
+    const trimmed = value?.trim();
+    return trimmed && trimmed.length > 0 ? trimmed : null;
+}

package/dist/cli/resolveAgent.js

@@ -39,8 +39,12 @@ export async function resolveAgent(agent, opts = {}) {
     const pkg = pin.packageName;
     const binName = AGENT_REGISTRY[agent].binName;
     const agentRoot = path.join(cacheRoot, agent);
-    // 1. PATH lookup (skipped when user pinned a specific version)
-    if (!pin.version && opts.preferPath !== false) {
+    // 1. PATH lookup (opt-in only).
+    // PATH lookup is OFF by default so the running agent version is always the one copillm
+    // manages in its cache. Users who want to fall back to a system-installed binary can opt
+    // in via the COPILLM_USE_SYSTEM_AGENT env var (wired in launchAgent.ts) or by passing
+    // `preferPath: true` directly. Pinned versions always skip this branch.
+    if (!pin.version && opts.preferPath === true) {
         const found = findOnPath(binName);
         if (found) {
             const v = probeVersion(found) ?? "unknown";

package/dist/cli/updateNotifier.js

@@ -0,0 +1,223 @@
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { writeFileSecureAtomic } from "../config/fsSecurity.js";
+import { getCopillmHome } from "../config/home.js";
+const DEFAULT_REGISTRY_URL = "https://registry.npmjs.org";
+const UPDATE_CHECK_TIMEOUT_MS = 3_000;
+export async function maybeNotifyAboutUpdate(options) {
+    const argv = options.argv ?? process.argv;
+    const env = options.env ?? process.env;
+    const stderr = options.stderr ?? process.stderr;
+    const now = options.now ?? Date.now;
+    const packageInfo = options.packageInfo;
+    const cacheFile = options.cacheFilePath ?? updateCachePath();
+    if (!shouldRunUpdateCheck({ argv, env, moduleUrl: options.moduleUrl ?? import.meta.url, packageInfo, stderr })) {
+        return;
+    }
+    const cache = readUpdateCache(cacheFile, packageInfo.name);
+    const checkedAt = now();
+    const latestVersion = await fetchLatestNpmVersion(packageInfo.name, {
+        fetchImpl: options.fetchImpl,
+        registryUrl: env.COPILLM_UPDATE_REGISTRY_URL,
+        timeoutMs: UPDATE_CHECK_TIMEOUT_MS
+    });
+    if (latestVersion) {
+        writeUpdateCache(cacheFile, {
+            version: 1,
+            packageName: packageInfo.name,
+            latestVersion,
+            checkedAt
+        });
+        notifyIfNewer(stderr, packageInfo, latestVersion);
+        return;
+    }
+    writeUpdateCache(cacheFile, {
+        version: 1,
+        packageName: packageInfo.name,
+        latestVersion: cache?.latestVersion ?? null,
+        checkedAt
+    });
+    notifyIfNewer(stderr, packageInfo, cache?.latestVersion ?? null);
+}
+export async function fetchLatestNpmVersion(packageName, options = {}) {
+    const registryUrl = options.registryUrl && options.registryUrl.trim().length > 0
+        ? options.registryUrl.trim()
+        : DEFAULT_REGISTRY_URL;
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const timeoutMs = options.timeoutMs ?? UPDATE_CHECK_TIMEOUT_MS;
+    const signal = AbortSignal.timeout(timeoutMs);
+    try {
+        const response = await fetchImpl(distTagsUrl(packageName, registryUrl), {
+            headers: { accept: "application/json" },
+            signal
+        });
+        if (!response.ok) {
+            return null;
+        }
+        return latestFromDistTags(await response.json());
+    }
+    catch {
+        return null;
+    }
+}
+export function distTagsUrl(packageName, registryUrl = DEFAULT_REGISTRY_URL) {
+    return `${registryUrl.replace(/\/+$/, "")}/-/package/${encodeURIComponent(packageName)}/dist-tags`;
+}
+export function isNewerVersion(candidate, current) {
+    return compareSemver(candidate, current) > 0;
+}
+function shouldRunUpdateCheck(opts) {
+    if (opts.stderr.isTTY !== true)
+        return false;
+    if (isTruthyCi(opts.env.CI) || isTruthyCi(opts.env.CONTINUOUS_INTEGRATION))
+        return false;
+    if (opts.env.NODE_ENV === "test")
+        return false;
+    if ("NO_UPDATE_NOTIFIER" in opts.env)
+        return false;
+    if (hasArg(opts.argv, "--no-update-notifier"))
+        return false;
+    if (hasArg(opts.argv, "--version") || hasArg(opts.argv, "-V") || hasArg(opts.argv, "--help") || hasArg(opts.argv, "-h"))
+        return false;
+    if (hasArg(opts.argv, "--json"))
+        return false;
+    if (opts.argv.slice(2).includes("daemon"))
+        return false;
+    const override = parseBooleanOverride(opts.env.COPILLM_UPDATE_CHECK);
+    if (override !== null) {
+        return override;
+    }
+    return isNpmInstalledRuntime(opts.moduleUrl, opts.packageInfo.name);
+}
+function isNpmInstalledRuntime(moduleUrl, packageName) {
+    let modulePath;
+    try {
+        modulePath = fileURLToPath(moduleUrl);
+    }
+    catch {
+        return false;
+    }
+    const normalized = modulePath.split(path.sep).join("/").toLowerCase();
+    const marker = `/node_modules/${packageName.toLowerCase()}/`;
+    return normalized.includes(marker);
+}
+function updateCachePath() {
+    return path.join(getCopillmHome(), "update-check.json");
+}
+function readUpdateCache(filePath, packageName) {
+    if (!fs.existsSync(filePath)) {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(fs.readFileSync(filePath, "utf8"));
+        return parseUpdateCache(parsed, packageName);
+    }
+    catch {
+        return null;
+    }
+}
+function writeUpdateCache(filePath, cache) {
+    try {
+        writeFileSecureAtomic(filePath, `${JSON.stringify(cache, null, 2)}\n`, 0o600);
+    }
+    catch {
+        // Update checks are advisory and must never prevent the CLI from starting.
+    }
+}
+function parseUpdateCache(value, packageName) {
+    if (!value || typeof value !== "object") {
+        return null;
+    }
+    const candidate = value;
+    if (candidate.version !== 1 || candidate.packageName !== packageName) {
+        return null;
+    }
+    if (candidate.latestVersion !== null && typeof candidate.latestVersion !== "string") {
+        return null;
+    }
+    if (typeof candidate.checkedAt !== "number" || !Number.isFinite(candidate.checkedAt)) {
+        return null;
+    }
+    return {
+        version: 1,
+        packageName,
+        latestVersion: candidate.latestVersion,
+        checkedAt: candidate.checkedAt
+    };
+}
+function latestFromDistTags(value) {
+    if (!value || typeof value !== "object") {
+        return null;
+    }
+    const latest = value.latest;
+    return typeof latest === "string" && latest.trim().length > 0 ? latest.trim() : null;
+}
+function notifyIfNewer(stderr, packageInfo, latestVersion) {
+    if (!latestVersion || !isNewerVersion(latestVersion, packageInfo.version)) {
+        return;
+    }
+    stderr.write([
+        "",
+        `copillm ${latestVersion} is available (current ${packageInfo.version}).`,
+        "Update with: npm install -g copillm",
+        "Release notes: https://github.com/jcjc-dev/copillm/releases/latest",
+        ""
+    ].join("\n"));
+}
+function hasArg(argv, arg) {
+    return argv.slice(2).includes(arg);
+}
+function parseBooleanOverride(value) {
+    if (value === undefined) {
+        return null;
+    }
+    const normalized = value.trim().toLowerCase();
+    if (["1", "true", "yes", "on"].includes(normalized)) {
+        return true;
+    }
+    if (["0", "false", "no", "off"].includes(normalized)) {
+        return false;
+    }
+    return null;
+}
+function isTruthyCi(value) {
+    if (value === undefined) {
+        return false;
+    }
+    const normalized = value.trim().toLowerCase();
+    return normalized !== "" && normalized !== "0" && normalized !== "false";
+}
+function compareSemver(left, right) {
+    const parsedLeft = parseSemver(left);
+    const parsedRight = parseSemver(right);
+    if (!parsedLeft || !parsedRight) {
+        return 0;
+    }
+    for (let i = 0; i < 3; i += 1) {
+        const delta = parsedLeft.core[i] - parsedRight.core[i];
+        if (delta !== 0) {
+            return delta;
+        }
+    }
+    if (parsedLeft.prerelease === parsedRight.prerelease) {
+        return 0;
+    }
+    if (parsedLeft.prerelease === null) {
+        return 1;
+    }
+    if (parsedRight.prerelease === null) {
+        return -1;
+    }
+    return parsedLeft.prerelease.localeCompare(parsedRight.prerelease);
+}
+function parseSemver(value) {
+    const match = value.trim().match(/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/);
+    if (!match) {
+        return null;
+    }
+    return {
+        core: [Number(match[1]), Number(match[2]), Number(match[3])],
+        prerelease: match[4] ?? null
+    };
+}

package/dist/cli/windowsSpawn.js

@@ -0,0 +1,71 @@
+import { spawn } from "node:child_process";
+const META_CHARS = /([()\][%!^"`<>&|;, *?])/g;
+function escapeArgument(arg, doubleEscapeMetaChars) {
+    let escaped = `${arg}`;
+    escaped = escaped.replace(/(?=(\\+?)?)\1"/g, '$1$1\\"');
+    escaped = escaped.replace(/(?=(\\+?)?)\1$/, "$1$1");
+    escaped = `"${escaped}"`;
+    escaped = escaped.replace(META_CHARS, "^$1");
+    if (doubleEscapeMetaChars) {
+        escaped = escaped.replace(META_CHARS, "^$1");
+    }
+    return escaped;
+}
+function escapeCommand(command) {
+    return command.replace(META_CHARS, "^$1");
+}
+/**
+ * Build the `cmd.exe /d /s /c "..."` invocation we need to run a `.cmd` /
+ * `.bat` file safely on Windows.
+ *
+ * Background: Node's `child_process.spawn` cannot directly exec a batch file
+ * (CreateProcess only understands real PE binaries), and `shell: true` is now
+ * deprecated when combined with an args array because Node performs no
+ * escaping (see Node DEP0190). The accepted alternative — long used by
+ * cross-spawn and npm's own bin shims — is to spawn `cmd.exe` ourselves,
+ * pre-quote the command line, and set `windowsVerbatimArguments: true` so
+ * Node hands the buffer to Windows untouched.
+ *
+ * The quoting follows the well-known two-layer algorithm:
+ *   1. Apply Microsoft's CommandLineToArgvW rules (backslash/quote dance) so
+ *      that the underlying program parses each argument back into the values
+ *      we passed in.
+ *   2. Escape cmd.exe metacharacters (`^ & | < > ( ) % ! ;` etc.) with `^` so
+ *      they don't get interpreted by the shell before the program sees them.
+ *
+ * `doubleEscape` is needed when the target is an npm-generated `.cmd` shim
+ * (which itself spawns a nested cmd.exe via `CALL` on older npm versions, or
+ * via subshell composition); each cmd.exe parse strips one layer of `^`, so
+ * we apply it twice to survive the round trip. We default to true for
+ * `.cmd`/`.bat` because every agent we launch is installed via npm.
+ */
+export function buildWindowsCmdInvocation(file, args, doubleEscape = true) {
+    const escapedCommand = escapeCommand(file);
+    const escapedArgs = args.map((a) => escapeArgument(a, doubleEscape));
+    const commandLine = [escapedCommand, ...escapedArgs].join(" ");
+    const comspec = process.env.ComSpec || process.env.comspec || "cmd.exe";
+    return {
+        command: comspec,
+        args: ["/d", "/s", "/c", `"${commandLine}"`]
+    };
+}
+/**
+ * Spawn a child process, transparently routing `.cmd` / `.bat` files through
+ * `cmd.exe` with safe quoting on Windows. Non-Windows platforms and real
+ * `.exe` / `.com` binaries go through a direct `spawn` with no shell flag.
+ *
+ * Mirrors the surface of `child_process.spawn(file, args, options)` but
+ * never sets `shell: true` and therefore never triggers Node's DEP0190
+ * deprecation warning.
+ */
+export function spawnAgent(file, args, options) {
+    if (process.platform !== "win32" || !/\.(cmd|bat)$/i.test(file)) {
+        return spawn(file, args, { ...options, shell: false });
+    }
+    const { command, args: cmdArgs } = buildWindowsCmdInvocation(file, args);
+    return spawn(command, cmdArgs, {
+        ...options,
+        shell: false,
+        windowsVerbatimArguments: true
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "copillm",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "Local Copilot proxy CLI (OpenAI/Anthropic-compatible)",
   "license": "MIT",
   "type": "module",