{"id":49066946,"url":"https://github.com/andyzengmath/copilot-plugin-cc","last_synced_at":"2026-04-30T12:01:14.292Z","repository":{"id":352311795,"uuid":"1214667003","full_name":"andyzengmath/copilot-plugin-cc","owner":"andyzengmath","description":"Use GitHub Copilot CLI from Claude Code for code review and task delegation (port of codex-plugin-cc over ACP v1)","archived":false,"fork":false,"pushed_at":"2026-04-29T06:34:09.000Z","size":472,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-04-29T07:08:17.376Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/andyzengmath.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":"NOTICE","maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-04-18T22:08:48.000Z","updated_at":"2026-04-29T06:33:52.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/andyzengmath/copilot-plugin-cc","commit_stats":null,"previous_names":["andyzengmath/copilot-plugin-cc"],"tags_count":19,"template":false,"template_full_name":null,"purl":"pkg:github/andyzengmath/copilot-plugin-cc","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andyzengmath%2Fcopilot-plugin-cc","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andyzengmath%2Fcopilot-plugin-cc/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andyzengmath%2Fcopilot-plugin-cc/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andyzengmath%2Fcopilot-plugin-cc/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/andyzengmath","download_url":"https://codeload.github.com/andyzengmath/copilot-plugin-cc/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andyzengmath%2Fcopilot-plugin-cc/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32463896,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-29T22:27:22.272Z","status":"online","status_checked_at":"2026-04-30T02:00:05.929Z","response_time":57,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-04-20T05:10:50.161Z","updated_at":"2026-04-30T12:01:14.280Z","avatar_url":"https://github.com/andyzengmath.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Copilot plugin for Claude Code\n\nUse **GitHub Copilot CLI** from inside Claude Code for code reviews or to\ndelegate tasks to Copilot.\n\nThis plugin is for Claude Code users who already have Copilot CLI installed\nand want to invoke Copilot from the same workflow, without leaving Claude.\n\nIt is a port of [`codex-plugin-cc`](https://github.com/openai/codex-plugin-cc)\nthat swaps the underlying runtime: `codex app-server` is replaced by\n`copilot --acp`, which speaks the standard\n[Agent Client Protocol v1](https://agentclientprotocol.com/).\n\n## What you get\n\n- `/copilot:review` — standard code review of your current work\n- `/copilot:adversarial-review` — steerable challenge review\n- `/copilot:rescue`, `/copilot:status`, `/copilot:result`, `/copilot:cancel` — delegate work and manage background jobs\n- `/copilot:setup` — installer and auth check; toggle the optional stop-time review gate\n\n## Requirements\n\n- **GitHub Copilot subscription.** Usage counts against your Copilot allowance.\n- **Copilot CLI 1.0.11 or later** (for native `--effort` passthrough; anything that speaks ACP v1).\n- **Node.js 18.20.2+, 20.12.2+, or 22.0.0+** — `engines.node` enforces this so the CVE-2024-27980 (`.cmd` argv-injection) patch is guaranteed present. Earlier 18.x lines are explicitly rejected.\n\n## Install\n\nAdd the marketplace in Claude Code:\n\n```bash\n/plugin marketplace add andyzengmath/copilot-plugin-cc\n```\n\nInstall the plugin:\n\n```bash\n/plugin install copilot@copilot-plugin-cc\n```\n\nReload plugins:\n\n```bash\n/reload-plugins\n```\n\nThen run:\n\n```bash\n/copilot:setup\n```\n\n`/copilot:setup` will tell you whether Copilot CLI is ready. If Copilot is\nmissing and npm is available, it can offer to install Copilot for you.\n\nIf you prefer to install Copilot yourself:\n\n```bash\nnpm install -g @github/copilot\n```\n\nIf Copilot is installed but not signed in:\n\n```bash\n!copilot login\n```\n\n## Usage\n\n### `/copilot:review`\n\nRuns a standard code review on your current work.\n\nUse it when you want:\n\n- a review of your uncommitted changes\n- a review of your branch compared to a base branch like `main`\n\nFlags: `--base \u003cref\u003e`, `--wait`, `--background`, `--model \u003cname\u003e`,\n`--effort \u003clevel\u003e`, optional focus text.\n\n```bash\n/copilot:review\n/copilot:review --base main\n/copilot:review --background\n/copilot:review --effort high\n```\n\n### `/copilot:adversarial-review`\n\nA **steerable** review that challenges the implementation approach and\ndesign choices rather than just scanning for defects. Accepts the same\nflags as `/copilot:review`.\n\n```bash\n/copilot:adversarial-review\n/copilot:adversarial-review --base main challenge whether the caching design is right\n/copilot:adversarial-review --background look for race conditions\n/copilot:adversarial-review --effort high focus on the retry semantics\n```\n\n### `/copilot:rescue`\n\nHands a task to Copilot through the `copilot:copilot-rescue` subagent.\n\nUse it when you want Copilot to investigate a bug, try a fix, continue a\nprevious Copilot task, or take a different pass at the problem.\n\nFlags: `--background`, `--wait`, `--resume`, `--fresh`, `--model \u003cname\u003e`, `--effort \u003clevel\u003e`.\n\n```bash\n/copilot:rescue investigate why the tests started failing\n/copilot:rescue fix the failing test with the smallest safe patch\n/copilot:rescue --resume apply the top fix from the last run\n/copilot:rescue --model claude-opus-4.6 --effort high investigate the regression\n/copilot:rescue --background investigate the flaky integration test\n```\n\n**Model aliases**: `fast` → `claude-opus-4.6-fast`, `opus` →\n`claude-opus-4.7`, `sonnet` → `claude-sonnet-4.6`, `haiku` →\n`claude-haiku-4.5`, `gpt` → `gpt-5.4`, `codex` → `gpt-5.3-codex`,\n`auto` → Copilot's auto-model-selection (GA 2026-04-17).\nAny concrete Copilot model name works too — e.g.\n`--model claude-opus-4.6` or `--model gpt-5.5` or\n`--model gpt-5.4-mini` — even if it doesn't have a short alias.\n\n\u003e Note: `claude-opus-4.7` currently sits at a 7.5x Copilot premium-\n\u003e request multiplier (through 2026-04-30). The `opus` alias tracks\n\u003e it anyway; type `--model claude-opus-4.6` explicitly if you need\n\u003e the pre-4.7 billing rate.\n\n**`--effort`** passes straight through to Copilot CLI's native\n`--effort=\u003clow|medium|high|xhigh\u003e` flag (Copilot CLI 1.0.11+). The\nplugin's `none`/`minimal` aliases collapse to `low` at spawn time\nfor codex-plugin-cc command parity. When `--effort` is set without\n`--model`, the user's default model from\n[`~/.copilot/settings.json`](#default-model--effort) is preserved\n— effort and model are independent knobs.\n\n`--model` and `--effort` can be passed together; both flow through\nverbatim and Copilot's runtime applies them independently. There is\nno longer an \"either/or\" override: in v0.0.16 the plugin dropped the\ninternal effort-to-model mapping that used to silently force a Claude\nmodel whenever `--effort` was set.\n\n### Default model + effort\n\nThe plugin reads its default model and reasoning effort from\n`~/.copilot/settings.json` (the standard Copilot CLI settings file —\nlocation is `$COPILOT_HOME/settings.json` if you've set\n`COPILOT_HOME`). Selection precedence is:\n\n1. `/model` slash command inside an interactive `copilot` session\n2. `--model` / `--effort` CLI flags on the plugin command\n3. `COPILOT_MODEL` / `COPILOT_EFFORT_LEVEL` environment variables\n4. `model` / `effortLevel` keys in `~/.copilot/settings.json`\n5. Copilot CLI's built-in default (`claude-sonnet-4.5` today)\n\nThe fastest way to change your default for every plugin command is:\n\n```bash\n/copilot:setup --default-model gpt-5.5 --default-effort high\n```\n\nThat writes the two keys into `~/.copilot/settings.json` atomically,\npreserving leading `// ...` comments and every other key the file\nalready had. After that, `/copilot:rescue`, `/copilot:review`, and\nthe others will inherit GPT-5.5 + high reasoning unless a per-call\nflag overrides them.\n\nEvery plugin call also emits an `[copilot] Using model: ...` line\nto stderr before doing work, so you can confirm the active model +\neffort + source on each invocation.\n\n### `/copilot:status`, `/copilot:result`, `/copilot:cancel`\n\nSame semantics as codex-plugin-cc. Track, fetch, and cancel background\nCopilot jobs scoped to this Claude session.\n\n### `/copilot:setup`\n\nChecks install, ACP health, and auth state. The output also shows the\n**active model** line — your inherited default model, effort, and where\nthe value came from (settings.json, env, or Copilot CLI default).\n\nToggle the optional stop-time review gate:\n\n```bash\n/copilot:setup --enable-review-gate\n/copilot:setup --disable-review-gate\n```\n\nPersist a default model and reasoning effort into\n`~/.copilot/settings.json`:\n\n```bash\n/copilot:setup --default-model gpt-5.5\n/copilot:setup --default-effort high\n/copilot:setup --default-model auto --default-effort medium\n```\n\nAliases (`fast`, `opus`, `sonnet`, `haiku`, `gpt`, `codex`, `auto`)\nresolve to canonical Copilot model identifiers before being written.\nThe plugin's `none`/`minimal` effort tiers collapse to `low` (Copilot's\nown `effortLevel` only accepts `low`/`medium`/`high`/`xhigh`). Other\nkeys in `settings.json` are preserved.\n\nProbe Copilot for model availability against a fixed list of common\nmodels (Claude + GPT) before you hit an availability error mid-run:\n\n```bash\n/copilot:setup --probe-models\n```\n\n## How it works\n\n- Spawns one shared `copilot --acp` broker process per Claude session.\n- Routes all plugin commands to the broker over a Unix socket (or Windows\n  named pipe).\n- Tracks jobs in `${CLAUDE_PLUGIN_DATA}/state/\u003cworkspace\u003e/` with per-job\n  JSON + log files, session-scoped via a `SessionStart` hook.\n- Cancels a live run with ACP `session/cancel`; falls back to killing the\n  process tree if the session ID is unknown.\n- Cross-Claude-session resume falls back to `copilot -p --continue` when no\n  in-broker session is available (streaming progress degrades to coarse\n  phase transitions).\n\nSee [`docs/plans/2026-04-17-copilot-plugin-cc-design.md`](docs/plans/2026-04-17-copilot-plugin-cc-design.md)\nfor the full design, including the Codex-RPC ↔ ACP-v1 mapping table and\nthe per-command porting decisions.\n\n## Status (v0.0.18)\n\n- Core runtime, broker, companion, and hooks all ported and under test.\n- Standard and adversarial review commands share one prompt-engineered\n  path (Copilot has no native `review/start` RPC). The `copilot-agents/`\n  files are the canonical review methodology; the runtime prompt\n  templates include them via `{{AGENT:\u003cname\u003e}}` so there's no drift\n  between the plugin prompt and `copilot --agent copilot-code-review`.\n- Per-call `--model` and `--effort` flags pass straight through to\n  Copilot CLI's native flags (1.0.11+) via a one-shot\n  `copilot -p \"\u003cprompt\u003e\"` subprocess that bypasses the shared ACP\n  broker. Applied uniformly across `/copilot:rescue`, `/copilot:review`,\n  and `/copilot:adversarial-review`. The legacy effort→model mapping\n  was removed in v0.0.16 so `--effort` no longer overrides your\n  configured default model.\n- The active model + effort + source is echoed to stderr before every\n  plugin call (v0.0.15) and shown in `/copilot:setup` output. Defaults\n  can be persisted to `~/.copilot/settings.json` via\n  `/copilot:setup --default-model X --default-effort Y` (v0.0.15).\n- Multi-session broker coordination via a workspace-scoped\n  `broker.lock` file (v0.0.8). Two Claude sessions starting on the\n  same workspace simultaneously share one `copilot --acp` broker\n  instead of racing to spawn duplicates. Fast path (live `broker.json`\n  + reachable endpoint) skips the lock entirely so single-session\n  reuse stays zero-overhead.\n- Review-output enforcement walks every constraint in\n  `plugins/copilot/schemas/review-output.schema.json` end-to-end\n  (v0.0.8 + v0.0.9 tightening). Violations render as a bulleted\n  `Schema violations:` section, not a short-circuited \"first error\"\n  message.\n- All three Copilot spawn sites use `lib/safe-spawn.mjs` (v0.0.18) — a\n  cross-spawn-style helper that pre-resolves Windows `.cmd`/`.bat`\n  launchers via PATHEXT and applies argv escaping with\n  `windowsVerbatimArguments: true`, so `shell: false` everywhere. This\n  closed the CVE-2024-27980 (\"BatBadBut\") class without the\n  hand-rolled deny-list that v0.0.3-v0.0.17 carried.\n- Defense-in-depth on the prompt-injection path: `--no-ask-user`\n  (v0.0.17) removes the `ask_user` tool at the CLI level so a\n  prompt-injected ask can't stall the run; `--secret-env-vars=COPILOT_GITHUB_TOKEN,GH_TOKEN,GITHUB_TOKEN`\n  (v0.0.17) redacts auth tokens from any debug-style shell output the\n  agent surfaces; `--deny-tool=shell(\u003ccmd\u003e:*)` for `curl`/`wget`/`nc`/`ncat`/`ssh`\n  (v0.0.18) cuts off exfiltration commands even with the broker's\n  `--allow-all-tools` (denial \u003e allow per `copilot help permissions`).\n- Test coverage is end-to-end against a spawnable fake-ACP fixture\n  (`tests/fake-copilot.mjs`). 173 tests across runtime suites, unit\n  tests (safe-spawn, prompt loader, firstAllowOption, broker\n  endpoint, schema validator, settings.json reader/writer, etc.) and\n  the protocol-agnostic set. `tests/safe-spawn.test.mjs` (v0.0.18) is\n  the first CI test that exercises the production Windows\n  `.cmd`-launcher spawn path. CI runs on every PR on Ubuntu + Windows.\n\nSee\n[`docs/plans/2026-04-20-v08-handoff.md`](docs/plans/2026-04-20-v08-handoff.md)\nfor the running backlog and per-release details.\n\n## Security\n\nSee [SECURITY.md](SECURITY.md) for the threat model, the Windows ACL\ncaveat on `broker.json`, the v0.0.18 cross-spawn helper plus\n`--deny-tool` exfiltration denials, and how to report vulnerabilities\nvia a private GitHub Security Advisory.\n\n## License\n\nApache-2.0. See [LICENSE](LICENSE) and [NOTICE](NOTICE).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fandyzengmath%2Fcopilot-plugin-cc","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fandyzengmath%2Fcopilot-plugin-cc","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fandyzengmath%2Fcopilot-plugin-cc/lists"}