feat(providers): add copilot_cli semantic-scan provider

[Yoseph-Zuskin]

Add copilot_cli semantic-scan provider

Problem

SkillSpector ships CLI providers for Claude, Codex, Gemini, and OpenCode,
but none for GitHub Copilot, so Copilot users get static-only scans
(llm_available stays false and the semantic analyzers are skipped) unless
they provide an OpenAI or Anthropic API key.

Fixes: #8

Approach

• New copilot_cli provider mirroring the merged opencode_cli shape:
  providers/copilot_cli/{provider.py,__init__.py}, registry entry,
  SKILLSPECTOR_PROVIDER=copilot_cli selection, provider_name() label,
  CLI help text.
• Transport is flags + piped stdin: copilot -s --no-ask-user with no -p
  flag — the prompt is piped to stdin by run_agent_cli (verified by nonce
  round-trip; -p "" is rejected, so stdin is the cleaner path).
  Untrusted content never reaches argv; list form throughout, shell never
  invoked. Windows hostile-prompt roundtrips covered by test.
• Least privilege from day one (not a caveat): --available-tools
  names a fixed implausible tool so the model is offered nothing usable
  (verified live: file-creation refused, no side effect), plus
  --deny-tool shell,write belt-and-braces in the documented
  Kind(argument) form (deny wins over allow). Never --allow-all*.
• Least privilege adds --disallow-temp-dir (verified live on
  1.0.89: inference from a temp working dir still answers exactly),
  alongside --disable-builtin-mcps. --stream=off /
  --log-level=none and =-form flags deliberately not adopted
  (cosmetic wire-format churn; validator already rejects
  flag-like model labels).
• --model <label> validated and forwarded only when SKILLSPECTOR_MODEL
  is set; max_output_tokens accepted for CliSpec uniformity and ignored.
• Auth probe is copilot --version with a 15s timeout, scrubbed env,
  fail-closed: non-zero exit, unparseable output, or anything but the
  pinned 1.0.89 fails. No status subcommand exists; authentication works
  via login session or one of COPILOT_GITHUB_TOKEN/GH_TOKEN/
  GITHUB_TOKEN (preserved deliberately by _prepare_copilot_env, which
  drops every other COPILOT_* and forces COPILOT_AUTO_UPDATE=false).
• Per-completion preflight registered in the CliSpec before Popen:
  version re-check on EVERY completion (a swapped binary or direct
  complete() call otherwise bypasses the probe), tmp-cwd tripwire for
  repo-level hook material, and home audit for user/plugin hook sources
  under the resolved home, the default home, and both XDG migration
  sources ($XDG_CONFIG_HOME/.copilot, $XDG_STATE_HOME/.copilot plus
  their ~/.config / ~/.local/state defaults) — startup migrates both
  into the home, so clean-home/dirty-source trees refuse. Redirecting
  either variable is not a lever (inference refuses under any redirected
  home, probed 2026-09-19); both are audited in place. Machine-wide
  policy hooks stay a documented residual (admin-owned, unauditable).
• No model registry (CLI fallback, per the registry-split lesson).
• Deliberate exception worth flagging: _prepare_copilot_env preserves
  COPILOT_GITHUB_TOKEN / GH_TOKEN / GITHUB_TOKEN through the scrub
  (everything else COPILOT_* is dropped). Rationale: these are the CLI's
  documented headless auth path — without them, token-only CI setups (where
  GITHUB_TOKEN is often the only credential) cannot use the provider at
  all, and the issue being resolved is precisely keyless operation. The
  model itself gets no tools, so it cannot read the environment; the CLI
  redacts these variables from its own output by default. If reviewers
  prefer login-only, the fallback is a one-line change (extend the scrub,
  document fail-closed for token setups).
• Docs trio updated in the same PR (README provider table, .env.example,
  docs/DEVELOPMENT.md); provider tests live in tests/provider/
  per repo convention.

Verification

• tests/provider/test_copilot_cli.py: 79 passed, 6 POSIX-skipped
  (TDD: argv, auth, parser, wiring, registry label, home/XDG audits,
  adversarial transport; RED witnessed for the STATE regressions).
• New since last review: STATE migration-source unit matrix (explicit,
  default, missing-explicit, clean), STATE transport rejection via the
  public path with empty markers, and 9.9.99 rejection via the public
  completion path (preflight removal cannot silently bypass the gate).
• Provider-adjacent suites (test_agent_cli, test_providers,
  test_new_providers, test_constants, test_llm_utils): 425 passed /
  15 skipped total.
• ruff check + ruff format --check: clean on all touched files.
• 1.0.89 release source re-inspected (darwin tarball app.js):
  migration path unchanged (installed-plugins still migrated from
  the STATE source); --help surface identical for policy purposes,
  still no --disable*hook* flag.
• Live preflight PASSES on the real 1.0.89 binary against a genuine
  user home (version gate + all sensitive settings + agent deny; no
  auth or inference required).
• Live single-skill probes on real 1.0.89 (Copilot Free, CLI-default
  model): skill-inspector 0/100 LOW SAFE; safe_skill 4/100 LOW
  SAFE; malicious_skill 100/100 CRITICAL with live semantic
  findings (P5 narrative, TP4 mismatch); mcp_poisoned_tool 100/100
  CRITICAL. No errors. (Runs 1.0.88-era figures below retained for
  the record: llm_available: true, 3/3 calls, 0/LOW.)

Risks

• Copilot Free budgets agent requests monthly; bulk scans will exhaust
  them — probes only, no bulk scanning on Free.
• --available-tools fixed-name posture depends on unknown names staying
  inert (verified on 1.0.89 behavior: silent acceptance); the version
  gate pins exactly 1.0.89 so any CLI behavior change fails closed first.
  The exact pin is deliberate (matches the merged opencode_cli policy):
  the tool-deny behavior was verified against this release, and a silent
  sandbox change must never pass unnoticed. Re-verification per Copilot
  release is the known maintenance cost.
• DCO: all commits carry Signed-off-by (maintainer: verify on push).

[rng1995]

[SkillSpector Review]

Reviewed exact head 6bb8dc5a6af1f8e59d4967f2e8133fd00d02bfa6.

The provider wiring, exact-version gate, stdin transport, output bounds, environment filtering, and zero-tool allowlist are well covered. One trust-boundary gap remains: the invocation leaves Copilot CLI's normal custom-instruction discovery enabled while deliberately preserving the user's home/login context. Ambient global or user instructions can therefore alter semantic-security judgments even though COPILOT_CUSTOM_INSTRUCTIONS_DIRS is stripped. Disable custom instructions explicitly for this provider and add an end-to-end argv/isolation regression before enabling it.

[yashrajp22]

Two issues remain in the Copilot safety boundary: inference bypasses the exact-version check, and ambient user/plugin lifecycle hooks remain enabled.

Validation: fresh base/head wheels with verified package identity; selected tests passed (324 base, 367 head; 10 skipped each); all 48 no-LLM corpus runs matched across source/wheel and base/head, with nine samples retaining partial reports. Synthetic unsupported-version checks reproduced prompt delivery through both public scans and direct completion. The real 1.0.86 binary reported missing authentication as expected, and the scan retained two PE3 findings while explicitly marking semantic analysis failed.

The hook finding is based on the pinned runtime source. The credential-free marker check was inconclusive; authenticated inference and native hook/tool/MCP behavior remain unverified. Corpus parity is not a global accuracy claim.

[rng1995]

[SkillSpector Review]

Re-reviewed exact head c9e001f29c7108fd3ecc23f7b6c4f15cac6fa53c, including the complete diff, provider/transport call path, tests, previous reviews and author replies, and CI.

Previous findings:

• Addressed: custom-instruction discovery is explicitly disabled with --no-custom-instructions; built-in MCPs and auto-update are also disabled, with argv coverage.
• Addressed in implementation: the exact-version check is now a registered per-completion preflight, invoked before Popen/stdin delivery, including direct complete() calls. The unsupported-version test currently calls the helper directly; please also exercise the public completion path so a future registry/wiring regression cannot bypass the gate unnoticed.
• Still open: user/plugin hook isolation is only partially addressed. Rejecting nonempty installed-plugins/ does not reject user hook files or inline settings hooks. The inline finding supplies the concrete non-plugin paths requested in the author reply.

I inspected (did not execute) package/app.js and the version metadata from the official Copilot CLI 1.0.86 release, asset github-copilot-1.0.86-darwin-arm64.tgz. createNativeHookSession loads user settings and passes both settingsJson and userHooksDir to hookSessionCreate before adding plugin hooks separately. This is pinned-runtime evidence, not an assumption from newer documentation.

All six reported CI checks pass. Contributor code/tests and authenticated Copilot inference were not executed during this review; the remaining finding is based on source inspection. Approval remains blocked on closing and testing the non-plugin hook paths.

[rng1995]

[SkillSpector Review]

Re-reviewed current head 05f3e3236ea5eae91ffa611faf1df4b5ba239a52, both follow-up commits, the current provider/transport code and regression tests, prior discussions, and CI.

The previous direct-home cases are now addressed: the audit rejects user hooks/*.json, inline settings.json hooks, unreadable settings, and missing explicit homes; the temp-directory tripwire and transport-level rejection test are also present. The custom-instruction/MCP restrictions and per-completion exact-version preflight remain wired in. I also independently checked the official Copilot 1.0.88 launcher: I am not requesting changes solely because auto-update was re-enabled.

One remaining user-hook path prevents approval: the new audit observes the home before Copilot's inference startup migrates legacy XDG hook material into it. The --version subprocess exits before those migrations, so it cannot make the subsequent home audit sufficient. This is a deterministic startup-order issue, not a hypothetical concurrent modification. The inline comment gives the affected configuration, exact pinned-runtime source path, and required correction.

Evidence: read-only inspection of package/app.js from the official Copilot CLI 1.0.88 release, asset github-copilot-1.0.88-darwin-arm64.tgz. The version branch returns before tOn(); tOn() calls X0n for XDG config/state migrations; normal session creation subsequently loads the destination home's hooks.

All six reported CI checks pass. Contributor code, tests, and downloaded Copilot code were not executed locally; this finding is source-traced. No merges or thread-resolution changes were made.

[Yoseph-Zuskin]

Hi @yashrajp22 and @rng1995, all comments have been addressed. Please resolve them or let me know if you would prefer I do so myself. The PR description has also been updated to reflect that the pinned CLI version is now 1.0.88. I will propose a minor automation to check for OpenCode and GitHub Copilot CLI releases once a week after this and #613 will be merged.

[rng1995]

[SkillSpector Review]

Re-reviewed exact head a053ab575bdf23e46d5971af3aedeffc2f11a75b, including the complete fourteen-file diff, transport/provider integration, tests, all prior reviews/replies/thread states, and CI. I also inspected the official Copilot CLI 1.0.88 release source as inert text.

Addressed: explicit custom-instruction/built-in MCP restrictions remain in place; the exact-version preflight is registered before inference Popen; current/fallback home hooks and inline settings are audited; the previously reported XDG_CONFIG_HOME user-hook migration source is now audited and has transport-level rejection coverage.

Still requires changes: startup migration is not fully covered. The pinned runtime also migrates installed-plugins from XDG_STATE_HOME/.copilot, but this environment variable survives the child environment and its source tree is never audited. The new inline finding describes how plugin hook material can appear after the audit and how to close this path. This is a separate migration source from the CONFIG-hook example fixed in the previous thread, not a repetition of that resolved example.

The earlier requested public-path unsupported-version regression is also still absent: the 9.9.99 rejection test invokes _preflight_copilot_policy directly, while transport tests run the supported version. Please add that public completion rejection case while extending migration coverage, so removal of the registered preflight cannot silently bypass the gate.

All six reported hosted checks pass. Contributor code/tests, downloaded runtime code, and authenticated Copilot inference were not executed locally. No merge or thread-resolution changes were made.