github-copilot-cli: use universal node package

Rather than using a per-platform SEA binary that includes Node, use the
"universal" package with the Nixpkgs' nodejs package.  This gives us
more control of other aspects of the environment, for example this
change is necessary to be able to use Copilot extensions installed in
~/.copilot/extensions.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

pkgs/by-name/gi/github-copilot-cli/package.nix

@@ -2,25 +2,26 @@
   lib,
   stdenv,
   autoPatchelfHook,
+  cacert,
   fetchurl,
   makeBinaryWrapper,
   bash,
+  nodejs,
   versionCheckHook,
+  nix-update-script,
 }:
 
-let
-  sources = lib.importJSON ./sources.json;
-  srcConfig =
-    sources.${stdenv.hostPlatform.system}
-      or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "github-copilot-cli";
-  inherit (sources) version;
+  version = "1.0.26";
 
+  # GitHub provide platform-specific SEA binaries as well as a "universal"
+  # package.  Use the universal package as it gives us a bit more flexibility
+  # about how it's configured.  In particular, the SEA binary has fixed ideas
+  # about how paths should be set up which don't reliably hold when using Nix.
   src = fetchurl {
-    url = "https://github.com/github/copilot-cli/releases/download/v${finalAttrs.version}/${srcConfig.name}.tar.gz";
-    inherit (srcConfig) hash;
+    url = "https://github.com/github/copilot-cli/releases/download/v${finalAttrs.version}/github-copilot-${finalAttrs.version}.tgz";
+    hash = "sha256-zNO0clQRfgw6CX9K8NaJXsoOhhNjBfK7KAr0AoL7Oqo=";
   };
 
   nativeBuildInputs = [
@@ -28,27 +29,38 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
   buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ stdenv.cc.cc.lib ];
-  sourceRoot = ".";
+  sourceRoot = "package";
   dontStrip = true;
+  # keytar.node and computer.node have optional system-library deps not provided
+  # here; ignore missing deps rather than fail the build.
+  autoPatchelfIgnoreMissingDeps = true;
 
   installPhase = ''
     runHook preInstall
-    # Use libexec to preserve filename when calling makeBinaryWrapper
-    install -Dm755 copilot $out/libexec/copilot
+    mkdir -p "$out"/lib/github-copilot-cli
+    cp -r * "$out"/lib/github-copilot-cli
     runHook postInstall
   '';
 
   postInstall = ''
-    # Filename must explictly be "copilot" for internal self-referencing
-    makeWrapper $out/libexec/copilot $out/bin/copilot \
-      --add-flags "--no-auto-update" \
+    makeWrapper ${nodejs}/bin/node "$out"/bin/copilot \
+      --add-flag "$out"/lib/github-copilot-cli/index.js \
+      --add-flag --no-auto-update \
+      --set-default NODE_NO_WARNINGS 1 \
+      --set-default SSL_CERT_DIR ${cacert}/etc/ssl/certs \
       --prefix PATH : "${lib.makeBinPath [ bash ]}"
   '';
 
   nativeInstallCheckInputs = [ versionCheckHook ];
+  # TODO are these errors still present after moving to using the "universal"
+  # package?
   doInstallCheck = !stdenv.hostPlatform.isDarwin; # skip on Darwin - OpenSSL errors in sandbox
 
-  passthru.updateScript = ./update.sh;
+  # Looks like GitHub use tags for both pre-release and actually released
+  # versions, but only the actual versions will be available as a GitHub
+  # release, so use the release endpoint rather than nix-update-script`'s
+  # default of looking for tags.
+  passthru.updateScript = nix-update-script { extraArgs = [ "--use-github-releases" ]; };
 
   meta = {
     description = "GitHub Copilot CLI brings the power of Copilot coding agent directly to your terminal";

pkgs/by-name/gi/github-copilot-cli/sources.json

@@ -1,19 +0,0 @@
-{
-  "version": "1.0.44",
-  "x86_64-linux": {
-    "name": "copilot-linux-x64",
-    "hash": "sha256-/wdMa5iYdRGiLukIuGzUmXIXaa+lmxaI79M5gHCS0Dw="
-  },
-  "aarch64-linux": {
-    "name": "copilot-linux-arm64",
-    "hash": "sha256-Lq9Fu4OGNMpBPrOXm4MSiWarArG8XNamH0WYFqfVXps="
-  },
-  "x86_64-darwin": {
-    "name": "copilot-darwin-x64",
-    "hash": "sha256-z5k8EKSzPKpSYNawl47ranPhW4KiBC078vx1smiZ9jI="
-  },
-  "aarch64-darwin": {
-    "name": "copilot-darwin-arm64",
-    "hash": "sha256-1am4zC3h0dbgiuZYzDUgacbucPJtEbPXdjtG5ECYMxo="
-  }
-}

pkgs/by-name/gi/github-copilot-cli/update.sh

@@ -1,46 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl jq nix
-
-set -euo pipefail
-
-ROOT="$(dirname "$(readlink -f "$0")")"
-SOURCES_FILE="$ROOT/sources.json"
-
-LATEST_TAG=$(curl -s https://api.github.com/repos/github/copilot-cli/releases/latest | jq -r .tag_name)
-
-if [ -z "$LATEST_TAG" ] || [ "$LATEST_TAG" = "null" ]; then
-  echo "Failed to fetch latest release from GitHub API"
-  exit 1
-fi
-
-VERSION="${LATEST_TAG#v}"
-
-echo "Updating to version $VERSION"
-
-# Create a temporary file for the JSON content
-TMP_FILE=$(mktemp)
-
-jq -n --arg v "$VERSION" '{version: $v}' > "$TMP_FILE"
-
-process_platform() {
-  local system="$1"
-  local name="$2"
-  local url="https://github.com/github/copilot-cli/releases/download/v${VERSION}/${name}.tar.gz"
-
-  echo "Processing $system..."
-
-  hash=$(nix-prefetch-url --type sha256 "$url")
-  sri_hash=$(nix hash convert --to sri --hash-algo sha256 "$hash")
-
-  jq --arg sys "$system" --arg n "$name" --arg h "$sri_hash" '. + {($sys): {name: $n, hash: $h}}' \
-    "$TMP_FILE" > "${TMP_FILE}.tmp" && mv "${TMP_FILE}.tmp" "$TMP_FILE"
-}
-
-process_platform "x86_64-linux" "copilot-linux-x64"
-process_platform "aarch64-linux" "copilot-linux-arm64"
-process_platform "x86_64-darwin" "copilot-darwin-x64"
-process_platform "aarch64-darwin" "copilot-darwin-arm64"
-
-mv "$TMP_FILE" "$SOURCES_FILE"
-
-echo "Updated sources.json successfully."