Copilot CLI
Route GitHub Copilot CLI's shell commands into the sandbox with a user-level hook.
boxer adds a hook to Copilot CLI that rewrites each intercepted command to boxer run.
Set up
boxer install copilot --userCopilot CLI loads repository hooks only from a trusted directory, and a headless copilot -p run
is never trusted. So boxer writes to ~/.copilot instead. The hook applies to every repository, and
there is nothing to commit.
What it writes
| File | What it is |
|---|---|
~/.copilot/hooks/boxer.json | the hook that rewrites commands |
~/.copilot/mcp-config.json | the boxer MCP server |
~/.copilot/skills/boxer/ | the skill that tells Copilot how commands run here |
In a repository with no boxer.toml, boxer still sandboxes the intercepted commands, using an image
picked from the lockfile.
Copilot's hook runs only before each command. It has no session-start event, so the sandbox is
created on the first intercepted command, and warm_on_session_start does nothing. Run
boxer install git to start each new worktree's sandbox as soon as git creates it.
Check it
boxer doctorThen ask Copilot to run node -p process.platform. It prints linux.
Options
- Run Copilot itself in the sandbox:
boxer shell copilot. See Inside mode.
Tested in the matrix with hook rewrite and PATH shims.