widget-creator: resilient Copilot CLI build + refresh vendored MXC binaries

[Chris Anderson (codemonkeychris)]

Summary

Makes the widget-creator sample's GitHub.Copilot.SDK build-time CLI acquisition resilient (it previously hard-failed dotnet build/dotnet run on restricted networks) and refreshes the stale vendored MXC sandbox binaries.

Copilot CLI acquisition

The SDK's GitHub.Copilot.SDK.targets download copilot.exe via an unauthenticated MSBuild DownloadFile hardcoded to registry.npmjs.org, then <Error> on failure (MSB3923). That breaks the build for anyone offline / behind a proxy / on a TLS-intercepted network, even though the CLI is a runtime-only artifact. CI already skips it (CopilotSkipCliDownload=true); local dev did not.

• build/Reactor.CopilotCli.targets (new, imported from Directory.Build.targets) — takes over acquisition at evaluation time (the only lever that gates the SDK's own targets) and obtains the CLI best-effort, in order:
  1. binary cached by a previous build
  2. COPILOT_CLI_PATH
  3. public registry DownloadFile (external / OSS)
  4. npm pack honoring the ambient authenticated .npmrc — the supported path for the internal Azure Artifacts npm feed (which requires auth DownloadFile can't provide)
  5. else the build succeeds without a bundled CLI and emits a REACTORCLI001 warning
  • Inert whenever CopilotSkipCliDownload=true, so all CI/official/nightly pipelines are unchanged — only previously-broken local builds are fixed.
• CopilotSdkClient.cs — resolves a CLI at run time (bundled → COPILOT_CLI_PATH → installed) and passes RuntimeConnection.ForStdio(path:), because the SDK's default stdio transport only looks for a bundled binary and ignores COPILOT_CLI_PATH.
• reactor-build-steps.yml — internal npm feed modernized to the pkgs.dev.azure.com domain (matching the NuGet feed's org/project; the preferred/required endpoint). Equivalent to the legacy github-private.pkgs.visualstudio.com form.
• README — documents the internal-vs-external CLI-at-build behavior.

MXC binary refresh

• Refreshes the vendored wxc-exec + helper binaries under tools/mxc/win-arm64/ from the latest MXC build, and updates the C-3 SHA-256 integrity pins in MxcBinaryManifest.cs to match (required, or the sandbox refuses to launch). The previously vendored wxc-exec was stale.

Validation

• Build succeeds against the stock GitHub.Copilot.SDK 1.0.7 on a restricted network (graceful REACTORCLI001 skip, ~9s, no hang); COPILOT_CLI_PATH correctly bundles the CLI into the output.
• The refreshed wxc-exec enforces the network policy: a default block config denies egress (curl → HTTPCODE:000), an internet-allowed config permits it (200) — verified by running wxc-exec directly, outside the app.

Notes / out of scope

• Only win-arm64 MXC binaries + pins were refreshed (this machine's arch); win-x64 is unchanged.
• A separate SDK/CLI protocol-compatibility fix (numeric timestamp converter + accepting protocol v2) lives in the upstream github/copilot-sdk repo and is not part of this PR; a local VersionOverride bridge was intentionally left out.

[Copilot]

Pull request overview

This PR improves the reliability of Copilot-powered samples/tools by preventing GitHub.Copilot.SDK’s build-time copilot.exe acquisition from hard-failing on restricted/offline networks, and refreshes the integrity pins for the vendored MXC sandbox binaries used by the widget-creator sample.

Changes:

• Add a repo-wide MSBuild override (build/Reactor.CopilotCli.targets, imported from Directory.Build.targets) that best-effort acquires/bundles the Copilot CLI (public download or npm pack) and otherwise emits REACTORCLI001 instead of failing the build.
• Update widget-creator’s runtime Copilot client to explicitly pass a resolved CLI path to the SDK stdio transport when no bundled CLI is present.
• Refresh win-arm64 MXC SHA-256 pins and modernize the internal npm registry URL in pipeline templates; document internal vs external behavior in the sample README.

Show a summary per file

File	Description
samples/apps/widget-creator/Services/MxcBinaryManifest.cs	Updates win-arm64 SHA-256 pins for refreshed vendored MXC binaries.
samples/apps/widget-creator/Services/CopilotSdkClient.cs	Adds runtime CLI-path resolution and explicit stdio connection wiring for Copilot SDK.
samples/apps/widget-creator/README.md	Documents internal vs external/offline Copilot CLI acquisition behavior.
Directory.Build.targets	Imports the new resilient Copilot CLI acquisition targets late in the build.
build/Reactor.CopilotCli.targets	Implements best-effort CLI acquisition (cache/env/public download/npm pack) and graceful warning fallback.
build/pipelines/templates/reactor-build-steps.yml	Updates default internal npm registry endpoint to pkgs.dev.azure.com.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (1)

samples/apps/widget-creator/Services/CopilotSdkClient.cs:114

• Enumerating and executing copilot.exe from every directory on PATH expands the attack surface: when the bundled CLI is absent (e.g. offline build), any unintended/malicious copilot.exe earlier on PATH would be launched. Prefer requiring an explicit COPILOT_CLI_PATH (or checking only well-known install locations) instead of probing PATH.

        // Anything named copilot.exe on PATH.
        var path = Environment.GetEnvironmentVariable("PATH") ?? string.Empty;
        foreach (var dir in path.Split(Path.PathSeparator))
        {
            if (string.IsNullOrWhiteSpace(dir))
                continue;
            string full;
            try { full = Path.Combine(dir.Trim(), "copilot.exe"); }
            catch { continue; }
            yield return full;
        }

• Files reviewed: 6/12 changed files
• Comments generated: 2
• Review effort level: Low

[Chris Anderson (codemonkeychris)]

Done in 8704eb1 — removed the PATH probing entirely (resolution is now bundled → COPILOT_CLI_PATH → the well-known per-user GitHub CLI install location only) and updated the doc comment to match, calling out that PATH is intentionally not scanned.

[Chris Anderson (codemonkeychris)]

Reworded in 8704eb1 — the offline bullet now says you need a Copilot CLI at run time (bundled or via COPILOT_CLI_PATH) and explicitly notes that gh auth only supplies credentials, not a runnable copilot.exe.

[Copilot]

Review details

• Files reviewed: 6/12 changed files
• Comments generated: 1
• Review effort level: Low