github-copilot

name	github:copilot
description	Get a cross-model second opinion on a code change from GPT via the Copilot CLI, then triage what it finds. Use when the ask names GPT, Copilot, a second model, or a cross-model check, and as the cross-model pass on a change that clears the review gate.
argument-hint	[--base <ref>] [--angles <n>] [--model <name>] [--agentic] [--status] [--dry-run] [--max-bytes <n>] [--force]
allowed-tools	["Bash(bun ${CLAUDE_PLUGIN_ROOT}/skills/copilot/scripts/review.ts:*)","Bash(git diff:*)","Bash(git log:*)","Bash(git status:*)","Read","Grep","Glob","Edit"]

Copilot Review

A second model reads the diff. The point is a different reviewer rather than a better one: Claude re-reading its own work shares the blind spot that produced it. It has already caught an unchecked-failure defect that two Claude review passes both cleared.

What It Costs

The plan grants 1500 AI credits a month. It resets on the 1st and does not roll over. Four measured facts shape every choice:

• A terra call pays about 3.5 credits before it reads a line of your code, writing 14k tokens of system prompt and tool definitions to cache at 250 credits per million. That is half a median review. A second call is never a rounding error.
• Output costs 6x input and 60x cache_read. Verbose answers run up a bill faster than large diffs.
• Nothing caches between calls. Separate spawns are separate sessions, and each one re-pays its whole prompt at the cache_write rate. Three angles cost three full prompts.
• gpt-5.6-luna prices every token class at exactly a tenth of terra.

Sizing a Review

--status prints the current tier and the bands, and spends nothing. Run it when you are unsure whether a change qualifies.

The tier comes from pace, credits remaining divided by days to reset. Under 25 is constrained, over 60 is abundant, and everything between is normal. The nominal allowance of 48 a day (1500 over 31) is the yardstick --status prints pace against, and it decides nothing on its own. The tier sets how strict the bar is, never how much to spend. Manufacturing reviews to use up an allotment is the failure mode this guards against, so credits left unspent in a month where every qualifying change got a full review are the right outcome.

tier	gate
constrained	terra only on risk-surface hits, luna one-shot otherwise
normal	terra one-shot on gate-worthy changes, skip the rest
abundant	terra one-shot on any substantial human change, 3 angles on the risk class, agentic available

The bands reuse ship's Bot Review Gate criteria, so one set of rules decides both:

band	criteria	shape	cost
skip	bot bumps, prose, lockfiles, reverts, config away from the risk surfaces	none	0
deep	a runtime surface, auth, sandbox, permissions, secrets, or egress; over ~200 lines or 8 files excluding tests, docs, and lockfiles; a bug review:code confirmed; a session that drifted	terra, 1 angle	7.6-12.4
deep+	risk-surface hits, abundant tier only	terra, 3 angles	~22.7
agentic	destructive, concurrent, or auth changes, abundant tier only	capped session	up to 60

The script enforces the hard stops on its own. It refuses --agentic outside the abundant tier, degrades to luna below 150 credits remaining, and refuses any run whose session cap could carry the account into billed overage. A meter it cannot read stops the run, which is what keeps this inert on a machine with no personal Copilot entitlement.

Arguments

Everything is optional and forwards to the script.

• --base <ref>: what to diff against. Defaults to the upstream tracking ref, then origin/main.
• --angles <1-3>: independent review calls. Defaults to 1. See Angles.
• --model <name>: see Models. Defaults to gpt-5.6-terra.
• --agentic: review from a disposable checkout with tools instead of from inlined text. It is one capped session and refuses --angles above 1. See Agentic Mode.
• --status: print the tier and bands, spend nothing.
• --dry-run: print the assembled prompts and their size, spend nothing.
• --max-bytes <n>: raise or lower the 120 KB prompt cap. The 400 KB ceiling still refuses.
• --force: run even when a prompt exceeds the size cap.

Run It

bun ${CLAUDE_PLUGIN_ROOT}/skills/copilot/scripts/review.ts [--base <ref>] [--angles <n>] [--model <name>]

The script resolves the diff, inlines the changed files, and prints each angle's findings with what it spent and what is left. It refuses a prompt over 120 KB rather than quietly spending on it. Prefer narrowing with --base, then --max-bytes, over passing --force.

Angles

One angle asks for every defect class in one call, which is the right default. Above that, the script splits the classes so the calls do not overlap, because three identical reviews mostly agree and cost three times as much for one review's worth of coverage.

angles	coverage
1	every class, one call
2	unchecked failure and correctness, then data loss and security
3	adds contracts, concurrency, and resources

Use 3 only for something security-sensitive, destructive, or concurrent, and only in the abundant tier. It triples the spend and buys no cache discount.

Agentic Mode

--agentic gives Copilot a throwaway git worktree checked out at HEAD and lets it use tools. It reads callers, tests, and history instead of only what the prompt carries. That is its one categorical advantage. It runs under a 60-credit cap against a one-shot's 30, and a one-shot in practice lands at 7.6 to 12.4, so budget for several times the cost rather than double. It needs a clean tree, because a worktree at HEAD would otherwise show it code that does not match the diff it was handed.

Reserve it for changes you authored. A diff carrying untrusted third-party text gets the one-shot shape, where the model has no tools and cannot act on anything it reads.

Triage the Findings

A one-shot finding is a claim from a model that cannot see the repository, so treat it the way you would a review bot rather than an oracle. For each finding, read the actual code and decide:

• Real → fix it, or say precisely why you are deferring.
• Wrong → say what the model missed. A one-shot review works from inlined text. A finding that depends on a caller or invariant it never saw is a common and expected miss.
• Unsure → put it to the user rather than guessing.

Report what you accepted and what you rejected, with the reason in both directions. A silent drop looks identical to a miss.

Never re-run to get a second opinion on a rejected finding. That doubles the spend for a judgment you have already made.

Models

Rates come from the CLI's own usage ledger, in credits per million tokens:

model	input	cache_read	cache_write	output
gpt-5.6-terra	200	20	250	1200
gpt-5.6-luna	20	2	25	120

copilot help config lists every model name the CLI accepts. That list is the discovery method: there is no models subcommand, and the names are not guessable. It is also broader than what this account can reach. A listed name can still come back "not available". Probing costs nothing when a model is rejected, because the CLI fails before inference.

gpt-5.6-codex does not exist. The GPT-5.6 family is sol, terra, and luna, and sol is not reachable on this plan.

Gotchas

No Prefix Cache Across Calls

Two terra spawns sharing an identical 20k-token prefix both wrote the full prompt and read nothing from cache. Caching works inside one session and not between them. Ordering the prompt to share a prefix across angles therefore buys nothing. Do not build for it without re-probing.

The Sandbox and HOME

The sandbox blocks Copilot writing to ~/.copilot, which kills the run with I/O error: Operation not permitted (os error 1). The script points HOME at ~/.cache/claude/copilot-home, which the sandbox allows. Do not solve this by disabling the sandbox. That home persists on purpose. This path's spend lands in a ledger you can read afterward, and --resume picks a session back up. --no-custom-instructions keeps the repo's own instructions out of the review.

Prompt Size

The prompt travels as an argv value. That bounds it by ARG_MAX as well as by cost. The 120 KB cap sits well under both, and --max-bytes moves it. A second ceiling at 400 KB refuses even under --force, because past that the spawn fails with E2BIG and no review runs at all.

What Reaches GitHub

The diff and the changed files go to GitHub. That is the whole mechanism, and there is no redaction. A changed file holding a token or a key sends it. Untracked files count. The script unions in git ls-files --others --exclude-standard so a pre-commit review does not miss new files, and it inlines their full contents like any other. A symlink out of the repository is the one exclusion, which is why a link to ~/.ssh inlines nothing. Check what is in the diff before reviewing a change that touches secrets or fixtures.

One-Shot Has No Tools

A one-shot run sits outside the repo with no tools, so everything it sees is inlined in the prompt. A finding that assumes it read a file misjudges the mode.

Agentic Containment Has Known Gaps

Agentic mode passes --allow-all-tools and subtracts from it: --deny-tool write and --deny-tool url, plus shell(git push), shell(gh:*), shell(curl:*), and shell(wget:*). Deny beats allow, so those six are the boundary. The stack is built to contain misbehavior. It will not hold against a deliberate attacker.

• --deny-tool write covers file-writing tools and leaves shell redirection open. The disposable worktree is the actual write barrier.
• That worktree shares the parent's .git. A shell write therefore reaches the real repository's refs and config. git update-ref moves a branch and git config changes repository settings, and neither is denied. The reflog records ref moves.
• The four shell denies and url close the outbound paths the sandbox cannot, since github.com is allowlisted and gh credentials resolve.
• Deny matching works on first-level subcommand grammar. An exotic invocation shape reaching git push may slip past it.
• Prompt injection in the reviewed diff stays open. The mitigation is the usage rule above rather than a flag.

The Guard Holds No Lock

Each invocation reads the meter once and reserves against that reading. Two reviews started at the same moment therefore both clear a reserve only one of them fits in. This script caps the common case. What makes the gap cost nothing is a separate $0 stop-usage budget on All AI Credit SKUs, which blocks billed overage outright. The plan still reports overage_permitted: true with a 2000-credit overage entitlement, because that figure describes plan capability. The budget is what describes billing consent.

Default Framing Is Thin

A default framing gets a pass that ignores most of what you asked for. The script's prompt names the defect classes in priority order and forbids summarizing the change back. Keep that if you edit it.