could not find copilotCliVersion in package.json or…

Error message

could not find copilotCliVersion in package.json or @github/copilot in package-lock.json

What it means

The legacy package-lock.json downloaded and parsed successfully, but the expected key node_modules/@github/copilot is missing or has an empty version field. The bundler throws this because it cannot determine the CLI version from either package.json (copilotCliVersion) or the legacy lockfile fallback.

Solutions

Inspect the lockfile at that ref: does packages["node_modules/@github/copilot"] exist and have a version?
Point gitRef at a commit/tag where the dependency exists under that path.
Update the lookup key if the package was renamed or moved.
Pin copilotCliVersion in package.json so the legacy fallback is not required.
Handle npm v1 lockfile format (dependencies tree) if old refs must be supported.

Example fix

// before
pkg, ok := packageLock.Packages["node_modules/@github/copilot"]
if !ok || pkg.Version == "" {
	return "", fmt.Errorf("could not find copilotCliVersion in package.json or @github/copilot in package-lock.json")
}
// after
pkg, ok := packageLock.Packages["node_modules/@github/copilot"]
if !ok || pkg.Version == "" {
	return "", fmt.Errorf("@github/copilot not found in package-lock.json at ref %s (packages has %d entries)", gitRef, len(packageLock.Packages))
}

Defensive patterns

Strategy: validation

Validate before calling

// preflight: confirm the key exists in the lockfile at the ref
out, _ := exec.Command("git", "show", ref+":package-lock.json").Output()
var lock struct{ Packages map[string]struct{ Version string } }
json.Unmarshal(out, &lock)
if _, ok := lock.Packages["node_modules/@github/copilot"]; !ok {
	return errors.New("@github/copilot absent from lockfile at " + ref)
}

Try / catch

v, err := fetchCLIVersionFromRepo(ref)
if err != nil && strings.Contains(err.Error(), "could not find copilotCliVersion") {
	// pick a gitRef where the dependency exists, or set copilotCliVersion explicitly
}

Prevention

Pin copilotCliVersion in package.json as the primary source.
Confirm the package path node_modules/@github/copilot before changing refs.
Use refs newer than the commit that added the dependency.
Support both npm v1 and v2+ lockfile layouts if old refs matter.

When it happens

Trigger: packageLock.Packages lacks the key "node_modules/@github/copilot", or that entry's Version is empty string, after a successful fetch+parse in fetchLegacyCLIVersionFromRepo — usually because copilotCliVersion was also absent from package.json (otherwise the fallback would not run).

Common situations: The repository renamed/moved the @github/copilot dependency or switched to a different package name; a very old or very new lockfile layout (e.g. npm v1 lockfile without a packages map); gitRef pointing at a commit before the dependency was added.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

AI-assisted analysis of github/copilot-sdk@cd8cf15dc3 (2026-09-09). Data as JSON: /api/errors/a5210b2f3c3d122f. Report an issue: GitHub.

Appendix: source

Thrown at go/cmd/bundler/main.go:371

	if err != nil {
		return "", fmt.Errorf("failed to fetch legacy package-lock.json: %w", err)
	}
	defer resp.Body.Close()
	if resp.StatusCode != http.StatusOK {
		return "", fmt.Errorf("failed to fetch legacy package-lock.json: %s", resp.Status)
	}

	var packageLock struct {
		Packages map[string]struct {
			Version string `json:"version"`
		} `json:"packages"`
	}
	if err := json.NewDecoder(resp.Body).Decode(&packageLock); err != nil {
		return "", fmt.Errorf("failed to parse legacy package-lock.json: %w", err)
	}
	pkg, ok := packageLock.Packages["node_modules/@github/copilot"]
	if !ok || pkg.Version == "" {
		return "", fmt.Errorf("could not find copilotCliVersion in package.json or @github/copilot in package-lock.json")
	}
	return pkg.Version, nil
}

// isHex returns true if s contains only hexadecimal characters.
func isHex(s string) bool {
	for _, c := range s {
		if (c < '0' || c > '9') && (c < 'a' || c > 'f') && (c < 'A' || c > 'F') {
			return false
		}
	}
	return true
}

type bundleArtifacts struct {
	binaryPath          string
	binaryHash          []byte
	runtimeArtifactPath string

View on GitHub (pinned to cd8cf15dc3)