github/copilot-sdk · error

failed to fetch package.json

Error message

failed to fetch package.json: %s

What it means

If the package.json fetch succeeds at the transport level but the server responds with a status other than 200, fetchCLIVersionFromRepo fails with the response status embedded in the message. Non-200 typically means the requested git ref (SDK version) does not exist in the repo or the file moved.

Solutions

1. Check the status in the message: 404 → the SDK version has no matching tag; switch to a released version via `go get copilot-sdk@latest`
2. For 403 rate limit, wait or use authenticated access, then retry
3. For 5xx, retry after confirming GitHub status
4. Verify the URL printed before the failure resolves in a browser

Example fix

// before go.mod: copilot-sdk v0.0.0-20240101000000-abcdef123456 (no tag) -> 404
// after go.mod: copilot-sdk v0.5.0 -> package.json found

resp, err := http.Get(url)
if err != nil {
    return err
}
if resp.StatusCode == 403 && resp.Header.Get("X-RateLimit-Remaining") == "0" {
    return errors.New("GitHub rate limited; wait or authenticate")
}
if resp.StatusCode != 200 {
    return fmt.Errorf("package.json unavailable: %s", resp.Status)
}

cli, err := detectCLIVersion()
if err != nil {
    if strings.Contains(err.Error(), "failed to fetch package.json: 404") {
        // fall back to a default CLI version or prompt user to upgrade SDK
    }
}

When it happens

Trigger: http.Get returns 404 (git tag/ref not found), 403 (rate limit), 5xx (GitHub error) for the packageJSONURLFmt URL; the status code check rejects it.

Common situations: go.mod contains a pseudo-version or dev version with no matching git tag; GitHub API rate limiting (403) without credentials; renamed repo paths in newer SDK versions.

Related errors

• failed to fetch CLI version
• failed to fetch
• failed to parse package.json
• failed to fetch legacy package-lock.json
• failed to fetch legacy package-lock.json

AI-assisted analysis of github/copilot-sdk@cd8cf15dc3 (2026-09-09). Data as JSON: /api/errors/bf4a02f301b17b4d. Report an issue: GitHub.

Appendix: source

Thrown at go/cmd/bundler/main.go:330

	if idx := strings.LastIndex(sdkVersion, "-"); idx != -1 {
		suffix := sdkVersion[idx+1:]
		// Use the commit hash when present so we fetch the exact source snapshot.
		if len(suffix) == 12 && isHex(suffix) {
			gitRef = suffix
		}
	}

	url := fmt.Sprintf(packageJSONURLFmt, gitRef)
	fmt.Printf("Fetching %s...\n", url)

	resp, err := http.Get(url)
	if err != nil {
		return "", fmt.Errorf("failed to fetch: %w", err)
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		return "", fmt.Errorf("failed to fetch package.json: %s", resp.Status)
	}

	var packageJSON struct {
		CopilotCLIVersion string `json:"copilotCliVersion"`
	}

	if err := json.NewDecoder(resp.Body).Decode(&packageJSON); err != nil {
		return "", fmt.Errorf("failed to parse package.json: %w", err)
	}

	if packageJSON.CopilotCLIVersion == "" {
		return fetchLegacyCLIVersionFromRepo(gitRef)
	}

	return packageJSON.CopilotCLIVersion, nil
}

func fetchLegacyCLIVersionFromRepo(gitRef string) (string, error) {

View on GitHub (pinned to cd8cf15dc3)