sdk: "./sdk" export throws at import time — native module resolved outside its own security boundary

Package: @github/copilot
Version affected: 1.0.11
Platform: darwin-arm64

Summary

package.json's "exports" map points the documented import path @github/copilot/sdk at sdk/index.js. That bundle's own require() wrapper enforces a same-directory security check — it resolves the requested module's real path, computes it relative to the bundle's own directory (sdk/), and throws if the relative path starts with .. (i.e. the target lives outside sdk/).

The native pty.node addon this bundle needs at import time lives in the package root's prebuilds/<platform>/ directory — one level outside sdk/. So the check the bundle enforces on itself is violated by the bundle's own required dependency, and import "@github/copilot/sdk" (or any import of sdk/index.js, including by absolute path) throws before a CopilotClient can even be constructed.

Reproduction

// Fails on darwin-arm64, @github/copilot@1.0.11:
import("/opt/homebrew/lib/node_modules/@github/copilot/sdk/index.js")
  .then(m => console.log("OK", Object.keys(m)))
  .catch(e => console.error("ERR", e.message));

The surfaced error is misleading: it reads as Cannot find module './prebuilds/<platform>/pty.node', which looks like an ordinary missing-file error. It is not — it's the last of six internal resolution attempts inside a try/catch loop, and it overwrites the real, earlier error: Requiring module outside of application is a security concern, thrown by the custom require() wrapper on the 5th attempt. Confirmed by instrumenting Module._resolveFilename directly.

Impact

Anyone following the package's own documented entry point (@github/copilot/sdk) for the CLI's JSON-RPC SDK hits this immediately — the import throws, not a runtime session error.

Workaround found

Importing the older copilot-sdk/index.js bundle directly by absolute path instead of the documented @github/copilot/sdk specifier works — it exposes the identical public API (CopilotClient, CopilotSession, defineTool, approveAll, SYSTEM_PROMPT_SECTIONS), uses a plain createRequire(import.meta.url) with no directory-boundary check, and is unaffected.

Suggested fix directions

• Either place sdk/'s security check's allowed root one level higher (package root, not sdk/), or ship prebuilds/ (or a copy/symlink of the needed native module) inside sdk/ so the resolved path never crosses the boundary the check enforces.
• Fix the swallowed-error behavior regardless: the security-check error should not be silently overwritten by a later, unrelated "module not found" from a subsequent resolution attempt in the same try/catch loop — it hides the real cause from anyone hitting this for the first time.

package.json の exports map と sdk/index.js から始め、次に示されているコマンドを使って darwin-arm64 の import を再現します。prebuilds//pty.node への解決試行と、握りつぶされたエラーを含む境界チェックを追跡します。@github/copilot/sdk の import が成功し、失敗時に元のセキュリティチェックの原因が保持されれば完了です。