# docs/context/TOOLS.md - Command Reference (Target Work Machine)

## GitHub Copilot CLI (Enterprise)

Primary setup script:

```bash
bash ./setup/setup_openclaw_copilot.sh
```

Custom locations (optional):

```bash
OPENCLAW_DATA_TARGET=/Volumes/Data/openclaw-copilot bash ./setup/setup_openclaw_copilot.sh
NPM_GLOBAL_PREFIX="$HOME/.npm-global" bash ./setup/setup_openclaw_copilot.sh
```

Install:

```bash
brew install copilot-cli@prerelease
# or
npm install -g @github/copilot-cli
```

Authenticate:

```bash
copilot auth login
copilot auth status
```

## OpenClaw Model Discovery and Routing

```bash
openclaw models refresh
openclaw models list
openclaw models status
```

If `models refresh` is unavailable on your OpenClaw version, use `openclaw models list` and continue.

## Lock to Copilot-only providers

Preferred (if supported):
- `openclaw config patch '{...}'`

Fallback command style:

```bash
openclaw config set --json providers.github-copilot.enabled true
openclaw config set --json providers.openai.enabled false
openclaw config set --json providers.anthropic.enabled false
openclaw config set --json providers.openrouter.enabled false
```

## Health and Logs

```bash
openclaw status --deep
openclaw logs --follow
openclaw gateway restart
```

## Model Budget Guardrail (Target Machine)

Files:
- `config/model-budget-guard.config.json`
- `config/copilot-policy-guard.config.json`
- `config/copilot-auth-watchdog.config.json`
- `scripts/model_budget_guard.sh`
- `scripts/copilot_policy_guard.sh`
- `scripts/copilot_auth_watchdog.sh`
- `scripts/install_model_budget_guard_launchd.sh`
- `scripts/install_copilot_policy_guard_launchd.sh`
- `scripts/install_copilot_auth_watchdog_launchd.sh`
- `scripts/configure_copilot_guardrails_defaults.sh`
- `scripts/install_copilot_guardrails.sh`

Configure + install:

```bash
bash ./scripts/install_copilot_guardrails.sh
```

This command also runs:

```bash
bash ./scripts/configure_copilot_guardrails_defaults.sh
```

Verify:

```bash
launchctl print gui/$(id -u)/ai.openclaw.model-budget-guard
launchctl print gui/$(id -u)/ai.openclaw.copilot-policy-guard
launchctl print gui/$(id -u)/ai.openclaw.copilot-auth-watchdog
tail -n 30 /tmp/openclaw-model-budget-guard.log /tmp/openclaw-model-budget-guard.err.log
tail -n 30 /tmp/openclaw-copilot-policy-guard.log /tmp/openclaw-copilot-policy-guard.err.log
tail -n 30 /tmp/openclaw-copilot-auth-watchdog.log /tmp/openclaw-copilot-auth-watchdog.err.log
```

Behavior:
- warns when expensive model stays active
- auto-switches back to configured low model
- auto-fixes Copilot-only provider/model policy drift
- alerts on Copilot auth problems

## Hooks (Recommended)

```bash
openclaw hooks enable boot-md
openclaw hooks enable command-logger
openclaw hooks enable session-memory
openclaw hooks list
```

## Security

- Never paste full API keys or bot tokens into chat/logs.
- Rotate secrets if exposed.