- "],
+ "files_updated": ["
- "]
+}
+```
+
+> [!NOTE]
+> The cached `last_synced_sha` is an **optimization hint, not a source of truth**. Because a PR opened by this workflow may later be closed or rejected before it merges to `main`, never treat a matching SHA as proof that the mirror is current — Step 1 must independently confirm the checked-out mirror actually matches upstream before taking the no-op path. Advancing the SHA here is acceptable only because that consistency check will re-detect and re-open any update that a rejected PR left unmerged.
+
+## Step 6 — Open a pull request
+
+Create a pull request with your changes using the `create-pull-request` safe output. Use `main` as the base branch for all work related to this workflow. The PR body must include:
+
+1. **What changed upstream** — a concise summary of the commits and file changes found in `github-samples/copilot-workshops` (or, on a first run, a note that this is the initial import of the workshop)
+2. **What was updated locally** — list each mirrored Learning Hub file or asset you created or edited and what changed, including any navigation wiring and any localized pages
+3. **Source links** — links to the relevant upstream files or commits on `main`
+4. A note that the markdown body of this workflow can be edited directly on GitHub.com without recompilation
+
+If there is nothing to change after your analysis, do **not** open a PR. Instead, call the `noop` safe output.
+
+## Guidelines
+
+- The canonical course content lives in `website/src/content/docs/learning-hub/copilot-workshops/` (English) and `website/src/content/docs/
Lovy Jain
kimtth
Akash Dwivedi
`gh skills install github/awesome-copilot context-map` | Generate a map of all files relevant to a task before making changes | None | | [conventional-branch](../skills/conventional-branch/SKILL.md)
`gh skills install github/awesome-copilot conventional-branch` | Create Git branches following the Conventional Branch specification (feature/, bugfix/, hotfix/, release/, chore/). Use when creating a new branch, naming a branch, or checking whether a branch name complies with the spec. | None | | [conventional-commit](../skills/conventional-commit/SKILL.md)
`gh skills install github/awesome-copilot conventional-commit` | Prompt and workflow for generating conventional commit messages using a structured XML format. Guides users to create standardized, descriptive commit messages in line with the Conventional Commits specification, including instructions, examples, and validation. | None | +| [convert-excel-to-md](../skills/convert-excel-to-md/SKILL.md)
`gh skills install github/awesome-copilot convert-excel-to-md` | Converts Excel (.xlsx) workbooks into Markdown so their contents can be accurately analyzed, summarized, searched, or extracted from. Use this skill whenever the user shares, references, or asks about a .xlsx file — even if they don't say "convert" or "markdown" explicitly. This includes requests to "read", "summarize", "review", "extract data from", "compare", "chart", or "analyze" a spreadsheet, workbook, budget, data export, or tracker. Always run the bundled conversion script to produce Markdown first; do not attempt to parse .xlsx content directly or write ad-hoc extraction code. Also use this skill for batch requests involving a whole folder of Excel workbooks. IMPORTANT: When the user references a folder or set of documents containing multiple file types (.pdf, .docx, .xlsx), invoke ALL three sibling skills — convert-pdf-to-md, convert-word-to-md, and convert-excel-to-md — so no file type is silently skipped. | `references/setup.md`
`scripts/convert_excel_to_md.py`
`scripts/requirements.txt` | +| [convert-pdf-to-md](../skills/convert-pdf-to-md/SKILL.md)
`gh skills install github/awesome-copilot convert-pdf-to-md` | Converts PDF (.pdf) documents into Markdown so their contents can be accurately analyzed, summarized, searched, or extracted from. Use this skill whenever the user shares, references, or asks about a .pdf file — even if they don't say "convert" or "markdown" explicitly. This includes requests to "read", "summarize", "review", "extract data from", "compare", or "analyze" a PDF report, paper, invoice, form, contract, or scanned document. Always run the bundled conversion script to produce Markdown first; do not attempt to parse PDF content directly or write ad-hoc extraction code. Also use this skill for batch requests involving a whole folder of PDF documents. IMPORTANT: When the user references a folder or set of documents containing multiple file types (.pdf, .docx, .xlsx), invoke ALL three sibling skills — convert-pdf-to-md, convert-word-to-md, and convert-excel-to-md — so no file type is silently skipped. | `references/setup.md`
`scripts/convert_pdf_to_md.py`
`scripts/requirements.txt` | | [convert-plaintext-to-md](../skills/convert-plaintext-to-md/SKILL.md)
`gh skills install github/awesome-copilot convert-plaintext-to-md` | Convert a text-based document to markdown following instructions from prompt, or if a documented option is passed, follow the instructions for that option. | None | +| [convert-word-to-md](../skills/convert-word-to-md/SKILL.md)
`gh skills install github/awesome-copilot convert-word-to-md` | Converts Word (.docx) documents into Markdown so their contents can be accurately analyzed, summarized, searched, or extracted from. Use this skill whenever the user shares, references, or asks about a .docx file — even if they don't say "convert" or "markdown" explicitly. This includes requests to "read", "summarize", "review", "extract data from", "compare", or "analyze" a Word document, resume, report, contract, or proposal. Always run the bundled conversion script to produce Markdown first; do not attempt to parse .docx content directly or write ad-hoc conversion code. Also use this skill for batch requests involving a whole folder of Word documents. IMPORTANT: When the user references a folder or set of documents containing multiple file types (.pdf, .docx, .xlsx), invoke ALL three sibling skills — convert-pdf-to-md, convert-word-to-md, and convert-excel-to-md — so no file type is silently skipped. | `references/setup.md`
`scripts/convert_word_to_md.py`
`scripts/requirements.txt` | | [copilot-cli-quickstart](../skills/copilot-cli-quickstart/SKILL.md)
`gh skills install github/awesome-copilot copilot-cli-quickstart` | Use this skill when someone wants to learn GitHub Copilot CLI from scratch. Offers interactive step-by-step tutorials with separate Developer and Non-Developer tracks, plus on-demand Q&A. Just say "start tutorial" or ask a question! Note: This skill targets GitHub Copilot CLI specifically and uses CLI-specific tools (ask_user, sql, fetch_copilot_cli_documentation). | None | | [copilot-instructions-blueprint-generator](../skills/copilot-instructions-blueprint-generator/SKILL.md)
`gh skills install github/awesome-copilot copilot-instructions-blueprint-generator` | Technology-agnostic blueprint generator for creating comprehensive copilot-instructions.md files that guide GitHub Copilot to produce code consistent with project standards, architecture patterns, and exact technology versions by analyzing existing codebase patterns and avoiding assumptions. | None | | [copilot-pr-autopilot](../skills/copilot-pr-autopilot/SKILL.md)
`gh skills install github/awesome-copilot copilot-pr-autopilot` | Copilot left 14 review comments on your PR — half are nits. Hours of fix → reply → resolve → re-request, and each round lands MORE comments. This skill runs loop engineering: auto-triggers Copilot Code Review via GraphQL (no @copilot mention), triages every open thread (Copilot, humans, advanced-security) with a fix / decline / escalate rubric, dispatches parallel fix sub-agents that obey the repo build/test/lint conventions, commits per iteration, replies+resolves citing the pushed SHA, then re-triggers until HEAD is reviewed with zero threads awaiting the agent's reply (remaining open threads are explicit hand-offs to the human — escalated declines, design tradeoffs). You merge a clean PR; the bot runs it. Trigger phrases: "address copilot comments", "run a copilot review loop", "fix this PR", "iterate on copilot feedback". Repo-agnostic, gh CLI + PowerShell. Full autopilot needs repo Triage/Write; external PR authors get single-iteration mode plus manual re-trigger (UI 🔄 or substantive-commit push). | `references/01-request-review.md`
`references/02-wait.md`
`references/03-list-threads.md`
`references/04-triage.md`
`references/05-fix.md`
`references/06-build-test.md`
`references/07-commit-push.md`
`references/08-reply-resolve.md`
`references/09-convergence.md`
`references/10-cleanup.md`
`references/api-quirks.md`
`references/orchestration.md`
`scripts/01-request-review.ps1`
`scripts/02-check-review-status.ps1`
`scripts/03-list-open-threads.ps1`
`scripts/08-reply-and-resolve.ps1`
`scripts/09-review-round.ps1`
`scripts/10-cleanup-outdated.ps1`
`scripts/_lib.ps1`
`templates` | @@ -250,7 +253,7 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-skills) for guidelines on how to | [microsoft-code-reference](../skills/microsoft-code-reference/SKILL.md)
`gh skills install github/awesome-copilot microsoft-code-reference` | Look up Microsoft API references, find working code samples, and verify SDK code is correct. Use when working with Azure SDKs, .NET libraries, or Microsoft APIs—to find the right method, check parameters, get working examples, or troubleshoot errors. Catches hallucinated methods, wrong signatures, and deprecated patterns by querying official docs. | None | | [microsoft-docs](../skills/microsoft-docs/SKILL.md)
`gh skills install github/awesome-copilot microsoft-docs` | Query official Microsoft documentation to find concepts, tutorials, and code examples across Azure, .NET, Agent Framework, Aspire, VS Code, GitHub, and more. Uses Microsoft Learn MCP as the default, with Context7 and Aspire MCP for content that lives outside learn.microsoft.com. | None | | [microsoft-skill-creator](../skills/microsoft-skill-creator/SKILL.md)
`gh skills install github/awesome-copilot microsoft-skill-creator` | Create agent skills for Microsoft technologies using Learn MCP tools. Use when users want to create a skill that teaches agents about any Microsoft technology, library, framework, or service (Azure, .NET, M365, VS Code, Bicep, etc.). Investigates topics deeply, then generates a hybrid skill storing essential knowledge locally while enabling dynamic deeper investigation. | `references/skill-templates.md` | -| [migrating-oracle-to-postgres-stored-procedures](../skills/migrating-oracle-to-postgres-stored-procedures/SKILL.md)
`gh skills install github/awesome-copilot migrating-oracle-to-postgres-stored-procedures` | Migrates Oracle PL/SQL stored procedures to PostgreSQL PL/pgSQL. Translates Oracle-specific syntax, preserves method signatures and type-anchored parameters, leverages orafce where appropriate, and applies COLLATE "C" for Oracle-compatible text sorting. Use when converting Oracle stored procedures or functions to PostgreSQL equivalents during a database migration. | None | +| [migrating-oracle-to-postgres-stored-procedures](../skills/migrating-oracle-to-postgres-stored-procedures/SKILL.md)
`gh skills install github/awesome-copilot migrating-oracle-to-postgres-stored-procedures` | Migrates Oracle PL/SQL stored procedures to PostgreSQL PL/pgSQL. Translates Oracle-specific syntax, preserves method signatures and type-anchored parameters, leverages orafce where appropriate, and applies explicit collation mapping (`COLLATE "C"` only when appropriate, locale collations when required). Use when converting Oracle stored procedures or functions to PostgreSQL equivalents during a database migration. | None | | [minecraft-plugin-development](../skills/minecraft-plugin-development/SKILL.md)
`gh skills install github/awesome-copilot minecraft-plugin-development` | Use this skill when building or modifying Minecraft server plugins for Paper, Spigot, or Bukkit, including plugin.yml setup, commands, listeners, schedulers, player state, team or arena systems, persistent progression, economy or profile data, configuration files, Adventure text, and version-safe API usage. Trigger for requests like "build a Minecraft plugin", "add a Paper command", "fix a Bukkit listener", "create plugin.yml", "implement a minigame mechanic", "add a perk or quest system", or "debug server plugin behavior". | `references/bootstrap-registration.md`
`references/build-test-and-runtime-validation.md`
`references/config-data-and-async.md`
`references/maps-heroes-and-feature-modules.md`
`references/minigame-instance-flow.md`
`references/persistent-progression-and-events.md`
`references/project-patterns.md`
`references/state-sessions-and-phases.md` | | [mini-context-graph](../skills/mini-context-graph/SKILL.md)
`gh skills install github/awesome-copilot mini-context-graph` | A persistent, compounding knowledge base combining Karpathy's LLM Wiki pattern
with a structured knowledge graph. Ingest documents once — the LLM writes wiki
pages, extracts entities/relations into the graph, and stores raw content for
evidence retrieval. Knowledge accumulates and cross-references; it is never
re-derived from scratch. | `references/ingestion.md`
`references/lint.md`
`references/ontology.md`
`references/retrieval.md`
`scripts/config.py`
`scripts/contextgraph.py`
`scripts/template_agent_workflow.py`
`scripts/tools` | | [mkdocs-translations](../skills/mkdocs-translations/SKILL.md)
`gh skills install github/awesome-copilot mkdocs-translations` | Generate a language translation for a mkdocs documentation stack. | None | @@ -336,7 +339,7 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-skills) for guidelines on how to | [repo-story-time](../skills/repo-story-time/SKILL.md)
`gh skills install github/awesome-copilot repo-story-time` | Generate a comprehensive repository summary and narrative story from commit history | None | | [resemble-detect](../skills/resemble-detect/SKILL.md)
`gh skills install github/awesome-copilot resemble-detect` | Deepfake detection and media safety — detect AI-generated audio, images, video, and text, trace synthesis sources, apply watermarks, verify speaker identity, and analyze media intelligence using Resemble AI | `LICENSE`
`references/api-reference.md` | | [review-and-refactor](../skills/review-and-refactor/SKILL.md)
`gh skills install github/awesome-copilot review-and-refactor` | Review and refactor code in your project according to defined instructions | None | -| [reviewing-oracle-to-postgres-migration](../skills/reviewing-oracle-to-postgres-migration/SKILL.md)
`gh skills install github/awesome-copilot reviewing-oracle-to-postgres-migration` | Identifies Oracle-to-PostgreSQL migration risks by cross-referencing code against known behavioral differences (empty strings, refcursors, type coercion, sorting, timestamps, concurrent transactions, etc.). Use when planning a database migration, reviewing migration artifacts, or validating that integration tests cover Oracle/PostgreSQL differences. | `references/REFERENCE.md`
`references/empty-strings-handling.md`
`references/no-data-found-exceptions.md`
`references/oracle-parentheses-from-clause.md`
`references/oracle-to-postgres-sorting.md`
`references/oracle-to-postgres-timestamp-timezone.md`
`references/oracle-to-postgres-to-char-numeric.md`
`references/oracle-to-postgres-type-coercion.md`
`references/postgres-concurrent-transactions.md`
`references/postgres-refcursor-handling.md` | +| [reviewing-oracle-to-postgres-migration](../skills/reviewing-oracle-to-postgres-migration/SKILL.md)
`gh skills install github/awesome-copilot reviewing-oracle-to-postgres-migration` | Identifies Oracle-to-PostgreSQL migration risks by cross-referencing code against known behavioral differences (empty strings, refcursors, type coercion, sorting/collations, UNION ALL planner risks, materialized-view refresh requirements, timestamps, concurrent transactions, etc.). Use when planning a database migration, reviewing migration artifacts, or validating that integration tests cover Oracle/PostgreSQL differences. | `references/REFERENCE.md`
`references/empty-strings-handling.md`
`references/no-data-found-exceptions.md`
`references/oracle-parentheses-from-clause.md`
`references/oracle-to-postgres-sorting.md`
`references/oracle-to-postgres-timestamp-timezone.md`
`references/oracle-to-postgres-to-char-numeric.md`
`references/oracle-to-postgres-type-coercion.md`
`references/postgres-concurrent-transactions.md`
`references/postgres-materialized-view-refresh.md`
`references/postgres-refcursor-handling.md`
`references/postgres-union-all-planner.md` | | [rhino3d-scripts](../skills/rhino3d-scripts/SKILL.md)
`gh skills install github/awesome-copilot rhino3d-scripts` | Authoring and debugging scripts for Rhinoceros 3D (Rhino 8 and later). Use when asked to write RhinoScript (VBScript / .rvb / .vbs), RhinoPython, or RhinoCommon-based scripts; automate Rhino modeling tasks; build command macros; manipulate Rhino geometry, layers, blocks, or document objects; pick objects from the viewport; control redraw and undo; or load and run scripts from the Rhino Script Editor. Covers `rhinoscriptsyntax`, `scriptcontext`, the `Rhino.*` RhinoCommon namespaces (`Rhino.Geometry`, `Rhino.DocObjects`, `Rhino.Input`, `Rhino.UI`, `Rhino.Display`, `Rhino.FileIO`), and the Rhino 8 unified Script Editor. | `references/macros-and-loading.md`
`references/rhinocommon-map.md`
`references/rhinoscriptsyntax-cheatsheet.md`
`references/vbscript-quirks.md` | | [roundup](../skills/roundup/SKILL.md)
`gh skills install github/awesome-copilot roundup` | Generate personalized status briefings on demand. Pulls from your configured data sources (GitHub, email, Teams, Slack, and more), synthesizes across them, and drafts updates in your own communication style for any audience you define. | None | | [roundup-setup](../skills/roundup-setup/SKILL.md)
`gh skills install github/awesome-copilot roundup-setup` | Interactive onboarding that learns your communication style, audiences, and data sources to configure personalized status briefings. Paste in examples of updates you already write, answer a few questions, and roundup calibrates itself to your workflow. | `references/config-template.md` | @@ -363,6 +366,7 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-skills) for guidelines on how to | [sql-optimization](../skills/sql-optimization/SKILL.md)
`gh skills install github/awesome-copilot sql-optimization` | Universal SQL performance optimization assistant for comprehensive query tuning, indexing strategies, and database performance analysis across all SQL databases (MySQL, PostgreSQL, SQL Server, Oracle). Provides execution plan analysis, pagination optimization, batch operations, and performance monitoring guidance. | None | | [sql-server-table-reconciliation](../skills/sql-server-table-reconciliation/SKILL.md)
`gh skills install github/awesome-copilot sql-server-table-reconciliation` | Use when: comparing SQL Server tables across instances, data migration validation, ETL verification, row mismatch detection, schema drift, reconciliation report, production vs staging comparison. Uses mssql-python driver with Apache Arrow for fast columnar data transfer and comparison. | `scripts/reconcile.py` | | [ssma-console](../skills/ssma-console/SKILL.md)
`gh skills install github/awesome-copilot ssma-console` | Use when: SSMA console operations — create project, generate assessment report, convert schema, migrate data, Oracle to SQL Server migration, schema conversion, data migration | None | +| [steno-mode](../skills/steno-mode/SKILL.md)
`gh skills install github/awesome-copilot steno-mode` | Shorthand-first response compression that cuts ~40% of response tokens while preserving technical precision and exact literals. Use when the user says "steno mode", "shorthand mode", "compressed responses", "token reduction", "brief structured output", or invokes /steno. Supports four compression levels: lite, brief, court, machine. Do not trigger for requests needing polished prose such as onboarding/tutorial content, stakeholder or customer-facing copy, or teaching-focused explanations. | None | | [structured-autonomy-generate](../skills/structured-autonomy-generate/SKILL.md)
`gh skills install github/awesome-copilot structured-autonomy-generate` | Structured Autonomy Implementation Generator Prompt | None | | [structured-autonomy-implement](../skills/structured-autonomy-implement/SKILL.md)
`gh skills install github/awesome-copilot structured-autonomy-implement` | Structured Autonomy Implementation Prompt | None | | [structured-autonomy-plan](../skills/structured-autonomy-plan/SKILL.md)
`gh skills install github/awesome-copilot structured-autonomy-plan` | Structured Autonomy Planning Prompt | None | @@ -376,6 +380,7 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-skills) for guidelines on how to | [threat-model-analyst](../skills/threat-model-analyst/SKILL.md)
`gh skills install github/awesome-copilot threat-model-analyst` | Full STRIDE-A threat model analysis and incremental update skill for repositories and systems. Supports two modes: (1) Single analysis — full STRIDE-A threat model of a repository, producing architecture overviews, DFD diagrams, STRIDE-A analysis, prioritized findings, and executive assessments. (2) Incremental analysis — takes a previous threat model report as baseline, compares the codebase at the latest (or a given commit), and produces an updated report with change tracking (new, resolved, still-present threats), STRIDE heatmap, findings diff, and an embedded HTML comparison. Only activate when the user explicitly requests a threat model analysis, incremental update, or invokes /threat-model-analyst directly. | `references/analysis-principles.md`
`references/diagram-conventions.md`
`references/incremental-orchestrator.md`
`references/orchestrator.md`
`references/output-formats.md`
`references/skeletons`
`references/tmt-element-taxonomy.md`
`references/verification-checklist.md` | | [tiny-stepping](../skills/tiny-stepping/SKILL.md)
`gh skills install github/awesome-copilot tiny-stepping` | Incremental development workflow that makes the smallest meaningful change per step and pauses for feedback, so the direction gets validated early before continuing. Use for careful, iterative implementation with continuous validation. | None | | [tldr-prompt](../skills/tldr-prompt/SKILL.md)
`gh skills install github/awesome-copilot tldr-prompt` | Create tldr summaries for GitHub Copilot files (prompts, agents, instructions, collections), MCP servers, or documentation from URLs and queries. | None | +| [tm7-threat-model](../skills/tm7-threat-model/SKILL.md)
`gh skills install github/awesome-copilot tm7-threat-model` | Creates valid Microsoft Threat Modeling Tool (.tm7) files compatible with the Microsoft Threat Modeling Tool v7.3+. Use this skill whenever asked to create, generate, or modify a .tm7 threat model file, or when performing STRIDE threat modeling that should output a .tm7 file that opens cleanly in the Microsoft Threat Modeling Tool. | `assets/example-minimal.tm7` | | [transloadit-media-processing](../skills/transloadit-media-processing/SKILL.md)
`gh skills install github/awesome-copilot transloadit-media-processing` | Process media files (video, audio, images, documents) using Transloadit. Use when asked to encode video to HLS/MP4, generate thumbnails, resize or watermark images, extract audio, concatenate clips, add subtitles, OCR documents, or run any media processing pipeline. Covers 86+ processing robots for file transformation at scale. | None | | [typescript-mcp-server-generator](../skills/typescript-mcp-server-generator/SKILL.md)
`gh skills install github/awesome-copilot typescript-mcp-server-generator` | Generate a complete MCP server project in TypeScript with tools, resources, and proper configuration | None | | [typespec-api-operations](../skills/typespec-api-operations/SKILL.md)
`gh skills install github/awesome-copilot typespec-api-operations` | Add GET, POST, PATCH, and DELETE operations to a TypeSpec API plugin with proper routing, parameters, and adaptive cards | None | diff --git a/eng/clean-materialized-plugins.mjs b/eng/clean-materialized-plugins.mjs index 9379d78a..2fcbacc2 100644 --- a/eng/clean-materialized-plugins.mjs +++ b/eng/clean-materialized-plugins.mjs @@ -6,6 +6,7 @@ import { fileURLToPath } from "url"; import { ROOT_FOLDER } from "./constants.mjs"; const PLUGINS_DIR = path.join(ROOT_FOLDER, "plugins"); +const EXTENSIONS_DIR = path.join(ROOT_FOLDER, "extensions"); const MATERIALIZED_SPECS = { agents: { path: "agents", @@ -89,6 +90,30 @@ function cleanPlugin(pluginPath) { return { removed, manifestUpdated }; } +function cleanMaterializedExtensionPlugin(extensionPath) { + const pluginJsonPath = path.join(extensionPath, ".github", "plugin", "plugin.json"); + let manifestUpdated = false; + if (fs.existsSync(pluginJsonPath)) { + const plugin = JSON.parse(fs.readFileSync(pluginJsonPath, "utf8")); + if (plugin.extensions === "extensions") { + plugin.extensions = "."; + fs.writeFileSync(pluginJsonPath, JSON.stringify(plugin, null, 2) + "\n", "utf8"); + manifestUpdated = true; + console.log(` Updated ${path.basename(extensionPath)}/.github/plugin/plugin.json`); + } + } + + const target = path.join(extensionPath, "extensions"); + if (!fs.existsSync(target) || !fs.statSync(target).isDirectory()) { + return { removed: 0, manifestUpdated }; + } + + const count = countFiles(target); + fs.rmSync(target, { recursive: true, force: true }); + console.log(` Removed ${path.basename(extensionPath)}/extensions/ (${count} files)`); + return { removed: count, manifestUpdated }; +} + function countFiles(dir) { let count = 0; for (const entry of fs.readdirSync(dir, { withFileTypes: true })) { @@ -171,6 +196,25 @@ function main() { } } + if (fs.existsSync(EXTENSIONS_DIR)) { + const extensionDirs = fs.readdirSync(EXTENSIONS_DIR, { withFileTypes: true }) + .filter((entry) => entry.isDirectory()) + .map((entry) => entry.name) + .sort(); + + for (const dirName of extensionDirs) { + const extensionPath = path.join(EXTENSIONS_DIR, dirName); + if (!fs.existsSync(path.join(extensionPath, "extension.mjs"))) { + continue; + } + const { removed, manifestUpdated } = cleanMaterializedExtensionPlugin(extensionPath); + total += removed; + if (manifestUpdated) { + manifestsUpdated++; + } + } + } + console.log(); if (total === 0 && manifestsUpdated === 0) { console.log("✅ No materialized files found. Plugins are already clean."); diff --git a/eng/external-plugin-intake-state.mjs b/eng/external-plugin-intake-state.mjs index f9351281..b73c7216 100644 --- a/eng/external-plugin-intake-state.mjs +++ b/eng/external-plugin-intake-state.mjs @@ -3,6 +3,10 @@ export const EXTERNAL_PLUGIN_INTAKE_LABELS = Object.freeze({ color: "FEF2C0", description: "Public external plugin submission", }, + "external-plugin-canvas": { + color: "1D76DB", + description: "External plugin submission includes a canvas extension", + }, "awaiting-review": { color: "FBCA04", description: "Submission is waiting for automated intake validation", @@ -27,6 +31,7 @@ export const EXTERNAL_PLUGIN_INTAKE_LABELS = Object.freeze({ const EXTERNAL_PLUGIN_INTAKE_SYNC_LABELS = Object.freeze([ "external-plugin", + "external-plugin-canvas", "awaiting-review", "ready-for-review", "requires-submitter-fixes", @@ -129,6 +134,9 @@ export async function applyExternalPluginIntakeEvaluation({ rejected: new Set(["external-plugin", "rejected"]), }; const desiredLabels = desiredLabelsByState[state] ?? desiredLabelsByState.rejected; + if (evaluation.isCanvasPlugin) { + desiredLabels.add("external-plugin-canvas"); + } await syncExternalPluginIntakeLabels({ github, diff --git a/eng/external-plugin-intake.mjs b/eng/external-plugin-intake.mjs index b7ddd2d6..fa9696e1 100644 --- a/eng/external-plugin-intake.mjs +++ b/eng/external-plugin-intake.mjs @@ -54,6 +54,13 @@ const FIELD_TITLES = Object.freeze({ const LEGACY_FIELD_TITLES = Object.freeze({ immutableRef: "Immutable ref to review", }); +const EXTERNAL_CANVAS_KEYWORD = "canvas"; +const EXTERNAL_CANVAS_PREVIEW_PATH = "assets/preview.png"; +const EXTERNAL_PLUGIN_ROOT_MANIFEST_PATHS = Object.freeze([ + ".github/plugin/plugin.json", + ".plugin/plugin.json", + "plugin.json", +]); function normalizeMultilineText(value) { return String(value ?? "").replace(/\r\n/g, "\n"); @@ -116,6 +123,29 @@ function parseKeywords(value) { return keywords.length > 0 ? keywords : undefined; } +function hasCanvasKeyword(plugin) { + return (plugin?.keywords ?? []).some( + (keyword) => String(keyword).trim().toLowerCase() === EXTERNAL_CANVAS_KEYWORD, + ); +} + +function normalizeRepoRelativePath(value) { + const normalized = stripNoResponse(value); + if (!normalized || normalized === "/") { + return ""; + } + + return normalized.replace(/\\/g, "/").replace(/^\/+|\/+$/g, ""); +} + +function joinRepoPath(...segments) { + return segments + .map((segment) => String(segment ?? "").trim()) + .filter(Boolean) + .join("/") + .replace(/\/+/g, "/"); +} + function parseChecklist(value) { const checked = new Set(); const normalized = normalizeMultilineText(value); @@ -231,6 +261,33 @@ async function fetchGitHubJson(apiPath, token) { } } +function encodeRepoContentPath(value) { + return String(value) + .split("/") + .filter((segment) => segment.length > 0) + .map((segment) => encodeURIComponent(segment)) + .join("/"); +} + +async function fetchGitHubFile(repo, filePath, ref, token) { + const encodedRepo = encodeRepoPath(repo); + const encodedPath = encodeRepoContentPath(filePath); + return fetchGitHubJson( + `/repos/${encodedRepo}/contents/${encodedPath}?ref=${encodeURIComponent(ref)}`, + token, + ); +} + +function decodeGitHubFileContent(fileResponse) { + const encodedContent = fileResponse?.data?.content; + if (!encodedContent || typeof encodedContent !== "string") { + return null; + } + + const normalized = encodedContent.replace(/\n/g, ""); + return Buffer.from(normalized, "base64").toString("utf8"); +} + function encodeRepoPath(repo) { const [owner, name] = String(repo).split("/"); return `${encodeURIComponent(owner ?? "")}/${encodeURIComponent(name ?? "")}`; @@ -273,6 +330,7 @@ async function validateRemoteRepository(repo, { ref, sha }, errors, warnings, to ); } } + } if (!ref) { @@ -322,6 +380,151 @@ async function validateRemoteRepository(repo, { ref, sha }, errors, warnings, to } } +async function validateCanvasPluginMetadata(plugin, errors, warnings, token) { + const repo = plugin?.source?.repo; + const sha = plugin?.source?.sha; + const ref = plugin?.source?.ref; + const releaseLocator = sha || ref; + const releaseLocatorDescription = sha ? `commit "${sha}"` : `ref "${ref}"`; + const pluginRoot = normalizeRepoRelativePath(plugin?.source?.path); + + if (!releaseLocator) { + errors.push('submission: plugins tagged with "canvas" must provide "Ref to review" and/or "Commit SHA to review"'); + return; + } + + if (!repo) { + return; + } + + let manifest = null; + let manifestPath = null; + let sawManifestApiError = false; + + const manifestCandidates = EXTERNAL_PLUGIN_ROOT_MANIFEST_PATHS.map((relativePath) => + joinRepoPath(pluginRoot, relativePath), + ); + + for (const candidatePath of manifestCandidates) { + const response = await fetchGitHubFile(repo, candidatePath, releaseLocator, token); + if (response.kind === "notFound") { + continue; + } + + if (response.kind === "apiError") { + sawManifestApiError = true; + continue; + } + + if (response.data?.type !== "file") { + continue; + } + + const decoded = decodeGitHubFileContent(response); + if (!decoded) { + errors.push(`submission: could not decode plugin manifest "${candidatePath}" at ${releaseLocatorDescription}`); + return; + } + + try { + manifest = JSON.parse(decoded); + manifestPath = candidatePath; + break; + } catch (error) { + errors.push( + `submission: plugin manifest "${candidatePath}" at ${releaseLocatorDescription} is not valid JSON (${error.message})`, + ); + return; + } + } + + if (!manifest) { + if (sawManifestApiError) { + warnings.push( + `submission: could not verify canvas plugin manifest in GitHub repository "${repo}" at ${releaseLocatorDescription}; a maintainer should re-run intake`, + ); + return; + } + + const expectedPaths = manifestCandidates.map((candidatePath) => `"${candidatePath}"`).join(", "); + errors.push( + `submission: plugins tagged with "canvas" must include a manifest at one of ${expectedPaths} in ${releaseLocatorDescription}`, + ); + return; + } + + if (manifest.logo !== EXTERNAL_CANVAS_PREVIEW_PATH) { + errors.push( + `submission: plugins tagged with "canvas" must set "logo" to "${EXTERNAL_CANVAS_PREVIEW_PATH}" in "${manifestPath}"`, + ); + } + + if (manifest.extenions !== undefined) { + errors.push( + `submission: plugins tagged with "canvas" must use "extensions" (found misspelled key "extenions") in "${manifestPath}"`, + ); + } + + if (manifest.extensions !== undefined && manifest.extensions !== "extensions") { + errors.push( + `submission: plugins tagged with "canvas" may omit "extensions", but if provided it must be "extensions" in "${manifestPath}"`, + ); + } + + const extensionContainerPath = joinRepoPath(pluginRoot, "extensions"); + const extensionContainerResponse = await fetchGitHubFile(repo, extensionContainerPath, releaseLocator, token); + if (extensionContainerResponse.kind === "notFound") { + errors.push( + `submission: plugins tagged with "canvas" must include an "extensions" directory at ${releaseLocatorDescription}`, + ); + } else if (extensionContainerResponse.kind === "apiError") { + warnings.push( + `submission: could not verify "extensions" directory in GitHub repository "${repo}" at ${releaseLocatorDescription}; a maintainer should re-run intake`, + ); + } else if ( + !( + extensionContainerResponse.data?.type === "dir" + || Array.isArray(extensionContainerResponse.data) + ) + ) { + errors.push( + `submission: "extensions" must be a directory in ${releaseLocatorDescription}`, + ); + } + + const extensionEntryPath = joinRepoPath(pluginRoot, "extensions", "extension.mjs"); + const extensionEntryResponse = await fetchGitHubFile(repo, extensionEntryPath, releaseLocator, token); + if (extensionEntryResponse.kind === "notFound") { + errors.push( + `submission: plugins tagged with "canvas" must include "extensions/extension.mjs" at ${releaseLocatorDescription}`, + ); + } else if (extensionEntryResponse.kind === "apiError") { + warnings.push( + `submission: could not verify "extensions/extension.mjs" in GitHub repository "${repo}" at ${releaseLocatorDescription}; a maintainer should re-run intake`, + ); + } else if (extensionEntryResponse.data?.type !== "file") { + errors.push( + `submission: "extensions/extension.mjs" must be a file in ${releaseLocatorDescription}`, + ); + } + + const previewPath = joinRepoPath(pluginRoot, EXTERNAL_CANVAS_PREVIEW_PATH); + const previewResponse = await fetchGitHubFile(repo, previewPath, releaseLocator, token); + if (previewResponse.kind === "notFound") { + errors.push( + `submission: plugins tagged with "canvas" must include "${EXTERNAL_CANVAS_PREVIEW_PATH}" at ${releaseLocatorDescription}`, + ); + } else if (previewResponse.kind === "apiError") { + warnings.push( + `submission: could not verify "${EXTERNAL_CANVAS_PREVIEW_PATH}" in GitHub repository "${repo}" at ${releaseLocatorDescription}; a maintainer should re-run intake`, + ); + } else if (previewResponse.data?.type !== "file") { + errors.push( + `submission: "${EXTERNAL_CANVAS_PREVIEW_PATH}" must be a file in ${releaseLocatorDescription}`, + ); + } +} + export function parseExternalPluginIssueBody(body) { const sections = parseIssueFormSections(body); const errors = []; @@ -425,10 +628,14 @@ function normalizeQualityGateResult(rawResult) { overall_status: "not_run", vally_lint_status: "not_run", smoke_status: "not_run", + version_match_status: "not_run", + canvas_structure_status: "not_run", failure_class: "none", summary: "", vally_lint_output: "", smoke_output: "", + version_match_output: "", + canvas_structure_output: "", }; if (!rawResult || typeof rawResult !== "object" || Array.isArray(rawResult)) { @@ -444,6 +651,8 @@ function normalizeQualityGateResult(rawResult) { function buildQualityGatesCommentSection(qualityResult) { const vallyState = qualityResult.vally_lint_status || "not_run"; const smokeState = qualityResult.smoke_status || "not_run"; + const versionMatchState = qualityResult.version_match_status || "not_run"; + const canvasStructureState = qualityResult.canvas_structure_status || "not_run"; const summaryText = String(qualityResult.summary || "").trim() || "_No quality gate details were provided._"; const sections = [ @@ -453,6 +662,8 @@ function buildQualityGatesCommentSection(qualityResult) { "|---|---|", `| vally lint | ${vallyState} |`, `| install smoke test | ${smokeState} |`, + `| version match | ${versionMatchState} |`, + `| canvas structure | ${canvasStructureState} |`, "", summaryText, ]; @@ -487,6 +698,36 @@ function buildQualityGatesCommentSection(qualityResult) { ); } + const versionMatchOutput = String(qualityResult.version_match_output || "").trim(); + if (versionMatchOutput) { + sections.push( + "", + "
",
+ "
",
+ );
+ }
+
+ const canvasStructureOutput = String(qualityResult.canvas_structure_output || "").trim();
+ if (canvasStructureOutput) {
+ sections.push(
+ "",
+ "Version match output
", + "", + "```text", + versionMatchOutput, + "```", + "", + "",
+ "
",
+ );
+ }
+
return sections.join("\n");
}
@@ -587,6 +828,7 @@ export async function evaluateExternalPluginIssue({ issue, token, runId, owner,
const validationResult = validateExternalPlugin(parsed.plugin, 0, { policy: "publicSubmission" });
errors.push(...validationResult.errors.map(toSubmissionError));
warnings.push(...validationResult.warnings.map(toSubmissionError));
+ const isCanvasPlugin = hasCanvasKeyword(parsed.plugin);
if (parsed.plugin?.name) {
const matchingName = duplicateNames.find(
@@ -601,6 +843,10 @@ export async function evaluateExternalPluginIssue({ issue, token, runId, owner,
await validateRemoteRepository(parsed.plugin.source.repo, parsed.plugin.source, errors, warnings, token);
}
+ if (isCanvasPlugin) {
+ await validateCanvasPluginMetadata(parsed.plugin, errors, warnings, token);
+ }
+
const dedupedErrors = [...new Set(errors)];
const dedupedWarnings = [...new Set(warnings)];
const valid = dedupedErrors.length === 0;
@@ -668,6 +914,7 @@ export async function evaluateExternalPluginIssue({ issue, token, runId, owner,
errors: dedupedErrors,
warnings: dedupedWarnings,
plugin: parsed.plugin,
+ isCanvasPlugin,
commentBody,
commentMarker: marker,
};
diff --git a/eng/external-plugin-pr-quality-gates.mjs b/eng/external-plugin-pr-quality-gates.mjs
index e72928c5..85cd6d9c 100644
--- a/eng/external-plugin-pr-quality-gates.mjs
+++ b/eng/external-plugin-pr-quality-gates.mjs
@@ -86,7 +86,7 @@ export async function runExternalPluginPrQualityGates(plugins) {
? "No changed external plugin entries were detected in plugins/external.json."
: checkedPlugins
.map((entry) =>
- `- ${entry.name}: vally-lint=${entry.quality.vally_lint_status}, install-smoke=${entry.quality.smoke_status}, overall=${entry.quality.overall_status}`
+ `- ${entry.name}: vally-lint=${entry.quality.vally_lint_status}, install-smoke=${entry.quality.smoke_status}, version-match=${entry.quality.version_match_status}, canvas-structure=${entry.quality.canvas_structure_status}, overall=${entry.quality.overall_status}`
)
.join("\n");
diff --git a/eng/external-plugin-quality-gates.mjs b/eng/external-plugin-quality-gates.mjs
index 6b857be0..507cc28f 100644
--- a/eng/external-plugin-quality-gates.mjs
+++ b/eng/external-plugin-quality-gates.mjs
@@ -8,6 +8,7 @@ import { spawnSync } from "child_process";
import { runLint, LintConsoleReporter } from "@microsoft/vally";
const MAX_OUTPUT_LENGTH = 12000;
+const EXTERNAL_CANVAS_KEYWORD = "canvas";
const INFRA_ERROR_PATTERNS = [
/\b401\b/,
@@ -69,6 +70,12 @@ function normalizePluginPath(pluginPath) {
return normalized;
}
+function hasCanvasKeyword(plugin) {
+ return (plugin?.keywords ?? []).some(
+ (keyword) => String(keyword).trim().toLowerCase() === EXTERNAL_CANVAS_KEYWORD,
+ );
+}
+
function resolveFetchSpec(pluginSource) {
if (pluginSource.sha) {
return pluginSource.sha;
@@ -130,7 +137,10 @@ function cloneSubmissionRepository(workDir, plugin) {
throw new Error(`git checkout failed: ${checkout.output}`);
}
- return repoDir;
+ return {
+ repoDir,
+ fetchSpec,
+ };
}
// Ordered list of candidate locations for plugin.json, from most to least specific.
@@ -144,6 +154,13 @@ const PLUGIN_JSON_CANDIDATES = [
["plugin.json"],
];
+function toPosixPath(...segments) {
+ return segments
+ .filter((segment) => segment !== undefined && segment !== null && String(segment).length > 0)
+ .map((segment) => String(segment).replace(/\\/g, "/"))
+ .join("/");
+}
+
function findPluginJson(pluginRoot) {
for (const segments of PLUGIN_JSON_CANDIDATES) {
const candidate = path.join(pluginRoot, ...segments);
@@ -304,8 +321,302 @@ function runInstallSmokeGate(workDir, plugin) {
}
}
-function toOverallStatus(skillStatus, smokeStatus) {
- const states = [skillStatus, smokeStatus];
+function isMissingPathAtLocator(output) {
+ const normalized = String(output ?? "").toLowerCase();
+ return (
+ normalized.includes("does not exist in") ||
+ normalized.includes("exists on disk, but not in") ||
+ (normalized.includes("path '") && normalized.includes("not in"))
+ );
+}
+
+function fetchLocatorIntoRepo(repoDir, locator) {
+ const result = runCommand("git", ["fetch", "--depth=1", "origin", locator], { cwd: repoDir });
+ if (result.exitCode === 0) {
+ return {
+ status: "pass",
+ output: "",
+ };
+ }
+
+ const status = classifySmokeFailure(result.output);
+ return {
+ status,
+ output: `git fetch failed for "${locator}": ${result.output}`,
+ };
+}
+
+function readPluginManifestAtLocator(repoDir, locator, normalizedPluginPath) {
+ const manifestCandidates = PLUGIN_JSON_CANDIDATES.map((segments) =>
+ toPosixPath(normalizedPluginPath, ...segments)
+ );
+
+ for (const manifestPath of manifestCandidates) {
+ const showResult = runCommand("git", ["show", `${locator}:${manifestPath}`], { cwd: repoDir });
+ if (showResult.exitCode === 0) {
+ const rawShow = spawnSync("git", ["show", `${locator}:${manifestPath}`], { cwd: repoDir, encoding: "utf8" });
+ const rawStdout = String(rawShow.stdout ?? "");
+
+ try {
+ return {
+ kind: "found",
+ manifestPath,
+ manifest: JSON.parse(rawStdout),
+ };
+ } catch (error) {
+ return {
+ kind: "invalid",
+ manifestPath,
+ message: `Invalid JSON in "${manifestPath}" at "${locator}": ${error.message}`,
+ };
+ }
+ }
+
+ if (isMissingPathAtLocator(showResult.output)) {
+ continue;
+ }
+
+ return {
+ kind: "infra_error",
+ message: `Unable to read "${manifestPath}" at "${locator}": ${showResult.output}`,
+ };
+ }
+
+ return {
+ kind: "not_found",
+ message: `No plugin.json found at "${locator}". Expected one of: ${manifestCandidates.join(", ")}`,
+ };
+}
+
+function runVersionMatchGate(repoDir, plugin, primaryFetchSpec) {
+ const expectedVersion = String(plugin?.version ?? "").trim();
+ const normalizedPluginPath = normalizePluginPath(plugin?.source?.path || "/");
+ const locators = [plugin?.source?.ref, plugin?.source?.sha]
+ .filter((value) => typeof value === "string" && value.trim().length > 0)
+ .map((value) => value.trim())
+ .filter((value, index, values) => values.indexOf(value) === index);
+
+ if (locators.length === 0) {
+ return {
+ status: "not_run",
+ output: "Version match gate skipped because neither source.ref nor source.sha was provided.",
+ };
+ }
+
+ const messages = [];
+ let hasFailure = false;
+ let hasInfraError = false;
+
+ for (const locator of locators) {
+ if (locator !== primaryFetchSpec) {
+ const fetchResult = fetchLocatorIntoRepo(repoDir, locator);
+ if (fetchResult.status === "fail") {
+ hasFailure = true;
+ messages.push(`- ${locator}: ${fetchResult.output}`);
+ continue;
+ }
+
+ if (fetchResult.status === "infra_error") {
+ hasInfraError = true;
+ messages.push(`- ${locator}: ${fetchResult.output}`);
+ continue;
+ }
+ }
+
+ const manifestResult = readPluginManifestAtLocator(repoDir, locator, normalizedPluginPath);
+ if (manifestResult.kind === "not_found" || manifestResult.kind === "invalid") {
+ hasFailure = true;
+ messages.push(`- ${locator}: ${manifestResult.message}`);
+ continue;
+ }
+
+ if (manifestResult.kind === "infra_error") {
+ hasInfraError = true;
+ messages.push(`- ${locator}: ${manifestResult.message}`);
+ continue;
+ }
+
+ const actualVersion = String(manifestResult.manifest?.version ?? "").trim();
+ if (!actualVersion) {
+ hasFailure = true;
+ messages.push(`- ${locator}: "${manifestResult.manifestPath}" is missing a non-empty "version" field.`);
+ continue;
+ }
+
+ if (actualVersion !== expectedVersion) {
+ hasFailure = true;
+ messages.push(
+ `- ${locator}: external.json version "${expectedVersion}" does not match "${manifestResult.manifestPath}" version "${actualVersion}".`
+ );
+ continue;
+ }
+
+ messages.push(`- ${locator}: matched version "${expectedVersion}" at "${manifestResult.manifestPath}".`);
+ }
+
+ if (hasFailure) {
+ return {
+ status: "fail",
+ output: messages.join("\n"),
+ };
+ }
+
+ if (hasInfraError) {
+ return {
+ status: "infra_error",
+ output: messages.join("\n"),
+ };
+ }
+
+ return {
+ status: "pass",
+ output: messages.join("\n"),
+ };
+}
+
+function checkPathExistsAtLocator(repoDir, locator, repoPath, expectedType) {
+ const result = runCommand("git", ["cat-file", "-e", `${locator}:${repoPath}`], { cwd: repoDir });
+ if (result.exitCode === 0) {
+ if (!expectedType) {
+ return { exists: true, output: "" };
+ }
+
+ const typeResult = runCommand("git", ["cat-file", "-t", `${locator}:${repoPath}`], { cwd: repoDir });
+ if (typeResult.exitCode !== 0) {
+ return {
+ exists: false,
+ output: `Unable to verify path "${repoPath}" type at "${locator}": ${typeResult.output}`,
+ };
+ }
+
+ const actualType = String(typeResult.stdout ?? "").trim();
+ if (actualType !== expectedType) {
+ return {
+ exists: false,
+ output: "",
+ kindMismatch: true,
+ actualType,
+ };
+ }
+
+ return { exists: true, output: "" };
+ }
+
+ const normalizedOutput = String(result.output ?? "").toLowerCase();
+ if (
+ normalizedOutput.includes("not a valid object name")
+ || normalizedOutput.includes("path '")
+ || normalizedOutput.includes("does not exist")
+ ) {
+ return { exists: false, output: "" };
+ }
+
+ return {
+ exists: false,
+ output: `Unable to verify path "${repoPath}" at "${locator}": ${result.output}`,
+ };
+}
+
+export function runCanvasStructureGate(repoDir, plugin, primaryFetchSpec) {
+ if (!hasCanvasKeyword(plugin)) {
+ return {
+ status: "not_run",
+ output: "Canvas structure gate skipped because plugin is not tagged with \"canvas\".",
+ };
+ }
+
+ const normalizedPluginPath = normalizePluginPath(plugin?.source?.path || "/");
+ const locators = [plugin?.source?.ref, plugin?.source?.sha]
+ .filter((value) => typeof value === "string" && value.trim().length > 0)
+ .map((value) => value.trim())
+ .filter((value, index, values) => values.indexOf(value) === index);
+
+ if (locators.length === 0) {
+ return {
+ status: "not_run",
+ output: "Canvas structure gate skipped because neither source.ref nor source.sha was provided.",
+ };
+ }
+
+ const extensionsDir = toPosixPath(normalizedPluginPath, "extensions");
+ const extensionEntryPoint = toPosixPath(extensionsDir, "extension.mjs");
+
+ let hasFailure = false;
+ let hasInfraError = false;
+ const messages = [];
+
+ for (const locator of locators) {
+ if (locator !== primaryFetchSpec) {
+ const fetchResult = fetchLocatorIntoRepo(repoDir, locator);
+ if (fetchResult.status === "fail") {
+ hasFailure = true;
+ messages.push(`- ${locator}: ${fetchResult.output}`);
+ continue;
+ }
+
+ if (fetchResult.status === "infra_error") {
+ hasInfraError = true;
+ messages.push(`- ${locator}: ${fetchResult.output}`);
+ continue;
+ }
+ }
+
+ const extensionDirCheck = checkPathExistsAtLocator(repoDir, locator, extensionsDir, "tree");
+ if (extensionDirCheck.output) {
+ hasInfraError = true;
+ messages.push(`- ${locator}: ${extensionDirCheck.output}`);
+ continue;
+ }
+ if (!extensionDirCheck.exists) {
+ hasFailure = true;
+ if (extensionDirCheck.kindMismatch) {
+ messages.push(`- ${locator}: "${extensionsDir}" must be a directory.`);
+ } else {
+ messages.push(`- ${locator}: missing required canvas extension directory "${extensionsDir}".`);
+ }
+ continue;
+ }
+
+ const extensionEntryCheck = checkPathExistsAtLocator(repoDir, locator, extensionEntryPoint, "blob");
+ if (extensionEntryCheck.output) {
+ hasInfraError = true;
+ messages.push(`- ${locator}: ${extensionEntryCheck.output}`);
+ continue;
+ }
+ if (!extensionEntryCheck.exists) {
+ hasFailure = true;
+ if (extensionEntryCheck.kindMismatch) {
+ messages.push(`- ${locator}: "${extensionEntryPoint}" must be a file.`);
+ } else {
+ messages.push(`- ${locator}: missing required canvas extension entry point "${extensionEntryPoint}".`);
+ }
+ continue;
+ }
+
+ messages.push(`- ${locator}: found "${extensionsDir}" with entry point "${extensionEntryPoint}".`);
+ }
+
+ if (hasInfraError) {
+ return {
+ status: "infra_error",
+ output: messages.join("\n"),
+ };
+ }
+
+ if (hasFailure) {
+ return {
+ status: "fail",
+ output: messages.join("\n"),
+ };
+ }
+
+ return {
+ status: "pass",
+ output: messages.join("\n"),
+ };
+}
+
+function toOverallStatus(states) {
if (states.includes("infra_error")) {
return "infra_error";
}
@@ -334,26 +645,44 @@ export async function runExternalPluginQualityGates(plugin) {
overall_status: "not_run",
vally_lint_status: "not_run",
smoke_status: "not_run",
+ version_match_status: "not_run",
+ canvas_structure_status: "not_run",
failure_class: "none",
summary: "",
vally_lint_output: "",
smoke_output: "",
+ version_match_output: "",
+ canvas_structure_output: "",
};
try {
- const repoDir = cloneSubmissionRepository(workDir, plugin);
+ const { repoDir, fetchSpec } = cloneSubmissionRepository(workDir, plugin);
const normalizedPluginPath = normalizePluginPath(plugin.source?.path || "/");
const pluginRoot = normalizedPluginPath ? path.join(repoDir, normalizedPluginPath) : repoDir;
if (!fs.existsSync(pluginRoot) || !fs.statSync(pluginRoot).isDirectory()) {
result.vally_lint_status = "fail";
result.smoke_status = "fail";
+ result.version_match_status = "fail";
+ result.canvas_structure_status = hasCanvasKeyword(plugin) ? "fail" : "not_run";
result.overall_status = "fail";
result.failure_class = "submitter_fixes";
result.summary = `Plugin path "${plugin.source?.path || "/"}" was not found in the submitted repository snapshot.`;
+ result.version_match_output = result.summary;
+ if (hasCanvasKeyword(plugin)) {
+ result.canvas_structure_output = result.summary;
+ }
return result;
}
+ const versionMatchResult = runVersionMatchGate(repoDir, plugin, fetchSpec);
+ result.version_match_status = versionMatchResult.status;
+ result.version_match_output = versionMatchResult.output;
+
+ const canvasStructureResult = runCanvasStructureGate(repoDir, plugin, fetchSpec);
+ result.canvas_structure_status = canvasStructureResult.status;
+ result.canvas_structure_output = canvasStructureResult.output;
+
const vallyResult = await runVallyLintGate(pluginRoot);
result.vally_lint_status = vallyResult.status;
result.vally_lint_output = vallyResult.output;
@@ -362,11 +691,18 @@ export async function runExternalPluginQualityGates(plugin) {
result.smoke_status = smokeResult.status;
result.smoke_output = smokeResult.output;
- result.overall_status = toOverallStatus(result.vally_lint_status, result.smoke_status);
+ result.overall_status = toOverallStatus([
+ result.vally_lint_status,
+ result.smoke_status,
+ result.version_match_status,
+ result.canvas_structure_status,
+ ]);
result.failure_class = toFailureClass(result.overall_status);
result.summary = [
`- vally lint: ${result.vally_lint_status}`,
`- install smoke test: ${result.smoke_status}`,
+ `- version match: ${result.version_match_status}`,
+ `- canvas structure: ${result.canvas_structure_status}`,
`- overall: ${result.overall_status}`,
].join("\n");
diff --git a/eng/external-plugin-quality-gates.test.mjs b/eng/external-plugin-quality-gates.test.mjs
new file mode 100644
index 00000000..5f619fae
--- /dev/null
+++ b/eng/external-plugin-quality-gates.test.mjs
@@ -0,0 +1,101 @@
+import assert from "node:assert/strict";
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { spawnSync } from "child_process";
+import { after, test } from "node:test";
+import { runCanvasStructureGate } from "./external-plugin-quality-gates.mjs";
+
+const tempDirs = [];
+
+after(() => {
+ for (const dir of tempDirs) {
+ fs.rmSync(dir, { recursive: true, force: true });
+ }
+});
+
+function runGit(repoDir, ...args) {
+ const result = spawnSync("git", args, { cwd: repoDir, encoding: "utf8" });
+ if (result.status !== 0) {
+ throw new Error(`git ${args.join(" ")} failed: ${result.stdout}\n${result.stderr}`);
+ }
+ return String(result.stdout ?? "").trim();
+}
+
+function createTempRepo() {
+ const repoDir = fs.mkdtempSync(path.join(os.tmpdir(), "external-plugin-quality-"));
+ tempDirs.push(repoDir);
+
+ runGit(repoDir, "init", "-q");
+ runGit(repoDir, "config", "user.name", "Copilot Test");
+ runGit(repoDir, "config", "user.email", "copilot@example.com");
+ return repoDir;
+}
+
+function commitAll(repoDir, message) {
+ runGit(repoDir, "add", "-A");
+ runGit(repoDir, "commit", "-m", message, "--quiet");
+ return runGit(repoDir, "rev-parse", "HEAD");
+}
+
+test("runCanvasStructureGate passes when extensions/extension.mjs exists", () => {
+ const repoDir = createTempRepo();
+ fs.mkdirSync(path.join(repoDir, "extensions"), { recursive: true });
+ fs.writeFileSync(path.join(repoDir, "extensions", "extension.mjs"), "export default {};\n");
+ const sha = commitAll(repoDir, "Add canvas extension container");
+
+ const plugin = {
+ name: "canvas-plugin",
+ keywords: ["canvas"],
+ source: {
+ source: "github",
+ repo: "owner/repo",
+ sha,
+ },
+ };
+
+ const result = runCanvasStructureGate(repoDir, plugin, sha);
+ assert.equal(result.status, "pass");
+ assert.match(result.output, /found "extensions"/);
+});
+
+test("runCanvasStructureGate fails when extension entrypoint is only at repo root", () => {
+ const repoDir = createTempRepo();
+ fs.writeFileSync(path.join(repoDir, "extension.mjs"), "export default {};\n");
+ const sha = commitAll(repoDir, "Add root extension entrypoint");
+
+ const plugin = {
+ name: "canvas-plugin",
+ keywords: ["canvas"],
+ source: {
+ source: "github",
+ repo: "owner/repo",
+ sha,
+ },
+ };
+
+ const result = runCanvasStructureGate(repoDir, plugin, sha);
+ assert.equal(result.status, "fail");
+ assert.match(result.output, /missing required canvas extension directory "extensions"/);
+});
+
+test("runCanvasStructureGate fails when extension entrypoint path is a directory", () => {
+ const repoDir = createTempRepo();
+ fs.mkdirSync(path.join(repoDir, "extensions", "extension.mjs"), { recursive: true });
+ fs.writeFileSync(path.join(repoDir, "extensions", "extension.mjs", "placeholder.txt"), "not-a-module\n");
+ const sha = commitAll(repoDir, "Add invalid extension entrypoint directory");
+
+ const plugin = {
+ name: "canvas-plugin",
+ keywords: ["canvas"],
+ source: {
+ source: "github",
+ repo: "owner/repo",
+ sha,
+ },
+ };
+
+ const result = runCanvasStructureGate(repoDir, plugin, sha);
+ assert.equal(result.status, "fail");
+ assert.match(result.output, /"extensions\/extension\.mjs" must be a file/);
+});
diff --git a/eng/generate-website-data.mjs b/eng/generate-website-data.mjs
index 2e646443..ef052693 100755
--- a/eng/generate-website-data.mjs
+++ b/eng/generate-website-data.mjs
@@ -2,7 +2,7 @@
/**
* Generate JSON metadata files for the GitHub Pages website.
- * This script extracts metadata from agents, instructions, skills, hooks, and plugins
+ * This script extracts metadata from agents, instructions, skills, and plugins
* and writes them to website/data/ for client-side search and display.
*/
@@ -14,27 +14,26 @@ import {
AGENTS_DIR,
COOKBOOK_DIR,
EXTENSIONS_DIR,
- HOOKS_DIR,
INSTRUCTIONS_DIR,
PLUGINS_DIR,
ROOT_FOLDER,
SKILLS_DIR,
- WORKFLOWS_DIR,
} from "./constants.mjs";
import { getGitFileDates } from "./utils/git-dates.mjs";
import {
parseFrontmatter,
- parseHookMetadata,
parseSkillMetadata,
- parseWorkflowMetadata,
parseYamlFile,
} from "./yaml-parser.mjs";
+import { readExternalPlugins } from "./external-plugin-validation.mjs";
const __filename = fileURLToPath(import.meta.url);
const WEBSITE_DIR = path.join(ROOT_FOLDER, "website");
const WEBSITE_DATA_DIR = path.join(WEBSITE_DIR, "public", "data");
const WEBSITE_SOURCE_DATA_DIR = path.join(WEBSITE_DIR, "data");
+const EXTERNAL_CANVAS_KEYWORD = "canvas";
+const EXTERNAL_CANVAS_PREVIEW_PATH = "assets/preview.png";
/**
* Ensure the output directory exists
@@ -101,6 +100,23 @@ function normalizeText(value, fallback = "") {
return typeof value === "string" ? value.trim() : fallback;
}
+function normalizeRepoRelativePath(value) {
+ const normalized = normalizeText(value);
+ if (!normalized || normalized === "/") {
+ return "";
+ }
+
+ return normalized.replace(/\\/g, "/").replace(/^\/+|\/+$/g, "");
+}
+
+function joinRepoPath(...segments) {
+ return segments
+ .map((segment) => String(segment ?? "").trim())
+ .filter(Boolean)
+ .join("/")
+ .replace(/\/+/g, "/");
+}
+
/**
* Normalize an author value (npm string form or { name, url } object) to
* { name, url? } | null. Returns null when no usable name is present.
@@ -211,136 +227,6 @@ function generateAgentsData(gitDates) {
};
}
-/**
- * Generate hooks metadata
- */
-/**
- * Generate hooks metadata (similar to skills - folder-based)
- */
-function generateHooksData(gitDates) {
- const hooks = [];
-
- // Check if hooks directory exists
- if (!fs.existsSync(HOOKS_DIR)) {
- return {
- items: hooks,
- filters: {
- hooks: [],
- tags: [],
- },
- };
- }
-
- // Get all hook folders (directories)
- const hookFolders = fs.readdirSync(HOOKS_DIR).filter((file) => {
- const filePath = path.join(HOOKS_DIR, file);
- return fs.statSync(filePath).isDirectory();
- });
-
- // Track all unique values for filters
- const allHookTypes = new Set();
- const allTags = new Set();
-
- for (const folder of hookFolders) {
- const hookPath = path.join(HOOKS_DIR, folder);
- const metadata = parseHookMetadata(hookPath);
- if (!metadata) continue;
-
- const relativePath = path
- .relative(ROOT_FOLDER, hookPath)
- .replace(/\\/g, "/");
- const readmeRelativePath = `${relativePath}/README.md`;
-
- // Get all files in the hook folder recursively (for the file browser and
- // ZIP download on the detail page).
- const files = getFolderFiles(hookPath, relativePath);
-
- // Track unique values
- (metadata.hooks || []).forEach((h) => allHookTypes.add(h));
- (metadata.tags || []).forEach((t) => allTags.add(t));
-
- hooks.push({
- id: folder,
- title: metadata.name,
- description: metadata.description,
- hooks: metadata.hooks || [],
- tags: metadata.tags || [],
- assets: metadata.assets || [],
- files,
- path: relativePath,
- readmeFile: readmeRelativePath,
- readmeFileName: "README.md",
- lastUpdated: gitDates.get(readmeRelativePath) || null,
- });
- }
-
- // Sort and return with filter metadata
- const sortedHooks = hooks.sort((a, b) => a.title.localeCompare(b.title));
-
- return {
- items: sortedHooks,
- filters: {
- hooks: Array.from(allHookTypes).sort(),
- tags: Array.from(allTags).sort(),
- },
- };
-}
-
-/**
- * Generate workflows metadata (flat .md files)
- */
-function generateWorkflowsData(gitDates) {
- const workflows = [];
-
- if (!fs.existsSync(WORKFLOWS_DIR)) {
- return {
- items: workflows,
- filters: {
- triggers: [],
- },
- };
- }
-
- const workflowFiles = fs.readdirSync(WORKFLOWS_DIR).filter((file) => {
- return file.endsWith(".md") && file !== ".gitkeep";
- });
-
- const allTriggers = new Set();
-
- for (const file of workflowFiles) {
- const filePath = path.join(WORKFLOWS_DIR, file);
- const metadata = parseWorkflowMetadata(filePath);
- if (!metadata) continue;
-
- const relativePath = path
- .relative(ROOT_FOLDER, filePath)
- .replace(/\\/g, "/");
-
- (metadata.triggers || []).forEach((t) => allTriggers.add(t));
-
- const id = path.basename(file, ".md");
- workflows.push({
- id,
- title: metadata.name,
- description: metadata.description,
- triggers: metadata.triggers || [],
- path: relativePath,
- lastUpdated: gitDates.get(relativePath) || null,
- });
- }
-
- const sortedWorkflows = workflows.sort((a, b) =>
- a.title.localeCompare(b.title)
- );
-
- return {
- items: sortedWorkflows,
- filters: {
- triggers: Array.from(allTriggers).sort(),
- },
- };
-}
-
/**
* Parse applyTo field into an array of patterns
*/
@@ -565,7 +451,7 @@ function getAgentFiles(agentDir, pluginRootPath) {
* Build a lookup index of resource id -> { title, url } for the kinds that have
* dedicated detail pages, so plugin items can deep-link to them.
*/
-function buildResourceIndex({ agents, skills, instructions, hooks, extensions }) {
+function buildResourceIndex({ agents, skills, instructions, extensions }) {
const toMap = (items, urlPrefix) => {
const map = new Map();
for (const item of items || []) {
@@ -602,7 +488,6 @@ function buildResourceIndex({ agents, skills, instructions, hooks, extensions })
agent: toMap(agents, "agent"),
skill: toMap(skills, "skill"),
instruction: toMap(instructions, "instruction"),
- hook: toMap(hooks, "hook"),
extension: extensionMap,
};
}
@@ -635,7 +520,7 @@ function resolvePluginItem(item, resourceIndex) {
return {
...item,
- title: match?.title || candidateId || item.path,
+ title: match?.title || item.title || candidateId || item.path,
detailUrl: match?.url || null,
};
}
@@ -749,12 +634,40 @@ function generatePluginsData(gitDates, resourceIndex = {}) {
];
});
- // Build items list from spec fields (agents, commands, skills)
+ // Parse mcpServers: supports a path to a .mcp.json file or an inline object
+ const mcpItems = [];
+ if (data.mcpServers) {
+ let mcpServersObj = null;
+ let mcpConfigPath = relPath;
+ if (typeof data.mcpServers === "string") {
+ const manifestMcpPath = data.mcpServers.replace(/^\.\//, "");
+ mcpConfigPath = manifestMcpPath ? `${relPath}/${manifestMcpPath}` : relPath;
+ const mcpJsonPath = path.join(pluginDir, manifestMcpPath);
+ if (fs.existsSync(mcpJsonPath)) {
+ try {
+ const mcpJson = JSON.parse(fs.readFileSync(mcpJsonPath, "utf-8"));
+ mcpServersObj = mcpJson.mcpServers || mcpJson;
+ } catch {
+ // ignore parse errors
+ }
+ }
+ } else if (typeof data.mcpServers === "object") {
+ mcpServersObj = data.mcpServers;
+ }
+ if (mcpServersObj) {
+ for (const serverName of Object.keys(mcpServersObj)) {
+ mcpItems.push({ kind: "mcp", path: mcpConfigPath, title: serverName });
+ }
+ }
+ }
+
+ // Build items list from spec fields (agents, commands, skills, mcpServers)
const items = [
...agentItems,
...(data.commands || []).map((p) => ({ kind: "prompt", path: p })),
...(data.skills || []).map((p) => ({ kind: "skill", path: p })),
...extensionItems,
+ ...mcpItems,
].map((item) => resolvePluginItem(item, resourceIndex));
const tags = data.keywords || data.tags || [];
@@ -1162,6 +1075,67 @@ function normalizeExternalScreenshotRole(value, ref) {
};
}
+function buildExternalRepoImageUrl(repo, locator, assetPath) {
+ if (!repo || !locator || !assetPath) {
+ return null;
+ }
+
+ const encodedLocator = locator
+ .split("/")
+ .map((segment) => encodeURIComponent(segment))
+ .join("/");
+ const encodedPath = assetPath
+ .split("/")
+ .map((segment) => encodeURIComponent(segment))
+ .join("/");
+ return `https://raw.githubusercontent.com/${repo}/${encodedLocator}/${encodedPath}`;
+}
+
+function buildExternalRepoTreeUrl(repo, locator, pluginRoot) {
+ if (!repo) {
+ return null;
+ }
+
+ if (locator) {
+ const treePath = normalizeRepoRelativePath(pluginRoot);
+ const encodedLocator = locator
+ .split("/")
+ .map((segment) => encodeURIComponent(segment))
+ .join("/");
+ const encodedTreePath = treePath
+ ? treePath
+ .split("/")
+ .map((segment) => encodeURIComponent(segment))
+ .join("/")
+ : null;
+ const suffix = encodedTreePath ? `/${encodedTreePath}` : "";
+ return `https://github.com/${repo}/tree/${encodedLocator}${suffix}`;
+ }
+
+ return `https://github.com/${repo}`;
+}
+
+function hasCanvasKeyword(plugin) {
+ return normalizeExternalKeywords(plugin).some(
+ (keyword) => normalizeText(keyword).toLowerCase() === EXTERNAL_CANVAS_KEYWORD
+ );
+}
+
+function normalizeExternalKeywords(plugin) {
+ const source = Array.isArray(plugin?.keywords)
+ ? plugin.keywords
+ : Array.isArray(plugin?.tags)
+ ? plugin.tags
+ : [];
+
+ return [...new Set(
+ source
+ .filter((keyword) => typeof keyword === "string")
+ .map((keyword) => keyword.trim())
+ .filter(Boolean)
+ )].sort((a, b) => a.localeCompare(b));
+}
+
function normalizeExtensionScreenshotRole(value, relPath, ref) {
if (!value) return null;
if (typeof value === "string") {
@@ -1427,6 +1401,93 @@ function generateCanvasManifest(gitDates, commitSha) {
}
}
+ const seenExtensionIds = new Set(items.map((item) => String(item.id).toLowerCase()));
+ const {
+ plugins: externalPlugins,
+ errors: externalPluginErrors,
+ warnings: externalPluginWarnings,
+ } = readExternalPlugins({ policy: "marketplace" });
+ externalPluginWarnings.forEach((warning) => console.warn(`Warning: ${warning}`));
+ if (externalPluginErrors.length > 0) {
+ externalPluginErrors.forEach((error) => console.error(`Error: ${error}`));
+ throw new Error("External plugin validation failed");
+ }
+
+ for (const ext of externalPlugins) {
+ if (!hasCanvasKeyword(ext)) {
+ continue;
+ }
+
+ const name = normalizeText(ext?.name);
+ if (!name) {
+ continue;
+ }
+ const displayName = formatDisplayName(name);
+
+ const id = normalizeText(ext?.name).toLowerCase().replace(/\s+/g, "-");
+ if (seenExtensionIds.has(id)) {
+ continue;
+ }
+
+ const source = ext?.source;
+ if (source?.source !== "github" || !normalizeText(source?.repo)) {
+ console.warn(`Warning: skipping external canvas "${name}" due to missing GitHub source`);
+ continue;
+ }
+
+ const locator = normalizeText(source.sha) || normalizeText(source.ref);
+ if (!locator) {
+ console.warn(`Warning: skipping external canvas "${name}" because source.sha or source.ref is required`);
+ continue;
+ }
+
+ const pluginRoot = normalizeRepoRelativePath(source.path);
+ const previewPath = joinRepoPath(pluginRoot, EXTERNAL_CANVAS_PREVIEW_PATH);
+ const imageUrl = buildExternalRepoImageUrl(source.repo, locator, previewPath);
+ const sourceUrl = buildExternalRepoTreeUrl(source.repo, locator, pluginRoot);
+ const externalSource = normalizeText(source.repo);
+ const keywords = normalizeExternalKeywords(ext);
+
+ items.push({
+ id,
+ canvasId: id,
+ extensionId: id,
+ extensionName: name,
+ pluginName: null,
+ name: displayName,
+ version: normalizeText(ext?.version, "1.0.0"),
+ readmeFile: null,
+ description: normalizeText(ext?.description, "External canvas extension"),
+ path: null,
+ ref: null,
+ lastUpdated: null,
+ screenshots: {
+ icon: imageUrl
+ ? {
+ path: imageUrl,
+ type: getImageMimeType(EXTERNAL_CANVAS_PREVIEW_PATH),
+ }
+ : null,
+ gallery: imageUrl
+ ? {
+ path: imageUrl,
+ type: getImageMimeType(EXTERNAL_CANVAS_PREVIEW_PATH),
+ }
+ : null,
+ },
+ imageUrl,
+ assetPath: null,
+ installUrl: null,
+ installCommand: null,
+ sourceUrl,
+ externalSource,
+ external: true,
+ author: normalizeAuthor(ext?.author),
+ keywords,
+ });
+ seenExtensionIds.add(id);
+ }
+
const sortedItems = items.sort((a, b) => a.name.localeCompare(b.name));
const keywordFilters = [...new Set(sortedItems.flatMap((item) => item.keywords || []))]
.filter(Boolean)
@@ -1459,71 +1520,12 @@ function generateExtensionsData(extensionManifestData) {
return { items, filters };
}
-/**
- * Generate tools metadata from website/data/tools.yml
- */
-function generateToolsData() {
- const toolsFile = path.join(WEBSITE_SOURCE_DATA_DIR, "tools.yml");
-
- if (!fs.existsSync(toolsFile)) {
- console.warn("No tools.yml file found at", toolsFile);
- return { items: [], filters: { categories: [], tags: [] } };
- }
-
- const data = parseYamlFile(toolsFile);
-
- if (!data || !data.tools) {
- return { items: [], filters: { categories: [], tags: [] } };
- }
-
- const allCategories = new Set();
- const allTags = new Set();
-
- const tools = data.tools.map((tool) => {
- const category = tool.category || "Other";
- allCategories.add(category);
-
- const tags = tool.tags || [];
- tags.forEach((t) => allTags.add(t));
-
- return {
- id: tool.id,
- name: tool.name,
- description: tool.description || "",
- category: category,
- featured: tool.featured || false,
- requirements: tool.requirements || [],
- features: tool.features || [],
- links: tool.links || {},
- configuration: tool.configuration || null,
- tags: tags,
- };
- });
-
- // Sort with featured first, then alphabetically
- const sortedTools = tools.sort((a, b) => {
- if (a.featured && !b.featured) return -1;
- if (!a.featured && b.featured) return 1;
- return a.name.localeCompare(b.name);
- });
-
- return {
- items: sortedTools,
- filters: {
- categories: Array.from(allCategories).sort(),
- tags: Array.from(allTags).sort(),
- },
- };
-}
-
/**
* Generate a combined index for search
*/
function generateSearchIndex(
agents,
instructions,
- hooks,
- workflows,
skills,
plugins
) {
@@ -1556,33 +1558,6 @@ function generateSearchIndex(
});
}
- for (const hook of hooks) {
- index.push({
- type: "hook",
- id: hook.id,
- title: hook.title,
- description: hook.description,
- path: hook.readmeFile,
- lastUpdated: hook.lastUpdated,
- searchText: `${hook.title} ${hook.description} ${hook.hooks.join(
- " "
- )} ${hook.tags.join(" ")}`.toLowerCase(),
- });
- }
-
- for (const workflow of workflows) {
- index.push({
- type: "workflow",
- id: workflow.id,
- title: workflow.title,
- description: workflow.description,
- path: workflow.path,
- lastUpdated: workflow.lastUpdated,
- searchText: `${workflow.title} ${workflow.description
- } ${workflow.triggers.join(" ")}`.toLowerCase(),
- });
- }
-
for (const skill of skills) {
index.push({
type: "skill",
@@ -1752,8 +1727,6 @@ async function main() {
[
"agents/",
"instructions/",
- "hooks/",
- "workflows/",
"skills/",
"extensions/",
"plugins/",
@@ -1771,18 +1744,6 @@ async function main() {
`✓ Generated ${agents.length} agents (${agentsData.filters.models.length} models, ${agentsData.filters.tools.length} tools)`
);
- const hooksData = generateHooksData(gitDates);
- const hooks = hooksData.items;
- console.log(
- `✓ Generated ${hooks.length} hooks (${hooksData.filters.hooks.length} hook types, ${hooksData.filters.tags.length} tags)`
- );
-
- const workflowsData = generateWorkflowsData(gitDates);
- const workflows = workflowsData.items;
- console.log(
- `✓ Generated ${workflows.length} workflows (${workflowsData.filters.triggers.length} triggers)`
- );
-
const instructionsData = generateInstructionsData(gitDates);
const instructions = instructionsData.items;
console.log(
@@ -1804,7 +1765,6 @@ async function main() {
agents,
skills,
instructions,
- hooks,
extensions,
});
const pluginsData = generatePluginsData(gitDates, resourceIndex);
@@ -1813,12 +1773,6 @@ async function main() {
`✓ Generated ${plugins.length} plugins (${pluginsData.filters.tags.length} tags)`
);
- const toolsData = generateToolsData();
- const tools = toolsData.items;
- console.log(
- `✓ Generated ${tools.length} tools (${toolsData.filters.categories.length} categories)`
- );
-
const samplesData = generateSamplesData();
console.log(
`✓ Generated ${samplesData.totalRecipes} recipes in ${samplesData.totalCookbooks} cookbooks (${samplesData.filters.languages.length} languages, ${samplesData.filters.tags.length} tags)`
@@ -1833,8 +1787,6 @@ async function main() {
const searchIndex = generateSearchIndex(
agents,
instructions,
- hooks,
- workflows,
skills,
plugins
);
@@ -1846,16 +1798,6 @@ async function main() {
JSON.stringify(agentsData, null, 2)
);
- fs.writeFileSync(
- path.join(WEBSITE_DATA_DIR, "hooks.json"),
- JSON.stringify(hooksData, null, 2)
- );
-
- fs.writeFileSync(
- path.join(WEBSITE_DATA_DIR, "workflows.json"),
- JSON.stringify(workflowsData, null, 2)
- );
-
fs.writeFileSync(
path.join(WEBSITE_DATA_DIR, "instructions.json"),
JSON.stringify(instructionsData, null, 2)
@@ -1876,10 +1818,6 @@ async function main() {
JSON.stringify(extensionsData, null, 2)
);
- fs.writeFileSync(
- path.join(WEBSITE_DATA_DIR, "tools.json"),
- JSON.stringify(toolsData, null, 2)
- );
fs.writeFileSync(
path.join(WEBSITE_DATA_DIR, "samples.json"),
@@ -1898,11 +1836,8 @@ async function main() {
agents: agents.length,
instructions: instructions.length,
skills: skills.length,
- hooks: hooks.length,
- workflows: workflows.length,
plugins: plugins.length,
extensions: extensions.length,
- tools: tools.length,
contributors: contributorCount,
samples: samplesData.totalRecipes,
total: searchIndex.length,
diff --git a/eng/materialize-plugins.mjs b/eng/materialize-plugins.mjs
index 978c250f..2d91cb61 100644
--- a/eng/materialize-plugins.mjs
+++ b/eng/materialize-plugins.mjs
@@ -2,9 +2,11 @@
import fs from "fs";
import path from "path";
+import { fileURLToPath } from "url";
import { ROOT_FOLDER } from "./constants.mjs";
const PLUGINS_DIR = path.join(ROOT_FOLDER, "plugins");
+const EXTENSIONS_DIR = path.join(ROOT_FOLDER, "extensions");
/**
* Recursively copy a directory.
@@ -22,6 +24,17 @@ function copyDirRecursive(src, dest) {
}
}
+function copyEntryRecursive(srcPath, destPath) {
+ const stats = fs.statSync(srcPath);
+ if (stats.isDirectory()) {
+ copyDirRecursive(srcPath, destPath);
+ return;
+ }
+
+ fs.mkdirSync(path.dirname(destPath), { recursive: true });
+ fs.copyFileSync(srcPath, destPath);
+}
+
/**
* Resolve a plugin-relative path to the repo-root source file.
*
@@ -45,6 +58,48 @@ function resolveSource(relPath) {
return null;
}
+export function materializeExtensionPlugin(extensionPath) {
+ const pluginJsonPath = path.join(extensionPath, ".github", "plugin", "plugin.json");
+ if (!fs.existsSync(pluginJsonPath)) {
+ return { copiedEntries: 0, manifestUpdated: false, skipped: true };
+ }
+
+ let metadata;
+ try {
+ metadata = JSON.parse(fs.readFileSync(pluginJsonPath, "utf8"));
+ } catch (err) {
+ throw new Error(`Failed to parse ${pluginJsonPath}: ${err.message}`);
+ }
+
+ const extensionContainerPath = path.join(extensionPath, "extensions");
+ fs.rmSync(extensionContainerPath, { recursive: true, force: true });
+ fs.mkdirSync(extensionContainerPath, { recursive: true });
+
+ let copiedEntries = 0;
+ for (const entry of fs.readdirSync(extensionPath, { withFileTypes: true })) {
+ if (entry.name === ".github" || entry.name === "extensions") {
+ continue;
+ }
+
+ copyEntryRecursive(
+ path.join(extensionPath, entry.name),
+ path.join(extensionContainerPath, entry.name)
+ );
+ copiedEntries++;
+ }
+
+ let manifestUpdated = false;
+ if (metadata.extensions !== "extensions") {
+ metadata.extensions = "extensions";
+ manifestUpdated = true;
+ }
+ if (manifestUpdated) {
+ fs.writeFileSync(pluginJsonPath, JSON.stringify(metadata, null, 2) + "\n", "utf8");
+ }
+
+ return { copiedEntries, manifestUpdated, skipped: false };
+}
+
function materializePlugins() {
console.log("Materializing plugin files...\n");
@@ -61,6 +116,8 @@ function materializePlugins() {
let totalAgents = 0;
let totalSkills = 0;
let totalExtensions = 0;
+ let totalExtensionPlugins = 0;
+ let totalExtensionPluginEntries = 0;
let warnings = 0;
let errors = 0;
@@ -185,7 +242,36 @@ function materializePlugins() {
}
}
- console.log(`\nDone. Copied ${totalAgents} agents, ${totalSkills} skills, ${totalExtensions} extensions.`);
+ if (fs.existsSync(EXTENSIONS_DIR)) {
+ const extensionDirs = fs.readdirSync(EXTENSIONS_DIR, { withFileTypes: true })
+ .filter((entry) => entry.isDirectory())
+ .map((entry) => entry.name)
+ .sort();
+
+ for (const dirName of extensionDirs) {
+ const extensionPath = path.join(EXTENSIONS_DIR, dirName);
+ if (!fs.existsSync(path.join(extensionPath, "extension.mjs"))) {
+ continue;
+ }
+
+ try {
+ const result = materializeExtensionPlugin(extensionPath);
+ if (result.skipped) {
+ continue;
+ }
+
+ totalExtensionPlugins++;
+ totalExtensionPluginEntries += result.copiedEntries;
+ console.log(`✓ ${dirName}: materialized extension bundle into ./extensions (${result.copiedEntries} entries)`);
+ } catch (err) {
+ console.error(`Error: Failed to materialize extension plugin ${dirName}: ${err.message}`);
+ errors++;
+ }
+ }
+ }
+
+ console.log(`\nDone. Copied ${totalAgents} agents, ${totalSkills} skills, ${totalExtensions} plugin extension refs.`);
+ console.log(`Materialized ${totalExtensionPlugins} extension plugins (${totalExtensionPluginEntries} top-level entries).`);
if (warnings > 0) {
console.log(`${warnings} warning(s).`);
}
@@ -195,4 +281,8 @@ function materializePlugins() {
}
}
-materializePlugins();
+export { materializePlugins };
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+ materializePlugins();
+}
diff --git a/eng/materialize-plugins.test.mjs b/eng/materialize-plugins.test.mjs
new file mode 100644
index 00000000..7f42981c
--- /dev/null
+++ b/eng/materialize-plugins.test.mjs
@@ -0,0 +1,48 @@
+import assert from "node:assert/strict";
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { after, test } from "node:test";
+import { materializeExtensionPlugin } from "./materialize-plugins.mjs";
+
+const tempDirs = [];
+
+after(() => {
+ for (const dir of tempDirs) {
+ fs.rmSync(dir, { recursive: true, force: true });
+ }
+});
+
+test("materializeExtensionPlugin writes extension bundles to ./extensions and rewrites manifest", () => {
+ const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "materialize-extension-plugin-"));
+ tempDirs.push(tempDir);
+
+ const pluginDir = path.join(tempDir, "extension-plugin");
+ fs.mkdirSync(path.join(pluginDir, ".github", "plugin"), { recursive: true });
+ fs.mkdirSync(path.join(pluginDir, "assets"), { recursive: true });
+ fs.writeFileSync(path.join(pluginDir, ".github", "plugin", "plugin.json"), JSON.stringify({
+ name: "test-extension-plugin",
+ description: "test plugin",
+ version: "1.0.0",
+ logo: "assets/preview.png",
+ extensions: ".",
+ }, null, 2));
+ fs.writeFileSync(path.join(pluginDir, "extension.mjs"), "export default {};\n");
+ fs.writeFileSync(path.join(pluginDir, "README.md"), "# test\n");
+ fs.writeFileSync(path.join(pluginDir, "assets", "preview.png"), "fake-image-bytes");
+
+ const result = materializeExtensionPlugin(pluginDir);
+
+ assert.equal(result.skipped, false);
+ assert.equal(result.manifestUpdated, true);
+ assert.equal(result.copiedEntries, 3);
+ assert.equal(fs.existsSync(path.join(pluginDir, "extensions", "extension.mjs")), true);
+ assert.equal(fs.existsSync(path.join(pluginDir, "extensions", "assets", "preview.png")), true);
+ assert.equal(fs.existsSync(path.join(pluginDir, "extensions", "README.md")), true);
+ assert.equal(fs.existsSync(path.join(pluginDir, "extensions", ".github")), false);
+
+ const pluginManifest = JSON.parse(
+ fs.readFileSync(path.join(pluginDir, ".github", "plugin", "plugin.json"), "utf8")
+ );
+ assert.equal(pluginManifest.extensions, "extensions");
+});
diff --git a/eng/validate-plugins.mjs b/eng/validate-plugins.mjs
index fc8003b3..7161df06 100755
--- a/eng/validate-plugins.mjs
+++ b/eng/validate-plugins.mjs
@@ -305,9 +305,14 @@ function validateExtensionManifest(folderName) {
errors.push("x-awesome-copilot field must not be present (use convention-based logo instead)");
}
- // Extension convention: extensions field must be "."
+ if (parsed.extenions !== undefined) {
+ errors.push('use "extensions" field (found misspelled key "extenions")');
+ }
+
+ // Extension convention: source manifests keep extensions at repository root.
+ // Materialization rewrites this to "extensions" on distribution branches.
if (parsed.extensions !== ".") {
- errors.push('extensions field must be exactly "." (extension convention)');
+ errors.push('extensions field must be exactly "." in source manifests (extension convention)');
}
return { errors, plugin: parsedPlugin };
diff --git a/extensions/accessibility-kanban/.github/plugin/plugin.json b/extensions/accessibility-kanban/.github/plugin/plugin.json
index 824a71c5..03903a27 100644
--- a/extensions/accessibility-kanban/.github/plugin/plugin.json
+++ b/extensions/accessibility-kanban/.github/plugin/plugin.json
@@ -1,7 +1,7 @@
{
"name": "accessibility-kanban",
"description": "Kanban board to manage accessibility issues, allow you to plan, track, and complete remediation work.",
- "version": "1.0.0",
+ "version": "1.0.1",
"author": {
"name": "Aaron Powell",
"url": "https://github.com/aaronpowell"
diff --git a/extensions/apng-studio/.github/plugin/plugin.json b/extensions/apng-studio/.github/plugin/plugin.json
index 6c46943c..fcd5bfc8 100644
--- a/extensions/apng-studio/.github/plugin/plugin.json
+++ b/extensions/apng-studio/.github/plugin/plugin.json
@@ -1,7 +1,7 @@
{
"name": "apng-studio",
"description": "Interactive GitHub Copilot app canvas extension for building Animated PNG (APNG) files from frames. Draw or upload frames, tune per-frame timing and compositing, preview live, send the result to your phone by QR, and export an animated .png.",
- "version": "1.0.0",
+ "version": "1.0.1",
"author": {
"name": "Andrea Griffiths",
"url": "https://github.com/AndreaGriffiths11"
diff --git a/extensions/arcade-canvas/.github/plugin/plugin.json b/extensions/arcade-canvas/.github/plugin/plugin.json
index 8bf1d4cb..975971d8 100644
--- a/extensions/arcade-canvas/.github/plugin/plugin.json
+++ b/extensions/arcade-canvas/.github/plugin/plugin.json
@@ -1,7 +1,7 @@
{
"name": "arcade-canvas",
"description": "Play five retro Phaser mini-games in a Copilot canvas while agents work.",
- "version": "1.0.0",
+ "version": "1.0.1",
"author": {
"name": "Dan Wahlin",
"url": "https://github.com/DanWahlin"
diff --git a/extensions/backlog-swipe-triage/.github/plugin/plugin.json b/extensions/backlog-swipe-triage/.github/plugin/plugin.json
index d45e7e39..6dda88bd 100644
--- a/extensions/backlog-swipe-triage/.github/plugin/plugin.json
+++ b/extensions/backlog-swipe-triage/.github/plugin/plugin.json
@@ -1,7 +1,7 @@
{
"name": "backlog-swipe-triage",
"description": "Quickly swipe through backlog issues to triage decisions like assign, needs-info, defer, close, or ignore.",
- "version": "1.0.0",
+ "version": "1.0.1",
"author": {
"name": "James Montemagno",
"url": "https://github.com/jamesmontemagno"
diff --git a/extensions/chromium-control-canvas/.github/plugin/plugin.json b/extensions/chromium-control-canvas/.github/plugin/plugin.json
index c8a2fa72..8c4d631d 100644
--- a/extensions/chromium-control-canvas/.github/plugin/plugin.json
+++ b/extensions/chromium-control-canvas/.github/plugin/plugin.json
@@ -1,7 +1,7 @@
{
"name": "chromium-control-canvas",
"description": "Opens a real Chromium window you can navigate and interact with from a Copilot canvas control panel and agent actions.",
- "version": "1.0.0",
+ "version": "1.0.1",
"author": {
"name": "Andrea Griffiths",
"url": "https://github.com/AndreaGriffiths11"
diff --git a/extensions/color-orb/.github/plugin/plugin.json b/extensions/color-orb/.github/plugin/plugin.json
index c162c294..3b564245 100644
--- a/extensions/color-orb/.github/plugin/plugin.json
+++ b/extensions/color-orb/.github/plugin/plugin.json
@@ -1,7 +1,7 @@
{
"name": "color-orb",
"description": "A visual orb that users can ask the agent to recolor while showing a live activity log in the canvas.",
- "version": "1.0.0",
+ "version": "1.0.1",
"author": {
"name": "Aaron Powell",
"url": "https://github.com/aaronpowell"
diff --git a/extensions/connector-namespaces/.github/plugin/plugin.json b/extensions/connector-namespaces/.github/plugin/plugin.json
new file mode 100644
index 00000000..397859c5
--- /dev/null
+++ b/extensions/connector-namespaces/.github/plugin/plugin.json
@@ -0,0 +1,19 @@
+{
+ "name": "connector-namespaces",
+ "description": "Browse, connect, and open MCP connectors from an Azure Connector Namespace.",
+ "version": "1.1.1",
+ "author": {
+ "name": "Alex Yang",
+ "url": "https://github.com/alexyaang"
+ },
+ "keywords": [
+ "azure",
+ "connector-namespace",
+ "mcp",
+ "mcp-connectors",
+ "model-context-protocol",
+ "tool-discovery"
+ ],
+ "logo": "assets/preview.png",
+ "extensions": "."
+}
diff --git a/extensions/connector-namespaces/LICENSE b/extensions/connector-namespaces/LICENSE
new file mode 100644
index 00000000..22aed37e
--- /dev/null
+++ b/extensions/connector-namespaces/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) Microsoft Corporation.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/extensions/connector-namespaces/README.md b/extensions/connector-namespaces/README.md
new file mode 100644
index 00000000..f7346247
--- /dev/null
+++ b/extensions/connector-namespaces/README.md
@@ -0,0 +1,85 @@
+# MCP Connectors — Copilot CLI Canvas Extension
+
+A GitHub Copilot CLI **canvas extension** that lets you browse and add MCP
+connectors from an Azure **Connector Namespace** directly inside a Copilot CLI
+session. Search by name or category, sign in to a connector, then restart the
+session to make its tools available to the agent.
+
+> The canvas talks to public Azure Resource Manager (`management.azure.com`)
+> using the signed-in Azure CLI account. The extension does not register its own
+> Entra application or persist Azure credentials.
+
+## Prerequisites
+
+- **GitHub Copilot CLI** (the host that loads canvas extensions).
+- **Azure CLI**, signed in with `az login`. The extension asks Azure CLI for a
+ short-lived ARM access token and refreshes it through the same broker.
+- **An Azure subscription with a Connector Namespace** — resource type
+ `Microsoft.Web/connectorGateways` (API version `2026-05-01-preview`). This is
+ a preview resource provider; you must have access to it for the catalog to
+ load. Without it the extension installs fine but has nothing to show.
+
+## Install
+
+Install it from the public Awesome Copilot repository:
+
+```
+install_extension https://github.com/github/awesome-copilot/tree/main/extensions/connector-namespaces
+```
+
+For a reproducible install, swap `main` for a reviewed commit SHA from this
+repository.
+
+The destination **scope** is chosen at install time:
+
+- **user** (default) — installs globally for you at
+ `$COPILOT_HOME/extensions/connector-namespaces/`. The usual choice for a
+ personal tool.
+- **project** — installs into the current repo.
+- **session** — scoped to a single CLI session.
+
+## Usage
+
+1. Open the **MCP Connectors** canvas from Copilot CLI.
+2. The canvas loads subscriptions from your signed-in Azure CLI account. Pick an
+ Azure **subscription** and a **Connector Namespace**. The choice is saved for
+ future sessions (change it any time via **Change namespace**).
+3. Browse or filter the connector catalog, then **Connect**. A browser tab
+ opens for Microsoft sign-in; complete it and the canvas updates on its own.
+4. Connected connectors move into **My MCPs**. Use **Sandbox** on a tile to open
+ that server directly in the namespace MCP playground.
+5. Restart the Copilot CLI session so the agent can load the connected tools.
+
+The extension registers the native `connector_namespaces_open_playground` tool,
+so GitHub Copilot can open a named connector from **My MCPs** without installing
+an additional Agent Skill.
+
+## How it works
+
+- `extension.mjs` — entry point; declares the canvas, `open_sandbox` action, and
+ native `connector_namespaces_open_playground` tool.
+- `server.mjs` — a loopback HTTP server (bound to `127.0.0.1` only) that serves
+ the canvas UI and the JSON/OAuth endpoints the iframe calls.
+- `armClient.mjs` — thin ARM client (token brokered by Azure CLI, public ARM
+ base only, SSRF-guarded path segments).
+- `catalog.mjs` — fetches and curates the connector list for a namespace.
+- `install.mjs` — the connect/install pipeline (managed-API connection, consent,
+ rollback on cancel, and native HTTPS MCP config registration).
+- `renderer.mjs` — all canvas HTML/CSS/client JS.
+- `sandbox.mjs` — builds namespace playground links and resolves named My MCPs.
+- `state.mjs` — saved namespace and connector state.
+
+## Privacy & security
+
+- ARM tokens come from `az account get-access-token`, stay in process memory,
+ and are never logged or written by the extension. Azure CLI owns sign-in and
+ credential storage.
+- All servers bind to loopback (`127.0.0.1`) and are never exposed externally.
+- ARM requests go only to `https://management.azure.com/`; path segments are
+ validated to prevent SSRF-style host smuggling.
+- The minted gateway API key is stored in the selected Copilot MCP config and
+ sent to its validated HTTPS endpoint as the `X-API-Key` header.
+
+## License
+
+[MIT](./LICENSE) © Microsoft Corporation.
diff --git a/extensions/connector-namespaces/armClient.mjs b/extensions/connector-namespaces/armClient.mjs
new file mode 100644
index 00000000..dc0f9fc4
--- /dev/null
+++ b/extensions/connector-namespaces/armClient.mjs
@@ -0,0 +1,444 @@
+// ARM API client — fetches real connector data with Azure CLI credentials.
+
+import { exec, execFile } from "node:child_process";
+import { constants as fsConstants, promises as fs } from "node:fs";
+import { homedir, platform } from "node:os";
+import { basename, delimiter, dirname, isAbsolute, join, resolve, sep } from "node:path";
+import { promisify } from "node:util";
+
+const API_VERSION = "2026-05-01-preview";
+const RG_API_VERSION = "2021-04-01";
+const MSI_API_VERSION = "2023-01-31";
+const SUBS_API_VERSION = "2020-01-01";
+
+const execFileAsync = promisify(execFile);
+const execAsync = promisify(exec);
+const ARM_RESOURCE = "https://management.azure.com/";
+const EXPIRY_SKEW_MS = 5 * 60 * 1000;
+const LEGACY_AUTH_CACHE = join(
+ process.env.COPILOT_HOME || join(homedir(), ".copilot"),
+ "extensions",
+ "connector-namespaces",
+ "artifacts",
+ "auth-cache.json",
+);
+
+let s_auth = null; // { token, expiresAt }
+let s_authInFlight = null;
+let s_legacyAuthCacheRemoved = false;
+
+export function parseAzureCliToken(stdout) {
+ let data;
+ try {
+ data = JSON.parse(stdout);
+ } catch {
+ throw new Error("Azure CLI returned invalid token JSON.");
+ }
+ const token = data?.accessToken;
+ const epochSeconds = Number(data?.expires_on);
+ const expiresAt = Number.isFinite(epochSeconds) && epochSeconds > 0
+ ? epochSeconds * 1000
+ : Date.parse(data?.expiresOn);
+ if (typeof token !== "string" || token.length === 0 || !Number.isFinite(expiresAt)) {
+ throw new Error("Azure CLI returned an incomplete ARM token.");
+ }
+ return { token, expiresAt };
+}
+
+async function removeLegacyAuthCache() {
+ if (s_legacyAuthCacheRemoved) return;
+ try {
+ await fs.unlink(LEGACY_AUTH_CACHE);
+ } catch (error) {
+ if (error?.code !== "ENOENT") {
+ throw new Error(`Could not remove the legacy connector credential cache at ${LEGACY_AUTH_CACHE}: ${error.message}`);
+ }
+ }
+ s_legacyAuthCacheRemoved = true;
+}
+
+function windowsSystemExecutable(name) {
+ const systemRoot = process.env.SystemRoot;
+ if (systemRoot && isAbsolute(systemRoot)) return join(systemRoot, "System32", name);
+ throw new Error(`Could not resolve the Windows system executable ${name}.`);
+}
+
+async function trustedExecutablePath(path, expectedName, workspaceRoot = process.cwd()) {
+ if (!isAbsolute(path) || /["\r\n]/.test(path)) return null;
+ let candidate;
+ let workspace;
+ try {
+ [candidate, workspace] = await Promise.all([
+ fs.realpath(path),
+ fs.realpath(workspaceRoot),
+ ]);
+ if (!(await fs.stat(candidate)).isFile()) return null;
+ if (platform() !== "win32") await fs.access(candidate, fsConstants.X_OK);
+ } catch {
+ return null;
+ }
+ const insensitive = platform() === "win32";
+ const normalize = (value) => insensitive ? value.toLowerCase() : value;
+ const normalizedCandidate = normalize(resolve(candidate));
+ const normalizedWorkspace = normalize(resolve(workspace));
+ const workspacePrefix = normalizedWorkspace.endsWith(sep)
+ ? normalizedWorkspace
+ : `${normalizedWorkspace}${sep}`;
+ if (
+ normalize(basename(candidate)) !== normalize(expectedName) ||
+ normalizedCandidate === normalizedWorkspace ||
+ normalizedCandidate.startsWith(workspacePrefix)
+ ) return null;
+ return candidate;
+}
+
+async function resolveWindowsAzureCli() {
+ const trustedCwd = homedir();
+ const { stdout } = await execFileAsync(
+ windowsSystemExecutable("where.exe"),
+ ["az.cmd"],
+ { cwd: trustedCwd, encoding: "utf8", windowsHide: true, timeout: 10_000, maxBuffer: 64 * 1024 },
+ );
+ for (const path of stdout.split(/\r?\n/).map((line) => line.trim())) {
+ if (/[%]/.test(path)) continue;
+ const candidate = await trustedExecutablePath(path, "az.cmd");
+ if (candidate) return candidate;
+ }
+ throw new Error("Azure CLI was not found outside the current workspace.");
+}
+
+export async function resolvePosixAzureCli(pathValue = process.env.PATH || "", workspaceRoot = process.cwd()) {
+ for (const directory of pathValue.split(delimiter)) {
+ const candidate = await trustedExecutablePath(resolve(directory || workspaceRoot, "az"), "az", workspaceRoot);
+ if (candidate) return candidate;
+ }
+ throw new Error("Azure CLI was not found outside the current workspace.");
+}
+
+export async function resolveSystemExecutable(name, workspaceRoot = process.cwd()) {
+ const candidates = platform() === "win32"
+ ? [windowsSystemExecutable(name)]
+ : [join("/usr/bin", name), join("/bin", name), join("/usr/local/bin", name)];
+ for (const path of candidates) {
+ const candidate = await trustedExecutablePath(path, name, workspaceRoot);
+ if (candidate) return candidate;
+ }
+ throw new Error(`Could not resolve the trusted system executable ${name}.`);
+}
+
+async function acquireToken() {
+ await removeLegacyAuthCache();
+ try {
+ const windows = platform() === "win32";
+ const azureCli = windows ? await resolveWindowsAzureCli() : await resolvePosixAzureCli();
+ const options = { cwd: homedir(), encoding: "utf8", windowsHide: true, timeout: 60_000, maxBuffer: 1024 * 1024 };
+ const { stdout } = windows
+ ? await execAsync(
+ `"${azureCli}" account get-access-token --resource https://management.azure.com/ --output json --only-show-errors`,
+ { ...options, shell: windowsSystemExecutable("cmd.exe") },
+ )
+ : await execFileAsync(
+ azureCli,
+ ["account", "get-access-token", "--resource", ARM_RESOURCE, "--output", "json", "--only-show-errors"],
+ options,
+ );
+ s_auth = parseAzureCliToken(stdout);
+ return s_auth.token;
+ } catch (error) {
+ const detail = String(error?.stderr || error?.message || "").trim();
+ throw new Error(
+ `Azure CLI authentication failed. Install Azure CLI and run "az login" before opening the canvas.${detail ? ` ${detail}` : ""}`,
+ );
+ }
+}
+
+export async function getToken() {
+ if (s_auth && s_auth.expiresAt - EXPIRY_SKEW_MS > Date.now()) return s_auth.token;
+ if (s_authInFlight) return s_authInFlight;
+ s_authInFlight = acquireToken().finally(() => {
+ s_authInFlight = null;
+ });
+ return s_authInFlight;
+}
+
+/**
+ * List all enabled Azure subscriptions the user has access to.
+ */
+// The set of enabled subscriptions is stable for a session, so cache it — the
+// first /setup pays the ARM round-trip once and every "Change namespace"
+// afterwards serves from memory.
+let s_subsCache = null; // { subs, expiresAt }
+const SUBS_TTL_MS = 30 * 60 * 1000;
+
+export async function listSubscriptions() {
+ const now = Date.now();
+ if (s_subsCache && s_subsCache.expiresAt > now) return s_subsCache.subs;
+ const token = await getToken();
+ const url = `https://management.azure.com/subscriptions?api-version=${SUBS_API_VERSION}`;
+ const raw = await paginateAll(url, token);
+ const subs = raw
+ .filter((s) => s.state === "Enabled")
+ .map((s) => ({ id: s.subscriptionId, name: s.displayName, tenantId: s.tenantId, state: s.state }));
+ s_subsCache = { subs, expiresAt: now + SUBS_TTL_MS };
+ return subs;
+}
+
+// ARM resource identifiers are a restricted charset (letters, digits and a few
+// punctuation chars). Validating each path segment against this allowlist before
+// it enters a URL rejects anything containing "/", "?", "#", "@" or ":" — the
+// characters that could otherwise alter the request path or redirect the host —
+// and acts as a taint barrier so config/file-derived names cannot reach fetch
+// unvalidated.
+const ARM_SEGMENT = /^[A-Za-z0-9._()-]{1,256}$/;
+
+export function armSegment(value) {
+ const s = String(value);
+ if (s === "." || s === ".." || !ARM_SEGMENT.test(s)) {
+ throw new Error(`Invalid ARM resource identifier: ${s}`);
+ }
+ return s;
+}
+
+function buildBaseUrl(subscriptionId, resourceGroup, gatewayName) {
+ return `https://management.azure.com/subscriptions/${armSegment(subscriptionId)}/resourceGroups/${armSegment(resourceGroup)}/providers/Microsoft.Web/connectorGateways/${armSegment(gatewayName)}`;
+}
+
+// Hard host allowlist: every request this client makes targets ARM and only
+// ARM. The trailing slash matters — it blocks suffix/userinfo bypasses such as
+// "https://management.azure.com.evil.com/" and "https://management.azure.com@evil.com/",
+// neither of which starts with this exact prefix. This guards the paginated
+// nextLink (a server-supplied value) which does not pass through armSegment.
+const ARM_BASE = "https://management.azure.com/";
+
+// Returns the URL only if it targets ARM, otherwise throws. Used by callers
+// (e.g. install.mjs) that build ARM URLs before handing them here.
+export function assertArmHost(rawUrl) {
+ const url = String(rawUrl);
+ if (!url.startsWith(ARM_BASE)) {
+ throw new Error(`Refusing to call non-ARM URL: ${url}`);
+ }
+ return url;
+}
+
+async function armFetch(url, token) {
+ // Guard the exact value handed to fetch so a tainted path segment or a
+ // server-supplied nextLink can never redirect the call off ARM.
+ if (!url.startsWith(ARM_BASE)) {
+ throw new Error(`Refusing to call non-ARM URL: ${url}`);
+ }
+ const res = await fetch(url, {
+ headers: {
+ Authorization: `Bearer ${token}`,
+ "Content-Type": "application/json",
+ },
+ });
+ if (!res.ok) {
+ const body = await res.text();
+ throw new Error(`ARM ${res.status}: ${body.slice(0, 300)}`);
+ }
+ return res.json();
+}
+
+// ARM normally returns distinct nextLink URLs that terminate, but a buggy or
+// hostile endpoint could return a repeating/self-referential nextLink. Guard
+// against an unbounded loop with a seen-set and a hard page cap.
+const MAX_PAGES = 1000;
+
+async function paginateAll(url, token) {
+ const results = [];
+ const seen = new Set();
+ let nextUrl = url;
+ let pages = 0;
+ while (nextUrl) {
+ if (seen.has(nextUrl) || pages >= MAX_PAGES) break;
+ seen.add(nextUrl);
+ pages++;
+ const data = await armFetch(nextUrl, token);
+ if (data.value) results.push(...data.value);
+ nextUrl = data.nextLink || null;
+ }
+ return results;
+}
+
+/**
+ * List connector gateways in a subscription.
+ * Uses $top=10 and stops after the first page for speed.
+ * Pass fetchAll=true to paginate through everything.
+ */
+export async function listConnectorGateways(subscriptionId, { fetchAll = false } = {}) {
+ const token = await getToken();
+ const url = `https://management.azure.com/subscriptions/${armSegment(subscriptionId)}/providers/Microsoft.Web/connectorGateways?api-version=${API_VERSION}&$top=10`;
+ if (fetchAll) return { items: await paginateAll(url, token), hasMore: false };
+ // First page only — much faster
+ const data = await armFetch(url, token);
+ const items = data.value || [];
+ return { items, hasMore: !!data.nextLink };
+}
+
+/**
+ * List managed APIs (traditional connectors)
+ */
+export async function listManagedApis(subscriptionId, resourceGroup, gatewayName) {
+ const token = await getToken();
+ const url = `${buildBaseUrl(subscriptionId, resourceGroup, gatewayName)}/managedApis?api-version=${API_VERSION}`;
+ return paginateAll(url, token);
+}
+
+/**
+ * List managed hosted MCP servers
+ */
+export async function listManagedHostedMcpServers(subscriptionId, resourceGroup, gatewayName) {
+ const token = await getToken();
+ const url = `${buildBaseUrl(subscriptionId, resourceGroup, gatewayName)}/managedHostedMcpServers?api-version=${API_VERSION}`;
+ return paginateAll(url, token);
+}
+
+/**
+ * List managed MCP operations
+ */
+export async function listManagedMcpOperations(subscriptionId, resourceGroup, gatewayName) {
+ const token = await getToken();
+ const url = `${buildBaseUrl(subscriptionId, resourceGroup, gatewayName)}/managedMcpOperations?api-version=${API_VERSION}`;
+ return paginateAll(url, token);
+}
+
+// ---------------------------------------------------------------------------
+// Create connector namespace (provisioning flow)
+// ---------------------------------------------------------------------------
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+// Write helper (PUT/PATCH/DELETE) that mirrors armFetch's host guard but keeps
+// the parsed error body so callers can surface ARM's message verbatim.
+async function armWrite(method, url, body, extraHeaders = {}) {
+ if (!url.startsWith(ARM_BASE)) {
+ throw new Error(`Refusing to call non-ARM URL: ${url}`);
+ }
+ const token = await getToken();
+ const headers = { Authorization: `Bearer ${token}` };
+ Object.assign(headers, extraHeaders);
+ if (body !== undefined) headers["Content-Type"] = "application/json";
+ const res = await fetch(url, {
+ method,
+ headers,
+ body: body !== undefined ? JSON.stringify(body) : undefined,
+ });
+ const text = await res.text();
+ let parsed;
+ try { parsed = text ? JSON.parse(text) : undefined; } catch { parsed = text; }
+ if (!res.ok) {
+ const msg = parsed?.error?.message ?? parsed?.message ?? text ?? `HTTP ${res.status}`;
+ const err = new Error(`ARM ${method} ${res.status}: ${String(msg).slice(0, 300)}`);
+ err.status = res.status;
+ throw err;
+ }
+ return parsed;
+}
+
+/**
+ * List resource groups in a subscription (sorted by name).
+ */
+export async function listResourceGroups(subscriptionId) {
+ const token = await getToken();
+ const url = `https://management.azure.com/subscriptions/${armSegment(subscriptionId)}/resourcegroups?api-version=${RG_API_VERSION}`;
+ const items = await paginateAll(url, token);
+ return items
+ .map((rg) => ({ name: rg.name, location: rg.location }))
+ .sort((a, b) => a.name.localeCompare(b.name));
+}
+
+/**
+ * Create a resource group without updating an existing group on a name race.
+ */
+export async function createResourceGroup(subscriptionId, name, location) {
+ const url = `https://management.azure.com/subscriptions/${armSegment(subscriptionId)}/resourcegroups/${armSegment(name)}?api-version=${RG_API_VERSION}`;
+ return armWrite("PUT", url, { location }, { "If-None-Match": "*" });
+}
+
+/**
+ * List user-assigned managed identities across a subscription (sorted by name).
+ */
+export async function listUserAssignedIdentities(subscriptionId) {
+ const token = await getToken();
+ const url = `https://management.azure.com/subscriptions/${armSegment(subscriptionId)}/providers/Microsoft.ManagedIdentity/userAssignedIdentities?api-version=${MSI_API_VERSION}`;
+ const items = await paginateAll(url, token);
+ return items
+ .map((id) => {
+ const parts = String(id.id).split("/");
+ const rgIdx = parts.findIndex((p) => p.toLowerCase() === "resourcegroups");
+ return {
+ id: id.id,
+ name: id.name,
+ resourceGroup: rgIdx >= 0 ? parts[rgIdx + 1] || "" : "",
+ location: id.location || "",
+ };
+ })
+ .sort((a, b) => a.name.localeCompare(b.name));
+}
+
+/**
+ * Check whether a connector namespace name is free in the given resource group.
+ * Returns true when available (ARM 404), false when taken (200). Uses fetch
+ * directly so the 404 isn't thrown the way armFetch would.
+ */
+export async function checkConnectorGatewayNameAvailable(subscriptionId, resourceGroup, gatewayName) {
+ const token = await getToken();
+ const url = `${buildBaseUrl(subscriptionId, resourceGroup, gatewayName)}?api-version=${API_VERSION}`;
+ const res = await fetch(url, { headers: { Authorization: `Bearer ${token}` } });
+ if (res.status === 404) return true;
+ if (res.ok) return false;
+ const body = await res.text();
+ throw new Error(`ARM ${res.status}: ${body.slice(0, 200)}`);
+}
+
+// ARM `identity` block — mirrors the portal's buildIdentityPayload so the PUT
+// body is always explicit ({ type: "None" } when nothing is configured).
+export function buildGatewayIdentity(enableSystem, userAssignedIds = []) {
+ const hasUser = userAssignedIds.length > 0;
+ const type = enableSystem && hasUser
+ ? "SystemAssigned,UserAssigned"
+ : enableSystem
+ ? "SystemAssigned"
+ : hasUser
+ ? "UserAssigned"
+ : "None";
+ const identity = { type };
+ if (hasUser) {
+ identity.userAssignedIdentities = Object.fromEntries(userAssignedIds.map((id) => [id, {}]));
+ }
+ return identity;
+}
+
+export async function waitForProvisioning(initialResult, gatewayName, fetchLatest, {
+ maxPolls = 60,
+ delay = () => sleep(3000),
+} = {}) {
+ let result = initialResult;
+ let state;
+ for (let poll = 0; poll <= maxPolls; poll++) {
+ state = result?.properties?.provisioningState;
+ if (state === "Succeeded") return result;
+ if (state === "Failed" || state === "Canceled") {
+ throw new Error(`Provisioning ${state} for "${gatewayName}".`);
+ }
+ if (poll === maxPolls) break;
+ await delay();
+ result = await fetchLatest();
+ }
+ throw new Error(`Provisioning timed out for "${gatewayName}" (last state: ${state ?? "unknown"}).`);
+}
+
+/**
+ * Create a connector namespace and poll until the
+ * provisioningState reaches a terminal value. Throws on Failed/Canceled.
+ * Returns the final resource object.
+ */
+export async function createConnectorGateway(subscriptionId, resourceGroup, gatewayName, { location, identity }) {
+ const token = await getToken();
+ const url = `${buildBaseUrl(subscriptionId, resourceGroup, gatewayName)}?api-version=${API_VERSION}`;
+ const body = { location, properties: {}, identity };
+ const result = await armWrite("PUT", url, body, { "If-None-Match": "*" });
+ // ~3 min ceiling (60 * 3s). A 202 may have no body, so every state other
+ // than explicit Succeeded enters the polling path.
+ return waitForProvisioning(result, gatewayName, () => armFetch(url, token));
+}
diff --git a/extensions/connector-namespaces/assets/preview-connected.png b/extensions/connector-namespaces/assets/preview-connected.png
new file mode 100644
index 00000000..4050d878
Binary files /dev/null and b/extensions/connector-namespaces/assets/preview-connected.png differ
diff --git a/extensions/connector-namespaces/assets/preview.png b/extensions/connector-namespaces/assets/preview.png
new file mode 100644
index 00000000..259e2794
Binary files /dev/null and b/extensions/connector-namespaces/assets/preview.png differ
diff --git a/extensions/connector-namespaces/catalog.mjs b/extensions/connector-namespaces/catalog.mjs
new file mode 100644
index 00000000..79f4165c
--- /dev/null
+++ b/extensions/connector-namespaces/catalog.mjs
@@ -0,0 +1,70 @@
+// Catalog — fetches MCP connectors from the gateway.
+//
+// The gateway exposes ~1600 managed APIs (the full Logic Apps connector
+// catalog). MCP servers are a small subset (~43) and there is no `kind` or
+// capability flag that distinguishes them. The only reliable signal is the
+// string "mcp" appearing in the API's name OR its display name — and those are
+// genuinely independent signals: `workiqsharepoint` has no "mcp" in its name
+// (display name "Work IQ SharePoint MCP"), while `hginsightsmcp` has "mcp" in
+// its name but a display name of "HG Insights Connect". Matching either keeps
+// the full set without an allowlist that has to be hand-maintained.
+
+import { listManagedApis } from "./armClient.mjs";
+import { CATEGORY } from "./categories.mjs";
+
+function isMcpServer(api) {
+ const name = api.name || "";
+ const displayName = api.properties?.generalInformation?.displayName || "";
+ return /mcp/i.test(name) || /mcp/i.test(displayName);
+}
+
+// Microsoft first-party servers (a365*/d365*/workiq* names, or a Microsoft-
+// branded display name) group under "Microsoft"; everything else is a partner
+// server. Derived rather than hardcoded so new servers categorize themselves.
+function categoryFor(name, displayName) {
+ const n = (name || "").toLowerCase();
+ const d = (displayName || "").toLowerCase();
+ const isMicrosoft =
+ /^(a365|d365|workiq)/.test(n) ||
+ d.startsWith("microsoft") ||
+ d.startsWith("work iq") ||
+ d.startsWith("dynamics 365");
+ return isMicrosoft ? CATEGORY.microsoft : CATEGORY.partner;
+}
+
+let cachedCatalog = null;
+let cacheKey = null;
+
+export function invalidateCache() {
+ cachedCatalog = null;
+ cacheKey = null;
+}
+
+export async function fetchCatalog(subscriptionId, resourceGroup, gatewayName) {
+ const key = `${subscriptionId}/${resourceGroup}/${gatewayName}`;
+ if (cachedCatalog && cacheKey === key) return cachedCatalog;
+
+ const apis = await listManagedApis(subscriptionId, resourceGroup, gatewayName);
+
+ const catalog = apis
+ .filter(isMcpServer)
+ .map((a) => {
+ const props = a.properties || {};
+ const general = props.generalInformation || {};
+ const metadata = props.metadata || {};
+ const displayName = general.displayName || a.name;
+ return {
+ id: a.name,
+ apiName: a.name,
+ displayName,
+ description: general.description || "",
+ iconUri: general.iconUri || "",
+ brandColor: metadata.brandColor || "",
+ category: categoryFor(a.name, displayName),
+ };
+ });
+
+ cachedCatalog = catalog;
+ cacheKey = key;
+ return catalog;
+}
diff --git a/extensions/connector-namespaces/categories.mjs b/extensions/connector-namespaces/categories.mjs
new file mode 100644
index 00000000..57cd9592
--- /dev/null
+++ b/extensions/connector-namespaces/categories.mjs
@@ -0,0 +1,15 @@
+// Catalog category values.
+//
+// `category` is a routing key, not display text: the renderer partitions catalog
+// items into the Microsoft vs Partners sections by comparing against these exact
+// values (see renderCatalogHtml in renderer.mjs). Kept as a frozen enum here,
+// rather than free-form strings scattered across the producer, renderer, and
+// tests, so the routing contract lives in one place.
+//
+// Zero-dependency on purpose: renderer.mjs imports this, and renderer.test.mjs
+// loads renderer.mjs as a pure string-rendering gate. Sourcing the enum from
+// catalog.mjs instead would drag armClient.mjs (the ARM SDK) into that gate.
+export const CATEGORY = Object.freeze({
+ microsoft: "Microsoft",
+ partner: "Partners",
+});
diff --git a/extensions/connector-namespaces/copilot-extension.json b/extensions/connector-namespaces/copilot-extension.json
new file mode 100644
index 00000000..3949dbe4
--- /dev/null
+++ b/extensions/connector-namespaces/copilot-extension.json
@@ -0,0 +1,4 @@
+{
+ "name": "connector-namespaces",
+ "version": 1
+}
diff --git a/extensions/connector-namespaces/createPage.mjs b/extensions/connector-namespaces/createPage.mjs
new file mode 100644
index 00000000..3eb86659
--- /dev/null
+++ b/extensions/connector-namespaces/createPage.mjs
@@ -0,0 +1,403 @@
+// Renderer for the "Create connector namespace" wizard page. Mirrors the
+// portal's CreateConnectorGatewayPage: subscription -> resource group
+// (existing or new) -> region -> name (live availability) -> managed identity
+// (system + user-assigned) -> real ARM provisioning.
+
+import { baseStyles, brandMark } from "./renderer.mjs";
+
+function esc(s) {
+ return String(s || "").replace(/[&<>"']/g, (c) => ({ "&": "&", "<": "<", ">": ">", '"': """, "'": "'" }[c]));
+}
+
+// Connector namespace regions — kept in sync with the portal's
+// CONNECTOR_NAMESPACE_REGIONS list (constants.ts).
+const REGIONS = [
+ ["australiaeast", "Australia East"], ["brazilsouth", "Brazil South"],
+ ["canadacentral", "Canada Central"], ["canadaeast", "Canada East"],
+ ["centralindia", "Central India"], ["centralus", "Central US"],
+ ["eastasia", "East Asia"], ["eastus", "East US"], ["eastus2", "East US 2"],
+ ["francecentral", "France Central"], ["germanywestcentral", "Germany West Central"],
+ ["italynorth", "Italy North"], ["japaneast", "Japan East"],
+ ["koreacentral", "Korea Central"], ["northcentralus", "North Central US"],
+ ["northeurope", "North Europe"], ["norwayeast", "Norway East"],
+ ["polandcentral", "Poland Central"], ["southafricanorth", "South Africa North"],
+ ["southcentralus", "South Central US"], ["southindia", "South India"],
+ ["southeastasia", "Southeast Asia"], ["spaincentral", "Spain Central"],
+ ["swedencentral", "Sweden Central"], ["switzerlandnorth", "Switzerland North"],
+ ["uaenorth", "UAE North"], ["uksouth", "UK South"],
+ ["westcentralus", "West Central US"], ["westus2", "West US 2"],
+ ["westus3", "West US 3"],
+];
+
+const DEFAULT_REGION = "eastus";
+
+export function renderCreateNamespaceHtml(subscriptions, preselectedSub = "", capabilityToken = "") {
+ const subOptions = subscriptions.map((s) =>
+ ``
+ ).join("");
+
+ const regionOptions = REGIONS.map(([v, l]) =>
+ ``
+ ).join("");
+
+ return `
+
+Canvas structure output
", + "", + "```text", + canvasStructureOutput, + "```", + "", + "
+
+
+${brandMark(28, "create")}Create connector namespace
+Provisions a real Azure connector namespace (Microsoft.Web/connectorGateways) in your subscription.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Pick the resource group the namespace will live in.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+`;
+}
diff --git a/extensions/connector-namespaces/extension.mjs b/extensions/connector-namespaces/extension.mjs
new file mode 100644
index 00000000..fe6f502e
--- /dev/null
+++ b/extensions/connector-namespaces/extension.mjs
@@ -0,0 +1,101 @@
+// Canvas extension entry point — MCP Connectors browser.
+
+import { joinSession, createCanvas } from "@github/copilot-sdk/extension";
+import { getServerConfig, startServer, stopServer } from "./server.mjs";
+import { getSavedConfig, loadSavedConfig, saveConfig } from "./state.mjs";
+import { fetchCatalog } from "./catalog.mjs";
+import { getInstalledState, openInBrowser, setWorkspaceRoot } from "./install.mjs";
+import { buildSandboxUrl, resolveSandboxConnector } from "./sandbox.mjs";
+
+// Load any previously saved connector namespace config on startup
+loadSavedConfig();
+
+async function openPlayground(server, instanceId) {
+ const config = instanceId ? getServerConfig(instanceId) : getSavedConfig();
+ if (!config) return { opened: false, reason: "no_namespace_configured" };
+ const catalog = await fetchCatalog(config.subscriptionId, config.resourceGroup, config.gatewayName);
+ const installedState = await getInstalledState(config);
+ const resolved = resolveSandboxConnector(catalog, installedState, server);
+ if (!resolved.connector) return { opened: false, ...resolved };
+ const url = buildSandboxUrl(config, resolved.connector.id);
+ await openInBrowser(url);
+ return { opened: true, server: resolved.connector, url };
+}
+
+const session = await joinSession({
+ tools: [
+ {
+ name: "connector_namespaces_open_playground",
+ description: "Open a named connector from My MCPs in the Azure Connector Namespace playground.",
+ parameters: {
+ type: "object",
+ properties: {
+ server: {
+ type: "string",
+ description: "Connector display name or server ID from My MCPs",
+ },
+ },
+ required: ["server"],
+ },
+ handler: async ({ server }) => JSON.stringify(await openPlayground(server)),
+ },
+ ],
+ canvases: [
+ createCanvas({
+ id: "connector-namespaces",
+ displayName: "MCP Connectors",
+ description: "Browse, connect, and open MCP connectors in the Azure Connector Namespace Sandbox.",
+ inputSchema: {
+ type: "object",
+ properties: {
+ subscriptionId: { type: "string", description: "Azure subscription ID (optional \u2014 if omitted, uses saved config or shows picker)" },
+ resourceGroup: { type: "string", description: "Resource group name" },
+ gatewayName: { type: "string", description: "Connector namespace name" },
+ },
+ },
+ actions: [
+ {
+ name: "open_sandbox",
+ description: "Open a named connector from My MCPs in the Azure Connector Namespace Sandbox",
+ inputSchema: {
+ type: "object",
+ properties: {
+ server: {
+ type: "string",
+ description: "Connector display name or server ID from My MCPs",
+ },
+ },
+ required: ["server"],
+ },
+ handler: async (ctx) => openPlayground(ctx.input.server, ctx.instanceId),
+ },
+ ],
+ open: async (ctx) => {
+ let config;
+ // If explicit input provided, use it and save for future
+ if (ctx.input && ctx.input.subscriptionId && ctx.input.resourceGroup && ctx.input.gatewayName) {
+ config = {
+ subscriptionId: ctx.input.subscriptionId,
+ resourceGroup: ctx.input.resourceGroup,
+ gatewayName: ctx.input.gatewayName,
+ };
+ saveConfig(config);
+ }
+ // A saved config seeds a new panel only. Rehydrating an existing
+ // panel keeps its active namespace even if another panel changed
+ // the persisted default.
+ const entry = await startServer(
+ ctx.instanceId,
+ config ? { config } : { defaultConfig: getSavedConfig() },
+ );
+ return { title: "MCP Connectors", url: entry.url };
+ },
+ onClose: async (ctx) => {
+ await stopServer(ctx.instanceId);
+ },
+ }),
+ ],
+});
+
+// Tell the install pipeline where the workspace .mcp.json lives (if any).
+setWorkspaceRoot(session.workspacePath);
diff --git a/extensions/connector-namespaces/install.mjs b/extensions/connector-namespaces/install.mjs
new file mode 100644
index 00000000..74264d6f
--- /dev/null
+++ b/extensions/connector-namespaces/install.mjs
@@ -0,0 +1,1007 @@
+// Install flow — creates connection, handles OAuth, creates MCP server config,
+// mints API key, and writes to ~/.copilot/mcp-config.json.
+
+import { promises as fs } from "node:fs";
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { homedir, platform } from "node:os";
+import { dirname, join } from "node:path";
+import { getToken, assertArmHost, armSegment, resolveSystemExecutable } from "./armClient.mjs";
+
+const COPILOT_HOME = process.env.COPILOT_HOME || join(homedir(), ".copilot");
+
+// Two scopes the Copilot CLI reads MCP servers from:
+// profile -> ~/.copilot/mcp-config.json (private, follows you everywhere)
+// workspace ->
+
+${notice ? `${brandMark(30, "setup")}Select a Connector Namespace
+Choose which connector namespace to browse. This choice is saved for future sessions.
+${esc(notice)}
` : ""}
+
+
+
+
+
+
+
+
+
+
+`;
+}
+
+// ---------------------------------------------------------------------------
+// Catalog
+// ---------------------------------------------------------------------------
+
+const CSS_HEX_COLOR = /^#[0-9a-fA-F]{6}$/;
+
+function iconBackgroundStyle(brandColor) {
+ const color = String(brandColor || "").trim();
+ return CSS_HEX_COLOR.test(color) ? ` style="background:${color}22"` : "";
+}
+
+export function renderCatalogHtml(instanceId, catalog, { filter, category, source, config }, capabilityToken = "") {
+ const renderItem = (c) => {
+ // Items carry their home grid so hydrateState can move them into
+ // "My MCPs" when added and back to Microsoft/Partner on remove.
+ const home = c.category === CATEGORY.microsoft ? "microsoft" : "partner";
+ const icon = c.iconUri
+ ? `Select a subscription to see available connector namespaces.
+${icon}${btn}
`;
+ };
+
+ const byName = (a, b) => a.displayName.localeCompare(b.displayName);
+ const microsoft = catalog.filter((c) => c.category === CATEGORY.microsoft).sort(byName);
+ const partner = catalog.filter((c) => c.category !== CATEGORY.microsoft).sort(byName);
+
+ const section = (key, title, rows, { collapsed, hidden }) => {
+ const cls = ["section", "collapsible"];
+ if (collapsed) cls.push("collapsed");
+ if (hidden) cls.push("is-hidden");
+ const n = rows.length;
+ return `${esc(c.displayName)}
${esc(c.description)}
`
+ + ``
+ + `
`;
+ };
+
+ // Server paints the first-run layout: My MCPs hidden+empty (filled by
+ // hydrateState), Microsoft expanded so there's something to browse, Partner
+ // collapsed. updateSections() flips to the steady layout on the first hydrate
+ // if anything is already added.
+ let sectionsHtml =
+ section("mine", "My MCPs", [], { collapsed: false, hidden: true }) +
+ section("microsoft", "Microsoft", microsoft, { collapsed: false, hidden: microsoft.length === 0 }) +
+ section("partner", "Partners", partner, { collapsed: true, hidden: partner.length === 0 });
+
+ if (!catalog.length) {
+ sectionsHtml = `${rows.map(renderItem).join("")}
`
+ + `No connectors available.
`;
+ }
+
+ return `
+
+
+
+
+
+ ${brandMark(24, "cat")}Connectors
+Namespace
+ ${esc(config.gatewayName)} · RG ${esc(config.resourceGroup)}
+
+
+
+
+
+
+
+
+
+${sectionsHtml}
+
+`;
+}
+
+// ---------------------------------------------------------------------------
+// Error
+// ---------------------------------------------------------------------------
+
+export function renderErrorHtml(message) {
+ return `
+Error
${esc(message)}
+`;
+}
+
+// ---------------------------------------------------------------------------
+function esc(s) {
+ return String(s ?? "").replace(/[&<>"']/g, (c) => ({"&":"&","<":"<",">":">",'"':""","'":"'"}[c]));
+}
diff --git a/extensions/connector-namespaces/renderer.test.mjs b/extensions/connector-namespaces/renderer.test.mjs
new file mode 100644
index 00000000..d0c464e4
--- /dev/null
+++ b/extensions/connector-namespaces/renderer.test.mjs
@@ -0,0 +1,393 @@
+// Regression guards for the connector-catalog renderer.
+//
+// Run: node --test extensions/connector-namespaces/renderer.test.mjs
+//
+// These tests exist because two UX bugs kept coming back:
+// 1. A `@media (prefers-reduced-motion: reduce)` rule froze functional
+// loaders without a visible fallback. Reduced motion now stops the
+// animation while forcing each loader into a visible static busy state;
+// nearby text continues to communicate progress.
+// 2. The "Restart your Copilot session" banner ignoring Dismiss. The real
+// root cause was CSS specificity: `.restart-banner{display:flex}` is an
+// author rule with the same (0,1,0) specificity as the UA
+// `[hidden]{display:none}` rule, so it overrode the hidden attribute and
+// `restartBanner.hidden=true` did nothing. The fix is a global
+// `[hidden]{display:none !important}` reset. A client-side
+// `restartDismissed` flag also keeps a late hydrateState() from re-showing
+// it. The guards below fail if either the CSS reset or the JS gate
+// disappears.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+import { baseStyles, renderCatalogHtml, renderSetupHtml } from "./renderer.mjs";
+import { renderCreateNamespaceHtml } from "./createPage.mjs";
+import { CATEGORY } from "./categories.mjs";
+
+// Pull the balanced body of the prefers-reduced-motion media block out of a
+// stylesheet string (non-greedy regex can't handle the nested rule braces).
+// CSS comments are stripped so the guards test declarations rather than prose.
+function reducedMotionBlock(css) {
+ const start = css.indexOf("@media (prefers-reduced-motion: reduce)");
+ if (start === -1) return null;
+ const open = css.indexOf("{", start);
+ if (open === -1) return null;
+ let depth = 0;
+ for (let i = open; i < css.length; i++) {
+ if (css[i] === "{") depth++;
+ else if (css[i] === "}" && --depth === 0) {
+ return css.slice(open + 1, i).replace(/\/\*[\s\S]*?\*\//g, "");
+ }
+ }
+ return null;
+}
+
+function catalogHtml() {
+ return renderCatalogHtml("test-instance", [], {
+ filter: "",
+ category: "all",
+ source: "",
+ config: { subscriptionId: "sub", gatewayName: "ns", resourceGroup: "rg" },
+ });
+}
+
+test("setup subscription label names its select", () => {
+ const html = renderSetupHtml([], "", "token");
+ assert.match(html, /