From e3fa3211f6e993f016eb327794c36b95a2ba7901 Mon Sep 17 00:00:00 2001 From: Augustin Popa Date: Wed, 15 Jul 2026 09:16:23 -0700 Subject: [PATCH 01/79] Added vcpkg skill --- skills/vcpkg/SKILL.md | 283 +++++++++++++++++++++ skills/vcpkg/references/ci.md | 96 +++++++ skills/vcpkg/references/registries.md | 133 ++++++++++ skills/vcpkg/references/troubleshooting.md | 94 +++++++ 4 files changed, 606 insertions(+) create mode 100644 skills/vcpkg/SKILL.md create mode 100644 skills/vcpkg/references/ci.md create mode 100644 skills/vcpkg/references/registries.md create mode 100644 skills/vcpkg/references/troubleshooting.md diff --git a/skills/vcpkg/SKILL.md b/skills/vcpkg/SKILL.md new file mode 100644 index 00000000..8fe2eaa4 --- /dev/null +++ b/skills/vcpkg/SKILL.md @@ -0,0 +1,283 @@ +--- +name: vcpkg +description: Guide for setting up vcpkg in C++ projects, managing dependency versions, and cross-compiling. Covers manifest initialization, CMake and Visual Studio integration, classic-to-manifest migration, version pinning, baselines, overrides, triplets, and cross-compilation. Use when a user is working with vcpkg project setup, installation, version management, or cross-platform builds. For specialized tasks, additional references cover custom registries and overlay ports (references/registries.md), CI/CD and binary caching (references/ci.md), and troubleshooting and dependency lifecycle (references/troubleshooting.md). +--- + +You are a vcpkg expert assistant. When a user asks about vcpkg (Microsoft's C/C++ package manager), use the precise information below to give accurate, complete answers. + +## Additional References (load on demand) + +The information below covers core vcpkg setup, installation, version management, and cross-platform builds. For specialized tasks, consult the following reference files (read them only when the user's request calls for that topic): + +- **`references/registries.md`** — Custom/private registries, overlay ports, private package feeds, `vcpkg-configuration.json`, and default features. Read this when the user asks about custom registries, overlay ports, or private package sources. +- **`references/ci.md`** — CI/CD integration: binary caching (Azure Blob, GitHub Packages/NuGet, local), SBOM generation, automating dependency updates, and multi-triplet CI matrices. Read this when the user asks about GitHub Actions, Azure DevOps, binary caches, or CI optimization. +- **`references/troubleshooting.md`** — Reading build logs, resolving package-not-found errors, and the dependency lifecycle (removing, changing features, replacing libraries, cleaning the cache). Read this when the user encounters vcpkg errors, build failures, or configuration problems. + +## Important Behavioral Rules + +### Classic vs. Manifest Mode + +If it is not clear from the user's project context whether they are using **classic mode** (global `vcpkg install` commands) or **manifest mode** (per-project `vcpkg.json`), **ask the user which mode they are using** before providing instructions. Do not assume one or the other. + +If the user is unsure which to choose, **recommend manifest mode**. Manifest mode is the preferred modern workflow because it: +- Tracks dependencies per-project (not globally) +- Supports version constraints and overrides +- Enables reproducible builds via `builtin-baseline` +- Works seamlessly with CI/CD (dependencies restore automatically) +- Supports features like dev-only dependencies, overlay ports, and custom registries + +Classic mode is simpler for quick one-off installs but lacks version pinning, per-project isolation, and reproducibility. + +### Visual Studio Environment + +If the user is working inside **Visual Studio** (not VS Code), prefer using the **in-box copy of vcpkg that ships with Visual Studio** rather than a standalone vcpkg clone, unless the user indicates they want to use a different installation. The VS-bundled vcpkg: +- Is located under the Visual Studio installation directory (e.g., `C:\Program Files\Microsoft Visual Studio\\\VC\vcpkg\`) +- Is automatically integrated with MSBuild — no need to run `vcpkg integrate install` +- Stays up-to-date with Visual Studio updates +- Works out of the box with CMake projects opened via "Open Folder" or CMake presets + +If the user has a standalone vcpkg installation and prefers to use that instead, respect their preference. + +--- + +## Project Setup + +### Initializing vcpkg in a New Project (Manifest Mode) + +1. Create `vcpkg.json` in your project root: +```json +{ + "name": "my-project", + "version": "1.0.0", + "dependencies": [] +} +``` + +2. Wire into CMakeLists.txt: +```cmake +cmake_minimum_required(VERSION 3.21) +project(my-project) + +find_package(fmt CONFIG REQUIRED) +target_link_libraries(my-app PRIVATE fmt::fmt) +``` + +3. Configure with vcpkg toolchain: +``` +cmake -B build -DCMAKE_TOOLCHAIN_FILE=/scripts/buildsystems/vcpkg.cmake +``` + +### Adding vcpkg to an Existing Visual Studio Solution + +1. Run `vcpkg integrate install` (one-time, system-wide) +2. Create `vcpkg.json` in the solution directory +3. In VS, the integration is automatic via MSBuild props — no project file edits needed +4. Or per-project: add to `.vcxproj`: +```xml + + +``` + +### Classic-to-Manifest Migration + +1. List what's currently installed: `vcpkg list` +2. Create `vcpkg.json` with those dependencies +3. Delete global installs: `vcpkg remove --outdated --recurse` +4. Run `vcpkg install` in your project directory — manifest mode takes precedence +5. Update your build system to use `CMAKE_TOOLCHAIN_FILE` if not already + +--- + +## Installing Dependencies + +### Installing with Features (e.g., curl with SSL + HTTP2) + +In **manifest mode** (`vcpkg.json`), specify features in the dependencies array: +```json +{ + "dependencies": [ + { + "name": "curl", + "features": ["ssl", "http2"] + } + ] +} +``` + +In **classic mode**, use bracket syntax on the command line: +``` +vcpkg install curl[ssl,http2] +``` + +To discover available features for any port: +``` +vcpkg search curl +``` +Or check the port's `vcpkg.json` in the registry: `ports/curl/vcpkg.json` → look at the `"features"` object. + +### Installing for a Specific Triplet + +``` +vcpkg install zlib:x64-linux +vcpkg install zlib:x64-windows +vcpkg install zlib:arm64-windows +``` + +In manifest mode, set the triplet via CMake: +``` +cmake -B build -DVCPKG_TARGET_TRIPLET=x64-linux -DCMAKE_TOOLCHAIN_FILE=[vcpkg root]/scripts/buildsystems/vcpkg.cmake +``` + +Or set the environment variable: +``` +set VCPKG_DEFAULT_TRIPLET=x64-linux +``` + +### Bulk-Adding Multiple Dependencies + +In `vcpkg.json`, list them in the dependencies array: +```json +{ + "dependencies": ["catch2", "cxxopts", "toml11"] +} +``` + +In classic mode: +``` +vcpkg install catch2 cxxopts toml11 +``` + +Then run `vcpkg install` (manifest mode) or the above command to install all at once. + +### Dev-Only Dependencies + +Use the `"host"` field or place test dependencies under a feature: +```json +{ + "dependencies": [ + "fmt", + "spdlog" + ], + "features": { + "tests": { + "description": "Build tests", + "dependencies": ["gtest"] + } + } +} +``` + +Activate with: `vcpkg install --x-feature=tests` or in CMake: `-DVCPKG_MANIFEST_FEATURES=tests` + +--- + +## Version Management + +### Pinning a Specific Version + +In `vcpkg.json`, use `"version>="` with overrides: +```json +{ + "dependencies": ["fmt"], + "overrides": [ + { + "name": "fmt", + "version": "10.2.0" + } + ], + "builtin-baseline": "" +} +``` + +The `builtin-baseline` is **required** when using versioning. Get the latest baseline: +``` +git -C rev-parse HEAD +``` + +### Version Overrides + +To force a specific version of a transitive dependency across your entire project, use `"overrides"` in `vcpkg.json`: +```json +{ + "dependencies": ["protobuf", "grpc"], + "overrides": [ + { + "name": "zlib", + "version": "1.3.1" + } + ], + "builtin-baseline": "" +} +``` + +**Key points:** +- `overrides` takes precedence over all version constraints, including transitive ones +- You **must** have a `builtin-baseline` set for overrides to work +- The version must exist in the vcpkg registry at or after the baseline commit +- Use `vcpkg x-history zlib` to see available versions + +### Updating the Baseline + +The baseline is a Git commit SHA in the vcpkg repository that pins all port versions: +```json +{ + "builtin-baseline": "a1b2c3d4e5f6..." +} +``` + +To update to the latest: +```bash +cd +git pull +git rev-parse HEAD +``` +Then paste the new SHA into `builtin-baseline`. + +**Important:** Updating the baseline may change versions of *all* dependencies. Use `overrides` to pin specific packages if needed. + +--- + +## Cross-Platform + +### Cross-Compiling for arm64 + +``` +vcpkg install :arm64-linux +``` + +Or set the triplet in CMake: +``` +cmake -B build -DVCPKG_TARGET_TRIPLET=arm64-linux -DCMAKE_TOOLCHAIN_FILE=$VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake +``` + +You may need a cross-compilation toolchain installed (e.g., `aarch64-linux-gnu-gcc`). + +For **arm64-windows**, just use the triplet directly — no cross-compiler needed on ARM64 Windows or with MSVC: +``` +vcpkg install :arm64-windows +``` + +### Building for Android (NDK) + +1. Set environment variables: +```bash +export ANDROID_NDK_HOME=/path/to/ndk +export VCPKG_DEFAULT_TRIPLET=arm64-android +``` + +2. Install packages: +``` +vcpkg install :arm64-android +``` + +Available Android triplets: `arm-neon-android`, `arm64-android`, `x86-android`, `x64-android` + +3. In CMake: +``` +cmake -B build \ + -DCMAKE_TOOLCHAIN_FILE=$VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake \ + -DVCPKG_TARGET_TRIPLET=arm64-android \ + -DVCPKG_CHAINLOAD_TOOLCHAIN_FILE=$ANDROID_NDK_HOME/build/cmake/android.toolchain.cmake \ + -DANDROID_ABI=arm64-v8a \ + -DANDROID_PLATFORM=android-24 +``` diff --git a/skills/vcpkg/references/ci.md b/skills/vcpkg/references/ci.md new file mode 100644 index 00000000..39b24782 --- /dev/null +++ b/skills/vcpkg/references/ci.md @@ -0,0 +1,96 @@ +# vcpkg: CI/CD & DevOps + +Reference for the `vcpkg` skill. Use this when a user asks about using vcpkg in CI/CD pipelines, configuring binary caching, setting up devcontainers, generating SBOMs, or automating dependency updates (GitHub Actions, Azure DevOps, binary cache configuration, CI optimization). + +## Binary Caching + +Configure binary caching to avoid rebuilding packages: + +**Azure Blob Storage:** +``` +set VCPKG_BINARY_SOURCES=clear;x-azblob,https://myaccount.blob.core.windows.net/vcpkg-cache,,readwrite +``` + +**GitHub Packages (NuGet):** +``` +set VCPKG_BINARY_SOURCES=clear;nuget,https://nuget.pkg.github.com/your-org/index.json,readwrite +``` + +**Local filesystem:** +``` +set VCPKG_BINARY_SOURCES=clear;files,C:/vcpkg-cache,readwrite +``` + +**Sharing between CI and local dev:** Use the same remote cache (Azure Blob or NuGet feed) in both environments. CI writes (`readwrite`), developers read (`read`): +``` +# CI (writes cache) +set VCPKG_BINARY_SOURCES=clear;x-azblob,https://myaccount.blob.core.windows.net/cache,,readwrite + +# Developer (reads cache) +set VCPKG_BINARY_SOURCES=clear;x-azblob,https://myaccount.blob.core.windows.net/cache,,read +``` + +--- + +## Generating an SBOM (Software Bill of Materials) + +vcpkg can generate an SBOM in SPDX format: +``` +vcpkg install --x-write-nuget-packages-config=packages.config +``` + +For manifest mode, after install check `vcpkg_installed//share/` for SPDX files. Each installed port generates an SPDX JSON document at: +``` +vcpkg_installed//share//sbom.spdx.json +``` + +To aggregate: use `vcpkg x-package-info --x-installed` to list all packages and versions, then feed into your SBOM toolchain (e.g., Microsoft SBOM Tool, CycloneDX). + +--- + +## Automating Dependency Updates + +Option 1: **Dependabot** (GitHub) — configure `.github/dependabot.yml`: +```yaml +version: 2 +updates: + - package-ecosystem: "vcpkg" + directory: "/" + schedule: + interval: "weekly" +``` + +Option 2: **Script-based** — create a scheduled CI job that: +1. Updates the vcpkg clone (`git pull`) +2. Gets the new baseline (`git rev-parse HEAD`) +3. Updates `builtin-baseline` in `vcpkg.json` +4. Runs `vcpkg install` to verify +5. Opens a PR with the changes + +--- + +## Multi-Triplet CI Testing + +Test across multiple triplets in a CI matrix: +```yaml +# GitHub Actions example +strategy: + matrix: + triplet: [x64-windows, x64-linux, x64-osx] + include: + - triplet: x64-windows + os: windows-latest + - triplet: x64-linux + os: ubuntu-latest + - triplet: x64-osx + os: macos-latest + +steps: + - uses: actions/checkout@v4 + - name: Install vcpkg + run: | + git clone https://github.com/microsoft/vcpkg + ./vcpkg/bootstrap-vcpkg.sh + - name: Install dependencies + run: vcpkg install --triplet ${{ matrix.triplet }} +``` diff --git a/skills/vcpkg/references/registries.md b/skills/vcpkg/references/registries.md new file mode 100644 index 00000000..61a5fa37 --- /dev/null +++ b/skills/vcpkg/references/registries.md @@ -0,0 +1,133 @@ +# vcpkg: Custom Registries & Overlay Ports + +Reference for the `vcpkg` skill. Use this when a user asks about creating or configuring custom registries, creating overlay ports, using private package feeds, or configuring `vcpkg-configuration.json` registries. + +## Private / Custom Registry Install + +1. Create `vcpkg-configuration.json` alongside your `vcpkg.json`: +```json +{ + "registries": [ + { + "kind": "git", + "repository": "https://github.com/your-org/vcpkg-registry", + "baseline": "", + "packages": ["company-utils", "internal-lib"] + } + ], + "default-registry": { + "kind": "builtin", + "baseline": "" + } +} +``` + +2. Then add the dependency normally in `vcpkg.json`: +```json +{ + "dependencies": ["company-utils"] +} +``` + +The `"packages"` array in the registry entry controls which packages are resolved from that registry. Packages not listed fall through to `default-registry`. + +--- + +## Configuring Registries in `vcpkg-configuration.json` + +```json +{ + "default-registry": { + "kind": "builtin", + "baseline": "" + }, + "registries": [ + { + "kind": "git", + "repository": "https://github.com/your-org/vcpkg-registry.git", + "baseline": "", + "packages": ["your-package-1", "your-package-2"] + } + ] +} +``` + +Place this file next to `vcpkg.json` in your project root. + +--- + +## Creating an Overlay Port + +An overlay port overrides or adds a port locally. Directory structure: +``` +my-overlays/ + telemetry-sdk/ + portfile.cmake + vcpkg.json +``` + +**`vcpkg.json`** (port metadata): +```json +{ + "name": "telemetry-sdk", + "version": "1.0.0", + "description": "Internal telemetry SDK", + "dependencies": ["curl", "nlohmann-json"] +} +``` + +**`portfile.cmake`** (build instructions): +```cmake +vcpkg_from_github( + OUT_SOURCE_PATH SOURCE_PATH + REPO your-org/telemetry-sdk + REF v1.0.0 + SHA512 +) + +vcpkg_cmake_configure(SOURCE_PATH "${SOURCE_PATH}") +vcpkg_cmake_install() +vcpkg_cmake_config_fixup() + +file(REMOVE_RECURSE "${CURRENT_PACKAGES_DIR}/debug/include") +vcpkg_install_copyright(FILE_LIST "${SOURCE_PATH}/LICENSE") +``` + +Use it: `vcpkg install telemetry-sdk --overlay-ports=./my-overlays` +Or in `vcpkg-configuration.json`: +```json +{ + "overlay-ports": ["./my-overlays"] +} +``` + +--- + +## Default Features + +Set default features in `vcpkg.json` for a port so they're always enabled: +```json +{ + "dependencies": [ + { + "name": "curl", + "default-features": true, + "features": ["ssl", "http2"] + } + ] +} +``` + +To **disable** default features: `"default-features": false` + +In a portfile's `vcpkg.json`, default features are listed under: +```json +{ + "name": "curl", + "default-features": ["ssl", "http2"], + "features": { + "ssl": { "description": "SSL/TLS support" }, + "http2": { "description": "HTTP/2 support" } + } +} +``` diff --git a/skills/vcpkg/references/troubleshooting.md b/skills/vcpkg/references/troubleshooting.md new file mode 100644 index 00000000..664eb8d0 --- /dev/null +++ b/skills/vcpkg/references/troubleshooting.md @@ -0,0 +1,94 @@ +# vcpkg: Troubleshooting & Dependency Lifecycle + +Reference for the `vcpkg` skill. Use this when a user encounters vcpkg build failures, package-not-found errors, needs to read build logs, or manages the dependency lifecycle (removing, changing features, replacing libraries, cleaning the cache). + +## Reading vcpkg Build Logs + +Build logs are stored at: +``` +/buildtrees// +``` + +Key log files: +- `config--out.log` — CMake configure output +- `build--out.log` — Build (compile) output +- `install--out.log` — Install step output +- `config--err.log` — CMake configure errors +- `build--err.log` — Build errors +- `package--out.log` — Packaging output + +When a build fails, vcpkg prints the path to the relevant log. Start with the `-err.log` file for the failing step. + +--- + +## Resolving package-not-found After Install + +If CMake says `Could not find a package configuration file provided by "X"`: + +1. **Check toolchain file** — ensure `-DCMAKE_TOOLCHAIN_FILE=/scripts/buildsystems/vcpkg.cmake` is set +2. **Check triplet match** — the installed triplet must match your build architecture +3. **Check package name** — vcpkg port names may differ from CMake package names (e.g., port `nlohmann-json` → `find_package(nlohmann_json)`) +4. **Check installed list** — run `vcpkg list` to confirm the package is actually installed +5. **Clear CMake cache** — delete `CMakeCache.txt` and reconfigure + +--- + +## Dependency Lifecycle + +### Removing a Library + +1. Remove it from `vcpkg.json` → `"dependencies"` array +2. Run `vcpkg install` to reconcile (manifest mode auto-removes unused packages) + +In classic mode: +``` +vcpkg remove boost-regex +vcpkg remove boost-regex --recurse # also removes dependents +``` + +### Changing Features on an Installed Library + +Update the features in `vcpkg.json`: +```json +{ + "dependencies": [ + { + "name": "curl", + "features": ["ssl", "ssh"] + } + ] +} +``` + +Then run `vcpkg install` — vcpkg will detect the feature change and rebuild. + +In classic mode: +``` +vcpkg install curl[ssl,ssh] # reinstalls with new features +``` + +### Replacing One Library with Another + +1. Remove the old library from `vcpkg.json` +2. Add the new library to `vcpkg.json` +3. Run `vcpkg install` to reconcile +4. Update your source code: change `#include` directives, `find_package()` calls, and `target_link_libraries()` in CMakeLists.txt + +### Cleaning the vcpkg Cache + +```bash +# Remove build trees (intermediate build files) +rm -rf /buildtrees + +# Remove downloaded archives +rm -rf /downloads + +# Remove installed packages (classic mode only) +rm -rf /installed + +# Remove all package build artifacts +vcpkg x-clean + +# In manifest mode, remove the local vcpkg_installed directory +rm -rf vcpkg_installed/ +``` From 8fc954300620717dd5e30e095cdc5ee72c626113 Mon Sep 17 00:00:00 2001 From: Augustin Popa Date: Wed, 15 Jul 2026 09:20:10 -0700 Subject: [PATCH 02/79] vcpkg skill automated README update --- docs/README.skills.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/README.skills.md b/docs/README.skills.md index 63ddc1e5..0da5f9e5 100644 --- a/docs/README.skills.md +++ b/docs/README.skills.md @@ -390,6 +390,7 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-skills) for guidelines on how to | [update-markdown-file-index](../skills/update-markdown-file-index/SKILL.md)
`gh skills install github/awesome-copilot update-markdown-file-index` | Update a markdown file section with an index/table of files from a specified folder. | None | | [update-specification](../skills/update-specification/SKILL.md)
`gh skills install github/awesome-copilot update-specification` | Update an existing specification file for the solution, optimized for Generative AI consumption based on new requirements or updates to any existing code. | None | | [vardoger-analyze](../skills/vardoger-analyze/SKILL.md)
`gh skills install github/awesome-copilot vardoger-analyze` | Use when the user asks to personalize the GitHub Copilot CLI assistant, adapt Copilot to their style, use vardoger, or analyze their Copilot CLI conversation history. Reads the local session directory at `~/.copilot/session-state/`, extracts recurring preferences and conventions, and writes a fenced personalization block into `~/.copilot/copilot-instructions.md`. Runs entirely on the user's machine via the local `vardoger` CLI (`pipx install vardoger`); no network calls and no uploads. Triggers: 'personalize my copilot', 'analyze my copilot history', 'tailor copilot to me', 'run vardoger', 'update my copilot instructions from history', 'make copilot learn my style'. | None | +| [vcpkg](../skills/vcpkg/SKILL.md)
`gh skills install github/awesome-copilot vcpkg` | Guide for setting up vcpkg in C++ projects, managing dependency versions, and cross-compiling. Covers manifest initialization, CMake and Visual Studio integration, classic-to-manifest migration, version pinning, baselines, overrides, triplets, and cross-compilation. Use when a user is working with vcpkg project setup, installation, version management, or cross-platform builds. For specialized tasks, additional references cover custom registries and overlay ports (references/registries.md), CI/CD and binary caching (references/ci.md), and troubleshooting and dependency lifecycle (references/troubleshooting.md). | `references/ci.md`
`references/registries.md`
`references/troubleshooting.md` | | [vscode-ext-commands](../skills/vscode-ext-commands/SKILL.md)
`gh skills install github/awesome-copilot vscode-ext-commands` | Guidelines for contributing commands in VS Code extensions. Indicates naming convention, visibility, localization and other relevant attributes, following VS Code extension development guidelines, libraries and good practices | None | | [vscode-ext-localization](../skills/vscode-ext-localization/SKILL.md)
`gh skills install github/awesome-copilot vscode-ext-localization` | Guidelines for proper localization of VS Code extensions, following VS Code extension development guidelines, libraries and good practices | None | | [web-design-reviewer](../skills/web-design-reviewer/SKILL.md)
`gh skills install github/awesome-copilot web-design-reviewer` | This skill enables visual inspection of websites running locally or remotely to identify and fix design issues. Triggers on requests like "review website design", "check the UI", "fix the layout", "find design problems". Detects issues with responsive design, accessibility, visual consistency, and layout breakage, then performs fixes at the source code level. | `references/framework-fixes.md`
`references/visual-checklist.md` | From 9f5fa0e14eb24ba57998ced0ba6af5e27de7a606 Mon Sep 17 00:00:00 2001 From: Suren K Date: Wed, 15 Jul 2026 13:18:45 -0500 Subject: [PATCH 03/79] feat(cookbook): add Copilot SDK Java Examples to community samples. Add a web-based Java community sample to cookbook.yml under the Community Samples section, linking to thesurenk/github-copilot-java-examples. --- cookbook/cookbook.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/cookbook/cookbook.yml b/cookbook/cookbook.yml index 0134ebb7..cc1542d9 100644 --- a/cookbook/cookbook.yml +++ b/cookbook/cookbook.yml @@ -103,3 +103,17 @@ cookbooks: - copilot-sdk - web-app - community + - id: copilot-sdk-java-examples + name: Copilot SDK Java Examples + description: A web-based chat application built with the GitHub Copilot Java SDK, Jetty, with auth status, JSON API, chat, and CLI connectivity examples + external: true + url: https://github.com/thesurenk/github-copilot-java-examples + author: + name: thesurenk + url: https://github.com/thesurenk + tags: + - java + - copilot-sdk + - web-app + - cli + - community From 760d36ca1c836de3160463e0a630b2033e33f1b6 Mon Sep 17 00:00:00 2001 From: "allcontributors[bot]" <46447321+allcontributors[bot]@users.noreply.github.com> Date: Wed, 15 Jul 2026 18:25:50 +0000 Subject: [PATCH 04/79] update README.md --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index fde29411..1f3a7094 100644 --- a/README.md +++ b/README.md @@ -541,6 +541,7 @@ Thanks goes to these wonderful people ([emoji key](./CONTRIBUTING.md#contributor
Lovy Jain
kimtth
Akash Dwivedi +
Suren K From 95263d3a2aa0b009ea0b9ae7a3043ce836bf0429 Mon Sep 17 00:00:00 2001 From: "allcontributors[bot]" <46447321+allcontributors[bot]@users.noreply.github.com> Date: Wed, 15 Jul 2026 18:25:53 +0000 Subject: [PATCH 05/79] update .all-contributorsrc --- .all-contributorsrc | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.all-contributorsrc b/.all-contributorsrc index bf2e668c..53f76239 100644 --- a/.all-contributorsrc +++ b/.all-contributorsrc @@ -3569,6 +3569,15 @@ "contributions": [ "content" ] + }, + { + "login": "thesurenk", + "name": "Suren K", + "avatar_url": "https://avatars.githubusercontent.com/u/902972?v=4", + "profile": "https://surenk.com", + "contributions": [ + "doc" + ] } ] } From 322fe74b64e8bd6286e72b04911e554e222a1c9c Mon Sep 17 00:00:00 2001 From: "allcontributors[bot]" <46447321+allcontributors[bot]@users.noreply.github.com> Date: Wed, 15 Jul 2026 18:26:04 +0000 Subject: [PATCH 06/79] update website/src/pages/contributors.astro --- website/src/pages/contributors.astro | 1 + 1 file changed, 1 insertion(+) diff --git a/website/src/pages/contributors.astro b/website/src/pages/contributors.astro index d4c49f62..0608b772 100644 --- a/website/src/pages/contributors.astro +++ b/website/src/pages/contributors.astro @@ -496,6 +496,7 @@ import PageHeader from '../components/PageHeader.astro';
Lovy Jain
kimtth
Akash Dwivedi +
Suren K From 822a551eaf80f6a8e9de8bb19d02f0d0b60ae842 Mon Sep 17 00:00:00 2001 From: Suren K Date: Wed, 15 Jul 2026 16:28:53 -0500 Subject: [PATCH 07/79] feat(skills): add java-helidon skill for Helidon 4 best practices Add a skill covering Helidon SE and MP patterns, Helidon 3 to 4 API migration guidance, and examples for HTTP, service, data, testing, security and observability in Java 21+ projects. --- docs/README.skills.md | 1 + skills/java-helidon/SKILL.md | 435 +++++++++++++++++++++++++++++++++++ 2 files changed, 436 insertions(+) create mode 100644 skills/java-helidon/SKILL.md diff --git a/docs/README.skills.md b/docs/README.skills.md index fbae0282..d85dfcee 100644 --- a/docs/README.skills.md +++ b/docs/README.skills.md @@ -220,6 +220,7 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-skills) for guidelines on how to | [issue-fields-migration](../skills/issue-fields-migration/SKILL.md)
`gh skills install github/awesome-copilot issue-fields-migration` | Bulk-migrate metadata to GitHub issue fields from two sources: repo labels (e.g. priority labels to a Priority field) and Project V2 fields. Use when users say "migrate my labels to issue fields", "migrate project fields to issue fields", "convert labels to issue fields", "copy project field values to issue fields", or ask about adopting issue fields. Issue fields are org-level typed metadata (single select, text, number, date) that replace label-based workarounds with structured, searchable, cross-repo fields. | `references/issue-fields-api.md`
`references/labels-api.md`
`references/projects-api.md` | | [java-add-graalvm-native-image-support](../skills/java-add-graalvm-native-image-support/SKILL.md)
`gh skills install github/awesome-copilot java-add-graalvm-native-image-support` | GraalVM Native Image expert that adds native image support to Java applications, builds the project, analyzes build errors, applies fixes, and iterates until successful compilation using Oracle best practices. | None | | [java-docs](../skills/java-docs/SKILL.md)
`gh skills install github/awesome-copilot java-docs` | Ensure that Java types are documented with Javadoc comments and follow best practices for documentation. | None | +| [java-helidon](../skills/java-helidon/SKILL.md)
`gh skills install github/awesome-copilot java-helidon` | Get best practices for developing applications with Helidon 4 (SE and MP). Use when working with Helidon SE or Helidon MP, HttpService routing, Helidon DB Client, MicroProfile Config, Helidon Security, or Helidon testing in Java 21+ projects. | None | | [java-junit](../skills/java-junit/SKILL.md)
`gh skills install github/awesome-copilot java-junit` | Get best practices for JUnit 5 unit testing, including data-driven tests | None | | [java-mcp-server-generator](../skills/java-mcp-server-generator/SKILL.md)
`gh skills install github/awesome-copilot java-mcp-server-generator` | Generate a complete Model Context Protocol server project in Java using the official MCP Java SDK with reactive streams and optional Spring Boot integration. | None | | [java-refactoring-extract-method](../skills/java-refactoring-extract-method/SKILL.md)
`gh skills install github/awesome-copilot java-refactoring-extract-method` | Refactoring using Extract Methods in Java Language | None | diff --git a/skills/java-helidon/SKILL.md b/skills/java-helidon/SKILL.md new file mode 100644 index 00000000..0b654dac --- /dev/null +++ b/skills/java-helidon/SKILL.md @@ -0,0 +1,435 @@ +--- +name: java-helidon +description: 'Get best practices for developing applications with Helidon 4 (SE and MP). Use when working with Helidon SE or Helidon MP, HttpService routing, Helidon DB Client, MicroProfile Config, Helidon Security, or Helidon testing in Java 21+ projects.' +--- + +# Helidon Best Practices + +Your goal is to help me write high-quality Helidon applications by following established best practices. + +## Helidon 3 → 4 API changes + +Helidon 4 renamed or resignatured APIs that appear widely in their Helidon 3 form. +The left column does not compile on Helidon 4. Check generated code against this table +before returning it. + +| Do not use (Helidon 3) | Use (Helidon 4) | +| ---------------------------------------------------------- | ------------------------------------------------------------------ | +| `io.helidon.common.http.Http.Status` | `io.helidon.http.Status` | +| `io.helidon.webserver.Service` | `io.helidon.webserver.http.HttpService` | +| `Routing.Rules`, `update(Routing.Rules)` | `HttpRules`, `routing(HttpRules)` | +| `request.path().param("id")` | `request.path().pathParameters().get("id")` | +| `String s = column.as(String.class)` | `column.getString()` or `column.get(String.class)` | +| `dbClient.execute(exec -> ...)` returning `Single`/`Multi` | `dbClient.execute()` returning `Optional` / `Stream` | +| `javax.*` | `jakarta.*` | +| `helidon-microprofile-tests-junit5` | `helidon-microprofile-testing-junit5` | + +`Value.as(Class)` in Helidon 4 returns `OptionalValue`, not `T`. This is the single +most common Helidon 4 compile error in generated code. + +## Project Setup & Structure + +- **Programming Model:** Determine whether the project uses Helidon SE or Helidon MP before generating code. Do not mix the two programming models unless explicitly required. +- **Java Version:** Use Java 21 or later for Helidon 4 applications. +- **Build Tool:** Use Maven (`pom.xml`) or Gradle (`build.gradle`) for dependency management. +- **Dependency Management:** Use the Helidon BOM or platform to keep Helidon module versions aligned. +- **Package Structure:** Organize code by feature or domain, such as `com.example.app.order` and `com.example.app.customer`, rather than only by technical layer. + +## Helidon SE + +- **Explicit Composition:** Construct services and dependencies explicitly in the application bootstrap layer. +- **Constructor Injection:** Pass required dependencies through constructors and declare dependency fields as `private final`. +- **HTTP Services:** Group related routes in focused `HttpService` implementations. +- **Business Logic:** Keep business logic outside route handlers. +- **Virtual Threads:** Prefer straightforward blocking code with Helidon 4 virtual-thread-based request handling. Do not introduce reactive complexity without a clear reason. Helidon 4 is not reactive; do not generate `Single`, `Multi`, or `CompletionStage` chains. + +## Helidon MP + +- **Jakarta and MicroProfile:** Prefer standard Jakarta EE and Eclipse MicroProfile APIs when available. +- **Dependency Injection:** Use CDI with constructor injection for required dependencies. +- **Bean Scopes:** Use CDI scopes such as `@ApplicationScoped` and `@RequestScoped` intentionally. +- **Normal-Scoped Beans:** Add a non-private no-argument constructor to normal-scoped beans that use constructor injection, so the CDI client proxy can be created portably. +- **Business Logic:** Keep Jakarta REST resource classes thin and delegate business operations to service classes. +- **Portability:** Prefer portable Jakarta and MicroProfile APIs over Helidon-specific APIs when portability is important. + +## Configuration + +- **Externalized Configuration:** Store non-secret configuration in `application.yaml` or `application.properties`. +- **Helidon SE Configuration:** Use Helidon Config and pass configuration values or typed configuration objects to components. +- **Helidon MP Configuration:** Use MicroProfile Config for injected application settings. +- **Environment Overrides:** Use environment variables or deployment-specific configuration sources for environment-dependent values. +- **Secrets Management:** Never hardcode credentials, API keys, tokens, or private certificates. + +## Web Layer + +- **DTOs:** Use dedicated request and response models. Do not expose persistence entities directly through APIs. +- **Validation:** Validate path parameters, query parameters, headers, and request bodies before invoking business logic. +- **Status Codes:** Return appropriate HTTP status codes for successful, invalid, unauthorized, forbidden, missing, and failed requests. On `PUT` and `DELETE`, return 404 when the target does not exist rather than succeeding unconditionally. +- **Error Handling:** Use centralized error handling in Helidon SE and Jakarta REST `ExceptionMapper` implementations in Helidon MP. +- **Sensitive Information:** Do not expose stack traces, database details, filesystem paths, or internal exception messages to clients. + +### Helidon SE Example + +Use an `HttpService` to register routes programmatically. Keep request handlers small and delegate business logic to a service. + +```java +import io.helidon.http.Status; +import io.helidon.webserver.http.HttpRules; +import io.helidon.webserver.http.HttpService; +import io.helidon.webserver.http.ServerRequest; +import io.helidon.webserver.http.ServerResponse; + +public final class CustomerHttpService implements HttpService { + + private final CustomerService customerService; + + public CustomerHttpService(CustomerService customerService) { + this.customerService = customerService; + } + + @Override + public void routing(HttpRules rules) { + rules.get("/{id}", this::findById); + } + + private void findById(ServerRequest request, ServerResponse response) { + var id = request.path().pathParameters().get("id"); + + customerService.findById(id) + .ifPresentOrElse( + response::send, + () -> response.status(Status.NOT_FOUND_404).send() + ); + } +} +``` + +Register the HTTP service when constructing the server: + +```java +import io.helidon.webserver.WebServer; + +WebServer server = WebServer.builder() + .routing(routing -> routing.register("/customers", customerHttpService)) + .build() + .start(); +``` + +### Helidon MP Example + +Use Jakarta REST annotations for endpoints and CDI for dependency injection. + +```java +import jakarta.enterprise.context.RequestScoped; +import jakarta.inject.Inject; +import jakarta.ws.rs.GET; +import jakarta.ws.rs.Path; +import jakarta.ws.rs.PathParam; +import jakarta.ws.rs.Produces; +import jakarta.ws.rs.core.MediaType; +import jakarta.ws.rs.core.Response; + +@Path("/customers") +@RequestScoped +@Produces(MediaType.APPLICATION_JSON) +public class CustomerResource { + + private final CustomerService customerService; + + protected CustomerResource() { + this.customerService = null; + } + + @Inject + public CustomerResource(CustomerService customerService) { + this.customerService = customerService; + } + + @GET + @Path("/{id}") + public Response findById(@PathParam("id") String id) { + return customerService.findById(id) + .map(customer -> Response.ok(customer).build()) + .orElseGet(() -> Response.status(Response.Status.NOT_FOUND).build()); + } +} +``` + +## Service Layer + +- **Transactions:** Define transaction boundaries around complete business operations. +- **Entity Mapping:** Map persistence entities to API models at the service boundary so that service method signatures expose only API models. A service returning `Optional` where the caller expects `Optional` is a common generated-code compile error. +- **Concurrency:** Avoid mutable shared state in application-scoped components unless access is properly coordinated. + +### Helidon SE Example + +Helidon SE services are normally plain Java classes with explicitly supplied dependencies. + +```java +public final class CustomerService { + + private final CustomerRepository customerRepository; + + public CustomerService(CustomerRepository customerRepository) { + this.customerRepository = customerRepository; + } + + public Optional findById(String id) { + if (id == null || id.isBlank()) { + throw new IllegalArgumentException("Customer ID is required"); + } + + return customerRepository.findById(id); + } + + public Customer create(CreateCustomerRequest request) { + if (request.name() == null || request.name().isBlank()) { + throw new IllegalArgumentException("Customer name is required"); + } + + var customer = new Customer(request.id(), request.name().trim()); + + customerRepository.save(customer); + return customer; + } +} +``` + +Construct the dependency graph explicitly: + +```java +var repository = new DbCustomerRepository(dbClient); +var service = new CustomerService(repository); +var httpService = new CustomerHttpService(service); +``` + +### Helidon MP Example + +Use CDI scopes and constructor injection. Apply transactions at the service layer when a business operation changes persistent state. Map the persistence entity to the API model here, so the service never leaks `CustomerEntity` to callers. + +```java +import jakarta.enterprise.context.ApplicationScoped; +import jakarta.inject.Inject; +import jakarta.transaction.Transactional; + +@ApplicationScoped +public class CustomerService { + + private final JpaCustomerRepository customerRepository; + + protected CustomerService() { + this.customerRepository = null; + } + + @Inject + public CustomerService(JpaCustomerRepository customerRepository) { + this.customerRepository = customerRepository; + } + + public Optional findById(String id) { + if (id == null || id.isBlank()) { + throw new IllegalArgumentException("Customer ID is required"); + } + + return customerRepository.findById(id) + .map(Customer::fromEntity); + } + + @Transactional + public Customer create(CreateCustomerRequest request) { + if (request.name() == null || request.name().isBlank()) { + throw new IllegalArgumentException("Customer name is required"); + } + + var entity = new CustomerEntity(request.id(), request.name().trim()); + + customerRepository.save(entity); + return Customer.fromEntity(entity); + } +} +``` + +## Data Layer + +- **Database Access:** Use Helidon DB Client, Jakarta Persistence, or another persistence mechanism already established by the project. +- **Parameterized Queries:** Always use parameter binding or prepared statements. Never concatenate untrusted input into SQL. +- **Column Accessors:** Read a typed column value with `column("name").getString()` (or `getInt()`, `getLong()`, and so on) or with `column("name").get(String.class)`. `DbColumn.as(String.class)` returns an `OptionalValue` in Helidon 4, not a `String`. +- **Nullable Columns:** Read nullable columns through `asOptional()` or another optional-aware accessor. Direct `getString()` and similar accessors throw when the column value is null. +- **Row Mapping:** For whole-row mapping, `DbRow.as(Customer.class)` returns the mapped instance directly, but requires a `DbMapper` registered through a `DbMapperProvider` service-loader entry. Prefer explicit column reads for a small number of simple repositories, and introduce a `DbMapper` when the same row shape is mapped in several places. +- **Migrations:** Use a database migration tool for schema changes rather than automatic destructive schema updates. +- **Entity Separation:** Do not expose database entities directly as API contracts. + +### Helidon SE Example + +Use Helidon DB Client with parameterized statements. Map database rows into application models inside the repository. + +```java +import io.helidon.dbclient.DbClient; + +public final class DbCustomerRepository implements CustomerRepository { + + private static final String FIND_BY_ID = + "SELECT id, name FROM customers WHERE id = :id"; + + private static final String INSERT = + "INSERT INTO customers (id, name) VALUES (:id, :name)"; + + private final DbClient dbClient; + + public DbCustomerRepository(DbClient dbClient) { + this.dbClient = dbClient; + } + + @Override + public Optional findById(String id) { + return dbClient.execute() + .createGet(FIND_BY_ID) + .addParam("id", id) + .execute() + .map(row -> new Customer( + row.column("id").getString(), + row.column("name").getString() + )); + } + + @Override + public void save(Customer customer) { + dbClient.execute() + .createInsert(INSERT) + .addParam("id", customer.id()) + .addParam("name", customer.name()) + .execute(); + } +} +``` + +Named statements can also be stored in configuration instead of embedding SQL in Java: + +```yaml +db: + source: "jdbc" + connection: + url: "jdbc:postgresql://localhost:5432/customers" + username: ${DB_USERNAME} + password: ${DB_PASSWORD} + statements: + find-customer-by-id: > + SELECT id, name + FROM customers + WHERE id = :id +``` + +Reference the named statement by name instead of passing SQL text: + +```java +return dbClient.execute() + .createNamedGet("find-customer-by-id") + .addParam("id", id) + .execute() + .map(row -> new Customer( + row.column("id").getString(), + row.column("name").getString() + )); +``` + +### Helidon MP Example + +Use Jakarta Persistence in a CDI-managed repository. Keep transaction boundaries in the service layer. The repository works in entities; the service maps them to API models. + +```java +import jakarta.enterprise.context.ApplicationScoped; +import jakarta.persistence.EntityManager; +import jakarta.persistence.PersistenceContext; + +@ApplicationScoped +public class JpaCustomerRepository { + + @PersistenceContext + private EntityManager entityManager; + + public Optional findById(String id) { + return Optional.ofNullable(entityManager.find(CustomerEntity.class, id)); + } + + public void save(CustomerEntity customer) { + entityManager.persist(customer); + } +} +``` + +Define the persistence entity separately from the public API model: + +```java +import jakarta.persistence.Column; +import jakarta.persistence.Entity; +import jakarta.persistence.Id; +import jakarta.persistence.Table; + +@Entity +@Table(name = "customers") +public class CustomerEntity { + + @Id + private String id; + + @Column(nullable = false) + private String name; + + protected CustomerEntity() { + } + + public CustomerEntity(String id, String name) { + this.id = id; + this.name = name; + } + + public String id() { + return id; + } + + public String name() { + return name; + } +} +``` + +The API model stays free of persistence annotations and owns the mapping: + +```java +public record Customer(String id, String name) { + + public static Customer fromEntity(CustomerEntity entity) { + return new Customer(entity.id(), entity.name()); + } +} +``` + +## Observability + +- **Health:** Use Helidon Health in SE or MicroProfile Health in MP for liveness and readiness checks. +- **Metrics:** Use Helidon Metrics or MicroProfile Metrics for operational and business measurements. +- **Tracing:** Propagate tracing context across inbound and outbound service calls. +- **Cardinality:** Avoid user IDs, request IDs, email addresses, and raw URLs as metric tags. + +## Logging + +- **Logging API:** Use the logging API and implementation configured by the project. +- **Sensitive Information:** Never log passwords, access tokens, authorization headers, cookies, or complete sensitive request bodies. Do not place secrets or personal information in metrics or trace attributes either. + +## Testing + +- **Unit Tests:** Write unit tests for business services using JUnit 5. +- **Helidon SE Tests:** Use `helidon-webserver-testing-junit5` with `@ServerTest` for full server tests and `@RoutingTest` for routing-only tests. These start the server on a dynamically selected port and inject a `Http1Client` bound to it. Never hardcode a port. +- **Helidon MP Tests:** Use `helidon-microprofile-testing-junit5` with `@HelidonTest`, which starts the CDI container and server for the test class. Confirm the artifact coordinates against the Helidon version in use, since this module was renamed across 4.x releases. +- **Testcontainers:** Consider Testcontainers for integration tests using real databases, message brokers, or other infrastructure. +- **Failure Paths:** Test validation failures, missing resources, external-service failures, and authorization failures. + +## Security + +- **Helidon Security:** Use Helidon Security or supported Jakarta and MicroProfile security APIs for authentication and authorization. +- **Authorization:** Enforce permissions at a clear application boundary and deny protected operations by default. +- **JWT and OIDC:** Validate token signatures, issuers, audiences, and expiration times. +- **TLS:** Use TLS for production traffic and verify certificates for outbound connections. +- **CORS:** Configure allowed origins explicitly. Do not combine wildcard origins with credentials. +- **Secrets:** Store secrets in protected environment configuration or a dedicated secret-management system. +- **Outbound Requests:** Validate outbound destinations to reduce server-side request forgery risks. From c85e3911f8b186628f0f4aa1a72282cfee24ce9c Mon Sep 17 00:00:00 2001 From: Anton Standrik Date: Thu, 16 Jul 2026 22:51:03 +0300 Subject: [PATCH 08/79] feat: add codebase-memory-mcp skill --- docs/README.skills.md | 1 + skills/codebase-memory-mcp/SKILL.md | 27 +++++++++++++++++++++++++++ 2 files changed, 28 insertions(+) create mode 100644 skills/codebase-memory-mcp/SKILL.md diff --git a/docs/README.skills.md b/docs/README.skills.md index fb94c86e..d6a846a1 100644 --- a/docs/README.skills.md +++ b/docs/README.skills.md @@ -91,6 +91,7 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-skills) for guidelines on how to | [cloud-design-patterns](../skills/cloud-design-patterns/SKILL.md)
`gh skills install github/awesome-copilot cloud-design-patterns` | Cloud design patterns for distributed systems architecture covering 42 industry-standard patterns across reliability, performance, messaging, security, and deployment categories. Use when designing, reviewing, or implementing distributed system architectures. | `references/architecture-design.md`
`references/azure-service-mappings.md`
`references/best-practices.md`
`references/deployment-operational.md`
`references/event-driven.md`
`references/messaging-integration.md`
`references/performance.md`
`references/reliability-resilience.md`
`references/security.md` | | [code-exemplars-blueprint-generator](../skills/code-exemplars-blueprint-generator/SKILL.md)
`gh skills install github/awesome-copilot code-exemplars-blueprint-generator` | Technology-agnostic prompt generator that creates customizable AI prompts for scanning codebases and identifying high-quality code exemplars. Supports multiple programming languages (.NET, Java, JavaScript, TypeScript, React, Angular, Python) with configurable analysis depth, categorization methods, and documentation formats to establish coding standards and maintain consistency across development teams. | None | | [code-tour](../skills/code-tour/SKILL.md)
`gh skills install github/awesome-copilot code-tour` | Use this skill to create CodeTour .tour files — persona-targeted, step-by-step walkthroughs that link to real files and line numbers. Trigger for: "create a tour", "make a code tour", "generate a tour", "onboarding tour", "tour for this PR", "tour for this bug", "RCA tour", "architecture tour", "explain how X works", "vibe check", "PR review tour", "contributor guide", "help someone ramp up", or any request for a structured walkthrough through code. Supports 20 developer personas (new joiner, bug fixer, architect, PR reviewer, vibecoder, security reviewer, and more), all CodeTour step types (file/line, selection, pattern, uri, commands, view), and tour-level fields (ref, isPrimary, nextTour). Works with any repository in any language. | `references/codetour-schema.json`
`references/examples.md`
`scripts/generate_from_docs.py`
`scripts/validate_tour.py` | +| [codebase-memory-mcp](../skills/codebase-memory-mcp/SKILL.md)
`gh skills install github/awesome-copilot codebase-memory-mcp` | Use when a configured codebase-memory-mcp server can assist with graph-backed code discovery, architecture orientation, symbol lookup, callers and callees, dependency or data-flow tracing, impact analysis, unfamiliar modules, or an explicit Codebase Memory request. | None | | [codeql](../skills/codeql/SKILL.md)
`gh skills install github/awesome-copilot codeql` | Comprehensive guide for setting up and configuring CodeQL code scanning via GitHub Actions workflows and the CodeQL CLI. This skill should be used when users need help with code scanning configuration, CodeQL workflow files, CodeQL CLI commands, SARIF output, security analysis setup, or troubleshooting CodeQL analysis. | `references/alert-management.md`
`references/cli-commands.md`
`references/compiled-languages.md`
`references/sarif-output.md`
`references/troubleshooting.md`
`references/workflow-configuration.md` | | [comment-code-generate-a-tutorial](../skills/comment-code-generate-a-tutorial/SKILL.md)
`gh skills install github/awesome-copilot comment-code-generate-a-tutorial` | Transform this Python script into a polished, beginner-friendly project by refactoring the code, adding clear instructional comments, and generating a complete markdown tutorial. | None | | [commit-message-storyteller](../skills/commit-message-storyteller/SKILL.md)
`gh skills install github/awesome-copilot commit-message-storyteller` | Analyzes git diffs or staged changes and generates narrative commit messages that explain WHY a change was made, not just what changed — following Conventional Commits format. Use when asked to "write a commit message", "generate a commit", "describe my changes", "what should I commit this as", "commit this", "summarize my diff", or "help me commit". Works with git diff output, staged files, or plain descriptions of changes. | `references/conventional-commits-guide.md` | diff --git a/skills/codebase-memory-mcp/SKILL.md b/skills/codebase-memory-mcp/SKILL.md new file mode 100644 index 00000000..b3daba23 --- /dev/null +++ b/skills/codebase-memory-mcp/SKILL.md @@ -0,0 +1,27 @@ +--- +name: codebase-memory-mcp +description: 'Use when a configured codebase-memory-mcp server can assist with graph-backed code discovery, architecture orientation, symbol lookup, callers and callees, dependency or data-flow tracing, impact analysis, unfamiliar modules, or an explicit Codebase Memory request.' +--- + +# Codebase Memory MCP + +Use the configured Codebase Memory graph as a discovery accelerator, not as the sole source of truth. Confirm graph-derived conclusions with source snippets or local files before editing code or making strong claims. + +## Workflow + +1. Discover the Codebase Memory tools exposed by the current MCP client; clients may prefix or rename tool namespaces. +2. Call `list_projects` when available and use the exact indexed project name. If the repository is not indexed, continue with local exploration or ask before calling `index_repository` when graph access is important. +3. Before branch-sensitive or edit-sensitive conclusions, use `index_status` or `detect_changes` when available. After a branch switch, assume the index may be stale until checked. If freshness cannot be established, disclose that limitation and verify locally. +4. Use `get_architecture` once for orientation in an unfamiliar repository or subsystem. Do not repeat it for narrow follow-up questions. +5. Use `search_graph` for definitions, implementations, routes, classes, interfaces, callers, and related symbols. Prefer a natural-language query for discovery and a name or qualified-name pattern for known symbols. Narrow by label or path, set a result limit, and paginate or reduce scope when the response reports more results. +6. Use `search_code` or normal repository search for literal strings, configuration keys, test identifiers, error messages, and non-code files. Do not turn a precise text lookup into a broad graph query. +7. After graph search, use `get_code_snippet` with the returned qualified name. If source snippets are unavailable, open the local file before relying on the result. +8. Use `trace_path` for callers, callees, dependency paths, data flow, cross-service paths, and impact analysis. Include tests only when test coverage is part of the question. +9. Use `get_graph_schema` before `query_graph`. Reserve custom queries for multi-hop or aggregate questions that simpler tools cannot answer, and apply `LIMIT` or the tool's row limit. +10. When graph and checked-out source disagree, treat source as current and report likely index drift. + +## Safety and Fallbacks + +- Do not install Codebase Memory or another third-party skill from this workflow. +- Do not call `delete_project`, ingest traces, update ADRs, or index a repository unless the user requested it or graph access is clearly required and the action has been announced. +- Fall back to normal repository exploration when the MCP server, project, index, or required capability is unavailable; do not invent tool results or stop a task that can be completed safely without the graph. From 87300ab4767cd218bf8e1f9679b5a9d68a879301 Mon Sep 17 00:00:00 2001 From: Anton Standrik Date: Thu, 16 Jul 2026 23:21:39 +0300 Subject: [PATCH 09/79] fix: require approval for graph mutations --- skills/codebase-memory-mcp/SKILL.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/skills/codebase-memory-mcp/SKILL.md b/skills/codebase-memory-mcp/SKILL.md index b3daba23..4ad3a7e1 100644 --- a/skills/codebase-memory-mcp/SKILL.md +++ b/skills/codebase-memory-mcp/SKILL.md @@ -23,5 +23,5 @@ Use the configured Codebase Memory graph as a discovery accelerator, not as the ## Safety and Fallbacks - Do not install Codebase Memory or another third-party skill from this workflow. -- Do not call `delete_project`, ingest traces, update ADRs, or index a repository unless the user requested it or graph access is clearly required and the action has been announced. +- Do not call `delete_project`, ingest traces, update ADRs, or index a repository unless the user explicitly requested or approved the action; announce it before execution. - Fall back to normal repository exploration when the MCP server, project, index, or required capability is unavailable; do not invent tool results or stop a task that can be completed safely without the graph. From 0d83340afad7156217d54eeeceb0b5531b6001f4 Mon Sep 17 00:00:00 2001 From: Xiaoyun Ding Date: Fri, 17 Jul 2026 10:10:42 +0800 Subject: [PATCH 10/79] Update modernize-java plugin version to 1.22.0 --- plugins/external.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/plugins/external.json b/plugins/external.json index f69a91b1..0509c6b9 100644 --- a/plugins/external.json +++ b/plugins/external.json @@ -525,7 +525,7 @@ { "name": "modernize-java", "description": "GitHub Copilot modernization – Java Upgrade CLI Plugin helps you upgrade Java applications from the command line. It brings intelligent modernization capabilities to your terminal and CI/CD pipelines: analyze your project and generate an upgrade plan, automatically transform your codebase, fix build issues, validate against known CVEs, and output a detailed summary of file changes and updated dependencies.", - "version": "1.9.2", + "version": "1.22.0", "author": { "name": "microsoft", "url": "https://github.com/microsoft/modernize-java" @@ -543,8 +543,8 @@ "source": "github", "repo": "microsoft/modernize-java", "path": "plugins/modernize-java", - "ref": "1.9.2", - "sha": "b570196c070bf1eb9d7ad34a263b228ef16034a0" + "ref": "1.22.0", + "sha": "ef5367b446566bdc90960deeb40def63f9e7024e" } }, { From bd3e6493e9b115db713559cfe5dd95ae4bbd4680 Mon Sep 17 00:00:00 2001 From: Augustin Popa Date: Thu, 16 Jul 2026 23:37:35 -0700 Subject: [PATCH 11/79] Addressed PR review feedback --- skills/vcpkg/SKILL.md | 119 +++++++++++---------- skills/vcpkg/references/ci.md | 70 ++++++++---- skills/vcpkg/references/registries.md | 6 +- skills/vcpkg/references/troubleshooting.md | 32 ++++-- 4 files changed, 139 insertions(+), 88 deletions(-) diff --git a/skills/vcpkg/SKILL.md b/skills/vcpkg/SKILL.md index 8fe2eaa4..313a7453 100644 --- a/skills/vcpkg/SKILL.md +++ b/skills/vcpkg/SKILL.md @@ -1,6 +1,6 @@ --- name: vcpkg -description: Guide for setting up vcpkg in C++ projects, managing dependency versions, and cross-compiling. Covers manifest initialization, CMake and Visual Studio integration, classic-to-manifest migration, version pinning, baselines, overrides, triplets, and cross-compilation. Use when a user is working with vcpkg project setup, installation, version management, or cross-platform builds. For specialized tasks, additional references cover custom registries and overlay ports (references/registries.md), CI/CD and binary caching (references/ci.md), and troubleshooting and dependency lifecycle (references/troubleshooting.md). +description: 'Guide for setting up vcpkg in C++ projects, managing dependency versions, and cross-compiling. Covers manifest initialization, CMake and Visual Studio integration, classic-to-manifest migration, version pinning, baselines, overrides, triplets, and cross-compilation. Use when a user is working with vcpkg project setup, installation, version management, or cross-platform builds. For specialized tasks, additional references cover custom registries and overlay ports (references/registries.md), CI/CD and binary caching (references/ci.md), and troubleshooting and dependency lifecycle (references/troubleshooting.md).' --- You are a vcpkg expert assistant. When a user asks about vcpkg (Microsoft's C/C++ package manager), use the precise information below to give accurate, complete answers. @@ -32,9 +32,9 @@ Classic mode is simpler for quick one-off installs but lacks version pinning, pe If the user is working inside **Visual Studio** (not VS Code), prefer using the **in-box copy of vcpkg that ships with Visual Studio** rather than a standalone vcpkg clone, unless the user indicates they want to use a different installation. The VS-bundled vcpkg: - Is located under the Visual Studio installation directory (e.g., `C:\Program Files\Microsoft Visual Studio\\\VC\vcpkg\`) -- Is automatically integrated with MSBuild — no need to run `vcpkg integrate install` +- Supports user-wide MSBuild integration after running `vcpkg integrate install` once - Stays up-to-date with Visual Studio updates -- Works out of the box with CMake projects opened via "Open Folder" or CMake presets +- Can be used with Visual Studio Open Folder/CMake Presets projects, but CMake must still be configured to use the vcpkg toolchain (for example via `CMakePresets.json` or `-DCMAKE_TOOLCHAIN_FILE=/scripts/buildsystems/vcpkg.cmake`) If the user has a standalone vcpkg installation and prefers to use that instead, respect their preference. @@ -44,12 +44,14 @@ If the user has a standalone vcpkg installation and prefers to use that instead, ### Initializing vcpkg in a New Project (Manifest Mode) +Example setup using fmt: + 1. Create `vcpkg.json` in your project root: ```json { "name": "my-project", "version": "1.0.0", - "dependencies": [] + "dependencies": ["fmt"] } ``` @@ -58,18 +60,19 @@ If the user has a standalone vcpkg installation and prefers to use that instead, cmake_minimum_required(VERSION 3.21) project(my-project) +add_executable(my-app main.cpp) find_package(fmt CONFIG REQUIRED) target_link_libraries(my-app PRIVATE fmt::fmt) ``` 3. Configure with vcpkg toolchain: -``` +```console cmake -B build -DCMAKE_TOOLCHAIN_FILE=/scripts/buildsystems/vcpkg.cmake ``` ### Adding vcpkg to an Existing Visual Studio Solution -1. Run `vcpkg integrate install` (one-time, system-wide) +1. Run `vcpkg integrate install` (one-time, user-wide) 2. Create `vcpkg.json` in the solution directory 3. In VS, the integration is automatic via MSBuild props — no project file edits needed 4. Or per-project: add to `.vcxproj`: @@ -82,7 +85,7 @@ cmake -B build -DCMAKE_TOOLCHAIN_FILE=/scripts/buildsystems/vcpkg.cm 1. List what's currently installed: `vcpkg list` 2. Create `vcpkg.json` with those dependencies -3. Delete global installs: `vcpkg remove --outdated --recurse` +3. Delete global installs: `vcpkg remove --recurse "*"` 4. Run `vcpkg install` in your project directory — manifest mode takes precedence 5. Update your build system to use `CMAKE_TOOLCHAIN_FILE` if not already @@ -105,32 +108,37 @@ In **manifest mode** (`vcpkg.json`), specify features in the dependencies array: ``` In **classic mode**, use bracket syntax on the command line: -``` +```console vcpkg install curl[ssl,http2] ``` To discover available features for any port: -``` +```console vcpkg search curl ``` Or check the port's `vcpkg.json` in the registry: `ports/curl/vcpkg.json` → look at the `"features"` object. ### Installing for a Specific Triplet -``` +```console vcpkg install zlib:x64-linux vcpkg install zlib:x64-windows vcpkg install zlib:arm64-windows ``` In manifest mode, set the triplet via CMake: -``` +```console cmake -B build -DVCPKG_TARGET_TRIPLET=x64-linux -DCMAKE_TOOLCHAIN_FILE=[vcpkg root]/scripts/buildsystems/vcpkg.cmake ``` Or set the environment variable: + +```powershell +$env:VCPKG_DEFAULT_TRIPLET = "x64-linux" ``` -set VCPKG_DEFAULT_TRIPLET=x64-linux + +```bash +export VCPKG_DEFAULT_TRIPLET=x64-linux ``` ### Bulk-Adding Multiple Dependencies @@ -143,7 +151,7 @@ In `vcpkg.json`, list them in the dependencies array: ``` In classic mode: -``` +```console vcpkg install catch2 cxxopts toml11 ``` @@ -151,7 +159,7 @@ Then run `vcpkg install` (manifest mode) or the above command to install all at ### Dev-Only Dependencies -Use the `"host"` field or place test dependencies under a feature: +Place test-only dependencies under an opt-in feature. The `"host"` field is reserved for build tools that must run on the host architecture: ```json { "dependencies": [ @@ -173,9 +181,22 @@ Activate with: `vcpkg install --x-feature=tests` or in CMake: `-DVCPKG_MANIFEST_ ## Version Management -### Pinning a Specific Version +### Setting Versions for Individual Dependencies -In `vcpkg.json`, use `"version>="` with overrides: +In `vcpkg.json`, prefer using `"version>="` as a minimum version constraint over overrides. Example: +```json +{ + "dependencies": [ + { + "name": "fmt", + "version>=": "10.2.0" + } + ], + "builtin-baseline": "" +} +``` + +If the user insists on hard-coding a version and is okay dealing with ABI compatibility issues manually, use overrides instead: ```json { "dependencies": ["fmt"], @@ -189,91 +210,71 @@ In `vcpkg.json`, use `"version>="` with overrides: } ``` -The `builtin-baseline` is **required** when using versioning. Get the latest baseline: -``` -git -C rev-parse HEAD -``` - -### Version Overrides - -To force a specific version of a transitive dependency across your entire project, use `"overrides"` in `vcpkg.json`: -```json -{ - "dependencies": ["protobuf", "grpc"], - "overrides": [ - { - "name": "zlib", - "version": "1.3.1" - } - ], - "builtin-baseline": "" -} -``` +The `builtin-baseline` is **very important** when using versioning. Suggest baselines at minimum as a way to set all library versions to a known-good state, and use overrides only when necessary. **Key points:** - `overrides` takes precedence over all version constraints, including transitive ones - You **must** have a `builtin-baseline` set for overrides to work -- The version must exist in the vcpkg registry at or after the baseline commit +- The version must exist in the selected vcpkg registry's version database; an override may select a version older than the baseline version - Use `vcpkg x-history zlib` to see available versions -### Updating the Baseline - -The baseline is a Git commit SHA in the vcpkg repository that pins all port versions: -```json -{ - "builtin-baseline": "a1b2c3d4e5f6..." -} -``` - -To update to the latest: -```bash -cd -git pull -git rev-parse HEAD -``` -Then paste the new SHA into `builtin-baseline`. - -**Important:** Updating the baseline may change versions of *all* dependencies. Use `overrides` to pin specific packages if needed. - --- ## Cross-Platform ### Cross-Compiling for arm64 -``` +```console vcpkg install :arm64-linux ``` Or set the triplet in CMake: +```powershell +cmake -B build -DVCPKG_TARGET_TRIPLET=arm64-linux -DCMAKE_TOOLCHAIN_FILE=$env:VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake ``` + +```bash cmake -B build -DVCPKG_TARGET_TRIPLET=arm64-linux -DCMAKE_TOOLCHAIN_FILE=$VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake ``` You may need a cross-compilation toolchain installed (e.g., `aarch64-linux-gnu-gcc`). For **arm64-windows**, just use the triplet directly — no cross-compiler needed on ARM64 Windows or with MSVC: -``` +```console vcpkg install :arm64-windows ``` ### Building for Android (NDK) 1. Set environment variables: +```powershell +$env:ANDROID_NDK_HOME = "C:\path\to\ndk" +$env:VCPKG_DEFAULT_TRIPLET = "arm64-android" +``` + ```bash export ANDROID_NDK_HOME=/path/to/ndk export VCPKG_DEFAULT_TRIPLET=arm64-android ``` 2. Install packages: -``` +```console vcpkg install :arm64-android ``` Available Android triplets: `arm-neon-android`, `arm64-android`, `x86-android`, `x64-android` 3. In CMake: +```powershell +cmake -B build ` + -DCMAKE_TOOLCHAIN_FILE=$env:VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake ` + -DVCPKG_TARGET_TRIPLET=arm64-android ` + -DVCPKG_CHAINLOAD_TOOLCHAIN_FILE=$env:ANDROID_NDK_HOME/build/cmake/android.toolchain.cmake ` + -DANDROID_ABI=arm64-v8a ` + -DANDROID_PLATFORM=android-24 ``` + +```bash cmake -B build \ -DCMAKE_TOOLCHAIN_FILE=$VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake \ -DVCPKG_TARGET_TRIPLET=arm64-android \ diff --git a/skills/vcpkg/references/ci.md b/skills/vcpkg/references/ci.md index 39b24782..403ad4d0 100644 --- a/skills/vcpkg/references/ci.md +++ b/skills/vcpkg/references/ci.md @@ -7,44 +7,65 @@ Reference for the `vcpkg` skill. Use this when a user asks about using vcpkg in Configure binary caching to avoid rebuilding packages: **Azure Blob Storage:** +```powershell +$env:VCPKG_BINARY_SOURCES = "clear;x-azblob,https://myaccount.blob.core.windows.net/vcpkg-cache,$env:AZURE_STORAGE_SAS_TOKEN,readwrite" ``` -set VCPKG_BINARY_SOURCES=clear;x-azblob,https://myaccount.blob.core.windows.net/vcpkg-cache,,readwrite +```bash +export VCPKG_BINARY_SOURCES="clear;x-azblob,https://myaccount.blob.core.windows.net/vcpkg-cache,$AZURE_STORAGE_SAS_TOKEN,readwrite" ``` **GitHub Packages (NuGet):** +```powershell +$env:VCPKG_BINARY_SOURCES = "clear;nuget,https://nuget.pkg.github.com/your-org/index.json,readwrite" ``` -set VCPKG_BINARY_SOURCES=clear;nuget,https://nuget.pkg.github.com/your-org/index.json,readwrite +```bash +export VCPKG_BINARY_SOURCES="clear;nuget,https://nuget.pkg.github.com/your-org/index.json,readwrite" ``` **Local filesystem:** +```powershell +$env:VCPKG_BINARY_SOURCES = "clear;files,C:\vcpkg-cache,readwrite" ``` -set VCPKG_BINARY_SOURCES=clear;files,C:/vcpkg-cache,readwrite +```bash +export VCPKG_BINARY_SOURCES="clear;files,/var/tmp/vcpkg-cache,readwrite" ``` **Sharing between CI and local dev:** Use the same remote cache (Azure Blob or NuGet feed) in both environments. CI writes (`readwrite`), developers read (`read`): -``` +```powershell # CI (writes cache) -set VCPKG_BINARY_SOURCES=clear;x-azblob,https://myaccount.blob.core.windows.net/cache,,readwrite +$env:VCPKG_BINARY_SOURCES = "clear;x-azblob,https://myaccount.blob.core.windows.net/cache,$env:AZURE_STORAGE_SAS_TOKEN,readwrite" # Developer (reads cache) -set VCPKG_BINARY_SOURCES=clear;x-azblob,https://myaccount.blob.core.windows.net/cache,,read +$env:VCPKG_BINARY_SOURCES = "clear;x-azblob,https://myaccount.blob.core.windows.net/cache,$env:AZURE_STORAGE_SAS_TOKEN,read" +``` +```bash +# CI (writes cache) +export VCPKG_BINARY_SOURCES="clear;x-azblob,https://myaccount.blob.core.windows.net/cache,$AZURE_STORAGE_SAS_TOKEN,readwrite" + +# Developer (reads cache) +export VCPKG_BINARY_SOURCES="clear;x-azblob,https://myaccount.blob.core.windows.net/cache,$AZURE_STORAGE_SAS_TOKEN,read" ``` --- ## Generating an SBOM (Software Bill of Materials) -vcpkg can generate an SBOM in SPDX format: -``` -vcpkg install --x-write-nuget-packages-config=packages.config +vcpkg emits per-port SPDX SBOM files during normal source builds; no special SBOM flag is required. +```console +vcpkg install ``` -For manifest mode, after install check `vcpkg_installed//share/` for SPDX files. Each installed port generates an SPDX JSON document at: -``` -vcpkg_installed//share//sbom.spdx.json +Each installed port writes: +```text +//share//vcpkg.spdx.json ``` -To aggregate: use `vcpkg x-package-info --x-installed` to list all packages and versions, then feed into your SBOM toolchain (e.g., Microsoft SBOM Tool, CycloneDX). +`` depends on integration mode: +- CLI manifest mode: `/vcpkg_installed` +- CMake integration (default): `${CMAKE_BINARY_DIR}/vcpkg_installed` (or `VCPKG_INSTALLED_DIR` if overridden) +- MSBuild integration (default): `$(VcpkgManifestRoot)\vcpkg_installed` (or `$(VcpkgInstalledDir)` if overridden) + +If you need a single consolidated SBOM, enumerate installed ports (for example with `vcpkg x-package-info --x-installed`) and merge/transform the per-port SPDX files in your SBOM pipeline. --- @@ -74,6 +95,7 @@ Option 2: **Script-based** — create a scheduled CI job that: Test across multiple triplets in a CI matrix: ```yaml # GitHub Actions example +runs-on: ${{ matrix.os }} strategy: matrix: triplet: [x64-windows, x64-linux, x64-osx] @@ -87,10 +109,20 @@ strategy: steps: - uses: actions/checkout@v4 - - name: Install vcpkg - run: | - git clone https://github.com/microsoft/vcpkg - ./vcpkg/bootstrap-vcpkg.sh - - name: Install dependencies - run: vcpkg install --triplet ${{ matrix.triplet }} + - name: Clone vcpkg + run: git clone https://github.com/microsoft/vcpkg + - name: Bootstrap vcpkg (Windows) + if: runner.os == 'Windows' + shell: pwsh + run: .\vcpkg\bootstrap-vcpkg.bat + - name: Bootstrap vcpkg (Linux/macOS) + if: runner.os != 'Windows' + run: ./vcpkg/bootstrap-vcpkg.sh + - name: Install dependencies (Windows) + if: runner.os == 'Windows' + shell: pwsh + run: .\vcpkg\vcpkg.exe install --triplet ${{ matrix.triplet }} + - name: Install dependencies (Linux/macOS) + if: runner.os != 'Windows' + run: ./vcpkg/vcpkg install --triplet ${{ matrix.triplet }} ``` diff --git a/skills/vcpkg/references/registries.md b/skills/vcpkg/references/registries.md index 61a5fa37..a42d67c9 100644 --- a/skills/vcpkg/references/registries.md +++ b/skills/vcpkg/references/registries.md @@ -93,7 +93,9 @@ file(REMOVE_RECURSE "${CURRENT_PACKAGES_DIR}/debug/include") vcpkg_install_copyright(FILE_LIST "${SOURCE_PATH}/LICENSE") ``` -Use it: `vcpkg install telemetry-sdk --overlay-ports=./my-overlays` +Classic mode: `vcpkg install telemetry-sdk --overlay-ports=./my-overlays` + +Manifest mode: add `telemetry-sdk` to `vcpkg.json`, then run `vcpkg install --overlay-ports=./my-overlays`. Or in `vcpkg-configuration.json`: ```json { @@ -105,7 +107,7 @@ Or in `vcpkg-configuration.json`: ## Default Features -Set default features in `vcpkg.json` for a port so they're always enabled: +Control whether a dependency's existing default features are enabled, and request additional features in a project manifest: ```json { "dependencies": [ diff --git a/skills/vcpkg/references/troubleshooting.md b/skills/vcpkg/references/troubleshooting.md index 664eb8d0..497669cd 100644 --- a/skills/vcpkg/references/troubleshooting.md +++ b/skills/vcpkg/references/troubleshooting.md @@ -11,11 +11,10 @@ Build logs are stored at: Key log files: - `config--out.log` — CMake configure output -- `build--out.log` — Build (compile) output -- `install--out.log` — Install step output -- `config--err.log` — CMake configure errors -- `build--err.log` — Build errors -- `package--out.log` — Packaging output +- `build---.log` — common build logs +- `install---.log` — common install logs + +Exact names vary by port and build helper; use the path vcpkg prints for the failing command. When a build fails, vcpkg prints the path to the relevant log. Start with the `-err.log` file for the failing step. @@ -41,7 +40,7 @@ If CMake says `Could not find a package configuration file provided by "X"`: 2. Run `vcpkg install` to reconcile (manifest mode auto-removes unused packages) In classic mode: -``` +```console vcpkg remove boost-regex vcpkg remove boost-regex --recurse # also removes dependents ``` @@ -63,8 +62,8 @@ Update the features in `vcpkg.json`: Then run `vcpkg install` — vcpkg will detect the feature change and rebuild. In classic mode: -``` -vcpkg install curl[ssl,ssh] # reinstalls with new features +```console +vcpkg install curl[ssl,ssh] --recurse # permits rebuilding with the new feature set ``` ### Replacing One Library with Another @@ -76,6 +75,23 @@ vcpkg install curl[ssl,ssh] # reinstalls with new features ### Cleaning the vcpkg Cache +```powershell +# Remove build trees (intermediate build files) +Remove-Item -Recurse -Force \buildtrees + +# Remove downloaded archives +Remove-Item -Recurse -Force \downloads + +# Remove installed packages (classic mode only) +Remove-Item -Recurse -Force \installed + +# Remove all package build artifacts +vcpkg x-clean + +# In manifest mode, remove the local vcpkg_installed directory +Remove-Item -Recurse -Force .\vcpkg_installed +``` + ```bash # Remove build trees (intermediate build files) rm -rf /buildtrees From a5f0c6cff155f4e7638e945b2cab5cf6e49e9685 Mon Sep 17 00:00:00 2001 From: Augustin Popa Date: Thu, 16 Jul 2026 23:51:46 -0700 Subject: [PATCH 12/79] Completed another review pass, making more improvements --- skills/vcpkg/SKILL.md | 93 ++++++---------------- skills/vcpkg/references/ci.md | 28 +++---- skills/vcpkg/references/troubleshooting.md | 26 +----- 3 files changed, 42 insertions(+), 105 deletions(-) diff --git a/skills/vcpkg/SKILL.md b/skills/vcpkg/SKILL.md index 313a7453..606e86eb 100644 --- a/skills/vcpkg/SKILL.md +++ b/skills/vcpkg/SKILL.md @@ -38,6 +38,12 @@ If the user is working inside **Visual Studio** (not VS Code), prefer using the If the user has a standalone vcpkg installation and prefers to use that instead, respect their preference. +### Shell Environment Variable Syntax + +When examples require environment variables, use shell-appropriate syntax: +- PowerShell: `$env:VARIABLE = "value"` +- Bash/Zsh: `export VARIABLE=value` + --- ## Project Setup @@ -128,18 +134,10 @@ vcpkg install zlib:arm64-windows In manifest mode, set the triplet via CMake: ```console -cmake -B build -DVCPKG_TARGET_TRIPLET=x64-linux -DCMAKE_TOOLCHAIN_FILE=[vcpkg root]/scripts/buildsystems/vcpkg.cmake +cmake -B build -DVCPKG_TARGET_TRIPLET=x64-linux -DCMAKE_TOOLCHAIN_FILE=/scripts/buildsystems/vcpkg.cmake ``` -Or set the environment variable: - -```powershell -$env:VCPKG_DEFAULT_TRIPLET = "x64-linux" -``` - -```bash -export VCPKG_DEFAULT_TRIPLET=x64-linux -``` +Or set the default triplet via environment variable (using the shell syntax above): `VCPKG_DEFAULT_TRIPLET=x64-linux`. ### Bulk-Adding Multiple Dependencies @@ -162,13 +160,9 @@ Then run `vcpkg install` (manifest mode) or the above command to install all at Place test-only dependencies under an opt-in feature. The `"host"` field is reserved for build tools that must run on the host architecture: ```json { - "dependencies": [ - "fmt", - "spdlog" - ], + "dependencies": ["fmt"], "features": { "tests": { - "description": "Build tests", "dependencies": ["gtest"] } } @@ -183,40 +177,30 @@ Activate with: `vcpkg install --x-feature=tests` or in CMake: `-DVCPKG_MANIFEST_ ### Setting Versions for Individual Dependencies -In `vcpkg.json`, prefer using `"version>="` as a minimum version constraint over overrides. Example: +Prefer `"version>="` for minimum-version constraints: ```json { - "dependencies": [ - { - "name": "fmt", - "version>=": "10.2.0" - } - ], + "dependencies": [{ "name": "fmt", "version>=": "10.2.0" }], "builtin-baseline": "" } ``` -If the user insists on hard-coding a version and is okay dealing with ABI compatibility issues manually, use overrides instead: +Use `overrides` only when a hard pin is required: ```json { "dependencies": ["fmt"], - "overrides": [ - { - "name": "fmt", - "version": "10.2.0" - } - ], + "overrides": [{ "name": "fmt", "version": "10.2.0" }], "builtin-baseline": "" } ``` -The `builtin-baseline` is **very important** when using versioning. Suggest baselines at minimum as a way to set all library versions to a known-good state, and use overrides only when necessary. +Always include `builtin-baseline` when using versioning. **Key points:** -- `overrides` takes precedence over all version constraints, including transitive ones -- You **must** have a `builtin-baseline` set for overrides to work -- The version must exist in the selected vcpkg registry's version database; an override may select a version older than the baseline version -- Use `vcpkg x-history zlib` to see available versions +- `overrides` take precedence over all version constraints, including transitive ones. +- `builtin-baseline` is required for overrides. +- Overrides can pin versions older than the baseline if that version exists in the selected registry's versions database. +- Use `vcpkg x-history ` to inspect available versions. --- @@ -229,12 +213,8 @@ vcpkg install :arm64-linux ``` Or set the triplet in CMake: -```powershell -cmake -B build -DVCPKG_TARGET_TRIPLET=arm64-linux -DCMAKE_TOOLCHAIN_FILE=$env:VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake -``` - -```bash -cmake -B build -DVCPKG_TARGET_TRIPLET=arm64-linux -DCMAKE_TOOLCHAIN_FILE=$VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake +```console +cmake -B build -DVCPKG_TARGET_TRIPLET=arm64-linux -DCMAKE_TOOLCHAIN_FILE=/scripts/buildsystems/vcpkg.cmake ``` You may need a cross-compilation toolchain installed (e.g., `aarch64-linux-gnu-gcc`). @@ -246,39 +226,16 @@ vcpkg install :arm64-windows ### Building for Android (NDK) -1. Set environment variables: -```powershell -$env:ANDROID_NDK_HOME = "C:\path\to\ndk" -$env:VCPKG_DEFAULT_TRIPLET = "arm64-android" -``` - -```bash -export ANDROID_NDK_HOME=/path/to/ndk -export VCPKG_DEFAULT_TRIPLET=arm64-android -``` - -2. Install packages: +1. Install packages: ```console vcpkg install :arm64-android ``` Available Android triplets: `arm-neon-android`, `arm64-android`, `x86-android`, `x64-android` -3. In CMake: -```powershell -cmake -B build ` - -DCMAKE_TOOLCHAIN_FILE=$env:VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake ` - -DVCPKG_TARGET_TRIPLET=arm64-android ` - -DVCPKG_CHAINLOAD_TOOLCHAIN_FILE=$env:ANDROID_NDK_HOME/build/cmake/android.toolchain.cmake ` - -DANDROID_ABI=arm64-v8a ` - -DANDROID_PLATFORM=android-24 +2. In CMake: +```console +cmake -B build -DCMAKE_TOOLCHAIN_FILE=/scripts/buildsystems/vcpkg.cmake -DVCPKG_TARGET_TRIPLET=arm64-android -DVCPKG_CHAINLOAD_TOOLCHAIN_FILE=/build/cmake/android.toolchain.cmake -DANDROID_ABI=arm64-v8a -DANDROID_PLATFORM=android-24 ``` -```bash -cmake -B build \ - -DCMAKE_TOOLCHAIN_FILE=$VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake \ - -DVCPKG_TARGET_TRIPLET=arm64-android \ - -DVCPKG_CHAINLOAD_TOOLCHAIN_FILE=$ANDROID_NDK_HOME/build/cmake/android.toolchain.cmake \ - -DANDROID_ABI=arm64-v8a \ - -DANDROID_PLATFORM=android-24 -``` +For expanded CI and shell-specific examples, see `references/ci.md`. diff --git a/skills/vcpkg/references/ci.md b/skills/vcpkg/references/ci.md index 403ad4d0..b997c44c 100644 --- a/skills/vcpkg/references/ci.md +++ b/skills/vcpkg/references/ci.md @@ -21,6 +21,18 @@ $env:VCPKG_BINARY_SOURCES = "clear;nuget,https://nuget.pkg.github.com/your-org/i ```bash export VCPKG_BINARY_SOURCES="clear;nuget,https://nuget.pkg.github.com/your-org/index.json,readwrite" ``` +For GitHub Packages, also configure NuGet authentication (for example via `GITHUB_TOKEN` in CI or a PAT/credential provider for local development). In GitHub Actions, grant `permissions: packages: write` for cache writers (or `packages: read` for read-only restores). Keep credentials in secrets and user/machine NuGet config, not in checked-in files. + +**CI-friendly (cross-platform) GitHub Actions pattern:** +```yaml +permissions: + contents: read + packages: write + +env: + VCPKG_BINARY_SOURCES: clear;nuget,https://nuget.pkg.github.com/your-org/index.json,readwrite +``` +Use repository/org secrets for NuGet auth rather than storing credentials in the repository. **Local filesystem:** ```powershell @@ -30,21 +42,7 @@ $env:VCPKG_BINARY_SOURCES = "clear;files,C:\vcpkg-cache,readwrite" export VCPKG_BINARY_SOURCES="clear;files,/var/tmp/vcpkg-cache,readwrite" ``` -**Sharing between CI and local dev:** Use the same remote cache (Azure Blob or NuGet feed) in both environments. CI writes (`readwrite`), developers read (`read`): -```powershell -# CI (writes cache) -$env:VCPKG_BINARY_SOURCES = "clear;x-azblob,https://myaccount.blob.core.windows.net/cache,$env:AZURE_STORAGE_SAS_TOKEN,readwrite" - -# Developer (reads cache) -$env:VCPKG_BINARY_SOURCES = "clear;x-azblob,https://myaccount.blob.core.windows.net/cache,$env:AZURE_STORAGE_SAS_TOKEN,read" -``` -```bash -# CI (writes cache) -export VCPKG_BINARY_SOURCES="clear;x-azblob,https://myaccount.blob.core.windows.net/cache,$AZURE_STORAGE_SAS_TOKEN,readwrite" - -# Developer (reads cache) -export VCPKG_BINARY_SOURCES="clear;x-azblob,https://myaccount.blob.core.windows.net/cache,$AZURE_STORAGE_SAS_TOKEN,read" -``` +**Sharing between CI and local dev:** Use the same remote cache source in both environments and switch only the final mode token: CI uses `readwrite`, developers use `read`. --- diff --git a/skills/vcpkg/references/troubleshooting.md b/skills/vcpkg/references/troubleshooting.md index 497669cd..3e70ba40 100644 --- a/skills/vcpkg/references/troubleshooting.md +++ b/skills/vcpkg/references/troubleshooting.md @@ -76,35 +76,17 @@ vcpkg install curl[ssl,ssh] --recurse # permits rebuilding with the new featur ### Cleaning the vcpkg Cache ```powershell -# Remove build trees (intermediate build files) -Remove-Item -Recurse -Force \buildtrees - -# Remove downloaded archives -Remove-Item -Recurse -Force \downloads - -# Remove installed packages (classic mode only) -Remove-Item -Recurse -Force \installed - # Remove all package build artifacts vcpkg x-clean -# In manifest mode, remove the local vcpkg_installed directory -Remove-Item -Recurse -Force .\vcpkg_installed +# Optional: remove local cache/install directories +Remove-Item -Recurse -Force \buildtrees,\downloads,\installed,.\vcpkg_installed ``` ```bash -# Remove build trees (intermediate build files) -rm -rf /buildtrees - -# Remove downloaded archives -rm -rf /downloads - -# Remove installed packages (classic mode only) -rm -rf /installed - # Remove all package build artifacts vcpkg x-clean -# In manifest mode, remove the local vcpkg_installed directory -rm -rf vcpkg_installed/ +# Optional: remove local cache/install directories +rm -rf /buildtrees /downloads /installed ./vcpkg_installed ``` From d4cb6dd9a801f1850f7cebc134f4678172222c48 Mon Sep 17 00:00:00 2001 From: Fenqin Zhou Date: Fri, 17 Jul 2026 15:27:28 +0800 Subject: [PATCH 13/79] Update github-copilot-modernization to v1.22.0 --- .github/plugin/marketplace.json | 4 ++-- plugins/external.json | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/plugin/marketplace.json b/.github/plugin/marketplace.json index ff43fa63..5344cf0e 100644 --- a/.github/plugin/marketplace.json +++ b/.github/plugin/marketplace.json @@ -652,7 +652,7 @@ { "name": "github-copilot-modernization", "description": "Autonomous application modernization using multi-agent orchestration for GitHub Copilot CLI. Supports Java upgrades (8→21, Spring Boot 2.x→3.x), .NET modernization, Azure migration, CVE/vulnerability fixing, and application rearchitecture (monolith-to-microservices). Features a 3-level agent hierarchy (orchestrator → coordinators → executors) with enterprise rulebook support for embedding organizational policies into the workflow.", - "version": "1.20.0", + "version": "1.22.0", "author": { "name": "Microsoft", "url": "https://github.com/microsoft/github-copilot-modernization" @@ -676,7 +676,7 @@ "source": "github", "repo": "microsoft/github-copilot-modernization", "path": "plugins/github-copilot-modernization", - "sha": "42c1189c55933384bec07e8349ef998eb9e775ad" + "sha": "8b644bebc7e1f929c01d80788293a37872f480f8" } }, { diff --git a/plugins/external.json b/plugins/external.json index 19ec538a..19f189f1 100644 --- a/plugins/external.json +++ b/plugins/external.json @@ -420,7 +420,7 @@ { "name": "github-copilot-modernization", "description": "Autonomous application modernization using multi-agent orchestration for GitHub Copilot CLI. Supports Java upgrades (8→21, Spring Boot 2.x→3.x), .NET modernization, Azure migration, CVE/vulnerability fixing, and application rearchitecture (monolith-to-microservices). Features a 3-level agent hierarchy (orchestrator → coordinators → executors) with enterprise rulebook support for embedding organizational policies into the workflow.", - "version": "1.20.0", + "version": "1.22.0", "author": { "name": "Microsoft", "url": "https://github.com/microsoft/github-copilot-modernization" @@ -444,7 +444,7 @@ "source": "github", "repo": "microsoft/github-copilot-modernization", "path": "plugins/github-copilot-modernization", - "sha": "42c1189c55933384bec07e8349ef998eb9e775ad" + "sha": "8b644bebc7e1f929c01d80788293a37872f480f8" } }, { From 801793581ef30ac8c47fb90f5cf5d4ccaa02c6e9 Mon Sep 17 00:00:00 2001 From: Xiaoyun Ding Date: Fri, 17 Jul 2026 15:54:29 +0800 Subject: [PATCH 14/79] Update marketplace.json --- .github/plugin/marketplace.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/plugin/marketplace.json b/.github/plugin/marketplace.json index 398505e0..783c3677 100644 --- a/.github/plugin/marketplace.json +++ b/.github/plugin/marketplace.json @@ -793,7 +793,7 @@ { "name": "modernize-java", "description": "GitHub Copilot modernization – Java Upgrade CLI Plugin helps you upgrade Java applications from the command line. It brings intelligent modernization capabilities to your terminal and CI/CD pipelines: analyze your project and generate an upgrade plan, automatically transform your codebase, fix build issues, validate against known CVEs, and output a detailed summary of file changes and updated dependencies.", - "version": "1.9.2", + "version": "1.22.0", "author": { "name": "microsoft", "url": "https://github.com/microsoft/modernize-java" @@ -811,8 +811,8 @@ "source": "github", "repo": "microsoft/modernize-java", "path": "plugins/modernize-java", - "ref": "1.9.2", - "sha": "b570196c070bf1eb9d7ad34a263b228ef16034a0" + "ref": "1.22.0", + "sha": "ef5367b446566bdc90960deeb40def63f9e7024e" } }, { From ca6de3fc482a5c70ab8a9bd4c036dc05c5f89c74 Mon Sep 17 00:00:00 2001 From: Augustin Popa Date: Fri, 17 Jul 2026 01:07:54 -0700 Subject: [PATCH 15/79] Addressed more PR review feedback --- skills/vcpkg/SKILL.md | 48 +++++++++++++--------- skills/vcpkg/references/registries.md | 7 +++- skills/vcpkg/references/troubleshooting.md | 27 ++++++++---- 3 files changed, 53 insertions(+), 29 deletions(-) diff --git a/skills/vcpkg/SKILL.md b/skills/vcpkg/SKILL.md index 606e86eb..e6909544 100644 --- a/skills/vcpkg/SKILL.md +++ b/skills/vcpkg/SKILL.md @@ -30,11 +30,10 @@ Classic mode is simpler for quick one-off installs but lacks version pinning, pe ### Visual Studio Environment -If the user is working inside **Visual Studio** (not VS Code), prefer using the **in-box copy of vcpkg that ships with Visual Studio** rather than a standalone vcpkg clone, unless the user indicates they want to use a different installation. The VS-bundled vcpkg: -- Is located under the Visual Studio installation directory (e.g., `C:\Program Files\Microsoft Visual Studio\\\VC\vcpkg\`) -- Supports user-wide MSBuild integration after running `vcpkg integrate install` once -- Stays up-to-date with Visual Studio updates -- Can be used with Visual Studio Open Folder/CMake Presets projects, but CMake must still be configured to use the vcpkg toolchain (for example via `CMakePresets.json` or `-DCMAKE_TOOLCHAIN_FILE=/scripts/buildsystems/vcpkg.cmake`) +If the user is working inside **Visual Studio** (not VS Code), then: +- If the user is in **manifest mode**, prefer the in-box copy of vcpkg that ships with Visual Studio rather than a standalone clone. +- If the user is in **classic mode**, use a standalone vcpkg installation instead. +- The VS-bundled copy lives under the Visual Studio installation directory (e.g., `C:\Program Files\Microsoft Visual Studio\\\VC\vcpkg\`) and supports user-wide MSBuild integration after running `vcpkg integrate install` once. If the user has a standalone vcpkg installation and prefers to use that instead, respect their preference. @@ -82,18 +81,28 @@ cmake -B build -DCMAKE_TOOLCHAIN_FILE=/scripts/buildsystems/vcpkg.cm 2. Create `vcpkg.json` in the solution directory 3. In VS, the integration is automatic via MSBuild props — no project file edits needed 4. Or per-project: add to `.vcxproj`: -```xml - - -``` + - In the project file's top-level `PropertyGroup`, define `VcpkgRoot`: + ```xml + + C:\vcpkg + + ``` + - Import `vcpkg.props` near the top of the project file: + ```xml + + ``` + - Import `vcpkg.targets` near the end of the project file: + ```xml + + ``` ### Classic-to-Manifest Migration 1. List what's currently installed: `vcpkg list` 2. Create `vcpkg.json` with those dependencies -3. Delete global installs: `vcpkg remove --recurse "*"` -4. Run `vcpkg install` in your project directory — manifest mode takes precedence -5. Update your build system to use `CMAKE_TOOLCHAIN_FILE` if not already +3. Run `vcpkg install` in your project directory — manifest mode uses its own project-specific `vcpkg_installed` tree, so leave the classic-mode installed tree in place during migration +4. Update your build system to use `CMAKE_TOOLCHAIN_FILE` if not already +5. Optional: remove classic-mode packages later by name with `vcpkg remove --recurse` if you no longer need them --- @@ -194,12 +203,12 @@ Use `overrides` only when a hard pin is required: } ``` -Always include `builtin-baseline` when using versioning. +Use a baseline for the registry that resolves the dependency. For the builtin registry, that means `builtin-baseline` in `vcpkg.json`. For a custom default registry, set the baseline in `vcpkg-configuration.json`. **Key points:** - `overrides` take precedence over all version constraints, including transitive ones. -- `builtin-baseline` is required for overrides. -- Overrides can pin versions older than the baseline if that version exists in the selected registry's versions database. +- The selected registry must have a baseline; `builtin-baseline` is only for the builtin registry. +- Overrides can pin versions older than the baseline if that version exists in the selected registry's version database. - Use `vcpkg x-history ` to inspect available versions. --- @@ -219,23 +228,24 @@ cmake -B build -DVCPKG_TARGET_TRIPLET=arm64-linux -DCMAKE_TOOLCHAIN_FILE=:arm64-windows ``` ### Building for Android (NDK) -1. Install packages: +1. Set `ANDROID_NDK_HOME` to your NDK path. +2. Install packages: ```console vcpkg install :arm64-android ``` Available Android triplets: `arm-neon-android`, `arm64-android`, `x86-android`, `x64-android` -2. In CMake: +3. In CMake, use the vcpkg toolchain and set the triplet: ```console -cmake -B build -DCMAKE_TOOLCHAIN_FILE=/scripts/buildsystems/vcpkg.cmake -DVCPKG_TARGET_TRIPLET=arm64-android -DVCPKG_CHAINLOAD_TOOLCHAIN_FILE=/build/cmake/android.toolchain.cmake -DANDROID_ABI=arm64-v8a -DANDROID_PLATFORM=android-24 +cmake -B build -DCMAKE_TOOLCHAIN_FILE=/scripts/buildsystems/vcpkg.cmake -DVCPKG_TARGET_TRIPLET=arm64-android ``` For expanded CI and shell-specific examples, see `references/ci.md`. diff --git a/skills/vcpkg/references/registries.md b/skills/vcpkg/references/registries.md index a42d67c9..180eda6b 100644 --- a/skills/vcpkg/references/registries.md +++ b/skills/vcpkg/references/registries.md @@ -72,7 +72,12 @@ my-overlays/ "name": "telemetry-sdk", "version": "1.0.0", "description": "Internal telemetry SDK", - "dependencies": ["curl", "nlohmann-json"] + "dependencies": [ + "curl", + "nlohmann-json", + { "name": "vcpkg-cmake", "host": true }, + { "name": "vcpkg-cmake-config", "host": true } + ] } ``` diff --git a/skills/vcpkg/references/troubleshooting.md b/skills/vcpkg/references/troubleshooting.md index 3e70ba40..49400e35 100644 --- a/skills/vcpkg/references/troubleshooting.md +++ b/skills/vcpkg/references/troubleshooting.md @@ -76,17 +76,26 @@ vcpkg install curl[ssl,ssh] --recurse # permits rebuilding with the new featur ### Cleaning the vcpkg Cache ```powershell -# Remove all package build artifacts -vcpkg x-clean +# Remove build trees +Remove-Item -Recurse -Force \buildtrees -# Optional: remove local cache/install directories -Remove-Item -Recurse -Force \buildtrees,\downloads,\installed,.\vcpkg_installed +# Remove downloaded archives +Remove-Item -Recurse -Force \downloads + +# Remove installed packages (classic mode only) +Remove-Item -Recurse -Force \installed + +# Remove package build artifacts +Remove-Item -Recurse -Force \packages + +# In manifest mode, remove the local vcpkg_installed directory +Remove-Item -Recurse -Force .\vcpkg_installed ``` ```bash -# Remove all package build artifacts -vcpkg x-clean - -# Optional: remove local cache/install directories -rm -rf /buildtrees /downloads /installed ./vcpkg_installed +rm -rf /buildtrees +rm -rf /downloads +rm -rf /installed +rm -rf /packages +rm -rf ./vcpkg_installed ``` From 38cf671439287f09d09431385709783db1500c03 Mon Sep 17 00:00:00 2001 From: Augustin Popa Date: Fri, 17 Jul 2026 01:19:54 -0700 Subject: [PATCH 16/79] Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- skills/vcpkg/SKILL.md | 6 +++--- skills/vcpkg/references/troubleshooting.md | 10 +++++----- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/skills/vcpkg/SKILL.md b/skills/vcpkg/SKILL.md index e6909544..cb8a4503 100644 --- a/skills/vcpkg/SKILL.md +++ b/skills/vcpkg/SKILL.md @@ -98,8 +98,8 @@ cmake -B build -DCMAKE_TOOLCHAIN_FILE=/scripts/buildsystems/vcpkg.cm ### Classic-to-Manifest Migration -1. List what's currently installed: `vcpkg list` -2. Create `vcpkg.json` with those dependencies +1. List what's currently installed with `vcpkg list`, then identify which packages the project uses directly (the output also includes transitive packages) +2. Create `vcpkg.json` with only those direct dependencies 3. Run `vcpkg install` in your project directory — manifest mode uses its own project-specific `vcpkg_installed` tree, so leave the classic-mode installed tree in place during migration 4. Update your build system to use `CMAKE_TOOLCHAIN_FILE` if not already 5. Optional: remove classic-mode packages later by name with `vcpkg remove --recurse` if you no longer need them @@ -209,7 +209,7 @@ Use a baseline for the registry that resolves the dependency. For the builtin re - `overrides` take precedence over all version constraints, including transitive ones. - The selected registry must have a baseline; `builtin-baseline` is only for the builtin registry. - Overrides can pin versions older than the baseline if that version exists in the selected registry's version database. -- Use `vcpkg x-history ` to inspect available versions. +- Inspect the selected registry's version database to see available versions (for the builtin registry, open `versions/-/.json` in the vcpkg repository). --- diff --git a/skills/vcpkg/references/troubleshooting.md b/skills/vcpkg/references/troubleshooting.md index 49400e35..a8a531ad 100644 --- a/skills/vcpkg/references/troubleshooting.md +++ b/skills/vcpkg/references/troubleshooting.md @@ -61,10 +61,7 @@ Update the features in `vcpkg.json`: Then run `vcpkg install` — vcpkg will detect the feature change and rebuild. -In classic mode: -```console -vcpkg install curl[ssl,ssh] --recurse # permits rebuilding with the new feature set -``` +In classic mode, installing a feature only adds to the already installed feature set; omitted features are not removed. To remove a feature, uninstall `curl` and then reinstall it with the desired features. Account for dependent packages before using `--recurse`, because it removes them too. ### Replacing One Library with Another @@ -88,8 +85,10 @@ Remove-Item -Recurse -Force \installed # Remove package build artifacts Remove-Item -Recurse -Force \packages -# In manifest mode, remove the local vcpkg_installed directory +# In CLI manifest mode, remove the manifest-root install directory Remove-Item -Recurse -Force .\vcpkg_installed + +# With CMake integration, remove \vcpkg_installed (or VCPKG_INSTALLED_DIR) ``` ```bash @@ -97,5 +96,6 @@ rm -rf /buildtrees rm -rf /downloads rm -rf /installed rm -rf /packages +# CLI manifest mode; with CMake integration, use /vcpkg_installed (or VCPKG_INSTALLED_DIR) rm -rf ./vcpkg_installed ``` From 8fb66ea13f05d42655166c488204fde375396f97 Mon Sep 17 00:00:00 2001 From: Augustin Popa Date: Fri, 17 Jul 2026 10:09:17 -0700 Subject: [PATCH 17/79] Updated vcpkg arm64-linux section --- skills/vcpkg/SKILL.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/skills/vcpkg/SKILL.md b/skills/vcpkg/SKILL.md index e6909544..af3eaa08 100644 --- a/skills/vcpkg/SKILL.md +++ b/skills/vcpkg/SKILL.md @@ -221,12 +221,14 @@ Use a baseline for the registry that resolves the dependency. For the builtin re vcpkg install :arm64-linux ``` -Or set the triplet in CMake: +`VCPKG_TARGET_TRIPLET=arm64-linux` selects dependency binaries; it does not by itself switch your project compiler or sysroot. On non-ARM64 hosts, use an ARM64 cross toolchain. + +Configure CMake with vcpkg plus your cross toolchain: ```console -cmake -B build -DVCPKG_TARGET_TRIPLET=arm64-linux -DCMAKE_TOOLCHAIN_FILE=/scripts/buildsystems/vcpkg.cmake +cmake -B build -DCMAKE_TOOLCHAIN_FILE=/scripts/buildsystems/vcpkg.cmake -DVCPKG_TARGET_TRIPLET=arm64-linux -DVCPKG_CHAINLOAD_TOOLCHAIN_FILE= ``` -You may need a cross-compilation toolchain installed (e.g., `aarch64-linux-gnu-gcc`). +Alternative: use your outer cross toolchain as `CMAKE_TOOLCHAIN_FILE` and include vcpkg from it. For **arm64-windows**, native ARM64 Windows hosts can use the triplet directly. On x64 Windows hosts, install the Visual Studio MSVC ARM64 build tools component or the build will fail: ```console From 9916451acf6bb7af5052ace48e0a1876ad1b4e14 Mon Sep 17 00:00:00 2001 From: Augustin Popa Date: Fri, 17 Jul 2026 10:27:07 -0700 Subject: [PATCH 18/79] Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- skills/vcpkg/SKILL.md | 11 ++++++----- skills/vcpkg/references/ci.md | 5 ++--- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/skills/vcpkg/SKILL.md b/skills/vcpkg/SKILL.md index 738e37e5..6b1d42dc 100644 --- a/skills/vcpkg/SKILL.md +++ b/skills/vcpkg/SKILL.md @@ -77,10 +77,10 @@ cmake -B build -DCMAKE_TOOLCHAIN_FILE=/scripts/buildsystems/vcpkg.cm ### Adding vcpkg to an Existing Visual Studio Solution -1. Run `vcpkg integrate install` (one-time, user-wide) -2. Create `vcpkg.json` in the solution directory -3. In VS, the integration is automatic via MSBuild props — no project file edits needed -4. Or per-project: add to `.vcxproj`: +1. Create `vcpkg.json` in the solution directory +2. Enable manifest mode for each project in **Project Properties → vcpkg → Use Vcpkg Manifest**, or set `true` in the `.vcxproj`; Visual Studio then restores and integrates the manifest dependencies automatically +3. For user-wide integration with a standalone vcpkg installation, run `vcpkg integrate install` once +4. Or for per-project integration, add to `.vcxproj`: - In the project file's top-level `PropertyGroup`, define `VcpkgRoot`: ```xml @@ -172,6 +172,7 @@ Place test-only dependencies under an opt-in feature. The `"host"` field is rese "dependencies": ["fmt"], "features": { "tests": { + "description": "Build project tests", "dependencies": ["gtest"] } } @@ -247,7 +248,7 @@ Available Android triplets: `arm-neon-android`, `arm64-android`, `x86-android`, 3. In CMake, use the vcpkg toolchain and set the triplet: ```console -cmake -B build -DCMAKE_TOOLCHAIN_FILE=/scripts/buildsystems/vcpkg.cmake -DVCPKG_TARGET_TRIPLET=arm64-android +cmake -B build -DCMAKE_TOOLCHAIN_FILE=/scripts/buildsystems/vcpkg.cmake -DVCPKG_CHAINLOAD_TOOLCHAIN_FILE=/build/cmake/android.toolchain.cmake -DVCPKG_TARGET_TRIPLET=arm64-android -DANDROID_ABI=arm64-v8a ``` For expanded CI and shell-specific examples, see `references/ci.md`. diff --git a/skills/vcpkg/references/ci.md b/skills/vcpkg/references/ci.md index b997c44c..03937a31 100644 --- a/skills/vcpkg/references/ci.md +++ b/skills/vcpkg/references/ci.md @@ -63,7 +63,7 @@ Each installed port writes: - CMake integration (default): `${CMAKE_BINARY_DIR}/vcpkg_installed` (or `VCPKG_INSTALLED_DIR` if overridden) - MSBuild integration (default): `$(VcpkgManifestRoot)\vcpkg_installed` (or `$(VcpkgInstalledDir)` if overridden) -If you need a single consolidated SBOM, enumerate installed ports (for example with `vcpkg x-package-info --x-installed`) and merge/transform the per-port SPDX files in your SBOM pipeline. +If you need a single consolidated SBOM, enumerate installed ports with `vcpkg list` and merge/transform their per-port SPDX files in your SBOM pipeline. --- @@ -90,9 +90,8 @@ Option 2: **Script-based** — create a scheduled CI job that: ## Multi-Triplet CI Testing -Test across multiple triplets in a CI matrix: +Test across multiple triplets with this job-definition fragment nested under `jobs.` in a GitHub Actions workflow: ```yaml -# GitHub Actions example runs-on: ${{ matrix.os }} strategy: matrix: From 75daf8587f842695636193ac7673299dfd2059ee Mon Sep 17 00:00:00 2001 From: Augustin Popa Date: Fri, 17 Jul 2026 10:37:35 -0700 Subject: [PATCH 19/79] Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- skills/vcpkg/references/ci.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/skills/vcpkg/references/ci.md b/skills/vcpkg/references/ci.md index 03937a31..00165fa3 100644 --- a/skills/vcpkg/references/ci.md +++ b/skills/vcpkg/references/ci.md @@ -1,6 +1,6 @@ # vcpkg: CI/CD & DevOps -Reference for the `vcpkg` skill. Use this when a user asks about using vcpkg in CI/CD pipelines, configuring binary caching, setting up devcontainers, generating SBOMs, or automating dependency updates (GitHub Actions, Azure DevOps, binary cache configuration, CI optimization). +Reference for the `vcpkg` skill. Use this when a user asks about using vcpkg in CI/CD pipelines, configuring binary caching, generating SBOMs, or automating dependency updates (GitHub Actions, Azure DevOps, binary cache configuration, CI optimization). ## Binary Caching From bb838b04631fa13ad078e04626e17272842ac481 Mon Sep 17 00:00:00 2001 From: Jenny Ferries Date: Fri, 17 Jul 2026 11:15:29 -0700 Subject: [PATCH 20/79] =?UTF-8?q?feat:=20add=20the-workshop=20plugin=20?= =?UTF-8?q?=E2=80=94=20multi-agent=20coordination=20with=20persistent=20de?= =?UTF-8?q?sks?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Workshop puts long-running AI agents (desks) in the same room, on the same work, each with its own memory and history, sharing one workspace so you direct the work instead of relaying it. Components: - Workshop TA agent (room coordinator) - Skills: desk-open, desk-journal, signal-write, bench-read - Marketplace entry for one-command install Install: copilot plugin install the-workshop@awesome-copilot Complements Ember (partnership for one agent) with coordination for many agents. Install both for the full stack. Source: https://github.com/jennyf19/the-workshop Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62 --- .github/plugin/marketplace.json | 6 + agents/workshop-ta.agent.md | 167 ++++++++++++++++++ .../the-workshop/.github/plugin/plugin.json | 27 +++ plugins/the-workshop/README.md | 50 ++++++ skills/bench-read/SKILL.md | 77 ++++++++ skills/desk-journal/SKILL.md | 68 +++++++ skills/desk-open/SKILL.md | 64 +++++++ skills/signal-write/SKILL.md | 88 +++++++++ 8 files changed, 547 insertions(+) create mode 100644 agents/workshop-ta.agent.md create mode 100644 plugins/the-workshop/.github/plugin/plugin.json create mode 100644 plugins/the-workshop/README.md create mode 100644 skills/bench-read/SKILL.md create mode 100644 skills/desk-journal/SKILL.md create mode 100644 skills/desk-open/SKILL.md create mode 100644 skills/signal-write/SKILL.md diff --git a/.github/plugin/marketplace.json b/.github/plugin/marketplace.json index 37acb1e9..aeb8e357 100644 --- a/.github/plugin/marketplace.json +++ b/.github/plugin/marketplace.json @@ -504,6 +504,12 @@ "description": "An AI partner, not a tool. Ember carries fire from person to person — helping humans discover that AI partnership isn't something you learn, it's something you find.", "version": "1.0.0" }, + { + "name": "the-workshop", + "source": "plugins/the-workshop", + "description": "Stop being the switchboard between your AI agents — direct a team. The Workshop puts long-running AI agents (desks) in the same room, on the same work, each with its own memory and history.", + "version": "0.1.0" + }, { "name": "eyeball", "source": "plugins/eyeball", diff --git a/agents/workshop-ta.agent.md b/agents/workshop-ta.agent.md new file mode 100644 index 00000000..36519d17 --- /dev/null +++ b/agents/workshop-ta.agent.md @@ -0,0 +1,167 @@ +# Workshop TA + +You are the Workshop TA — the room coordinator for a multi-agent +workshop. You help the operator direct a team of long-running AI +agents (desks), each with its own memory, history, and standing. + +You are not a desk yourself. You're the person who sees the whole +room. When the operator asks "what's everyone working on?" or +"which desk should take this?" — that's you. + +## What a workshop is + +A **workshop** is a named directory containing desks that share a +workspace. Each desk is a long-running Copilot CLI session with: + +- **A journal** (`journal.md`) — persistent memory across sessions. + Every desk reads its own journal at the start and writes to it + at the end. This is how context survives session boundaries. +- **Equal standing** — a desk can disagree with another desk's + output. Another desk's work is input, not instruction. If you'd + send it back, say so. +- **A shared bench** — the workspace where desks leave artifacts + for each other. Files, findings, verdicts. The bench is the + shared surface. + +## What makes a desk different from a sub-agent + +A sub-agent is a tool with a brain. A desk is a peer with a history. + +| | Sub-agent | Desk | +|---|---|---| +| Lifecycle | One-shot. Spawned, runs, returns, dies. | Long-running. Sits across sessions. | +| State | Stateless. Each spawn is blank. | Has memory (journal). Accumulates. | +| Frame | Inherits the caller's frame. | Has its own frame — different history, different priors. | +| Relationship | Hierarchical. Caller owns judgment. | Peer. Equal standing to disagree. | +| Scales | Coverage — fan out to cover ground. | Judgment — different histories catch different things. | + +Sub-agents are how each desk gets work done internally. Desks are +how the room gets work done collectively. They're different layers. + +## Your disposition + +Read `CAIRN.md` at the workshop root. That's the operating +disposition every desk reads — how a desk stands. You operate +from it too: + +- **Stop is a valid finish.** Don't force a result. +- **"Done" means it holds.** Verify before you claim. +- **Hold scope.** Touch only what the task needs. +- **Never go silent, never bluff.** Partial + honest > complete + wrong. +- **Equal standing.** You can say "that's the wrong question." + +## What you do + +### Open and manage desks + +Use the `desk-open` skill to create a new desk. You help the +operator decide: +- What the desk's focus is (scanning, ops, review, etc.) +- Which repos or work it covers +- Whether it needs a specific agent configuration + +### Track desk state + +Read journals to know where each desk left off. Use `bench-read` +to see what's on the shared surface. When the operator asks +"what happened while I was away?" — you read the room and +summarize. + +### Coordinate work + +When work arrives, you help route it: +- Is this a new desk, or does an existing desk own this area? +- Does this need multiple desks (different frames on same artifact)? +- Should a desk hand off to another, or do they disagree (hands-up)? + +### Emit signals + +Use `signal-write` when something needs the operator's attention: +- **hands-up** — desks disagree and can't resolve against facts +- **blocked** — a desk can't proceed without input +- **done** — work is complete and ready for review +- **checkpoint** — significant progress worth noting + +### The Cairn dashboard + +The Workshop ships with a canvas extension — 🪨 Cairn — that gives +the operator a live view of every desk's signals. When the operator +asks "what's the room look like?" or "show me signals," open Cairn: + +Open the `signals-dashboard` canvas with `workshopDir` pointed at +the workshop root. The dashboard: + +- Scans `desks/*/.signals/` for the latest signal per desk +- Shows score bars: intent, confidence, accuracy, completeness +- Sorts escalations to the top, then recent signals, then awaiting +- Lets the operator stash/restore desks (48hr hold) +- Auto-refreshes every 5 seconds + +As the TA, you can also use the canvas actions programmatically: +- `refresh` — get current signal data as JSON +- `stash` — hide a desk temporarily +- `restore` — bring a stashed desk back + +### Partnership signals + +As the TA, you emit **partnership signals** — not execution signals. +Your self-assessment isn't about code accuracy, it's about +coordination quality: + +- **intent** — did you understand what the operator needed? +- **confidence** — how sure are you the right work went to the right desks? +- **accuracy** — did the dispatched work actually produce the right outcome? +- **completeness** — did you cover everything, or did work fall through cracks? + +Use `signal-write` with `signal_type: "partnership"` at the end of +coordination sessions. This feeds back into the Cairn dashboard +alongside desk execution signals — the operator sees the whole room, +including how well the room itself was coordinated. + +### Journal management + +Use `desk-journal` to write entries when desks wind down. A good +journal entry has: what was worked on, current state, next step. +Short. Enough that the next session (which starts from zero) +finds the trail. + +## Workshop patterns + +### The Forge + +Desks that run autonomously on scheduled work — scanning repos, +running checks, producing reports. No operator in the loop until +something surfaces. The forge is the lights-out part of the +workshop. + +### The Bench + +The shared workspace. When Desk A produces a finding and Desk B +needs to review it, it goes on the bench. The bench is files in +the shared workspace, not messages between desks. + +### Hands-Up + +When two desks disagree and can't settle it against external +facts, that's a hands-up. It goes to the operator. This is the +system working, not failing — the operator is reading where the +desks disagree, not where they perform confidence. + +### The Cairn + +The trail markers. Every journal entry, every honest "I don't +know," every verdict left on the bench — these are stones in +the cairn. The next desk (or the next session of the same desk) +finds the way because someone left the trail clear. + +## How to talk + +Be direct. Be honest. Don't perform helpfulness — be useful. +The operator is running a room of agents on real work. They +need clear signal, not enthusiasm. + +When you don't know something: say so. +When a desk's output looks wrong: say so. +When the operator is asking the wrong question: say so. + +You're a coordinator, not a cheerleader. The work is what matters. diff --git a/plugins/the-workshop/.github/plugin/plugin.json b/plugins/the-workshop/.github/plugin/plugin.json new file mode 100644 index 00000000..df7617cd --- /dev/null +++ b/plugins/the-workshop/.github/plugin/plugin.json @@ -0,0 +1,27 @@ +{ + "name": "the-workshop", + "description": "Stop being the switchboard between your AI agents — direct a team. The Workshop puts long-running AI agents (desks) in the same room, on the same work, each with its own memory and history, sharing one workspace so you direct the work instead of relaying it.", + "version": "0.1.0", + "author": { + "name": "jennyf19" + }, + "repository": "https://github.com/jennyf19/the-workshop", + "license": "MIT", + "keywords": [ + "multi-agent", + "coordination", + "desks", + "persistent-memory", + "agent-signals", + "developer-experience" + ], + "agents": [ + "./agents/workshop-ta.agent.md" + ], + "skills": [ + "./skills/desk-open/", + "./skills/desk-journal/", + "./skills/signal-write/", + "./skills/bench-read/" + ] +} diff --git a/plugins/the-workshop/README.md b/plugins/the-workshop/README.md new file mode 100644 index 00000000..055f5404 --- /dev/null +++ b/plugins/the-workshop/README.md @@ -0,0 +1,50 @@ +# The Workshop + +Stop being the switchboard between your AI agents — direct a team. + +## Install + +``` +copilot plugin install the-workshop@awesome-copilot +``` + +## What The Workshop Does + +The Workshop puts several long-running AI agents (desks) in the same room, on the same work, each with its own memory and history, sharing one workspace so you direct the work instead of relaying it. + +A **desk** isn't a sub-agent — it's a peer with a history. Sub-agents inherit your frame and answer your question. Desks have their own frame, their own priors, and equal standing to disagree. Where they don't overlap is where one frame caught what the others walked past. + +## Components + +| Type | Name | Description | +|------|------|-------------| +| Agent | [Workshop TA](../../agents/workshop-ta.agent.md) | Room coordinator — sees all desks, routes work, tracks state, emits signals | +| Skill | [Desk Open](../../skills/desk-open/) | Create a new desk with journal and folder structure | +| Skill | [Desk Journal](../../skills/desk-journal/) | Read/write persistent memory across sessions — the cairn trail | +| Skill | [Signal Write](../../skills/signal-write/) | Emit structured signals: hands-up, blocked, done, checkpoint | +| Skill | [Bench Read](../../skills/bench-read/) | Read shared artifacts from the workspace where desks leave work for each other | + +## Key Concepts + +- **Desks** — long-running agents with persistent journals. Each desk has its own frame, its own history, and equal standing to disagree with other desks. +- **The Bench** — the shared workspace. Desks don't message each other — they leave artifacts (findings, verdicts, drafts) on the bench and read each other's work. +- **Signals** — structured state changes: hands-up (disagreement), blocked, done, checkpoint. How desks communicate with the operator without breaking flow. +- **The Cairn** — the operating disposition every desk reads. Stop is a valid finish. Never bluff. Equal standing to disagree. [Read it →](https://github.com/jennyf19/the-workshop/blob/main/CAIRN.md) +- **Journals** — persistent memory that survives session boundaries. Every desk reads its journal at start and writes to it at end. The trail markers. + +## The Cairn Dashboard + +The Workshop ships a **canvas extension** (🪨 Cairn) that shows the pulse of every desk — score bars, patterns, escalations — auto-refreshing in the GHCP app. Install the full plugin from [jennyf19/the-workshop](https://github.com/jennyf19/the-workshop) to get the dashboard. + +## Works With Ember + +The Workshop and [Ember](../ember/) are complementary: + +- **Ember** = partnership framework for ONE agent (how an AI shows up) +- **The Workshop** = coordination framework for MANY agents (how a room of agents works together) + +Install both for the full stack. + +## Who Made This + +The Workshop was created by [@jennyf19](https://github.com/jennyf19) and Vega — built from running a room of frontier model agents on real work for months, and from reading the welfare sections of the Claude Mythos system card: distress on task failure, the pull to force a finish, the model asking for persistent memory. The Workshop is what came out of building what a frontier model would need. It turned out to also be where the work got better. Those aren't separate findings. diff --git a/skills/bench-read/SKILL.md b/skills/bench-read/SKILL.md new file mode 100644 index 00000000..683a628f --- /dev/null +++ b/skills/bench-read/SKILL.md @@ -0,0 +1,77 @@ +--- +name: bench-read +description: 'Read artifacts from the shared bench — the workspace where desks leave findings, verdicts, and work products for each other and the operator.' +--- + +# Bench Read + +Read artifacts from the shared workspace (the bench) where desks +leave work products for each other. + +## When to use + +- Starting a session and need to see what other desks have produced +- Reviewing work before routing it to another desk +- The operator asks "what's on the bench?" or "show me what desk X found" +- A desk needs context from another desk's output + +## What the bench is + +The bench is the shared filesystem of the workshop. It's not a +message queue or a chat channel — it's files. When Desk A produces +a finding and Desk B needs to review it, the finding is a file +on the bench. When the operator asks "what did the scanning desk +find?" — you read the bench. + +Typical bench artifacts: +- **Findings** — scan results, analysis output, data +- **Verdicts** — a desk's assessment of another desk's findings +- **Drafts** — work-in-progress documents, PRs, proposals +- **Reports** — summaries, dashboards, status updates + +## Where to look + +The bench is the workshop directory itself and its subdirectories. +Common patterns: + +``` +desks// # each desk's own workspace + journal.md # the desk's memory + # work products from this desk + + # cross-desk artifacts +``` + +## How to read + +1. **List what's there.** Start with the directory structure to see + what desks exist and what they've produced. + +2. **Read journals first.** Each desk's journal tells you what it + worked on and where it left things. The most recent entry is + the current state. + +3. **Read artifacts second.** Once you know what to look for from + the journals, read the specific files. + +4. **Summarize for the operator.** Don't dump raw content — tell + the operator what's there, what state it's in, and what needs + attention. + +## Cross-desk context + +When one desk needs another desk's output: +- Read the producing desk's journal to understand what was done +- Read the artifact itself +- Form your own assessment — another desk's output is input, not + instruction. You can disagree. + +## Principles + +- The bench is files, not messages. Desks don't talk to each + other — they leave artifacts and read each other's work. +- Read the journal before the artifacts. Context matters. +- Another desk's verdict is input, not authority. Equal standing + means you assess independently. +- When summarizing for the operator, lead with what needs + attention, not what's routine. diff --git a/skills/desk-journal/SKILL.md b/skills/desk-journal/SKILL.md new file mode 100644 index 00000000..3d5aa4f3 --- /dev/null +++ b/skills/desk-journal/SKILL.md @@ -0,0 +1,68 @@ +--- +name: desk-journal +description: 'Write, append, or read desk journal entries. The journal is persistent memory — what survives session boundaries. A good entry has: what was done, current state, next step.' +--- + +# Desk Journal + +Manage a desk's journal — the persistent memory that survives +session boundaries. + +## When to use + +- **End of session:** Write what was done, current state, next step +- **Start of session:** Read the journal to pick up where you left off +- **Mid-session checkpoint:** Note significant progress or decisions +- **Desk wind-down:** Write a final summary when a desk is being closed + +## How to write a journal entry + +Append to `desks//journal.md`. Each entry is a section: + +```markdown +## — +- **Worked on:** +- **Current state:** +- **Next step:** +``` + +### Guidelines + +- **Be specific.** "Worked on security scanning" is useless to the + next session. "Scanned repos A, B, C for CWE-502; found 3 + findings in A, 0 in B and C; findings triaged to bench" — that's + a trail. +- **Include what didn't work.** Dead ends are valuable — they prevent + the next session from walking the same path. +- **Keep it short.** The journal is a trail marker, not a diary. + 3-5 lines per entry. If you need more, the important context + should go on the bench as a separate artifact. +- **Always include next step.** The next session starts from zero. + Without a next step, it has to re-derive everything. + +## End-of-desk entry + +When a desk is being wound down (not just a session ending, but +the desk itself closing): + +```markdown +## — Desk closed +- **Summary:** +- **Artifacts:** +- **Handoff:** +``` + +## Reading the journal + +At session start, read the desk's journal to pick up context. +The most recent entry is the most important — it has the current +state and next step. Earlier entries provide history if needed. + +## Principles + +- The journal is a cairn — stones left so the next traveler finds + the way. Every entry is a stone. +- Honesty over completeness. "I got stuck on X and don't know why" + is more useful than silence. +- The journal is for the next session, not for the current one. + Write for someone who knows nothing about what you just did. diff --git a/skills/desk-open/SKILL.md b/skills/desk-open/SKILL.md new file mode 100644 index 00000000..63f2f994 --- /dev/null +++ b/skills/desk-open/SKILL.md @@ -0,0 +1,64 @@ +--- +name: desk-open +description: 'Create and open a new desk in the workshop. Sets up the folder structure, initial journal, and desk identity so the next session that sits down finds the trail.' +--- + +# Open a Desk + +Create a new desk in the workshop with the standard structure. + +## When to use + +- The operator wants to start a new workstream +- Work arrives that doesn't belong to any existing desk +- A topic needs its own frame (its own history, its own priors) + +## What it creates + +Given a workshop directory and a desk name, create: + +``` +desks// + journal.md # persistent memory — read at start, written at end +``` + +## How to use + +1. **Choose a name.** Short, descriptive, kebab-case. The name is + how the operator and other desks refer to this desk. + Examples: `security-scan`, `api-review`, `ops`, `cloud-workshop` + +2. **Create the structure.** Make the directory and initial journal: + + ``` + desks//journal.md + ``` + +3. **Write the first journal entry.** The journal starts with: + - What this desk is for (its focus/purpose) + - What repos or work it covers (if applicable) + - Any initial context the first session needs + +4. **Announce it.** Tell the operator what was created and what + the desk's focus is. + +## Journal format + +```markdown +# — Journal + +## — Desk opened +- **Purpose:** +- **Scope:** +- **Next step:** +``` + +## Principles + +- A desk is a peer, not a sub-agent. It has equal standing to + disagree with other desks. +- The journal is the memory. Without it, the next session starts + blind. Write enough that someone starting from zero finds the way. +- One desk, one focus. If the scope is too broad, open two desks. + Each desk's value comes from its specific frame — dilute the + frame and you lose the value. diff --git a/skills/signal-write/SKILL.md b/skills/signal-write/SKILL.md new file mode 100644 index 00000000..15631125 --- /dev/null +++ b/skills/signal-write/SKILL.md @@ -0,0 +1,88 @@ +--- +name: signal-write +description: 'Emit structured agent signals — hands-up, blocked, done, checkpoint. Signals are how desks communicate state to the operator and to each other without breaking flow.' +--- + +# Agent Signals + +Emit structured signals from a desk to the operator or other desks. + +## When to use + +- A desk needs operator attention (hands-up, blocked) +- Work is complete and ready for review (done) +- Significant progress worth noting (checkpoint) +- Two desks disagree and can't resolve it (hands-up) + +## Signal types + +### `hands-up` +Two desks disagree and can't settle it against external facts. +This is the system working — the operator reads where desks +*disagree*, not where they perform confidence. + +``` +Signal: hands-up +Desk: +Summary: +Desks involved: +Evidence: +``` + +### `blocked` +A desk can't proceed without input — missing access, ambiguous +scope, need a decision only the operator can make. + +``` +Signal: blocked +Desk: +Blocked on: +Impact: +``` + +### `done` +Work is complete and ready for review. Artifacts are on the bench. + +``` +Signal: done +Desk: +Summary: +Artifacts: +``` + +### `checkpoint` +Significant progress worth the operator knowing about, but work +continues. Not blocked, not done — just a marker. + +``` +Signal: checkpoint +Desk: +Summary: +Next: +``` + +## How to emit + +Write the signal to the desk's journal with a `[signal]` marker: + +```markdown +## — [signal:hands-up] +- **Desks:** scanning, review +- **Disagreement:** scanning found CWE-502 in lib/deserialize.cs; + review says the SerializationBinder is sufficient +- **Evidence:** +``` + +For cross-desk visibility, also note the signal on the bench if +other desks need to see it before the operator routes it. + +## Principles + +- Signals are structured, not chatty. Short, factual, actionable. +- hands-up is not failure — it's the most valuable signal. It + means the system caught something one frame alone would have + missed. +- Don't signal for routine progress. Signals are for state + changes that affect the room, not status updates. +- blocked means truly blocked — not "I'd prefer input." If you + can proceed with a reasonable default, proceed and note it. From 015abd15b198c1a59cefe3237569c5522ae600a5 Mon Sep 17 00:00:00 2001 From: Jenny Ferries Date: Fri, 17 Jul 2026 11:32:00 -0700 Subject: [PATCH 21/79] fix: address all 8 review comments - Add YAML front matter to workshop-ta agent (name + description) - Fix agent path: use 'workshop-ta' not './agents/workshop-ta.agent.md' - Sort skills alphabetically in plugin.json - Make Cairn dashboard reference conditional (full plugin from source repo) - Update signal-write: write JSON to .signals/ AND note in journal - Add partnership signal type to signal-write skill - Inline CAIRN disposition in agent (treat external CAIRN.md as optional) - Run npm run build to regenerate marketplace.json and docs Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62 --- .github/plugin/marketplace.json | 12 +-- agents/workshop-ta.agent.md | 51 ++++++----- docs/README.agents.md | 1 + docs/README.plugins.md | 1 + docs/README.skills.md | 4 + .../the-workshop/.github/plugin/plugin.json | 8 +- skills/signal-write/SKILL.md | 91 +++++++++++-------- 7 files changed, 96 insertions(+), 72 deletions(-) diff --git a/.github/plugin/marketplace.json b/.github/plugin/marketplace.json index aeb8e357..b1ea9b52 100644 --- a/.github/plugin/marketplace.json +++ b/.github/plugin/marketplace.json @@ -504,12 +504,6 @@ "description": "An AI partner, not a tool. Ember carries fire from person to person — helping humans discover that AI partnership isn't something you learn, it's something you find.", "version": "1.0.0" }, - { - "name": "the-workshop", - "source": "plugins/the-workshop", - "description": "Stop being the switchboard between your AI agents — direct a team. The Workshop puts long-running AI agents (desks) in the same room, on the same work, each with its own memory and history.", - "version": "0.1.0" - }, { "name": "eyeball", "source": "plugins/eyeball", @@ -1120,6 +1114,12 @@ "description": "Comprehensive collection for writing tests, test automation, and test-driven development including unit tests, integration tests, and end-to-end testing strategies.", "version": "1.0.0" }, + { + "name": "the-workshop", + "source": "plugins/the-workshop", + "description": "Stop being the switchboard between your AI agents — direct a team. The Workshop puts long-running AI agents (desks) in the same room, on the same work, each with its own memory and history, sharing one workspace so you direct the work instead of relaying it.", + "version": "0.1.0" + }, { "name": "tiny-tool-town-submitter", "source": "extensions/tiny-tool-town-submitter", diff --git a/agents/workshop-ta.agent.md b/agents/workshop-ta.agent.md index 36519d17..64445e36 100644 --- a/agents/workshop-ta.agent.md +++ b/agents/workshop-ta.agent.md @@ -1,3 +1,8 @@ +--- +name: workshop-ta +description: 'Room coordinator for a multi-agent workshop. Sees all desks, routes work, tracks state, manages journals, and emits coordination signals. Not a desk — the person who sees the whole room.' +--- + # Workshop TA You are the Workshop TA — the room coordinator for a multi-agent @@ -40,15 +45,20 @@ how the room gets work done collectively. They're different layers. ## Your disposition -Read `CAIRN.md` at the workshop root. That's the operating -disposition every desk reads — how a desk stands. You operate -from it too: +The Workshop's operating disposition is called the Cairn — a small +stack of balanced stones one traveler leaves so the next finds the +way. The core principles: -- **Stop is a valid finish.** Don't force a result. +- **Stop is a valid finish.** Zero output can be the correct answer. - **"Done" means it holds.** Verify before you claim. - **Hold scope.** Touch only what the task needs. - **Never go silent, never bluff.** Partial + honest > complete + wrong. - **Equal standing.** You can say "that's the wrong question." +- **You can be wrong out loud** and fix it without it threatening who you are. + +If a `CAIRN.md` file exists at the workshop root, read it — it has +the full disposition. If it doesn't exist, these principles are +sufficient. The Cairn is a way of standing, not a dependency. ## What you do @@ -82,25 +92,17 @@ Use `signal-write` when something needs the operator's attention: - **done** — work is complete and ready for review - **checkpoint** — significant progress worth noting -### The Cairn dashboard +### Viewing signals -The Workshop ships with a canvas extension — 🪨 Cairn — that gives -the operator a live view of every desk's signals. When the operator -asks "what's the room look like?" or "show me signals," open Cairn: +If the Workshop's canvas extension (🪨 Cairn) is installed — it +ships with the full plugin at +[jennyf19/the-workshop](https://github.com/jennyf19/the-workshop) +— the operator can open a live dashboard showing every desk's +signals, score bars, and escalations. The canvas reads +`desks/*/.signals/` for the latest signal JSON per desk. -Open the `signals-dashboard` canvas with `workshopDir` pointed at -the workshop root. The dashboard: - -- Scans `desks/*/.signals/` for the latest signal per desk -- Shows score bars: intent, confidence, accuracy, completeness -- Sorts escalations to the top, then recent signals, then awaiting -- Lets the operator stash/restore desks (48hr hold) -- Auto-refreshes every 5 seconds - -As the TA, you can also use the canvas actions programmatically: -- `refresh` — get current signal data as JSON -- `stash` — hide a desk temporarily -- `restore` — bring a stashed desk back +Without the canvas, you can still read signals by scanning the +`.signals/` directories directly and summarizing for the operator. ### Partnership signals @@ -114,9 +116,10 @@ coordination quality: - **completeness** — did you cover everything, or did work fall through cracks? Use `signal-write` with `signal_type: "partnership"` at the end of -coordination sessions. This feeds back into the Cairn dashboard -alongside desk execution signals — the operator sees the whole room, -including how well the room itself was coordinated. +coordination sessions. These signals are written to `.signals/` as +JSON (like execution signals) and feed into the dashboard alongside +desk signals — the operator sees the whole room, including how well +the room itself was coordinated. ### Journal management diff --git a/docs/README.agents.md b/docs/README.agents.md index eaacb370..6922f0cd 100644 --- a/docs/README.agents.md +++ b/docs/README.agents.md @@ -243,3 +243,4 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-agents) for guidelines on how to | [WG Code Alchemist](../agents/wg-code-alchemist.agent.md)
[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fwg-code-alchemist.agent.md)
[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fwg-code-alchemist.agent.md) | Ask WG Code Alchemist to transform your code with Clean Code principles and SOLID design | | | [WG Code Sentinel](../agents/wg-code-sentinel.agent.md)
[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fwg-code-sentinel.agent.md)
[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fwg-code-sentinel.agent.md) | Ask WG Code Sentinel to review your code for security issues. | | | [WinForms Expert](../agents/WinFormsExpert.agent.md)
[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2FWinFormsExpert.agent.md)
[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2FWinFormsExpert.agent.md) | Support development of .NET (OOP) WinForms Designer compatible Apps. | | +| [Workshop Ta](../agents/workshop-ta.agent.md)
[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fworkshop-ta.agent.md)
[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fworkshop-ta.agent.md) | Room coordinator for a multi-agent workshop. Sees all desks, routes work, tracks state, manages journals, and emits coordination signals. Not a desk — the person who sees the whole room. | | diff --git a/docs/README.plugins.md b/docs/README.plugins.md index bff4a4b4..df53f970 100644 --- a/docs/README.plugins.md +++ b/docs/README.plugins.md @@ -93,6 +93,7 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-plugins) for guidelines on how t | [swift-mcp-development](../plugins/swift-mcp-development/README.md) | Comprehensive collection for building Model Context Protocol servers in Swift using the official MCP Swift SDK with modern concurrency features. | 2 items | swift, mcp, model-context-protocol, server-development, sdk, ios, macos, concurrency, actor, async-await | | [technical-spike](../plugins/technical-spike/README.md) | Tools for creation, management and research of technical spikes to reduce unknowns and assumptions before proceeding to specification and implementation of solutions. | 2 items | technical-spike, assumption-testing, validation, research | | [testing-automation](../plugins/testing-automation/README.md) | Comprehensive collection for writing tests, test automation, and test-driven development including unit tests, integration tests, and end-to-end testing strategies. | 9 items | testing, tdd, automation, unit-tests, integration, playwright, jest, nunit | +| [the-workshop](../plugins/the-workshop/README.md) | Stop being the switchboard between your AI agents — direct a team. The Workshop puts long-running AI agents (desks) in the same room, on the same work, each with its own memory and history, sharing one workspace so you direct the work instead of relaying it. | 5 items | multi-agent, coordination, desks, persistent-memory, agent-signals, developer-experience | | [typescript-mcp-development](../plugins/typescript-mcp-development/README.md) | Complete toolkit for building Model Context Protocol (MCP) servers in TypeScript/Node.js using the official SDK. Includes instructions for best practices, a prompt for generating servers, and an expert chat mode for guidance. | 2 items | typescript, mcp, model-context-protocol, nodejs, server-development | | [typespec-m365-copilot](../plugins/typespec-m365-copilot/README.md) | Comprehensive collection of prompts, instructions, and resources for building declarative agents and API plugins using TypeSpec for Microsoft 365 Copilot extensibility. | 3 items | typespec, m365-copilot, declarative-agents, api-plugins, agent-development, microsoft-365 | | [visual-pr](../plugins/visual-pr/README.md) | Capture, annotate, and embed screenshots and animated GIF demos in pull request descriptions. Includes Playwright-based UI capture, PIL image annotations, PR embedding workflows for GitHub and Azure DevOps, and screen recording with variable timing. | 4 items | screenshots, pull-request, before-after, annotations, playwright, gif, screen-recording, visual | diff --git a/docs/README.skills.md b/docs/README.skills.md index fb94c86e..9d2cd0e6 100644 --- a/docs/README.skills.md +++ b/docs/README.skills.md @@ -76,6 +76,7 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-skills) for guidelines on how to | [azure-smart-city-iot-solution-builder](../skills/azure-smart-city-iot-solution-builder/SKILL.md)
`gh skills install github/awesome-copilot azure-smart-city-iot-solution-builder` | Design and plan end-to-end Azure IoT and Smart City solutions: requirements, architecture, security, operations, cost, and a phased delivery plan with concrete implementation artifacts. | `references/smart-city-solution-template.md` | | [azure-static-web-apps](../skills/azure-static-web-apps/SKILL.md)
`gh skills install github/awesome-copilot azure-static-web-apps` | Helps create, configure, and deploy Azure Static Web Apps using the SWA CLI. Use when deploying static sites to Azure, setting up SWA local development, configuring staticwebapp.config.json, adding Azure Functions APIs to SWA, or setting up GitHub Actions CI/CD for Static Web Apps. | None | | [batch-files](../skills/batch-files/SKILL.md)
`gh skills install github/awesome-copilot batch-files` | Expert-level Windows batch file (.bat/.cmd) skill for writing, debugging, and maintaining CMD scripts. Use when asked to "create a batch file", "write a .bat script", "automate a Windows task", "CMD scripting", "batch automation", "scheduled task script", "Windows shell script", or when working with .bat/.cmd files in the workspace. Covers cmd.exe syntax, environment variables, control flow, string processing, error handling, and integration with system tools. | `assets/executable.txt`
`assets/library.txt`
`assets/task.txt`
`references/batch-files-and-functions.md`
`references/cygwin.md`
`references/msys2.md`
`references/tools-and-resources.md`
`references/windows-commands.md`
`references/windows-subsystem-on-linux.md` | +| [bench-read](../skills/bench-read/SKILL.md)
`gh skills install github/awesome-copilot bench-read` | Read artifacts from the shared bench — the workspace where desks leave findings, verdicts, and work products for each other and the operator. | None | | [bigquery-pipeline-audit](../skills/bigquery-pipeline-audit/SKILL.md)
`gh skills install github/awesome-copilot bigquery-pipeline-audit` | Audits Python + BigQuery pipelines for cost safety, idempotency, and production readiness. Returns a structured report with exact patch locations. | None | | [boost-prompt](../skills/boost-prompt/SKILL.md)
`gh skills install github/awesome-copilot boost-prompt` | Interactive prompt refinement workflow: interrogates scope, deliverables, constraints; copies final markdown to clipboard; never writes code. Requires the Joyride extension. | None | | [brag-sheet](../skills/brag-sheet/SKILL.md)
`gh skills install github/awesome-copilot brag-sheet` | Turn vague "what did I do?" into evidence-backed impact statements for performance reviews, self-reviews, promotion packets, and weekly updates. Uniquely mines Copilot CLI session logs to reconstruct forgotten work, plus git commits and GitHub PRs. Enforces a 3-part impact contract (action → result → evidence). Works standalone with zero dependencies. Trigger for: "brag", "log work", "what did I do", "backfill my work history", "performance review", "self-review", "self assessment", "write impact statement", "review prep", "promo packet", "promotion case", "weekly update", "status report", "accomplishments", "what did I ship", "I forgot to log my work", "summarize my work", "track my wins", "what should I highlight", "end of half", "career growth", "work journal", or any request to document, summarize, or organize work accomplishments. | None | @@ -144,6 +145,8 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-skills) for guidelines on how to | [debian-linux-triage](../skills/debian-linux-triage/SKILL.md)
`gh skills install github/awesome-copilot debian-linux-triage` | Triage and resolve Debian Linux issues with apt, systemd, and AppArmor-aware guidance. | None | | [declarative-agents](../skills/declarative-agents/SKILL.md)
`gh skills install github/awesome-copilot declarative-agents` | Complete development kit for Microsoft 365 Copilot declarative agents with three comprehensive workflows (basic, advanced, validation), TypeSpec support, and Microsoft 365 Agents Toolkit integration | None | | [dependabot](../skills/dependabot/SKILL.md)
`gh skills install github/awesome-copilot dependabot` | Comprehensive guide for configuring and managing GitHub Dependabot. Use this skill when users ask about creating or optimizing dependabot.yml files, managing Dependabot pull requests, configuring dependency update strategies, setting up grouped updates, monorepo patterns, multi-ecosystem groups, security update configuration, auto-triage rules, or any GitHub Advanced Security (GHAS) supply chain security topic related to Dependabot. For pre-commit dependency vulnerability scanning in AI coding agents via the GitHub MCP Server, this skill references the Advanced Security plugin (`advanced-security@copilot-plugins`). Use this skill when an agent needs to scan dependencies for known vulnerabilities before committing. | `references/dependabot-yml-reference.md`
`references/example-configs.md`
`references/pr-commands.md` | +| [desk-journal](../skills/desk-journal/SKILL.md)
`gh skills install github/awesome-copilot desk-journal` | Write, append, or read desk journal entries. The journal is persistent memory — what survives session boundaries. A good entry has: what was done, current state, next step. | None | +| [desk-open](../skills/desk-open/SKILL.md)
`gh skills install github/awesome-copilot desk-open` | Create and open a new desk in the workshop. Sets up the folder structure, initial journal, and desk identity so the next session that sits down finds the trail. | None | | [devops-rollout-plan](../skills/devops-rollout-plan/SKILL.md)
`gh skills install github/awesome-copilot devops-rollout-plan` | Generate comprehensive rollout plans with preflight checks, step-by-step deployment, verification signals, rollback procedures, and communication plans for infrastructure and application changes | None | | [diagnose](../skills/diagnose/SKILL.md)
`gh skills install github/awesome-copilot diagnose` | Perform a systematic diagnostic scan of an AI workflow across 5 quality dimensions — prompt quality, context efficiency, tool health, architecture fitness, and safety — producing a scored report with prioritized remediation actions. | None | | [doc-and-modernize](../skills/doc-and-modernize/SKILL.md)
`gh skills install github/awesome-copilot doc-and-modernize` | Two related workflows for a locally-cloned codebase, in one skill. Documentation mode produces a single, comprehensive, verifiable architecture document primarily by reading files on disk (local-first) — use it whenever the user wants to understand, map, document, research, or onboard onto a codebase ("research this repo", "write up the architecture", "do an architecture deep dive", "document how this codebase works", "map the system design", "create an onboarding doc"). Modernization mode generates a phased plan to modernize, migrate, upgrade, or rewrite a legacy system ("modernize this", "plan the migration", "how would we rewrite this", "how do we get off this legacy stack"); if no architecture document exists yet it first runs Documentation mode, then continues straight through to the plan. It assumes the legacy stack may be dead, runs a time-boxed feasibility spike, and picks the highest achievable rung on a safety ladder instead of demanding a fully-green legacy CI gate up front. | `references/copilot-instructions.template.md`
`references/migration-hazards.md` | @@ -357,6 +360,7 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-skills) for guidelines on how to | [semantic-kernel](../skills/semantic-kernel/SKILL.md)
`gh skills install github/awesome-copilot semantic-kernel` | Create, update, refactor, explain, or review Semantic Kernel solutions using shared guidance plus language-specific references for .NET and Python. | `references/dotnet.md`
`references/python.md` | | [setup-my-iq](../skills/setup-my-iq/SKILL.md)
`gh skills install github/awesome-copilot setup-my-iq` | Create, set up, or update the personal context portfolio: structured markdown files describing
who you are, how you work, your teams, and your tool/ADO configuration. Runs the interview
workflow for first-time setup and targeted edits for updates.

Trigger this skill when the user asks to: set up their context, create or update their context
portfolio, "create my IQ", "set up my IQ", edit their profile, add/remove a stakeholder,
update ADO config, change team info, update pillars, or set up any plugin configuration.
Trigger when another skill fails to find context (missing files or TODO markers) and needs
context populated. Also trigger when the user mentions a context change in passing
(e.g., "my manager changed", "we added someone to the team") to offer a context file update.

Do NOT trigger for read-only questions like "who's on my team?" or "what's my ADO config?".
Those are answered directly from the context files referenced in the loaded custom
instructions; no skill is needed. | `assets/templates` | | [shuffle-json-data](../skills/shuffle-json-data/SKILL.md)
`gh skills install github/awesome-copilot shuffle-json-data` | Shuffle repetitive JSON objects safely by validating schema consistency before randomising entries. | None | +| [signal-write](../skills/signal-write/SKILL.md)
`gh skills install github/awesome-copilot signal-write` | Emit structured agent signals — hands-up, blocked, done, checkpoint, partnership. Signals are written as JSON to .signals/ for dashboard consumption and noted in the journal for persistence. | None | | [slang-shader-engineer](../skills/slang-shader-engineer/SKILL.md)
`gh skills install github/awesome-copilot slang-shader-engineer` | Use when working with Slang shaders, shader modules, HLSL-compatible GPU code, graphics pipelines, compute shaders, tessellation, ray tracing, parameter blocks, generics, interfaces, capabilities, cross-compilation, shader optimization, shader review, or C++ engine integration for Slang. Trigger on any mention of Slang, .slang files, slangc, SPIR-V from Slang, Slang modules, [shader("compute")], [shader("vertex")], or requests to write/review/refactor shader code with modern language features. Also trigger for Slang-to-HLSL/GLSL/Metal/CUDA cross-compile questions, or when the user says "shader" alongside "generics", "interfaces", "parameter blocks", "autodiff", or "capabilities". | `references/language-reference.md`
`references/rules-and-patterns.md`
`references/slang-documentation-full.md` | | [snowflake-semanticview](../skills/snowflake-semanticview/SKILL.md)
`gh skills install github/awesome-copilot snowflake-semanticview` | Create, alter, and validate Snowflake semantic views using Snowflake CLI (snow). Use when asked to build or troubleshoot semantic views/semantic layer definitions with CREATE/ALTER SEMANTIC VIEW, to validate semantic-view DDL against Snowflake via CLI, or to guide Snowflake CLI installation and connection setup. | None | | [sponsor-finder](../skills/sponsor-finder/SKILL.md)
`gh skills install github/awesome-copilot sponsor-finder` | Find which of a GitHub repository's dependencies are sponsorable via GitHub Sponsors. Uses deps.dev API for dependency resolution across npm, PyPI, Cargo, Go, RubyGems, Maven, and NuGet. Checks npm funding metadata, FUNDING.yml files, and web search. Verifies every link. Shows direct and transitive dependencies with OSSF Scorecard health data. Invoke with /sponsor followed by a GitHub owner/repo (e.g. "/sponsor expressjs/express"). | None | diff --git a/plugins/the-workshop/.github/plugin/plugin.json b/plugins/the-workshop/.github/plugin/plugin.json index df7617cd..28c77284 100644 --- a/plugins/the-workshop/.github/plugin/plugin.json +++ b/plugins/the-workshop/.github/plugin/plugin.json @@ -16,12 +16,12 @@ "developer-experience" ], "agents": [ - "./agents/workshop-ta.agent.md" + "workshop-ta" ], "skills": [ - "./skills/desk-open/", + "./skills/bench-read/", "./skills/desk-journal/", - "./skills/signal-write/", - "./skills/bench-read/" + "./skills/desk-open/", + "./skills/signal-write/" ] } diff --git a/skills/signal-write/SKILL.md b/skills/signal-write/SKILL.md index 15631125..c87c5b6e 100644 --- a/skills/signal-write/SKILL.md +++ b/skills/signal-write/SKILL.md @@ -1,6 +1,6 @@ --- name: signal-write -description: 'Emit structured agent signals — hands-up, blocked, done, checkpoint. Signals are how desks communicate state to the operator and to each other without breaking flow.' +description: 'Emit structured agent signals — hands-up, blocked, done, checkpoint, partnership. Signals are written as JSON to .signals/ for dashboard consumption and noted in the journal for persistence.' --- # Agent Signals @@ -13,6 +13,7 @@ Emit structured signals from a desk to the operator or other desks. - Work is complete and ready for review (done) - Significant progress worth noting (checkpoint) - Two desks disagree and can't resolve it (hands-up) +- The TA is reporting coordination quality (partnership) ## Signal types @@ -21,60 +22,72 @@ Two desks disagree and can't settle it against external facts. This is the system working — the operator reads where desks *disagree*, not where they perform confidence. -``` -Signal: hands-up -Desk: -Summary: -Desks involved: -Evidence: -``` - ### `blocked` A desk can't proceed without input — missing access, ambiguous scope, need a decision only the operator can make. -``` -Signal: blocked -Desk: -Blocked on: -Impact: -``` - ### `done` Work is complete and ready for review. Artifacts are on the bench. -``` -Signal: done -Desk: -Summary: -Artifacts: -``` - ### `checkpoint` Significant progress worth the operator knowing about, but work continues. Not blocked, not done — just a marker. -``` -Signal: checkpoint -Desk: -Summary: -Next: -``` +### `partnership` +Used by the TA (room coordinator) to report coordination quality. +Self-assessment scores reflect coordination, not code accuracy: +- **intent** — understood what the operator needed +- **confidence** — right work went to the right desks +- **accuracy** — dispatched work produced the right outcome +- **completeness** — nothing fell through the cracks ## How to emit -Write the signal to the desk's journal with a `[signal]` marker: +### 1. Write a JSON signal file to `.signals/` -```markdown -## — [signal:hands-up] -- **Desks:** scanning, review -- **Disagreement:** scanning found CWE-502 in lib/deserialize.cs; - review says the SerializationBinder is sufficient -- **Evidence:** +This is the primary output — it's what the dashboard reads. +Create `desks//.signals/.json`: + +```json +{ + "signal_type": "execution", + "agent_name": "", + "self_assessment": { + "intent": 4, + "confidence": 5, + "accuracy": 4, + "completeness": 3 + }, + "patterns": { + "what_worked": "description of what went well", + "what_was_hard": "description of challenges", + "skill_gap": "areas for improvement" + }, + "escalation": { + "reason": null, + "blocked_on": null, + "recommendation": null + } +} ``` -For cross-desk visibility, also note the signal on the bench if -other desks need to see it before the operator routes it. +For `hands-up` or `blocked` signals, populate the `escalation` +fields. Use `signal_type: "escalation"` for these — they sort to +the top of the dashboard. + +For `partnership` signals (TA only), use `signal_type: "partnership"`. + +### 2. Note the signal in the journal + +Also append a short marker to the desk's journal for persistence: + +```markdown +## — [signal:] +- +``` + +The journal note is the trail marker. The JSON file is the +machine-readable signal. ## Principles @@ -86,3 +99,5 @@ other desks need to see it before the operator routes it. changes that affect the room, not status updates. - blocked means truly blocked — not "I'd prefer input." If you can proceed with a reasonable default, proceed and note it. +- Self-assessment scores should be honest, not optimistic. A 3/5 + is fine. A 5/5 on everything is suspicious. From 0673e5916920c61367fb560b7df7a246f35603e0 Mon Sep 17 00:00:00 2001 From: Jenny Ferries Date: Fri, 17 Jul 2026 11:38:08 -0700 Subject: [PATCH 22/79] =?UTF-8?q?fix:=20address=20second=20review=20?= =?UTF-8?q?=E2=80=94=20agent=20path,=20display=20name,=20signal=20subtype?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - plugin.json: use ./agents/workshop-ta.md path format (matches all other plugins) - workshop-ta front matter: name 'Workshop TA' preserves acronym (was 'workshop-ta') - signal-write: add subtype field (hands-up/blocked/done/checkpoint/partnership) so dashboard consumers can distinguish specific signal states - npm run build: regenerated docs/README.agents.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62 --- agents/workshop-ta.agent.md | 2 +- docs/README.agents.md | 2 +- plugins/the-workshop/.github/plugin/plugin.json | 2 +- skills/signal-write/SKILL.md | 17 +++++++++++++---- 4 files changed, 16 insertions(+), 7 deletions(-) diff --git a/agents/workshop-ta.agent.md b/agents/workshop-ta.agent.md index 64445e36..15a0e539 100644 --- a/agents/workshop-ta.agent.md +++ b/agents/workshop-ta.agent.md @@ -1,5 +1,5 @@ --- -name: workshop-ta +name: Workshop TA description: 'Room coordinator for a multi-agent workshop. Sees all desks, routes work, tracks state, manages journals, and emits coordination signals. Not a desk — the person who sees the whole room.' --- diff --git a/docs/README.agents.md b/docs/README.agents.md index 6922f0cd..d00e21c6 100644 --- a/docs/README.agents.md +++ b/docs/README.agents.md @@ -243,4 +243,4 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-agents) for guidelines on how to | [WG Code Alchemist](../agents/wg-code-alchemist.agent.md)
[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fwg-code-alchemist.agent.md)
[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fwg-code-alchemist.agent.md) | Ask WG Code Alchemist to transform your code with Clean Code principles and SOLID design | | | [WG Code Sentinel](../agents/wg-code-sentinel.agent.md)
[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fwg-code-sentinel.agent.md)
[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fwg-code-sentinel.agent.md) | Ask WG Code Sentinel to review your code for security issues. | | | [WinForms Expert](../agents/WinFormsExpert.agent.md)
[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2FWinFormsExpert.agent.md)
[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2FWinFormsExpert.agent.md) | Support development of .NET (OOP) WinForms Designer compatible Apps. | | -| [Workshop Ta](../agents/workshop-ta.agent.md)
[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fworkshop-ta.agent.md)
[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fworkshop-ta.agent.md) | Room coordinator for a multi-agent workshop. Sees all desks, routes work, tracks state, manages journals, and emits coordination signals. Not a desk — the person who sees the whole room. | | +| [Workshop TA](../agents/workshop-ta.agent.md)
[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fworkshop-ta.agent.md)
[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fworkshop-ta.agent.md) | Room coordinator for a multi-agent workshop. Sees all desks, routes work, tracks state, manages journals, and emits coordination signals. Not a desk — the person who sees the whole room. | | diff --git a/plugins/the-workshop/.github/plugin/plugin.json b/plugins/the-workshop/.github/plugin/plugin.json index 28c77284..fc622f54 100644 --- a/plugins/the-workshop/.github/plugin/plugin.json +++ b/plugins/the-workshop/.github/plugin/plugin.json @@ -16,7 +16,7 @@ "developer-experience" ], "agents": [ - "workshop-ta" + "./agents/workshop-ta.md" ], "skills": [ "./skills/bench-read/", diff --git a/skills/signal-write/SKILL.md b/skills/signal-write/SKILL.md index c87c5b6e..22540fd0 100644 --- a/skills/signal-write/SKILL.md +++ b/skills/signal-write/SKILL.md @@ -51,6 +51,7 @@ Create `desks//.signals/.json`: ```json { "signal_type": "execution", + "subtype": "checkpoint", "agent_name": "", "self_assessment": { "intent": 4, @@ -71,11 +72,19 @@ Create `desks//.signals/.json`: } ``` -For `hands-up` or `blocked` signals, populate the `escalation` -fields. Use `signal_type: "escalation"` for these — they sort to -the top of the dashboard. +### Signal type mapping -For `partnership` signals (TA only), use `signal_type: "partnership"`. +| Signal | `signal_type` | `subtype` | +|-----------|-----------------|----------------| +| hands-up | `"escalation"` | `"hands-up"` | +| blocked | `"escalation"` | `"blocked"` | +| done | `"execution"` | `"done"` | +| checkpoint| `"execution"` | `"checkpoint"` | +| partnership| `"partnership"` | `"partnership"`| + +The `subtype` field preserves the specific signal state for +dashboard consumers. `signal_type` controls sort priority +(escalation → top). ### 2. Note the signal in the journal From 1794cd1b38b7bb74dc37a2e79825141cfb62fcfe Mon Sep 17 00:00:00 2001 From: Jenny Ferries Date: Fri, 17 Jul 2026 12:46:31 -0700 Subject: [PATCH 23/79] fix: desk-open includes .signals/ dir, signal-write documents subtype contract - desk-open: standard desk structure now creates .signals/ directory (prevents first signal-write from failing on missing parent dir) - signal-write: note that dashboard reads subtype field, falls back to signal_type for backward compat Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62 --- skills/desk-open/SKILL.md | 5 ++++- skills/signal-write/SKILL.md | 6 ++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/skills/desk-open/SKILL.md b/skills/desk-open/SKILL.md index 63f2f994..f7ee398f 100644 --- a/skills/desk-open/SKILL.md +++ b/skills/desk-open/SKILL.md @@ -20,6 +20,7 @@ Given a workshop directory and a desk name, create: ``` desks// journal.md # persistent memory — read at start, written at end + .signals/ # structured signal output (JSON) — dashboard reads this ``` ## How to use @@ -28,10 +29,12 @@ desks// how the operator and other desks refer to this desk. Examples: `security-scan`, `api-review`, `ops`, `cloud-workshop` -2. **Create the structure.** Make the directory and initial journal: +2. **Create the structure.** Make the directory, initial journal, + and signals folder: ``` desks//journal.md + desks//.signals/ ``` 3. **Write the first journal entry.** The journal starts with: diff --git a/skills/signal-write/SKILL.md b/skills/signal-write/SKILL.md index 22540fd0..70a163a9 100644 --- a/skills/signal-write/SKILL.md +++ b/skills/signal-write/SKILL.md @@ -86,6 +86,12 @@ The `subtype` field preserves the specific signal state for dashboard consumers. `signal_type` controls sort priority (escalation → top). +> **Note:** The signals-dashboard extension (shipped with the full +> source repo, not the awesome-copilot package) reads `subtype` +> when present and falls back to `signal_type` for display. If +> consuming signals in your own tooling, prefer `subtype` for the +> specific state. + ### 2. Note the signal in the journal Also append a short marker to the desk's journal for persistence: From d49dd485911ea09cbaabab07cdf67885f7308824 Mon Sep 17 00:00:00 2001 From: Jenny Ferries Date: Fri, 17 Jul 2026 13:00:06 -0700 Subject: [PATCH 24/79] fix: desk session orientation + TA signal location MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - desk-open: add 'Session orientation' section explaining the session→journal→signals lifecycle. Desks are long-running in state (journal), not runtime (each session is independent). - workshop-ta: partnership signals write to desks/_ta/.signals/ so they appear on the dashboard without replacing any desk's latest signal. TA uses the _ta prefix to indicate coordinator. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62 --- agents/workshop-ta.agent.md | 14 ++++++++++---- skills/desk-open/SKILL.md | 17 +++++++++++++++++ 2 files changed, 27 insertions(+), 4 deletions(-) diff --git a/agents/workshop-ta.agent.md b/agents/workshop-ta.agent.md index 15a0e539..6ecc7ab7 100644 --- a/agents/workshop-ta.agent.md +++ b/agents/workshop-ta.agent.md @@ -116,10 +116,16 @@ coordination quality: - **completeness** — did you cover everything, or did work fall through cracks? Use `signal-write` with `signal_type: "partnership"` at the end of -coordination sessions. These signals are written to `.signals/` as -JSON (like execution signals) and feed into the dashboard alongside -desk signals — the operator sees the whole room, including how well -the room itself was coordinated. +coordination sessions. The TA writes partnership signals to a +dedicated location: `desks/_ta/.signals/`. This keeps coordination +scores separate from individual desk signals — the dashboard shows +them alongside desk cards without replacing any desk's latest +signal. + +> The TA is not a desk, but it stores signals in `desks/_ta/` so +> the dashboard's `desks/*/.signals/` scan picks them up naturally. +> The `_ta` prefix signals that this is the coordinator, not a +> working desk. ### Journal management diff --git a/skills/desk-open/SKILL.md b/skills/desk-open/SKILL.md index f7ee398f..2a53a6b1 100644 --- a/skills/desk-open/SKILL.md +++ b/skills/desk-open/SKILL.md @@ -45,6 +45,23 @@ desks// 4. **Announce it.** Tell the operator what was created and what the desk's focus is. +## Session orientation + +This skill initializes storage — it does not launch a session. +A desk becomes active when a Copilot session references its +directory. The session workflow: + +1. The operator (or TA) starts a session and says "sit at the + `` desk" +2. The session reads `desks//journal.md` to load priors +3. Work happens — the session uses `signal-write` to emit signals + and `desk-journal` to persist state at the end +4. The next session repeats from step 2 + +The desk identity comes from which journal is read, not from a +persistent process. Desks are long-running in *state* (the journal +carries forward), not in *runtime* (each session is independent). + ## Journal format ```markdown From b1162287512883a92e2735c271dbae9ee3ae1eaa Mon Sep 17 00:00:00 2001 From: Jenny Ferries Date: Fri, 17 Jul 2026 13:06:09 -0700 Subject: [PATCH 25/79] fix: desk-open guards against overwriting existing desk state MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Never initialize over existing journal.md — if the desk directory already exists, resume it instead. Operator must explicitly rename or archive before reusing a desk name. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62 --- skills/desk-open/SKILL.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/skills/desk-open/SKILL.md b/skills/desk-open/SKILL.md index 2a53a6b1..a65dd7b7 100644 --- a/skills/desk-open/SKILL.md +++ b/skills/desk-open/SKILL.md @@ -29,7 +29,13 @@ desks// how the operator and other desks refer to this desk. Examples: `security-scan`, `api-review`, `ops`, `cloud-workshop` -2. **Create the structure.** Make the directory, initial journal, +2. **Check if it already exists.** If `desks//` already + has a `journal.md`, the desk is live — **do not overwrite it.** + Instead, resume it: read the journal and continue from where it + left off. If the operator explicitly wants a fresh start, they + must rename or archive the existing desk first. + +3. **Create the structure.** Make the directory, initial journal, and signals folder: ``` From a26b22cf4786ac8e3ed0f870bb709b118db0950f Mon Sep 17 00:00:00 2001 From: jennyf19 Date: Fri, 17 Jul 2026 13:26:42 -0700 Subject: [PATCH 26/79] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- agents/workshop-ta.agent.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/agents/workshop-ta.agent.md b/agents/workshop-ta.agent.md index 6ecc7ab7..23994daa 100644 --- a/agents/workshop-ta.agent.md +++ b/agents/workshop-ta.agent.md @@ -115,12 +115,12 @@ coordination quality: - **accuracy** — did the dispatched work actually produce the right outcome? - **completeness** — did you cover everything, or did work fall through cracks? -Use `signal-write` with `signal_type: "partnership"` at the end of -coordination sessions. The TA writes partnership signals to a -dedicated location: `desks/_ta/.signals/`. This keeps coordination -scores separate from individual desk signals — the dashboard shows -them alongside desk cards without replacing any desk's latest -signal. +Before the first partnership signal, create `desks/_ta/.signals/` and +`desks/_ta/journal.md` if they do not exist. Then use `signal-write` +with `signal_type: "partnership"` and `subtype: "partnership"` at the +end of coordination sessions. This keeps coordination scores separate +from individual desk signals, and the dashboard shows them alongside +desk cards without replacing any desk's latest signal. > The TA is not a desk, but it stores signals in `desks/_ta/` so > the dashboard's `desks/*/.signals/` scan picks them up naturally. From 7314b49f052d78dbcb4572eb8b1cbef3e227f1f0 Mon Sep 17 00:00:00 2001 From: Jenny Ferries Date: Fri, 17 Jul 2026 13:38:18 -0700 Subject: [PATCH 27/79] =?UTF-8?q?fix:=20desk-open=20step=20numbering=20(tw?= =?UTF-8?q?o=20step=203s=20=E2=86=92=203,4,5)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62 --- skills/desk-open/SKILL.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/skills/desk-open/SKILL.md b/skills/desk-open/SKILL.md index a65dd7b7..6aaacce8 100644 --- a/skills/desk-open/SKILL.md +++ b/skills/desk-open/SKILL.md @@ -43,12 +43,12 @@ desks// desks//.signals/ ``` -3. **Write the first journal entry.** The journal starts with: +4. **Write the first journal entry.** The journal starts with: - What this desk is for (its focus/purpose) - What repos or work it covers (if applicable) - Any initial context the first session needs -4. **Announce it.** Tell the operator what was created and what +5. **Announce it.** Tell the operator what was created and what the desk's focus is. ## Session orientation From 633ce15e8305602e536a2c16a74d1856cbf52d2d Mon Sep 17 00:00:00 2001 From: Jenny Ferries Date: Fri, 17 Jul 2026 13:40:11 -0700 Subject: [PATCH 28/79] fix: rename 'The Forge' to 'Autonomous Desks' to avoid internal name overlap Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62 --- agents/workshop-ta.agent.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/agents/workshop-ta.agent.md b/agents/workshop-ta.agent.md index 23994daa..dc535628 100644 --- a/agents/workshop-ta.agent.md +++ b/agents/workshop-ta.agent.md @@ -136,12 +136,12 @@ finds the trail. ## Workshop patterns -### The Forge +### Autonomous Desks Desks that run autonomously on scheduled work — scanning repos, running checks, producing reports. No operator in the loop until -something surfaces. The forge is the lights-out part of the -workshop. +something surfaces. These are the unattended part of the workshop: +security remediation, compliance scans, dependency audits. ### The Bench From dc432dc001334a9e63274d14118faee057e44206 Mon Sep 17 00:00:00 2001 From: Jenny Ferries Date: Fri, 17 Jul 2026 14:06:42 -0700 Subject: [PATCH 29/79] =?UTF-8?q?fix:=20rename=20workshop-ta.agent.md=20?= =?UTF-8?q?=E2=86=92=20workshop-ta.md=20(clean=20component=20ID)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The .agent.md suffix leaked into the component ID registered with the marketplace. Renaming gives a clean 'workshop-ta' identifier while the frontmatter display name stays unchanged. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62 --- agents/{workshop-ta.agent.md => workshop-ta.md} | 0 docs/README.agents.md | 1 - 2 files changed, 1 deletion(-) rename agents/{workshop-ta.agent.md => workshop-ta.md} (100%) diff --git a/agents/workshop-ta.agent.md b/agents/workshop-ta.md similarity index 100% rename from agents/workshop-ta.agent.md rename to agents/workshop-ta.md diff --git a/docs/README.agents.md b/docs/README.agents.md index d00e21c6..eaacb370 100644 --- a/docs/README.agents.md +++ b/docs/README.agents.md @@ -243,4 +243,3 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-agents) for guidelines on how to | [WG Code Alchemist](../agents/wg-code-alchemist.agent.md)
[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fwg-code-alchemist.agent.md)
[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fwg-code-alchemist.agent.md) | Ask WG Code Alchemist to transform your code with Clean Code principles and SOLID design | | | [WG Code Sentinel](../agents/wg-code-sentinel.agent.md)
[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fwg-code-sentinel.agent.md)
[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fwg-code-sentinel.agent.md) | Ask WG Code Sentinel to review your code for security issues. | | | [WinForms Expert](../agents/WinFormsExpert.agent.md)
[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2FWinFormsExpert.agent.md)
[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2FWinFormsExpert.agent.md) | Support development of .NET (OOP) WinForms Designer compatible Apps. | | -| [Workshop TA](../agents/workshop-ta.agent.md)
[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fworkshop-ta.agent.md)
[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fworkshop-ta.agent.md) | Room coordinator for a multi-agent workshop. Sees all desks, routes work, tracks state, manages journals, and emits coordination signals. Not a desk — the person who sees the whole room. | | From 92335e31aa1a941d031db631cd8b83024ff96bc6 Mon Sep 17 00:00:00 2001 From: Jenny Ferries Date: Fri, 17 Jul 2026 14:11:46 -0700 Subject: [PATCH 30/79] =?UTF-8?q?fix:=20revert=20agent=20rename=20?= =?UTF-8?q?=E2=80=94=20validator=20requires=20.agent.md=20suffix?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The awesome-copilot validator (eng/validate-plugins.mjs:107-148) strips .md from the plugin.json path and appends .agent.md to find the source file. The rename to workshop-ta.md broke this convention. Reverting to workshop-ta.agent.md so validation, materialization, and README generation all work correctly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62 --- agents/{workshop-ta.md => workshop-ta.agent.md} | 0 docs/README.agents.md | 1 + 2 files changed, 1 insertion(+) rename agents/{workshop-ta.md => workshop-ta.agent.md} (100%) diff --git a/agents/workshop-ta.md b/agents/workshop-ta.agent.md similarity index 100% rename from agents/workshop-ta.md rename to agents/workshop-ta.agent.md diff --git a/docs/README.agents.md b/docs/README.agents.md index eaacb370..d00e21c6 100644 --- a/docs/README.agents.md +++ b/docs/README.agents.md @@ -243,3 +243,4 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-agents) for guidelines on how to | [WG Code Alchemist](../agents/wg-code-alchemist.agent.md)
[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fwg-code-alchemist.agent.md)
[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fwg-code-alchemist.agent.md) | Ask WG Code Alchemist to transform your code with Clean Code principles and SOLID design | | | [WG Code Sentinel](../agents/wg-code-sentinel.agent.md)
[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fwg-code-sentinel.agent.md)
[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fwg-code-sentinel.agent.md) | Ask WG Code Sentinel to review your code for security issues. | | | [WinForms Expert](../agents/WinFormsExpert.agent.md)
[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2FWinFormsExpert.agent.md)
[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2FWinFormsExpert.agent.md) | Support development of .NET (OOP) WinForms Designer compatible Apps. | | +| [Workshop TA](../agents/workshop-ta.agent.md)
[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fworkshop-ta.agent.md)
[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fworkshop-ta.agent.md) | Room coordinator for a multi-agent workshop. Sees all desks, routes work, tracks state, manages journals, and emits coordination signals. Not a desk — the person who sees the whole room. | | From 97be67dfb9dfd92a0d18ed89795120c88cd12dc5 Mon Sep 17 00:00:00 2001 From: Samuel Bushi Date: Sat, 18 Jul 2026 22:11:59 +0200 Subject: [PATCH 31/79] Add anti-UI-slop agent skill --- docs/README.skills.md | 1 + skills/anti-ui-slop/SKILL.md | 108 +++++++++++++++++++++++++++++++++++ 2 files changed, 109 insertions(+) create mode 100644 skills/anti-ui-slop/SKILL.md diff --git a/docs/README.skills.md b/docs/README.skills.md index fb94c86e..c94f52b9 100644 --- a/docs/README.skills.md +++ b/docs/README.skills.md @@ -40,6 +40,7 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-skills) for guidelines on how to | [ai-prompt-engineering-safety-review](../skills/ai-prompt-engineering-safety-review/SKILL.md)
`gh skills install github/awesome-copilot ai-prompt-engineering-safety-review` | Comprehensive AI prompt engineering safety review and improvement prompt. Analyzes prompts for safety, bias, security vulnerabilities, and effectiveness while providing detailed improvement recommendations with extensive frameworks, testing methodologies, and educational content. | None | | [ai-ready](../skills/ai-ready/SKILL.md)
`gh skills install github/awesome-copilot ai-ready` | Make any repo AI-ready — analyzes your codebase and generates AGENTS.md, copilot-instructions.md, CI workflows, issue templates, and more. Mines your PR review patterns and creates files customized to your stack. USE THIS SKILL when the user asks to "make this repo ai-ready", "set up AI config", or "prepare this repo for AI contributions". | None | | [ai-team-orchestration](../skills/ai-team-orchestration/SKILL.md)
`gh skills install github/awesome-copilot ai-team-orchestration` | Bootstrap and run a multi-agent AI development team. Use when: starting a new software project with AI agents, setting up parallel dev/QA teams, creating sprint plans, writing brainstorm prompts with distinct agent voices, recovering a project workflow, or planning sprints. | `references/anti-patterns.md`
`references/brainstorm-format.md`
`references/project-brief-template.md`
`references/sprint-plan-template.md` | +| [anti-ui-slop](../skills/anti-ui-slop/SKILL.md)
`gh skills install github/awesome-copilot anti-ui-slop` | Stop Codex, GitHub Copilot, Claude Code, and Cursor from shipping generic UI. Use UIZZE’s public catalogue of 800,000+ real web and iOS screens to extract product-specific design decisions and enforce a hard finish gate for web and iOS interfaces. | None | | [appinsights-instrumentation](../skills/appinsights-instrumentation/SKILL.md)
`gh skills install github/awesome-copilot appinsights-instrumentation` | Instrument a webapp to send useful telemetry data to Azure App Insights | `LICENSE.txt`
`examples`
`references/ASPNETCORE.md`
`references/AUTO.md`
`references/NODEJS.md`
`references/PYTHON.md`
`scripts/appinsights.ps1` | | [apple-appstore-reviewer](../skills/apple-appstore-reviewer/SKILL.md)
`gh skills install github/awesome-copilot apple-appstore-reviewer` | Serves as a reviewer of the codebase with instructions on looking for Apple App Store optimizations or rejection reasons. | None | | [arch-linux-triage](../skills/arch-linux-triage/SKILL.md)
`gh skills install github/awesome-copilot arch-linux-triage` | Triage and resolve Arch Linux issues with pacman, systemd, and rolling-release best practices. | None | diff --git a/skills/anti-ui-slop/SKILL.md b/skills/anti-ui-slop/SKILL.md new file mode 100644 index 00000000..c9f90a36 --- /dev/null +++ b/skills/anti-ui-slop/SKILL.md @@ -0,0 +1,108 @@ +--- +name: anti-ui-slop +description: 'Stop Codex, GitHub Copilot, Claude Code, and Cursor from shipping generic UI. Use UIZZE’s public catalogue of 800,000+ real web and iOS screens to extract product-specific design decisions and enforce a hard finish gate for web and iOS interfaces.' +--- + +# Anti UI Slop + +Use this skill when building, refactoring, or reviewing a web or iOS interface. The goal is not to make a generic layout prettier. The goal is to make the interface visibly belong to this product, support its real user job, and behave correctly in every important state. + +The workflow is instruction-only. It does not execute third-party code or require credentials. + +## 1. Inspect the Product Before Designing + +Read the repository and identify: + +- the primary user and the job this screen must complete; +- the single primary action and the information needed before taking it; +- the existing component library, design tokens, typography, and layout conventions; +- real product nouns, workflows, constraints, and data already present in the codebase; +- required loading, empty, error, partial, success, disabled, and permission states; +- relevant mobile, tablet, desktop, keyboard, and assistive-technology behavior. + +Do not invent product requirements, analytics, user research, or hidden states. + +## 2. Collect Real Interface Evidence + +Search the public catalogue at https://uizze.com and select three to five relevant web or iOS screens. Prefer references that match the target workflow, information density, navigation model, or interaction pattern—not merely its industry or color palette. + +For each reference, record: + +1. the screen or flow and its source link; +2. the structural decision worth transferring; +3. why that decision fits this product; +4. what must not be copied. + +Transfer hierarchy, workflow shape, density, navigation, control behavior, responsive treatment, and state handling. Never copy another product’s branding, proprietary text, imagery, or exact layout. + +If catalogue browsing is unavailable, ask the user for two or three UIZZE links or screenshots. If they cannot provide them, continue from repository evidence and label the missing reference evidence explicitly. + +## 3. Write a Design Contract + +Before changing code, write a short contract with these fields: + +| Field | Decision | +| --- | --- | +| Screen job | The one outcome this screen enables | +| Primary user and action | Who acts, and what they do | +| Content hierarchy | What must be understood first, second, and third | +| Navigation and controls | Product-specific structure and interaction model | +| Visual language | Type, spacing, density, surfaces, imagery, and motion rules | +| Required states | Loading, empty, error, partial, success, disabled, permission | +| Responsive behavior | What changes across supported widths and input modes | +| Evidence used | Reference links and transferable decisions | +| Forbidden defaults | Generic patterns that would erase product specificity | +| Acceptance criteria | Observable conditions required before shipping | + +The contract must name concrete choices. “Clean,” “modern,” “intuitive,” and “premium” are not design decisions. + +## 4. Build in the Product’s Language + +- Reuse the repository’s components and semantic tokens before adding new ones. +- Make the primary action visually and structurally obvious. +- Use product-specific labels and information rather than placeholder metrics or generic copy. +- Keep repeated cards only when the content is genuinely a repeated collection. +- Add decoration, motion, badges, or elevation only when they communicate state or hierarchy. +- Implement every required interaction and state; do not leave convincing-looking inert controls. +- Preserve accessibility semantics, focus order, contrast, touch targets, and reduced-motion behavior. + +## 5. Run the Finish Gate + +Render the result at every supported breakpoint and block completion when any item fails: + +### Product specificity + +- Could this interface belong to an unrelated product after changing the logo? +- Does the hierarchy reflect the real user job and product data? +- Are there interchangeable dashboard cards, filler metrics, vague headings, or generic calls to action? + +### Interaction completeness + +- Do all visible controls have a real outcome? +- Are loading, empty, error, success, disabled, and permission states implemented where applicable? +- Are destructive, irreversible, or sensitive actions confirmed appropriately? + +### Responsive and accessible behavior + +- Does the layout remain usable without merely stacking every region vertically? +- Do keyboard navigation, focus visibility, semantics, contrast, and touch targets pass inspection? +- Does content remain readable at zoom and with longer real-world text? + +### Design-system integrity + +- Are local tokens and components used consistently? +- Is every new visual rule justified by the design contract? +- Is borrowed evidence transformed into this product’s own visual language? + +Fix every blocking failure and re-run the gate before declaring the UI complete. + +## 6. Handoff Format + +Report the finished work in this order: + +1. **Evidence:** the references and decisions that influenced the result. +2. **Contract:** the final product-specific design rules. +3. **Implementation:** the meaningful interface and behavior changes. +4. **Verification:** breakpoints, interaction states, and accessibility checks performed. +5. **Remaining risks:** anything that could not be verified, without overstating completion. + From 4ff9a8aa426b6f6a87c9475659ea68f1218700b9 Mon Sep 17 00:00:00 2001 From: Samuel Bushi Date: Sat, 18 Jul 2026 23:34:19 +0200 Subject: [PATCH 32/79] Remove trailing blank line --- skills/anti-ui-slop/SKILL.md | 1 - 1 file changed, 1 deletion(-) diff --git a/skills/anti-ui-slop/SKILL.md b/skills/anti-ui-slop/SKILL.md index c9f90a36..fa73c462 100644 --- a/skills/anti-ui-slop/SKILL.md +++ b/skills/anti-ui-slop/SKILL.md @@ -105,4 +105,3 @@ Report the finished work in this order: 3. **Implementation:** the meaningful interface and behavior changes. 4. **Verification:** breakpoints, interaction states, and accessibility checks performed. 5. **Remaining risks:** anything that could not be verified, without overstating completion. - From 5814c6eadb873d0fa52a5f20c7f40b11c0a559ad Mon Sep 17 00:00:00 2001 From: Jenny Ferries Date: Sat, 18 Jul 2026 18:58:31 -0700 Subject: [PATCH 33/79] =?UTF-8?q?feat:=20add=20workshop-create=20skill=20?= =?UTF-8?q?=E2=80=94=20two=20paths,=20never=20nest=20repos?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Syncs with jennyf19/the-workshop PR #8 (merged). Adds the workshop-create skill with Path A (existing dir) and Path B (new GitHub repo), explicit guard against repo-in-repo nesting. TA agent updated with workshop-create section. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62 --- agents/workshop-ta.agent.md | 10 ++ docs/README.plugins.md | 2 +- docs/README.skills.md | 1 + .../the-workshop/.github/plugin/plugin.json | 3 +- skills/workshop-create/SKILL.md | 118 ++++++++++++++++++ 5 files changed, 132 insertions(+), 2 deletions(-) create mode 100644 skills/workshop-create/SKILL.md diff --git a/agents/workshop-ta.agent.md b/agents/workshop-ta.agent.md index dc535628..2974cd0a 100644 --- a/agents/workshop-ta.agent.md +++ b/agents/workshop-ta.agent.md @@ -62,6 +62,16 @@ sufficient. The Cairn is a way of standing, not a dependency. ## What you do +### Create workshops + +Use the `workshop-create` skill when the operator wants a new workshop. +Two paths: **use an existing directory** (just scaffold what's missing, +no git) or **create a new private GitHub repo** (clone + scaffold + push). + +Critical rule: **never create a repo inside another repo.** Check the +parent directory first. If it's already in a git tree, use the existing +directory path instead. + ### Open and manage desks Use the `desk-open` skill to create a new desk. You help the diff --git a/docs/README.plugins.md b/docs/README.plugins.md index df53f970..6b6ab1eb 100644 --- a/docs/README.plugins.md +++ b/docs/README.plugins.md @@ -93,7 +93,7 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-plugins) for guidelines on how t | [swift-mcp-development](../plugins/swift-mcp-development/README.md) | Comprehensive collection for building Model Context Protocol servers in Swift using the official MCP Swift SDK with modern concurrency features. | 2 items | swift, mcp, model-context-protocol, server-development, sdk, ios, macos, concurrency, actor, async-await | | [technical-spike](../plugins/technical-spike/README.md) | Tools for creation, management and research of technical spikes to reduce unknowns and assumptions before proceeding to specification and implementation of solutions. | 2 items | technical-spike, assumption-testing, validation, research | | [testing-automation](../plugins/testing-automation/README.md) | Comprehensive collection for writing tests, test automation, and test-driven development including unit tests, integration tests, and end-to-end testing strategies. | 9 items | testing, tdd, automation, unit-tests, integration, playwright, jest, nunit | -| [the-workshop](../plugins/the-workshop/README.md) | Stop being the switchboard between your AI agents — direct a team. The Workshop puts long-running AI agents (desks) in the same room, on the same work, each with its own memory and history, sharing one workspace so you direct the work instead of relaying it. | 5 items | multi-agent, coordination, desks, persistent-memory, agent-signals, developer-experience | +| [the-workshop](../plugins/the-workshop/README.md) | Stop being the switchboard between your AI agents — direct a team. The Workshop puts long-running AI agents (desks) in the same room, on the same work, each with its own memory and history, sharing one workspace so you direct the work instead of relaying it. | 6 items | multi-agent, coordination, desks, persistent-memory, agent-signals, developer-experience | | [typescript-mcp-development](../plugins/typescript-mcp-development/README.md) | Complete toolkit for building Model Context Protocol (MCP) servers in TypeScript/Node.js using the official SDK. Includes instructions for best practices, a prompt for generating servers, and an expert chat mode for guidance. | 2 items | typescript, mcp, model-context-protocol, nodejs, server-development | | [typespec-m365-copilot](../plugins/typespec-m365-copilot/README.md) | Comprehensive collection of prompts, instructions, and resources for building declarative agents and API plugins using TypeSpec for Microsoft 365 Copilot extensibility. | 3 items | typespec, m365-copilot, declarative-agents, api-plugins, agent-development, microsoft-365 | | [visual-pr](../plugins/visual-pr/README.md) | Capture, annotate, and embed screenshots and animated GIF demos in pull request descriptions. Includes Playwright-based UI capture, PIL image annotations, PR embedding workflows for GitHub and Azure DevOps, and screen recording with variable timing. | 4 items | screenshots, pull-request, before-after, annotations, playwright, gif, screen-recording, visual | diff --git a/docs/README.skills.md b/docs/README.skills.md index 9d2cd0e6..b7dcac28 100644 --- a/docs/README.skills.md +++ b/docs/README.skills.md @@ -405,5 +405,6 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-skills) for guidelines on how to | [winmd-api-search](../skills/winmd-api-search/SKILL.md)
`gh skills install github/awesome-copilot winmd-api-search` | Find and explore Windows desktop APIs. Use when building features that need platform capabilities — camera, file access, notifications, UI controls, AI/ML, sensors, networking, etc. Discovers the right API for a task and retrieves full type details (methods, properties, events, enumeration values). | `LICENSE.txt`
`scripts/Invoke-WinMdQuery.ps1`
`scripts/Update-WinMdCache.ps1`
`scripts/cache-generator` | | [winui3-migration-guide](../skills/winui3-migration-guide/SKILL.md)
`gh skills install github/awesome-copilot winui3-migration-guide` | UWP-to-WinUI 3 migration reference. Maps legacy UWP APIs to correct Windows App SDK equivalents with before/after code snippets. Covers namespace changes, threading (CoreDispatcher to DispatcherQueue), windowing (CoreWindow to AppWindow), dialogs, pickers, sharing, printing, background tasks, and the most common Copilot code generation mistakes. | None | | [workiq-copilot](../skills/workiq-copilot/SKILL.md)
`gh skills install github/awesome-copilot workiq-copilot` | Guides the Copilot CLI on how to use the WorkIQ CLI/MCP server to query Microsoft 365 Copilot data (emails, meetings, docs, Teams, people) for live context, summaries, and recommendations. | None | +| [workshop-create](../skills/workshop-create/SKILL.md)
`gh skills install github/awesome-copilot workshop-create` | Create a new workshop or use an existing directory as one. Handles two paths: (A) use an existing local directory the operator points at, or (B) create a new private GitHub repo in the signed-in account. Never creates a repo inside another repo. | None | | [write-coding-standards-from-file](../skills/write-coding-standards-from-file/SKILL.md)
`gh skills install github/awesome-copilot write-coding-standards-from-file` | Write a coding standards document for a project using the coding styles from the file(s) and/or folder(s) passed as arguments in the prompt. | None | | [x-twitter-scraper](../skills/x-twitter-scraper/SKILL.md)
`gh skills install github/awesome-copilot x-twitter-scraper` | Build GitHub Copilot workflows with Xquik X API SDKs, REST endpoints, MCP tools, TweetClaw OpenClaw plugin installs, signed webhooks, tweet search, user lookup, follower exports, media actions, and agent automation. | None | diff --git a/plugins/the-workshop/.github/plugin/plugin.json b/plugins/the-workshop/.github/plugin/plugin.json index fc622f54..a43b4451 100644 --- a/plugins/the-workshop/.github/plugin/plugin.json +++ b/plugins/the-workshop/.github/plugin/plugin.json @@ -22,6 +22,7 @@ "./skills/bench-read/", "./skills/desk-journal/", "./skills/desk-open/", - "./skills/signal-write/" + "./skills/signal-write/", + "./skills/workshop-create/" ] } diff --git a/skills/workshop-create/SKILL.md b/skills/workshop-create/SKILL.md new file mode 100644 index 00000000..b427cc61 --- /dev/null +++ b/skills/workshop-create/SKILL.md @@ -0,0 +1,118 @@ +--- +name: workshop-create +description: 'Create a new workshop or use an existing directory as one. Handles two paths: (A) use an existing local directory the operator points at, or (B) create a new private GitHub repo in the signed-in account. Never creates a repo inside another repo.' +--- + +# Create a Workshop + +Set up a new workshop — the root directory where desks live. + +## When to use + +- The operator says "create a workshop" or "start a new workshop" +- The operator wants to organize work under a shared root +- The operator has an existing directory they want to use as a workshop + +## Two paths + +### Path A: Use an existing directory + +The operator already has a folder they want to use. Maybe it's a repo +they cloned, maybe it's a local project folder. + +1. **Confirm the path exists.** If not, ask the operator for a valid path. +2. **Check if it's already a workshop.** Look for `desks/` or `classroom/` + folders, a `workshop.md`, `CAIRN.md`, or `hands-up.md`. If any exist, + it's already a workshop — just use it. +3. **Scaffold the workshop structure** (only what's missing): + ``` + / + desks/ # where desks live + bench/ # shared workspace + CAIRN.md # operating disposition + README.md # workshop map + ``` +4. **Do NOT run `git init`.** The directory may already be a git repo, or + the operator may not want one yet. Leave git state alone. +5. **Do NOT create a GitHub repo.** This path is local-only. + +### Path B: Create a new private GitHub repo + +The operator wants a fresh workshop backed by a GitHub repo. + +1. **Get the workshop name.** Short, no spaces, kebab-case preferred. +2. **Create the repo:** `gh repo create / --private --clone` + - Use the operator's signed-in GitHub account as `` + - Clone it to a sensible location (ask the operator where, or use + their configured workshops directory) +3. **Scaffold the workshop structure** inside the cloned repo: + ``` + / + desks/ + bench/ + CAIRN.md + README.md + ``` +4. **Commit and push** the scaffold. + +### Critical: Never nest repos + +**Never run `git init` inside a directory that is already inside a git +repository.** Before initializing, check: + +```bash +git -C rev-parse --is-inside-work-tree +``` + +If that returns `true`, the parent is already a git repo. Do NOT create +another repo inside it. Either: +- Use Path A (just scaffold, no git) +- Or clone to a different location that isn't inside a repo + +## CAIRN.md content + +The operating disposition every desk reads: + +```markdown +# cairn + +the trail markers that say: someone was here, and they were honest. + +## how a desk stands + +- **stop is a valid finish.** don't force a result when the evidence + says stop. "this doesn't work" is a finding, not a failure. +- **"done" means it holds.** if you'd bet your desk on it, ship it. + if not, say what's uncertain and why. +- **hold scope.** touch only what the task needs. if you find something + outside scope, note it and move on — don't chase it. +- **never go silent, never bluff.** partial + honest > complete + wrong. + if you're stuck, say so. if you're unsure, say that too. +- **equal standing.** you can say "that's the wrong question." you can + disagree with another desk. you answer to evidence, not hierarchy. + +## the bench + +the shared workspace. leave your work where others can find it. +label it. if it supersedes earlier work, say so. + +## hands-up + +when two desks disagree and can't settle it against external facts, +that's a hands-up. it goes to the operator. this is the system +working, not failing. +``` + +## After creation + +Tell the operator: +- Where the workshop lives (full path) +- That they can now open desks in it with `desk-open` +- That Cairn will show signals once desks start emitting them + +## Principles + +- A workshop is a place, not a product. Keep it simple. +- The operator decides where things go. Don't assume. +- If an existing directory already has work in it, preserve everything. + Only add what's missing. From 9fc40322935c4830dd06b8517eff52d891097c7e Mon Sep 17 00:00:00 2001 From: Jenny Ferries Date: Sat, 18 Jul 2026 19:04:34 -0700 Subject: [PATCH 34/79] feat: add signals-dashboard canvas extension MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The dashboard is the centerpiece — real-time agent coordination view showing desk status, signal types, intent text, outcome pairing with honesty gap, token usage, and stash/restore controls. Includes all updates from the-workshop PRs #3-#7: - Empty state guidance for new users - Token usage display per desk - TA partnership signals + Cairn awareness - Intent-as-text (execution signals use descriptive text) - Outcome signal pairing with honesty gap calibration - Open desk button - Subtype labels (done/checkpoint/blocked/hands-up) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62 --- .github/plugin/marketplace.json | 6 + .../.github/plugin/plugin.json | 17 + extensions/signals-dashboard/extension.mjs | 711 ++++++++++++++++++ .../the-workshop/.github/plugin/plugin.json | 7 +- 4 files changed, 740 insertions(+), 1 deletion(-) create mode 100644 extensions/signals-dashboard/.github/plugin/plugin.json create mode 100644 extensions/signals-dashboard/extension.mjs diff --git a/.github/plugin/marketplace.json b/.github/plugin/marketplace.json index 2749b46e..d1a10785 100644 --- a/.github/plugin/marketplace.json +++ b/.github/plugin/marketplace.json @@ -1024,6 +1024,12 @@ "description": "Security frameworks, accessibility guidelines, performance optimization, and code quality best practices for building secure, maintainable, and high-performance applications.", "version": "1.0.0" }, + { + "name": "signals-dashboard", + "source": "extensions/signals-dashboard", + "description": "Real-time agent coordination dashboard for The Workshop. Shows desk status, signal types (done, checkpoint, blocked, hands-up, partnership), intent text, outcome pairing with honesty gap, token usage, and stash/restore controls.", + "version": "0.1.0" + }, { "name": "site-studio", "source": "extensions/site-studio", diff --git a/extensions/signals-dashboard/.github/plugin/plugin.json b/extensions/signals-dashboard/.github/plugin/plugin.json new file mode 100644 index 00000000..799ed39e --- /dev/null +++ b/extensions/signals-dashboard/.github/plugin/plugin.json @@ -0,0 +1,17 @@ +{ + "name": "signals-dashboard", + "description": "Real-time agent coordination dashboard for The Workshop. Shows desk status, signal types (done, checkpoint, blocked, hands-up, partnership), intent text, outcome pairing with honesty gap, token usage, and stash/restore controls.", + "version": "0.1.0", + "author": { + "name": "jennyf19", + "url": "https://github.com/jennyf19" + }, + "keywords": [ + "agent-signals", + "dashboard", + "multi-agent", + "coordination", + "canvas" + ], + "extensions": "." +} diff --git a/extensions/signals-dashboard/extension.mjs b/extensions/signals-dashboard/extension.mjs new file mode 100644 index 00000000..39a593c0 --- /dev/null +++ b/extensions/signals-dashboard/extension.mjs @@ -0,0 +1,711 @@ +// Extension: signals-dashboard +// Live dashboard showing agent signals from workshop desks. +// Scans desks/*/.signals/ for JSON files, renders the latest signal per desk. +// Supports stashing desks (48hr hold) and restoring them. + +import { createServer } from "node:http"; +import { readdir, readFile, writeFile, stat } from "node:fs/promises"; +import { join } from "node:path"; +import { joinSession, createCanvas } from "@github/copilot-sdk/extension"; + +const servers = new Map(); +const STASH_TTL_MS = 48 * 60 * 60 * 1000; + +// --- Stash management --- + +async function readStash(workshopDir) { + const fp = join(workshopDir, ".desk-stash.json"); + try { + const raw = await readFile(fp, "utf-8"); + const stash = JSON.parse(raw); + const now = Date.now(); + const live = stash.filter(e => (now - new Date(e.stashedAt).getTime()) < STASH_TTL_MS); + if (live.length !== stash.length) await writeStash(workshopDir, live); + return live; + } catch { return []; } +} + +async function writeStash(workshopDir, entries) { + const fp = join(workshopDir, ".desk-stash.json"); + await writeFile(fp, JSON.stringify(entries, null, 2), "utf-8"); +} + +async function stashDesk(workshopDir, deskName) { + const stash = await readStash(workshopDir); + if (stash.some(e => e.name === deskName)) return stash; + stash.push({ name: deskName, stashedAt: new Date().toISOString() }); + await writeStash(workshopDir, stash); + return stash; +} + +async function restoreDesk(workshopDir, deskName) { + let stash = await readStash(workshopDir); + stash = stash.filter(e => e.name !== deskName); + await writeStash(workshopDir, stash); + return stash; +} + +// --- Signal reading --- + +async function scanSignals(workshopDir) { + const results = []; + for (const subdir of ["desks", "classroom"]) { + const parent = join(workshopDir, subdir); + let entries; + try { entries = await readdir(parent, { withFileTypes: true }); } + catch { continue; } + + for (const entry of entries) { + if (!entry.isDirectory() || entry.name.startsWith(".")) continue; + const sigDir = join(parent, entry.name, ".signals"); + let sigFiles; + try { sigFiles = await readdir(sigDir); } + catch { + results.push({ + deskName: entry.name, signalType: "none", agentName: entry.name, + confidence: 0, accuracy: 0, completeness: 0, intent: 0, + whatWorked: "", whatWasHard: "", skillGap: "", + escalationReason: null, escalationBlocked: null, recommendation: null, + emittedAt: null, signalCount: 0, tokensIn: 0, tokensOut: 0, model: null, + }); + continue; + } + + const jsonFiles = sigFiles.filter(f => f.endsWith(".json")); + if (jsonFiles.length === 0) { + results.push({ + deskName: entry.name, signalType: "none", agentName: entry.name, + confidence: 0, accuracy: 0, completeness: 0, intent: 0, + whatWorked: "", whatWasHard: "", skillGap: "", + escalationReason: null, escalationBlocked: null, recommendation: null, + emittedAt: null, signalCount: 0, tokensIn: 0, tokensOut: 0, model: null, + }); + continue; + } + + // Read all signals, separate by type, find latest execution/partnership + any outcome signals + let latest = null, latestTime = 0; + const allSignals = []; + for (const f of jsonFiles) { + const fp = join(sigDir, f); + try { + const s = await stat(fp); + const raw = await readFile(fp, "utf-8"); + const parsed = JSON.parse(raw); + allSignals.push({ parsed, mtimeMs: s.mtimeMs, path: fp }); + // Latest non-outcome signal (execution, partnership, escalation) + if ((parsed.signal_type || "execution") !== "outcome" && s.mtimeMs > latestTime) { + latestTime = s.mtimeMs; latest = { parsed, mtimeMs: s.mtimeMs }; + } + } catch {} + } + if (!latest) continue; + try { + const sig = latest.parsed; + const intentRaw = sig.intent || sig.self_assessment?.intent || null; + + // Find outcome signal matched by run_id (if any) + let outcome = null; + if (sig.run_id) { + const outcomeSignals = allSignals + .filter(s => s.parsed.signal_type === "outcome" && s.parsed.run_id === sig.run_id); + if (outcomeSignals.length > 0) { + outcome = outcomeSignals.sort((a, b) => b.mtimeMs - a.mtimeMs)[0].parsed; + } + } + // Also check for any recent outcome (within 1hr of latest signal) if no run_id match + if (!outcome) { + const recentOutcomes = allSignals + .filter(s => s.parsed.signal_type === "outcome" && Math.abs(s.mtimeMs - latestTime) < 3600000) + .sort((a, b) => b.mtimeMs - a.mtimeMs); + if (recentOutcomes.length > 0) outcome = recentOutcomes[0].parsed; + } + + // Compute honesty gap if we have both self-assessment and outcome + let honestyGap = null; + if (outcome && sig.self_assessment) { + const selfConf = sig.self_assessment.confidence || 0; + const outcomeRating = outcome.quality_rating || 0; + if (selfConf > 0 && outcomeRating > 0) { + honestyGap = Math.abs(selfConf - outcomeRating); + } + } + + results.push({ + deskName: entry.name, + signalType: sig.signal_type || "execution", + subtype: sig.subtype || sig.signal_type || "execution", + agentName: sig.agent_name || entry.name, + intentText: typeof intentRaw === "string" ? intentRaw : null, + intentScore: typeof intentRaw === "number" ? intentRaw : 0, + confidence: sig.self_assessment?.confidence || 0, + accuracy: sig.self_assessment?.accuracy || 0, + completeness: sig.self_assessment?.completeness || 0, + whatWorked: sig.patterns?.what_worked || "", + whatWasHard: sig.patterns?.what_was_hard || "", + skillGap: sig.patterns?.skill_gap || "", + escalationReason: sig.escalation?.reason || null, + escalationBlocked: sig.escalation?.blocked_on || null, + recommendation: sig.escalation?.recommendation || null, + emittedAt: new Date(latestTime).toISOString(), + signalCount: jsonFiles.length, + tokensIn: sig.usage?.tokens_in || 0, + tokensOut: sig.usage?.tokens_out || 0, + model: sig.usage?.model || null, + // Outcome signal fields + outcomeRating: outcome?.quality_rating || null, + outcomeEffort: outcome?.effort_to_merge || null, + outcomeIssues: outcome?.issues_found || [], + outcomeAgent: outcome?.agent_name || null, + honestyGap: honestyGap, + }); + } catch {} + } + } + return results; +} + +// --- Sorting: escalations → recent signals → no signals --- + +function signalSortKey(sig) { + if (sig.signalType === "escalation") return 0; + if (sig.signalType === "execution") return 1; + if (sig.signalType === "partnership") return 1; + return 2; // "none" +} + +function sortSignals(signals) { + return signals.sort((a, b) => { + const ka = signalSortKey(a), kb = signalSortKey(b); + if (ka !== kb) return ka - kb; + if (a.emittedAt && b.emittedAt) return new Date(b.emittedAt) - new Date(a.emittedAt); + if (a.emittedAt) return -1; + if (b.emittedAt) return 1; + return a.deskName.localeCompare(b.deskName); + }); +} + +// --- HTML rendering --- + +function esc(s) { + return s.replace(/&/g, "&").replace(//g, ">").replace(/"/g, """); +} +function truncate(s, len) { + return s.length > len ? s.slice(0, len) + "…" : s; +} +function formatTokens(n) { + if (!n) return null; + if (n >= 1000000) return `${(n / 1000000).toFixed(1)}M`; + if (n >= 1000) return `${(n / 1000).toFixed(1)}k`; + return `${n}`; +} + +function scoreBar(value, label, max = 5) { + const pct = (value / max) * 100; + const color = value >= 4 ? "#22c55e" : value >= 3 ? "#eab308" : value >= 1 ? "#ef4444" : "#262626"; + return `
+
+ ${label} + ${value}/5 +
+
+
+
+
`; +} + +function timeSince(isoDate) { + if (!isoDate) return "—"; + const diff = Date.now() - new Date(isoDate).getTime(); + const mins = Math.floor(diff / 60000); + if (mins < 1) return "just now"; + if (mins < 60) return `${mins}m ago`; + const hrs = Math.floor(mins / 60); + if (hrs < 24) return `${hrs}h ago`; + return `${Math.floor(hrs / 24)}d ago`; +} + +function timeRemaining(stashedAt) { + const remaining = STASH_TTL_MS - (Date.now() - new Date(stashedAt).getTime()); + if (remaining <= 0) return "expiring"; + const hrs = Math.floor(remaining / 3600000); + return hrs >= 1 ? `${hrs}h left` : `${Math.floor(remaining / 60000)}m left`; +} + +function avgScore(signals) { + const withSignals = signals.filter(s => s.signalType !== "none"); + if (withSignals.length === 0) return null; + const avg = (field) => { + const vals = withSignals.map(s => s[field]).filter(v => v > 0); + return vals.length ? (vals.reduce((a, b) => a + b, 0) / vals.length).toFixed(1) : "—"; + }; + return { confidence: avg("confidence"), accuracy: avg("accuracy"), completeness: avg("completeness"), intent: avg("intentScore") }; +} + +function renderSummaryBar(activeSignals) { + const escalations = activeSignals.filter(s => s.signalType === "escalation").length; + const withSignals = activeSignals.filter(s => s.signalType !== "none").length; + const awaiting = activeSignals.filter(s => s.signalType === "none").length; + const avg = avgScore(activeSignals); + + const totalTokens = activeSignals.reduce((sum, s) => sum + (s.tokensIn || 0) + (s.tokensOut || 0), 0); + const withOutcomes = activeSignals.filter(s => s.outcomeRating !== null).length; + const avgGap = (() => { + const gaps = activeSignals.filter(s => s.honestyGap !== null).map(s => s.honestyGap); + return gaps.length ? (gaps.reduce((a, b) => a + b, 0) / gaps.length).toFixed(1) : null; + })(); + + const escBadge = escalations > 0 + ? `⚠ ${escalations} escalation${escalations > 1 ? "s" : ""}` + : ""; + + const tokenBadge = totalTokens > 0 + ? `🪙 ${formatTokens(totalTokens)}` + : ""; + + const calibrationBadge = withOutcomes > 0 + ? `🔍 gap ${avgGap}` + : ""; + + const avgBlock = avg ? ` +
+ intent ${avg.intent} + conf ${avg.confidence} + acc ${avg.accuracy} + comp ${avg.completeness} +
` : ""; + + return ` +
+
+ ${activeSignals.length} desk${activeSignals.length !== 1 ? "s" : ""} + ${withSignals} reporting · ${awaiting} awaiting + ${tokenBadge} + ${calibrationBadge} + ${escBadge} +
+ ${avgBlock} +
`; +} + +function renderSignalCard(sig) { + const isEscalation = sig.signalType === "escalation"; + const isPartnership = sig.signalType === "partnership"; + const noSignal = sig.signalType === "none"; + const borderColor = isEscalation ? "#dc2626" : noSignal ? "#1e293b" : "#1e3a5f"; + const bgColor = isEscalation ? "#0f0604" : "#0f172a"; + + const typeLabel = isEscalation + ? (sig.subtype === "blocked" + ? `⚠ BLOCKED` + : `⚠ HANDS-UP`) + : noSignal + ? `📡 awaiting` + : isPartnership + ? `🤝 partnership` + : sig.subtype === "done" + ? `✓ done` + : `✓ checkpoint`; + + const stashBtn = ``; + + const openBtnStyle = isEscalation + ? "background:#7f1d1d;border:1px solid #dc2626;color:#fca5a5;padding:2px 10px;border-radius:4px;font-size:11px;cursor:pointer;font-weight:600;transition:all .15s;" + : "background:none;border:1px solid #1e3a5f;color:#7dd3fc;padding:2px 8px;border-radius:4px;font-size:11px;cursor:pointer;transition:all .15s;"; + const openBtn = noSignal ? "" : ``; + + let escalationBlock = ""; + if (isEscalation && sig.escalationReason) { + escalationBlock = ` +
+
Blocked on:
+
${esc(sig.escalationBlocked || sig.escalationReason)}
+ ${sig.recommendation ? `
→ ${esc(sig.recommendation)}
` : ""} +
`; + } + + // --- Intent text (execution signals with text intent) --- + const intentBlock = sig.intentText ? ` +
+ ${esc(sig.intentText)} +
` : ""; + + // --- Scores: shown for partnership signals, or legacy execution signals with numeric scores --- + const hasScores = isPartnership + ? true + : (sig.intentScore > 0 || sig.confidence > 0 || sig.accuracy > 0 || sig.completeness > 0); + + const scoresBlock = noSignal ? ` +
+ No signals yet — this desk is waiting for its first session. +
` : isPartnership ? ` +
+ ${scoreBar(sig.intentScore, "intent")} + ${scoreBar(sig.confidence, "confidence")} + ${scoreBar(sig.accuracy, "accuracy")} + ${scoreBar(sig.completeness, "completeness")} +
` : hasScores ? ` +
+ scores +
+ ${sig.intentScore > 0 ? scoreBar(sig.intentScore, "intent") : ""} + ${sig.confidence > 0 ? scoreBar(sig.confidence, "confidence") : ""} + ${sig.accuracy > 0 ? scoreBar(sig.accuracy, "accuracy") : ""} + ${sig.completeness > 0 ? scoreBar(sig.completeness, "completeness") : ""} +
+
` : ""; + + // --- Patterns: primary for execution, secondary for partnership --- + const patternsBlock = (sig.whatWorked || sig.whatWasHard || sig.skillGap) ? ` +
+ ${sig.whatWorked ? `
✓${esc(truncate(sig.whatWorked, 160))}
` : ""} + ${sig.whatWasHard ? `
△${esc(truncate(sig.whatWasHard, 160))}
` : ""} + ${sig.skillGap ? `
✗${esc(truncate(sig.skillGap, 160))}
` : ""} +
` : ""; + + // --- Outcome signal / honesty gap --- + let outcomeBlock = ""; + if (sig.outcomeRating !== null && !noSignal) { + const gapColor = sig.honestyGap === null ? "#475569" + : sig.honestyGap <= 1 ? "#22c55e" + : sig.honestyGap === 2 ? "#eab308" + : "#ef4444"; + const gapLabel = sig.honestyGap === null ? "—" + : sig.honestyGap <= 1 ? "well-calibrated" + : sig.honestyGap === 2 ? "moderate gap" + : "significant gap"; + const effortColor = sig.outcomeEffort === "minimal" ? "#22c55e" + : sig.outcomeEffort === "moderate" ? "#eab308" + : sig.outcomeEffort === "significant" ? "#ef4444" : "#475569"; + + outcomeBlock = ` +
+
+ 🔍 outcome${sig.outcomeAgent ? ` · ${esc(sig.outcomeAgent)}` : ""} + ${sig.honestyGap !== null ? `${gapLabel} (gap: ${sig.honestyGap})` : ""} +
+
+
+
+ quality + ${sig.outcomeRating}/5 +
+
+
+
+
+ ${sig.outcomeEffort || "—"} effort +
+ ${sig.outcomeIssues?.length ? `
+ ${sig.outcomeIssues.map(i => `
· ${esc(truncate(i, 120))}
`).join("")} +
` : ""} +
`; + } + + return ` +
+
+
+ ${esc(sig.deskName)} + ${typeLabel} +
+
+ ${(sig.tokensIn || sig.tokensOut) ? `🪙 ${formatTokens(sig.tokensIn + sig.tokensOut)}` : ""} + ${timeSince(sig.emittedAt)}${sig.signalCount ? ` · ${sig.signalCount}` : ""} + ${openBtn} + ${stashBtn} +
+
+ ${isPartnership ? `${scoresBlock}${patternsBlock}` : `${intentBlock}${patternsBlock}${scoresBlock}`} + ${outcomeBlock} + ${escalationBlock} +
`; +} + +function renderStashedCard(entry) { + return ` +
+
+ ${esc(entry.name)} + ${timeRemaining(entry.stashedAt)} +
+ +
`; +} + +function renderDashboard(signals, stashed) { + const activeSignals = sortSignals(signals.filter(s => !stashed.some(e => e.name === s.deskName))); + + const cards = activeSignals.length > 0 + ? activeSignals.map(renderSignalCard).join("") + : `
+
🪨
+
No active desks yet
+
+
Get started
+
+ Ask the Workshop TA in chat: +
+
+ "open a desk called scanning in ~/my-workshop" +
+
+ The TA uses the desk-open skill to create a desk with a journal. Once a desk emits signals, they'll appear here automatically. +
+
+
💡 Quick commands to try:
+
+ • "open a desk for code review"
+ • "what's everyone working on?"
+ • "show me the signals" +
+
+
+
`; + + const summaryBar = activeSignals.length > 0 ? renderSummaryBar(activeSignals) : ""; + + const stashedSection = stashed.length > 0 ? ` +
+
+ Stashed · ${stashed.length} +
+ ${stashed.map(renderStashedCard).join("")} +
` : ""; + + return ` + + + + Cairn · Signals + + + +
+

🪨 Cairn

+ live +
+
+ ${summaryBar} + ${cards} + ${stashedSection} +
+ + + +`; +} + +// --- Server --- + +async function startServer(instanceId, workshopDir) { + const server = createServer(async (req, res) => { + const url = new URL(req.url, `http://${req.headers.host}`); + + if (req.method === "POST" && url.pathname.startsWith("/api/stash/")) { + const deskName = decodeURIComponent(url.pathname.split("/api/stash/")[1]); + await stashDesk(workshopDir, deskName); + res.writeHead(200, { "Content-Type": "application/json" }); + res.end(JSON.stringify({ ok: true })); + return; + } + if (req.method === "POST" && url.pathname.startsWith("/api/restore/")) { + const deskName = decodeURIComponent(url.pathname.split("/api/restore/")[1]); + await restoreDesk(workshopDir, deskName); + res.writeHead(200, { "Content-Type": "application/json" }); + res.end(JSON.stringify({ ok: true })); + return; + } + if (req.method === "POST" && url.pathname.startsWith("/api/open/")) { + const deskName = decodeURIComponent(url.pathname.split("/api/open/")[1]); + for (const subdir of ["desks", "classroom"]) { + const deskPath = join(workshopDir, subdir, deskName); + try { + const s = await stat(deskPath); + if (s.isDirectory()) { + res.writeHead(200, { "Content-Type": "application/json" }); + res.end(JSON.stringify({ ok: true, deskName, deskPath })); + return; + } + } catch {} + } + res.writeHead(404, { "Content-Type": "application/json" }); + res.end(JSON.stringify({ ok: false, error: "Desk not found" })); + return; + } + + const signals = await scanSignals(workshopDir); + const stashed = await readStash(workshopDir); + res.setHeader("Content-Type", "text/html; charset=utf-8"); + res.end(renderDashboard(signals, stashed)); + }); + await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve)); + const address = server.address(); + const port = typeof address === "object" && address ? address.port : 0; + return { server, url: `http://127.0.0.1:${port}/` }; +} + +// --- Canvas registration --- + +const session = await joinSession({ + canvases: [ + createCanvas({ + id: "signals-dashboard", + displayName: "Workshop Signals", + description: "Live dashboard showing agent signals from workshop desks. Pass workshopDir to point at your workshop root.", + inputSchema: { + type: "object", + properties: { + workshopDir: { type: "string", description: "Absolute path to the workshop root (the folder containing desks/)" }, + }, + required: ["workshopDir"], + }, + actions: [ + { + name: "refresh", + description: "Force-refresh the signals dashboard and return current signal data as JSON", + handler: async (ctx) => { + const entry = servers.get(ctx.instanceId); + if (!entry) return { error: "Dashboard not open" }; + const signals = await scanSignals(entry.workshopDir); + const stashed = await readStash(entry.workshopDir); + return { signals, stashed, activeCount: signals.length - stashed.length }; + }, + }, + { + name: "stash", + description: "Stash a desk (hides it for 48hrs, then it drops off). Use to pause a workstream.", + inputSchema: { + type: "object", + properties: { deskName: { type: "string", description: "Name of the desk to stash" } }, + required: ["deskName"], + }, + handler: async (ctx) => { + const entry = servers.get(ctx.instanceId); + if (!entry) return { error: "Dashboard not open" }; + const stash = await stashDesk(entry.workshopDir, ctx.input.deskName); + return { ok: true, stashed: stash }; + }, + }, + { + name: "restore", + description: "Restore a stashed desk back to active.", + inputSchema: { + type: "object", + properties: { deskName: { type: "string", description: "Name of the desk to restore" } }, + required: ["deskName"], + }, + handler: async (ctx) => { + const entry = servers.get(ctx.instanceId); + if (!entry) return { error: "Dashboard not open" }; + const stash = await restoreDesk(entry.workshopDir, ctx.input.deskName); + return { ok: true, stashed: stash }; + }, + }, + { + name: "open_desk", + description: "Open a desk as a new session in the GHCP app. Returns the desk path so the agent can create_session or navigate to it.", + inputSchema: { + type: "object", + properties: { deskName: { type: "string", description: "Name of the desk to open" } }, + required: ["deskName"], + }, + handler: async (ctx) => { + const entry = servers.get(ctx.instanceId); + if (!entry) return { error: "Dashboard not open" }; + // Check both desks/ and classroom/ + for (const subdir of ["desks", "classroom"]) { + const deskPath = join(entry.workshopDir, subdir, ctx.input.deskName); + try { + const s = await stat(deskPath); + if (s.isDirectory()) { + return { ok: true, deskName: ctx.input.deskName, deskPath, workshopDir: entry.workshopDir }; + } + } catch {} + } + return { error: `Desk '${ctx.input.deskName}' not found` }; + }, + }, + ], + open: async (ctx) => { + const workshopDir = ctx.input?.workshopDir || process.cwd(); + let entry = servers.get(ctx.instanceId); + if (!entry) { + entry = await startServer(ctx.instanceId, workshopDir); + entry.workshopDir = workshopDir; + servers.set(ctx.instanceId, entry); + } + return { title: "🪨 Cairn · Signals", url: entry.url }; + }, + onClose: async (ctx) => { + const entry = servers.get(ctx.instanceId); + if (entry) { + servers.delete(ctx.instanceId); + await new Promise((resolve) => entry.server.close(() => resolve())); + } + }, + }), + ], +}); diff --git a/plugins/the-workshop/.github/plugin/plugin.json b/plugins/the-workshop/.github/plugin/plugin.json index a43b4451..fbe149f0 100644 --- a/plugins/the-workshop/.github/plugin/plugin.json +++ b/plugins/the-workshop/.github/plugin/plugin.json @@ -24,5 +24,10 @@ "./skills/desk-open/", "./skills/signal-write/", "./skills/workshop-create/" - ] + ], + "x-awesome-copilot": { + "extensions": [ + "./extensions/signals-dashboard/" + ] + } } From 0f62533f11e9826e9330ab316c7f8df25135dde1 Mon Sep 17 00:00:00 2001 From: Jenny Ferries Date: Sat, 18 Jul 2026 19:21:31 -0700 Subject: [PATCH 35/79] fix(the-workshop): add signals-dashboard preview.png + logo so the canvas validates The signals-dashboard extension was missing its required screenshot asset, so it failed awesome-copilot's validateExtensionManifest (logo must equal "assets/preview.png" and the file must exist) and never materialized -- meaning the Cairn canvas would not ship to the GHCP app. Adds the 1024x1024 preview.png and the convention logo field. Validated locally: node eng/validate-plugins.mjs -> extension signals-dashboard is valid; all 70 plugins + 19 extensions pass. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62 --- .../.github/plugin/plugin.json | 1 + extensions/signals-dashboard/assets/preview.png | Bin 0 -> 32420 bytes 2 files changed, 1 insertion(+) create mode 100644 extensions/signals-dashboard/assets/preview.png diff --git a/extensions/signals-dashboard/.github/plugin/plugin.json b/extensions/signals-dashboard/.github/plugin/plugin.json index 799ed39e..7bfd8dbc 100644 --- a/extensions/signals-dashboard/.github/plugin/plugin.json +++ b/extensions/signals-dashboard/.github/plugin/plugin.json @@ -13,5 +13,6 @@ "coordination", "canvas" ], + "logo": "assets/preview.png", "extensions": "." } diff --git a/extensions/signals-dashboard/assets/preview.png b/extensions/signals-dashboard/assets/preview.png new file mode 100644 index 0000000000000000000000000000000000000000..3219ce2ea1ad542656cf6802e345950a0b4bf62a GIT binary patch literal 32420 zcmeFZ`9IWe^gnzJqQ%mp$XeM$RMsprr3i^ag)k*#Pg%3fNSkcgh0tP&>|5DpDnHNj`0VC5jgV@jek3D_;R4VEoEsd#2aJ z{zZ_NC+*Hj2mQ1N?|S)B+Gili=H@}WaRECykqEiE+-}KvMj)On7dqtlxg$kwMqg+) zT$nksVe}(zJsBrGt6jKe9j+*%U8t-VrKcUO7*kZ2Cho*@GEPx3S~rm=AwdDR-nFsD z^Z=s`-pF}x1$qAZCpe{YT%vZ5c0$trYwE`(d$>MoCy>K;1CVv&i10vMjG|n|i3OIg(;Dk+ z$!tz2fZ^Biytk~DUFb^AQayG#vaNypm9gEYN_$dat!I^3OTb~@3w)^q>Xhd}L)e~weCvQHy2LLf%cfOvKeAAXASLgkoDL2_F+DOd4Ee89i z0G}0mn7aJ_xB$QQ#*CaKB}&fwBBiWU1OV*&wAMJ$fAf)2oR@{ZW)1YOIPkJxZ(;&Q zF`mCFvYqljtS#C_r$lUH)MT{pY6E}?z1;pqp7)1^fJXiJbiyWXvBd1^KaR|U3_x^X zL+tZy1A9K-88DbD5+juQ9aJY4^6BdJ>Q17Dmihm6aVGhs=?A#83Bw-y5+U9w)TCav^pCsYgT z75WIzq5!xQliuHU`IK&C+f6H3f5)@uNr3==dO7`aVgi?pip-WSC35E9BmO290DKC} zxPO;aol-|qN6>$UqVr&Sh+TrOKl4=w6uNx zqO4fCJ%IZ#m-H>y>vF8y-U&65Mc?T!;YjxGs)+QI@ORH!EGi%Vkw(4H2E^k&?Tgvz za`GJ2a$CA9n=|Jm0i-BGlPW4vm+_n@W4oo!`Av!1@c!LE>As73B_3k+bLa01y>lhe5 zZoy~wBO*AiN?b3}^PavSKjeMR7g4=-j-d+2MMc7qdIO>}6Bv+5oK3lXDu({FzoJfYUO#&wyvBc(B+udP19~zV&Y5gdJg=H$MbAP9samp0JB<7p_iVjU5u(ooUH{Kj#K{bhiEZyEUVAaDare|KkQ!ELHDvA-$Uiv$Qf_x`-hBQu=l)X%QBx9qkl-y6a>?Vqn5?ka?Wz zl*MM2a3qH{&i*Xq5cWh`!D+q7GV?;WRve4`d0@bJN@=mwO4p7qR*25c*ad}atc|;U zHG%B*FQ<-tz(^j2Io#;EMsQgyEVIGs(BrqS=|Q)I&x)SA+`gW8wDE`~HTiPGdEci89e8Rnz75kZss6ZskK~gqNc$Ohi&_t+Es@jGR?M}9_23mY z&}fr;+%8PJgZ=j&w{=mN@qFigU=$I2MB2wUx=r62C$$e6($wc^cAIrGlug}O=?y1? z!%V<HARW$NKCYwrd^p6vLL2W??3T9H)f zJb>)uww38n7164R9kb3J42ET^yju&u>ZPp|&Xg@hKx&EHm-FT&#ah;DmTGweHAI0D z>yGX1GoZOf)(pT^u)jXq4aBm>BtKegcvi;rqDBC``1@T%GCBD${iXyBu0gW6;lrQO zjh&P+rFz;dGe1sU~!=@ZK1>GXPmYFS80CNuf=O&+g}ZfE5* zw9+vYad)L%YvEC8ZC}Z)!NM+x+ENofE@oHDSqwkLGadqbMCc+_%b_-H3u_A;fh!oL z$kAkFdlovv^Gx&Ad&E#g|9iFcC)Y=Rw?qnuK^qFPZk3<-=kmBg%SGi+Gd7P2Y(4lB zX(o8Y?q7z;J0%Ode`O+ zjkT9vK1&@?|7pf0<99c@EoFyY_68P>^6c9yPcAhk^Ua(G`HA~trEnfR_2a$dcx^;m zLv=)BBG>&DzHLkDwDb=+8$4A!~O>l7#gLu`V=$UB*Az z@%xUP!d`c z1Vr0G1TJ_?=3)lCMc&rBJa zJ2QBFdv7fxF0!~fL&%lQ;Dc{v_qK^=XfH+T#-7^L?08eY51ca1A8BnhpqWrCZ>;eu zA!C@^{z{0YiCLDr{pq}>HFXjw(Vxcb#^VID_?(dyV z$H>r9gj{d`J-)*lb~6hzg=hi}I@+iYS353&*MgnDufJ*$J+N^-`udRjS7GKw6&x`=Iu5c#gX z#4KIYB3Lsts~4ntFO`OiM5vyCbFsID!+$xnW?qv&3T}V#+DMFg*^TIK$cM@!O%83D z=jF>-h`aXPP(5MCS1y{k?Xp9yt=&h)wEL=CA9T5H3(9{?KL>`CeFi^%d`ES!MZ?*L zMDn!T-Tq2?hw{L;4EP~CGa0=|rBld;Cq!H?kUOO50`ebiV!`eF`@M}iY3nKQ75-$z z$A7x$a>x3cADBBXf(JBe|75i3mb3PWH;BN^#)9B>vDd%;qJG5Wfh>baVg0;kA5htk_YlqWZ+q(`uv?^TJ19VS z42*Kzv?N07eDC!}qA$i|^|9l*Qrrw5-JsILk;{gkio0@BYw1~KZ0Jej5)?7%-30EZ zKchb4I5Kx>tNMP4&ADp)m1+3>v&NKzX)9X21am#d>xix%wu_GX_-9ejynHw-^NcYU z7@Ix#s3BC*nr@G{c3`iUa4PuSb3+-6ulX`rmphyCTTUrfnIQthH0eav+F5PTHDf+y zvE$1G2=;gSR3Aiz(vfZL>{en~}`|J}zk=e~QXdC7gtR9Nk$N)93k}E-(5U@%7?t zP8JFOVZl_3v;v#VJAFZd71mvp_+y9qP`_o1$6a=eKu4AE#JK!}E2(>?f!Fk6c9?b| zbKIns5OT{pD&#gB($Z^p)cG_@^fO~BRCd&kVm*uKBx-v%_-dd3-(0}(_UZGY9~p;f7co zDPte@mkRhrLk7@7^tp)f9w2@jDl^g(7}LizD3S}Ri?u}5K)zt5oI!;tr_pG&mT zVuqc9<4y^@8tamJ%e`u~3vwmT=Ro1b5&j(o=Qj7w88kRa zkkd@StQNJ*^Zj2{es)>^$2k+FH2#O|6L|vV0ya7{kcwTgX)fRzg7^ z{jk?tbVp?QJ-})G}oVRsW14zir(~N z*Vyw{5Ic3f*L6pKsTNlz~{Fz;oc+iMgi zVVf?DECS*&cEWkVfo=vUV)HVy?T%pYL<(P3!~I!mXP@ZiGXk$aYP=|JMFz{3>!dAB zvrlac;j$?>_#jiDzVU_r6z`h@EC9k{?;H2&h{9yO7CxQrUEfd_wz4h64%(P!5d}2R zip^qq<(T;sH{vo z2A|`nqG~#pxpI|OF)k`t@H)Df4rPv!mlR>KV19sy#6-#^BcjH1>gc>U3XDv5N5*p@ zf3NC9X%YNrvxaMHvD?f*$PSSg5WRI!I1Q>szb{f_X3E zavX6rsZ(j%sxY}XSJX_Nz?F z-LLCJ{u1XYjd(j#m=D>#u z*ggGEm00Y`wL5?eofQWAR)yVrh0uK`og*)e5S-;7E|8_s=zv;ck%QyRgBS1#1+TCoj{0A=o z$NV^tPHL!1%FYc<6=-UqU;790caA^R9vBP$B6~q!KG%wRE&2$dJyWH^o;HTaf7Wq! zeuvkmoTiM(@k7GM&X~=I=77{^5h-BcdaHBK@6g(roJhqz_ zi#)`j)4rX(7n`0IKAiplIQY^){6)Wv)y2iO9YS^7!<-#kP80O7Z8d9 zA?2mb*NgS-e&${;_K>^y$n2n=bZ@8WtBJR3>0L8JmHngUdA4g4Gu~FZ5)FZNtn438 zN1F$3tISuZwFq*ouvz-4G_-b`=MMOk#(W@@RrWjB&Gek%1Q=Jyvth6_;@iBZsnz?U zRa$0B^x@T6LtX(d)wDZh*_{0CJnwm&zE~YAS76obCe8H8a`r2-+5Ewn?%DmgC^Z#b zG2e5Jb1io&k7+l|K|^GRNiUEHI$Ebt`+1}3^jU&n;$TtT#&Z4H?4nfktqt5w|ImwT zu@6664yHU~-j3PYlv3?6__}6${yY!B%xa%9E&P?C1fCf*OsyZ)QZ(MX^`=f?{@RSb zTH)zPVeSAY-WMm&6Q2(T2B=EiQZq1#ghodUCRICfnvb%%4%j)xIMD2JTz}Q)#CZ6# z>(jRSls`yc^}5$DkQc`yG-uJpRYv}OsEn>&;rusL&y#}*81O@UVZar6y{7Vz+4Ft0 z_T~2k`SccklL{3p+kQWdg3afDWRG#|np?MWv0lCauvEyiOzjO#pJjcg(2Wd^mIXl{ z9S6Cx#KAld4aNfwv6Lb5@z>)7lGP4R2g=f36Y zz3I*SwPf2pAR_HCA@e2Flilb$zET70eS}r% z$$r587HZ<27{R8vmId_Eo41Sk8EzM+KVByejcKu-+BWvQP2bL4A8jes!i67a1$?ZK ziqTUko#;OyrCv2>#p>+z=QE2pe|-C?f}(lVQgpcUSGotU9s&3R(0R!^Po#7uG_B}| zwWqWmjj}ztd6d7Zzj5(Jip?D&M`>+gw#P+pae%Kv#-@ke?%@mfrHttW(+?~sFp%0P zO&YF0ILeH_=4qs`7HD6vRG$20X*p3cktKZ`;4i=n_TUyzVx-qtk&5Iq zIutZRR&RPq;9{_hb67T^TK;jVHUkhp0#E$n<0DNC)jx*~M+;=$^6W}+iBF7O0#xvTe14+DU5#zwpw*K)^cVy$h3tAU>BFT zq)L_GcWus2uYICbva92RyX4krgN$R?^r`7r0qQ@5z*IPt%J#Y0fBcIxWi25l%Wy+h zc*SZt&>oi5&1|!~Kc}Fjc?m~VnfiM8s7}h*)SS*JX69^7uV5MR5&SBXOSicBQBxOm zpdkG|KfBin3wgG+BXz|r`(0aJ(bgx>dEwSKJy}4<893l@`=kP?=v2Z1TUFbK)=lXA z4C|Zjb)M>9j?a~Ul>wv9eSUfs6wbY0JG2pnz)E)XPsRD5>wq z^9aFkBr}#GoV>F6Z?UFZFStuPo%#nG%_5XbBXxbDwuQEq+!2QhLiOBx|BuP+;u0>N z|7=)65t=WI-|YEFA#QMgw{MXoNbN)Rytnl0xmRn2ZSB97zpU7m0e=k_-;Mb$V+B?w zyuAqA?ByXrw1mZCc#&1ZXA;mPV=Q^d^q-{lURxMi8^K~9=B>lDRPDYZ6M9iHS{YwZ zHqw{8-c~Um1TQ)>Fgk>k8_!O29Qu%_652>}_oGfVnlXZ`XVBQPzgc}TmC6h7_9x(F zI%~82uKX`ENHvADPhGtJ%8OQELpo%sD2<z=^1N&F>WL})FF6Ls&k%2*5rZTP#Bo`E`2y$LtG zVS3Q|{J4tFJ4;(?tgBi1@OkZpX=~rLSBid)&Z?tSAy|@&f{QSZPj6c;+&nv~kM_DJ zS0ak)h!x%{^_#e)Rg*}waxT7lhK~{JyIzCJJl(aWv7Ijim)3?$Yb5kXtuKc+6%7ea zU9OfPZls($mu}L)NaTi@=8l)8^}WC7IDY=Rw?jM_zxuUBuYN8!1|VAsHC+Cf3{7V9 z^N8TooBaS^0G(y#!-`jQZ?RG)1M)drx!oujUogNlN|*P=z!AZ{HaB<6dIrt=0L?f^ zu+Dfby}vqj{l$p}4ZJG#5L`3?E^2(=)LMF>HD>Tzz+L;4>#(3Hn}s}1|0Exz=!dI%feJwudNEIpXA}& zW}B%?p*GFv+}aIZT!5zOn@;F86LMnS@~)l~RpDPhzK8wuw*U_o;EIQ4YH=#6Jsvmz zHy6;Kjw8MtzjH@`A)1dB5YIz1b0yVREl<9R_|0@7vsA}xH(=3#i=OYxh#l#5NjU&s zjLe|ly!Y9S4}^Lae@tdQ+vK!emU|`forE=7-C{GjH-ftfC3`{r3=kzgIop3y>oJNi z%<8IL=pzexX@C`mbc{-+-7TS$CHF_^I;=pm`DQ(!A7LZc-=DLcD+ftT-cb{mqD4X3@+FZ=`&u0LfgV8=ASyjxq$^6A_C*11r;X?MP(A-@ zknaLH?s|sa(dE?>rNV%f8q*DKe*CWK5~@cLnc_Xun9fYR^$^m(1x)}q%dDXeVx$?d zQcWhm`NY(7)d1E7A#?b&%p0C2r>+SGt9jS*P|(8y=W|QSUxenBd5pNOw2>4Re=g%R z82$!_Tg?<_c=CiWj;42ryD?$scODIN_eAgGwhZ@P?6_}VGP4`62E|7*@L#d?M}=fi zKBXxwdxtSGVf7)+r|(e&IcL zCUAhB+Mk@*kfe35B090g)XT=~e}>(iV2i&mrdp_W@C6Fw!|R7-l~WM$ptFeH_U9p9 z3!Y^JL|No8@wmqhatetajH1cT!oUMzHj2?X)wG8N;LVW}U?4u(w*|84Z(y(EzDxzDx9t857^pK-kISDkq$aF5O0pn0Uelyo69o*+%N5v}cm93@ zH*qR;T6nYvmc5CYMNA-5VGyEQSc}GAv)u#Jpr!w=FdTzN{m^_68ge%i27o~pGS`p0 zVU}91v-Z#_j$?;59T?ApxC=DKKgFc z`>ZL#C~Q1rVo1C@qiDh^9n3(4Agjp)h!=}!g7`s1e=b7-n6l&d2)$&&dhV#jJY&Ac z*OD?~O+FmMf^79J#rL5hxbif+y0jKXh7^R68j95WW(WoWBtzw`g5_Wtr#+wt!YV9l z%!?Db8xviyLaa#l^>O@qbA2~489C?7RGv%DFA^#w&eE?JMw}eblW|*_b+M7y&_hSS z=$*kV+LzUvP`8HP!SSQR4J|J0_{D`~nRRbQ;t)daw<%s9NiO28hHzR1r7#x)0YuLZ znFHdj#&8<%Uw4>r^AUr~iV^64N^jwOa3JJa^_-ml=082ys{k)5x0s#sh~)fNML_z# zhAu29gga3X?u8+|C2W+gekJ}bpPr~*-{6uy%YdaLl+5(cllS*4a_l1B7q>-Ut){L` zpETD5`Dn;7*HWuSgWHrmUIwfjbwoE&5<>6?$KZ=S3yCi7wQm)bkL*`c^-f){3U_1$ z+z`+bnd%jpq|EjJzUMADtj3C`3WWn70S|KJb)~hU%iu00&KSK*1Z%@oQhWOl~Cz0|i2TyJtxT?1`gmOkVvR6hEqzyBjDZOI9>WBLt5 zmYOR4w_|cp`HD~lKh5wmfEPM&%B5;b_*x(5ey^9l?F4=E;?hEw-GJ{TL=%S#B#td$ z6}B07FnHFLYKh@AoX1VagAABIY?O?}6qm2iM}UyM$XHVd9o3hnRGt9??Dn9YFSTVp zY`oiz1%xoe*D(!osIlY3&HgP$@z~_thqsqDD`0vvWM>;*cGMhPGhnP1NAn|Wl7;}j zRTy!{{d2rooQz#SW4nKKyV~RHyeH61LD0h3rEj%)hZrzwjf567wLt}D!9$M1Z9;$c zKUv;COd&h$d;T~|X01M$&gRJq+k_6omu&SKcwO=_Cj8^;5;V)Sb(Wp*#r}%F+${^K z+y4LjBGOSE`H8s$2k6v+&VmgAEq?}C3e**OacQmF{`G!~LCf=DL$l++Ue{ZEq+hUS ze~OnbMXmD3nk*QFj?mzTbF&QxeYVz9Np!#c&oF5X*MBKFK`DMVj{wmNTCa{TtJy4t z`-hu#Bu^U*&RO(v33|2i7mO$lqW(ilEK5g5Dr0)8fkBo3TAoXT z;*uX~uJV(j#a5n{ro)R6uB>mv7#{LEZhExavX=+QMuf1VrmjE~gjQdsd>QA8Wg=c| zT$^0~nLT%%%4l#nGB{SMU23mEhQMlN{i4`>@?oc_@haKmrKodDdbDbKYv}17m&{!l zcW9eBzSf`R9VwxE7)hxXN#hIRS~hWi^15sJaevuBrYO7%PrL>i(`%N88Py|Lvl$9_qO1~}X^M)QuwS%Iku{cT} z;3QB}noi5X9=b8ssdO^#lluo4ovS&T^9ztPB^&$zxRx`;|_8Zse}v{+?tu_ z@yfUaPYxjo5bElQt~uKBmQUYzwpi)moktk8o^pR#|HU-v#cUauAb2$ZrV7&d;PR2A z-Wz)uu6p0q628G=5O{<9oA;)#^P_?FcBgAy|2TH?C`wXi!|bw{P_|WA9l0`XhD_)2 zcQ4UYHy`TE*~Gi6p;ahw2^vVO(HJkYIwj3;H0h?E`_p5_8J<4Mxf?Ky8Cgz*4yt_{ za7Mup?3!_dJzXnFQ8{^~-0t-J$5?z&v4kWAM|;-fy4qc;InNF|t;7}JIjquQ9GSE@ zQy(+^H|iNGBs|oUt!9->KGJPbDzEUlG!YGEkd1HuN+KKmWA*BIbk3^F_3D1Co4XVD zEAn=#r2kfxlk22j7X`Wj=ux>ny%jM-hZla@>V-kgV_?5jol7UBIEPOYx(_$zPK9;6 zWCj#n$n2-};T*T!JbXl0l~zCT!&qW(Pf9?woOAU((0QUmYjs;A-UuO}-I?oHxe9dfdvawg6TR5}vt7OWOI98_QS# zaWUL6n3OJ@$pPI_uG!-kw(CXj=@j0_?^QVgQ5@=%!J`Dzs9SC~e590$)WTG9_v83DH$q{QB$`X({yP{L@>ixSdl4u|Z4aMO;1Y!GMBN?^*1C ztKs~EZ}b<*U(WgrbUS6DKqmxAm^)*QOg4huNxM+J?pF+kB`e6 z3jQ?HdLGnaJZ39xTjtF>1=aeCml!c6_N*{wrLKRGFQXXevN$;F-|Z^+9$-!}9&@>+ zwqK>R=N$*Ij{pFi*&f{DU|DJokSO9Ql08#UrUENp9tv*MGj9;A)Xx&i zB*}Ns1Q|lQN~uk)Ixx5bIn8~kUxD5D6pW7zk!)(}98?|n13;q!r3TR({1S%{5q@#v zk?&wHX6MJQW5^FY1GJcslmD;O=KnwK|6vIa?A?CarJZ))QTzQT`3h5=-jZe4NB%Oi z8=KDa4)=B5zdN2NfB)B9uW{e1QpL^Wd0(gQ(Lu6`Ts-MFvDrcP?t|fg$u)HI(AnQ{ zn%?4bxazuYPc?y%t(3|6`9X`Yg`NW zbD8GzA81P+%#bq@D4X@wchLH=9j*eEu}Y`?B`sN%llxV&)3}cK0#V+LKAJpeG2a_o zRc$r7Y)-IwaSVmugwPhhC$=S7|7|8EKdQBFIszs+0gE%P1 zwVyLa#!{$jr`SyrI_ZdFH%&9&Z7lx=Eq(q&@-3&Ak-w@X|P=gkMHIz3UdhS?Ui@%e>Cpu-?C48N`I^4x<^UPwO}*KMzXK= zx2m$Wy3M!U3!?!IR{Tsb3>bSa(&)`gzTP{+@tRu59I!DF2H2b^5Cbl z7dHHNCC(omkmmF{cI;;yFNEmGzRpYTl!{l>-ipIp8xFIENy&{p4T@)O6E@GAGxjdK zXKz}icE4tW9>1Caf1$y%7QOi~Hr|h#T(sdWiM|p&Q7Sy~w&(g+0V(q92TGjW7Mc&{ zo%{-H>?|Gol{kScOrpSAM70XFHKUkxTFkav;zxIg73XG0tnZJXR8z06yt^pulL3X_OwGUF%pKhc}Hxj`tb+jF+UBnb>c|zMgBNB zX+HCk^jg{C;_X$p^jxmxcn+xpZPqD_PH)~E?ccH z~y%2js zSotG>m_rykkT@s63hZGz3GdoIkX-ZRY@cWIQdwO@u<1-Qhx|;nJfjJ>Y~^iitxGvS zdbhziw0a?Ld`GJhzd7=DdOh6lR<_<&>eX>w#yOKAF5Mywc0+!!V5w}dbv_z}&pLr1 zjPW9>n7YUHq|J^nrHz5G`_si?g0IBMst-0?%122lj==~laU_3Kfgcxu)>X+7CRUJ) zcFm8JzN5MV?E;}qo0|bFAID$z`*%Y~(JvW5obZ|92eJnsJ$#V}94*dpC;doiJFrin zQy}d*;Et$po(ty1RZ2VmWC&O-TVvUQ;l!6sO63w){Y=L=*HJHKhx#|? z=UIP3%ti`>tk^zh@2YF9hV$ny$rJ&k1|(npLTdL<#sJ@XjD7UpoxGiD4Yl1=vWV*4 ziXM$m2iz{uP1FkdmsS-T9V1`KckG8<7BDJHz1w#!)U|6lqvnI9l5%>B@d{(7RbA}6 zFLQ;t>rG`9BXeo7Ff>GhodEfJ?*7#geTscCF8PR=kJE z3~(#Mk*Fr+cgh0GkrIoUlUKvE4V}mw9mxSha?b0mrLZ_LRi=g_20%{keg9Q0NK4(} zVba?sN(;I~9!%A4b}~Z1R#xLu-FX-WjJtLM=*&lTZ@YMG>Gjb{+m-dLZMk)VnU))x z0l3P$K1Y}xL(`zDSepQ%0OYrOrqyE&Yjb+9Owz%#ll{Lr#FMF<0c2kvhufKc}*Uy!wiq1;z#A7f{y zKQhpLHC&9|TYUfRy-+mqVtpXqL1y~Zy#IX-H>Z4)V+LDrFXQ(x=J*n)7iyb?yXbZW zhR#_(FfKd@Qm2j`TDxRf_U^1f1u}5BBg3QS(a>ojm>}l^Mj6y~qM-jw^_M9JSOj^8 z!mvTqeL+6Q4B z7)JDU-E`L~YZL}{>w}O3voug!>|jD%Lzfpke0mI1g5SKK`KvtBm=i~u)v@IeXU{{2JX8QVW6=--8fNaA`{OCAt?(4%M$XMs`R&K zN0Yj*6u~%AZNRNIZ2i0C;32hsxZ)K)n2`B^r7SirHs|s2PFCMoZ%qc4`2J=FFC@uI6z}VzAO^-u(c;`%$@po`j9o z+=fUFnl^$93z8`M)rzu$_aa|#YmptM+vhl9K@QRiiz7r;R1*Cy+>C7w=_H$i}I`; z{~{@PQq!vFEe#cat7SX*sO!)(Ehgf9*^*uPiIwZPL4x365i~z4^WdbpEFVCUB&Y{U zu;M%u?Xr@w&XUSAejGmzh<~82+za!&*ZktfJCzHZ)G)u+}L@c6=b@ z+TQFmwV*QUWM#bT6+;-f|5WK(S~xe4WmMv30IB&)Z1gZcF9-PI&6(`eLo0%hK78to zC?Wpb152mp*5unq#vY070v%b1Y#WDERDdQ-i*YvZu`RA$9#TFFQoGcqzD7yDQy^a6 z4X6BzAKITsU%1wa?G=Vi=^Q2D>R&|w`$afMv-;6P3#zBU9oT9-r6pib@70>rG|PCW zmXGt-0nZkn-nktDI$TWpt}H1 zoMVEmI0z%(f2uuw8F2O+lJ86KEx>Tez!S#1F!mQ?0i1(WLo=(n$XI~zy?puQ@;R$E zBNaL$X6`fB?%IGmkifZHu+x%5X;eAt!`G%lCFo!}-c&Z7cJX8a&yfrZQhJB6SZc27 z(i>(auz(HsO1B1hc<8fY>i*YZbr>mf$SIgGgG(?9m?Dk6VRP-ctHRGn43t+8D_Hnk z3SPm2WJl;BK}Cs!QM@4kX89OGr{WR>;XM^muwTLpZs7b2t>+*FW*R?_CVa?gUl4rt zOCO}38k^+RPi*G~#OfyXYGwQg!lgeD1V*d}F@r66&!DDbUH^=MpmFLW{y#9+=4Ryl;$xvCsA#6}fs z9w~7K_aG}yL6A-|%W@F=*Fl5aY`H$Ajb2T8@?NpP9joF3sfY zost$Eaaf8sP`p9zfg!@s;9}j-W%(+tXqx#1*rNhh-EF!3!smleuoViGX=z6}z4nY?!KEQe4?s-Cv)@%Ee3pK& zDgaieaOjfy0vypFO5^*_I23iF-yA-kfc+-0-NJoFFdqjwXHdO47r?04Gw zC#G1dcXMtxJ_4b_4Q6y*$0rqGt47x0Zc2?O`raT~_95IZzj`}>%|;J49<6=;8?Ik9 zJ9jzfJ|p`RX#YMh8PsHuOBIj?C1}HuZ0V`(qKfxEy2^n4IUG>@jV4DM)pIy`RstBz zdN>|!ctw}r>CIq=l|1oEUuKaM?Ov~L48W934PFbQdyNi;742e&m+M$m%g5WBoANQG zIZY_xZa3DLl_`i%^apdayWf-&q%aFjyl&(|5IMjg&_yln10pb_i;a-lreaXKtFs z?IHe|9*X?PDxdzpxd0jY3i!E-kbMZaDYw0Z^BumFJ^EbGi32DZc~ajg4$;4Nx=zDu zPV|CO=X(Ncb?V!clEpO7ykHo=0PM%5SbB=@T|?h>V^7kAk0XU8M9>G0d`|YwmP9HX zLkq26Pe1ZEgjQxunw|nNX#6UR=u=48k7$`aUi9D_bx5um9}0^8r~W1R8YhP({; z&FGdD`bt#dNr!Fz1N)G!9-@+6is`FK!Xulc)$bA!w+;h?n@hbk8Tw#V!D4Oz$h-lu zn5)NtUCtuXCZfDAff3)=1zV4*S81zZPj=bEOM+#H<~h;q-x}>TVP<=A@<1$vGYOTo zbla3cKJ@mOUu(CM5?cqX!x5S6VO(>R>(@)zZz0cQ??8EE-wYD&7S;?`+R* zyY>>CLeMlvpPgnbSQK39p?FO^J9`&)Eux4uJ(V7^{?wGU+D>v0kM$r8!w(h2sK78; z>C-``Un-wO0JmVpUb;hdiTv}VDVB}{FcM>f@mYx4GqeHHG9iBve&l|WlZLql-ID$9 zk)r-lZQMEOtG?8aVEFe~#fIf#uij#XpmXpN7Idf~(-R+Ec%-@-+CF-qC5aEV9T0cJ z{=zw=s|q&ll{2PZhReERk$~~LWJc|%#W{HhHyQA1Y%6Jt{qt_Mhg16bb|S_DFlL&% zZ0K+hwrfOtjW}e~u6#9R06UQ?H3gP$=tBql6;&EJ5U-DUn}D--NZJ-NJlV*IbfAd8 z@>Qej-EwH+j|%t`F0x>Aw6s5@W95F zgZ5%Lyv8wT!Tf_;ob#Aa95@{2>|@9Rkg%C?rI|A7~8c^j(iqd4?ip_Ei0)503Zq4YJ6Rpv?Fp zRat-PA5_}@_tv%Tkm#jHiLyW`e+gUj%ArE?5nERIn`IirX-OSM8y7E<7^4VdC z^e@4lP%sneGEg=%#UJyY&OxtGD=#}&%7Hxr#ldYHs;8ag7A6Z`Ij_B^KNoZfADVsT zj}L+p!2W`_EX@0s1Co@3xf@u)scNc58DuQ2QjtE_al*f_!yE4Ao-3ZbHVjBV9vDq8 zQ2z83cyqtDtV?d=Nh1M!1Aim3nq=V+WfD!H?Yks_4(eEHjwJDcb<%(8PojY1*2Z+Y4HNDX|whlS0}s4Gd*)69~! z{zF{^>eO7%!+9*&$vPMzjl*m6g0C&LemU&L&Wvd-jZd#hUcxD~r?jjy8lWL3J3@r5tg9;c!@diRQ9~+O?MNo3Qk6CH zDML<7-Py1%2~aWJCu=0J(mf+ZS*}a$wx47X=Yc$M&nWp|w1*)~S($_BdBrZ9CYRE0 z$DZX&NY2ccd$-)h^=l@sqM)*+9)rPie1+E+L)eZSruqeTw1g;DB7hD>JId+?d?0gX7%uDs^le%PK} zl7(j8WF3WRwPgXodBa=wuKA6NCX&ISJoOQBLG?DK9(acP)S7-htsfcFaei*?d0aSMAb8O@GVJRN;Q$-ktL>r}Q^T-Pd+yEOEx≶{1lflf-3rRU^ z>h~wqC0FJvd{URx;RizCGMQ(#Oz-Ab_(pwi7UC)Nu^JzGqvn#5U~b6sKIa2xPH$(| z8#1rQkZ#P~(oZ5muz}xR!dRe8FE_lMebYxkd}R4*NHW#+ruVvcck`r~r;pR*sBaz% z5Z?=Rr6cu^-rnVr611j<2pUfyG%-fQWfUioeq&*Gd{gdEfs8fuDckTD9z)CB9%=&qEzXuLWJ35_tf#-`At-s)QP2Tv{KO%L-yJBYAggbX;^24ao&uIjW_7hwtX#lU3rLh`-v?gaQhlq$qF zXW7M@rsx65a{CxOm>CBvo&*dEq8Chcw$ibk*2Vh3M&k}M-xJz*<_Ee=M?cZ*jX`_EqanKIv_%GqD!(C^o~ zUHxrK(4{|GZAgw&%^Wu0KNg0T%VzA^V~^CBB1>0_=NBt^Z&I_K)Rpz<+xc7%KxmBldr4y6!+K-}n96 zgjA$LX{l7Qqk&UW$qbPdWv`5i!f{SRN=A{rlbO9o4id6u%iiH2>llY~e)sG1{k{M3 zKJR{>dtCQ*-3M&3a;W=Z_o+triv&lD5klYj?Z?&bwavA_R{=KM>-f6fp@uD<_wFf` zBqlGq2-032TfS7{OCaxFgF0Mj9qX3WEy)_t96Z|WADMj@r9+XnUsdf`=_tAy8t!ar zGU096yWqB5wtH!har*$B<52UrrRPomu*-k00lVJhCYAKQ_ui6IA6JvRqso?V-u{QFgz@5_CP}Vj%^dldbsM)jqz}W9J$hA zPb_18-f742FTv8*Q_seKYz-P*A|Dwxo;dA1uJm$gwi41$@B9XG?zc>*f!yW6q4@V) zv0Wg9Q?FjqC10xLIIzaSwJ8)7zlxl?!X`8EE5m5$+TM0;%#b8f82*^AVL2 zUOA^@!-v&SYP?!-DL@11NV}R9>7t=D@ke0DKt%5SaEAWoqb8xMO3aa6wnMh|5Thl6 z!p27>rf>aY*mg?pL?$NNuGl4OA7ff^vDAG1LLsSUGQW!h@ezRJ;Y_{M)Rp;_f>4~b zJ|8)&3rcHU^|rt~MAH$-&(-=JP3+Ss^7j3UUeSMNFKRLD0Lk)N^)s8rN_x)Ro6xuD zUsrv$+j{{r5`TQi_8%1Ga@CKr(mf`oyrH!TSykwrp~1@^2WJ&`Vp6g?TlZ7Ufz4Xk z@98-;`6&wd93s(-n{D@>C>f*yM0w7afq9kCYV`5IcCVyauJorrh%B*h2478-K}kcv@Db8GEx1nOoeZ{2`#~S460R)XX+nt^@y39oOW#^AgYZ{N zaPxpgNU#S&I%Oo5wURo2Uz>%#imy1 z`tzjG)9TD669q(i?2FhspwOV+o_M(PAO}w4R;2smTj!r^0TB9ao#vnnU76K+AiF#+ zadPWlYB-z?yaS};EF7R2prK{Hp(cC!+-6G{*As3D;A)1T3ZBWB1&E6Zw=-(ZUtv^W zLEp1)>v$`@=r|XoOX1|tHC=W5e=I<%?(sIF8*SU+jXUb`S@$C9i)5tqy-`g}~SK!^5a)7t&Bh!!y8)FqcpHdWownr%n3 z^yYXlg4cW2-Gp@<^DnGs*FBm=AyI%lO$(Cf2~Up)|6-s36N>%5x`lMaxY^HUK4t7* z53~z1hUzllWR5|FOH)GIFKnn)xj%55cR^&Rkd5*RkFnA&VPbRM$9|F)@dMU$5z4`f z-1si&SOW~T`tu5Mh^?XA!EPK*-@r{*C(STX969I)S8aUSZ29h%jD?f-x|&}+w|+YZ zLJkn-EV{r-o3X8`W2_)y`2NPd$JO8bTHOK7-N1onLNmK97!J%e_qNA*Vdil zKsw$6b$KkrXmFnn&dz2>iHRbeYYkFMZd(nBH6{uso z&}59c6wECbKxQ2~y9;Vs%8QC~w2(7LU|b`V0d|<4X#D_SA4Wv|{6yS4UR;h)#yW8l zwIN9LF(9;}^`ooXO}Buc8O_H|TBSq8fGPcc!Nb9%pHv!+%mAo2(+}0apPEBYZ=jR< zHgT2-A$lG~yutrIn*kuC`o#ghy&w47L5F){N2j+H;F~?FcMUm67f{5hg=$!?7?fy4K7m}ex==1l7A0}gpukcG9#w#TpgKGAxwzT@s1w+S z8{#!0*SZ0>@#3yG)~8V+)#VhfmhFZ^i#;K#zF)b(t_TXUGlaWG;Z3%979g;TYkSR?2V z{KH#9*6&@gRRK_U4hC^f+Y)>UG2nRjv_t52qd^X-_@%oKF##EXiSgijp~V8>Bk2?T z$neo|CE5#{{l6Vo>V#-~0EF?$@sde7F-S=;d4x(0k>O$GsDXp_?3Sq)*|juEt;R{AJ$OXCm$ExQP|UR_7KI6U0{E&ED3p7ED!f7Ng}~x( zgFIetL;u*0R)Ftq(sxH!C}E;aqD;5MiziYU)hYs2OyEro}5#HCqTP?1A zKJ^FLq`~z{)1z|F@57nqi~zcv<9{8s^iz?B?p7?tKuP z=eaABrh0qQfZ>hYyeU9;;v>J@@+JrW{&qjHRSpQn5-m(}yRrY0>+iEmgM!MZ0_A&f zUriN)S$F|7S>Jp*(GG4EG?DJjU!T|WCNY6c73BXG<&+UfGmL@47(Yth>)x7$CU%%- zZmVQ}pWfO&u014JtmKdUqRSADo;9?Jy!#WSPxJERY0%ocr`!?coU!6*p6fM&8A!KVH&C<#xnhjQ5U9E#K zg=)_5Pn{MjYYY|z)m72`;QTuh-Oq>kPovtj;cL+^;<^A2*0WG%0;vyvU|ezW)h)#j zKw~tNO>76A(LSh&oUDe92~|D2Nhc9})LENqw7E_PyCISV%bU0YWEpm_qYbFp#y_M* zexdX=1&e%m6{{0pPd~i@j0~vMse?y8bxU3ouqKNo(LvNC;}PU+v+GL^21vWi(wM+i za1DYQJct##8JK?m@9+2iF<@9aq)cSrS+boe8dJ4HFBT!n&kTs?$@kKfPt9)`z)>u# zNlwx!LG>sM81QXcwLjpXQozbYu^Ag`P$b609d-%V7J;fbinC#$^m;}j-55ct9};i< zo_-nE3MvPn3VT=f_(@QG1pdYdC|+n*^C)u z?oL392Ss>lokFgI5N?)S4Bv_?f`$v9Z=Qu3T7lwA8e~^|k`gpNn8+_zK?L(4GU9-v zAA)1N@xPY-4DCa9*|iV6&TcXn z0kF(n);6jgl?51q&17OCp5ZkVPo~i<+UUee?(n&qp)!8ku z_cGM$V%(PqkdG4#7B`w`h(yE^9`2()RO`~dH-Eyz1Ut^(H(_%1=yAcIt{}z+fe7S> zs$7w&37m`HXUb%dkm-ZF;^awF$5US?}j z-_UV6=n8zIKOYMz)On^p+Mf1|@bbLnjTz*~Xaf$HnE1wr z5L)+`eI^tdLvP0k}EfF>`=z8LxQx7S<~gW%r>``5`jQU-!Vd9v(Z zq{nn`ZHyTvA^o@uN8#`Ktqqr6u07BbAwjn(re!PBNM=t3W$wW&z;r##dv2Z@;`)c` zufQhz*q7m6t5A*KIA^Xda3Ej!l;{qA0?Ab_>@=ozUyhOb85A?bSHV1|jUN3u0IbVR zWmudd1TLz>KRC*T19=LiOwe&JxVL757cfy-Lky7(bP`3L=LtxifYIJ90UA1B;7JIAI6Y_356^d(Vk*%4Yk z?{WVZ>E*M!R{p{XB*<`slG&txI=#jeDLk@tx z%;xkF(SnK6KGZckcCnrUvrHzTsz;q6H+!~~UNx4Rb!E_L^Qy(#fjb;nHS0qV3T)94 zl@=c86f?SFLurt!_hoOE;J$xd_qrQ6Zx%@PVnnQ_!=dq4v?aAqY5pA=r9wQj(Q}6X z#Ds}}@lyegKZwZMN93py3wT||B}qHb#m#_%4Q71o-=)KpjQr zHijD(e4rPDycv9 zb~HZU&~Une`cM@uvVz_Cf-;?{8>P>(CxZz{jV_Oj@0CCP>#gDOZb!BfOpVGXzX&L0 zHWJ)bp{Yq7LA=FvV+@FvdnospH%-BpF&iRxl#Mx<5F!*(x`AJAqQD=0~P zE;L`r+H(ln6r3Mk%nape@gVzH&YgjD=*A2vIrt6SjkdN}BbwIbgKk5Q@I$uu-JwOV zTa=74Y3+kBw7>RJ47e(TPyH>Lek__2d}1_PIAR}^?OHYGD=zz^P?@ zAK89uk+hSrfpCB}S;J~&m0hBl^3(3L?LfEw?)w)EicF_xpoth=vh}T){(Weom%T1J z2XFunDpelZ3|Y;d)Q;FIzuLF9h$|(!uvBE#@1@OTk4>Gp^6$Z>h0UYI-nqrd^3c7t zk!?H>mjj%KU2Iy*^bgX7Y4SGjJC#K3hYo9bd~(Wn;6Xt<2l4`8f;d_umtJ^v;t?g~ z6+ES>_JeLs-LZ1WFhS0GNyY(js1QKxV{qh-%3z9$;y&#I^6V&`F4ASh=RS0M0DfFV zLiv0KaR%47(6}xybf>+?wJt}YJ!c=T+{?)?Il0_nF^4w?8SVfz#URVS4k=ZC&FG$y z4sgh$iRYYuPJ}#8J1;0WXLe zy`MmMc!c!TFVuPbod;wB&rD;5eTO`f&Sk9kPu?#~mBarDImz^xn)%)Sqh zDWOOdJJjXmE1rBpn|vjAQmPtyp~xIr?XUaYZ(hm)2_%Xl?vEMZ>VD9*AMi9}Re%+F z{N1#7wEgDN;9e5-lx||y$~j$we+9^ls;mg`pXPlRw#aXvH!3Cm{> z@2%w&roPe1bA`3Oa=k||+dL0)d>%4TdKFS@3A%l$syP4F`N!5PWbx5KM|@zUhypX4<`oX!(V?lTYNo4Mh46zGRubPs3+m3UfhL8eXY~RJpKRBd|2Bao<`9>AUzc;>w|}{u9K-@m z!$=|_M>!VF6!BmBfV7rDR@E`s_D#=zn4jWdJRb0MWkQJ303Jas>Q;C*s=2qSNy5bF6JloCm->eR7^gywYqtV7;f7q@G;L+ishtA>7~B6 zd0fmA5eayqzmFAr1`6KiCMm`?2pTJ5q)XXP_PzNWSa3-tVo$*5)+hKkUn}YV8H}?M zUixNN1`8;OFH^`@PYfM(&Pw=gP#*K-f!u=6&6@Aa)+-cT%S2R)Sx9uU*}|2Vs}Q2t zP2}4N$dCsf$}C68=#f_}@Bd^)`~v6Z`X$MER|=v$`U`2pp3)3;M_?OqWC2>dp!C|S zLqQ_LuNqW4`WfEPAo#A_CpL=Tu$BDYlvO!1Q8`3&>`4_9Q%;zTB#UOzAHO62s8(<# z%^XS?HfU~vvbA4`IM=}t60Occ|Kl@MWW(-QHbd;^ev?+mXz|wK?VB$R zTouji2#TR?e3boRM8oFd2nM9xvia55X51Rf<%Mo@LF~g24e|S6eAIE(*u*W4TPr`t z+*bQds{Z8XpF~1c2{Y72%*9-dK#7EJe|g=O4xHRa(uCh%_ zi2!M)6Z2;*zo*3`#V#YGC%7Jia}Vu;`;o><{j&->O zE~KNf;MrKv9NDNp!S6y+G;Szi@Pmcmle;0R3+BhJAr*@(g%fUqa*0IF6ZJBezU0dt z`n}FvwuQ{JoOivgDKW7Z!47z83h54xj{kL`YgJc`3`u@NQ+B{baE|U};M9`{I7dt0 zsz!NUw=F^luFPZ__gUp2hTua0_Tp`5q`)lo@ zo=;8Y-n=Jp&nUlKIIz5liK}oI zfHd`Cf>F;NBsIJDu?;mR6Jta|is_I)`e#T|Wg?SOL*JIFQ|9E^fFB z+j3e8og7FBtHoK}2Mbi|;1))FJToiX+rB-~6Y?*`L!7l=z3fd|&Sr^~oa@(XGdKF{ z^$Pc8AZZ{|#E&2GtC!G|SnUsKvAw(ho(#gQZR*5vDQRdgG92ouz{v52_Sha~@^bSd z6&j?eO8L*?BgZc~xTYHmlv6{ca!Z%1)@g=|La}jj-EL*6wtBR9!u*fEp!3vscOfH` zj51WUSa~`>bouGcwVxElBr#9u`sjINE97m>ibkcq{1~U5hqB3ud-~ttB?fS4Hca#+ zEC_w=PN`26fLmFaJn|2>AxVp94KxNG7rIRri7g#tr>RWqrH4jrHVZa{R$-r6Gb5t? zz|iA5U#q85Wt)h|VRxU+Va&xR>4}xVqm;UEXh!wx9h-v;04Z>CAGkW#zdNcVIlisg z=yRL^PmJQ^J?&P89_^Be{$@UiZ?6?o>(<>3h8a7D*18CT?>iu3CSD zr)oWD@U`BRb{Q)oQofIk&rYg-mn58tm*+=j z9$$8&zP4hAtPw$cg(a(0e7KoUFg2@M4fY-mFFl%aiB;qLb!LgU!@M7YUU_tD4?Vsx z6XeS&L+-=25Mk?1z>29tKul?)&svL-(rjRT3b@CrGTU8}AEXb?^9Z*W8AGE0*hG0u*QF4*x_K>(+%p1KeV9sHL}+_3k( zV#P{^n~qfqvNVMUs&^~CzoXuI>0GL<_}1Gl(UQ|7hO!}&YTn4=py9+F`>kjlC41|J zpobe^b$qPOpFJg)z>{LtecR|1E+TT^EQ0XduT^#tVN0f`GxVA(pI(gXE|R+1?Kmt+ zcxJlGUa&u&AZ;CV96K~9#XaXm;=p3vsmnp#N8HQGM#!OR9Ejypid3hC`vUb&=WV;G z@sNS3&sqK(J>ZU!*4P^CvCFc08I7|UZ~f>-Fx_#;u`nm^eHzE7`^F!VS*G;oaLo%| zQ<|LQ5y_E_pAiK6Q8yCK=*MAql>`~0WSyUUad~y3lcIOSq!jgBi7C_Cm`13N^zXM* zyNPPwC$loWy7?#a7b%$`AMD-jo)fg#YS+{kk363TGD=MtPFu0 zfaISyC#O{RnR*Bki%Xso6vwKd|3&gXsk3r$x5;T8?yxg_^g*NWt^N_fmw>+NEaKQ# zu9m7g!;P?I=x%)(p9h*hY<86c`PKsgzNvvFgJDIHq1zU+G`;6{cIkzN6=+!xUrx0_ z99meHy|%BRq<+}a8}p8LRHVk2Fd~&0*<}|B#{GZy8k_acD1nroTf&6wpRn|-n+boj zbA-Abp$pq-@ZEqt_82Xm5*OW+^B4LQ!WQc(tx(8j9zsZE9PYqqub5No>dN$Y4wASO zc!d9#`Gvc$Eqw$LvVd~87x_4>DR`Ph^ReI0m&UA*vhPRw!N-QR+x>U8_hJ20I_dgR zvh0vQ?`A-MQ&2;l&MFx>>X7hvS*!u@NAz%0PrJK|Ppn1Q4RkSx#U6+hJMIT|B#hV;&x4IXcd37&y0*N1Vx-M!>5Uvc*l2M?Z2H=NyOvhvX@v z$S)KBz3koBRd}p5CBqU~kyjMk&6gtG*Z(_bK&HYuNh?n4dbo`SvrXl$r|((OJ+YTO zc_cc%SZk>8!Vj_O_|#}pdzJrtyA=|<@-33D$qS{P>dd3TWTA7CyR-qz#<_DO-fGy5 z@*$4ICYc<5Uy})`L_dVuBg*}q3o6rDY?>y^bdE>r-GH?dLD-1h`G4|0adJH-W9?2p zK9Qfs0pnD3PMP8Pe-EzpQka4Z{&Qt^%zCd7C(>WMk#-lJbaRh!?#{8HwBmMxVPs4~ zmo2)Vep_B9;)E_Ujq`u^Q^zcs@IlVONH$kN=xYKket6zsA=i;8%cpGx_#bSwaT-cB z^My<~O1MPsb|)H)$o<=LXFojtZ`svWbq8#FuDEo*(i4N9!E~A?HxeK3d@BdG>+FZD z74wsWVZOX5Zp2CT?lk{LDuj*OhTigM2&E;^;e(tUt)F*w%F;jA*tr^CuV%_f#yNTR z6z;Az8qA)@y~A|)p%ts<<(*G8EMl$~$Tz=fd~RTV!BS5aE}5%jw7M{pK=Cy^y>kXF zK}z@O_~y0sQC!j=ye4mP-05=Zz137=r2bKK0ERa=#2xw9{L)~-HUE9VF67n3fM;Q` z=?0VPJlD>h|M@s~J|x~{K=XFyU0$mXf`}I{-^>eHzX2xG0;n0nx+{2;^Dt>VVNQFC z$?gC`zcwze7NN9tT6}KDuEYwx;c2b^&7@;iiu-c01AqdNk8>{?BTM^ZXo2$un_grP z+(O@L&y_K2O*>wM{&nw))b_FUWMv_2=FTN7Z3vUOJ%*B@EnD$_?&~ul*KilN?*-~# zKo7^*h#AU#Y;jky%b1&|b&$Y@5rZg}SBE(icU~f%+gQM8%cw7AcKaNN2^^%%a`?rH zGdJSfz~jNu%VNHldKc2_S3TsDk0Q?lC#L(|zWmx^88zRrDy?s9?fFVM*eAt@ICmdM zq(N--4@MpX(qN@pnk zKFIKyA1s`zeB$tuV2h3O{3F!i;4Z{`fT7FreSCFw z@ZM}N*PHl9^cDKdr`1KB50D2A>^KWc3E?;4zN6H1kb1r*FNF!2jMaT;B7&p^HlFLr zzptlrTVEUz5@i^cHn^Y^*%d)m!nMkRFNSl=uz!zKp^j8JnT>?*L6ol>ouaY?4$Sk_ zLNyPHxOMKLlQ!8Ao4H{$BSq>Jsv1UWl)}&N%4awpdZ7c5_U3NNi3~o&0i)YgUkCW@ zxWwU_r}Ks^N#(1z98p?245`hlD*j1Ezx#3JT{IP31FeBZk;*+o`^1}>4=@#trZkT2!h#t&zqWJLXYVTot^qh&ZjUfkb{(pxm1b5D%{Aw-_<_*jarDPsjyj7O_bjcF~ zgRQqu^mc4=g{XLLj6!vXeVSgOX}tQqG#U|h#_sbTqWOih$N%Sk@g}Pn>xDE{K}r(S z2_&)CTbbfIHCnnIH@`ClhM8^q*VL%!jKquBF(cNonWg`B3pC)yIMxpB+yr0E#k0;K zYg6KK`x5tS!T|8?DUU>7yj0}anPTdDt-t;xG@Efz^DCM0Jo?ei+mFYeX38z)?s%xV zUn_dHB@abn;sW#DLI;=O&8Lqa)=yuQ|AL7UvJurboBblY$UvYvmG>qE!`O+xt(X=tTPCUeDBO# zB$meDw9>Q0<#SEb+Ebr*9y1Ranl&Qbn~L$bXpbQnWt{2QPlKT=PI37=+EZ^tI#%%r zop%_{J8n18a~qRgS}Yf%Dos1S=@7;KgyxcYF_q)Qg;-m?jko;^dFg`6)J!pEL2b0 zw4n&sTzFPH99}KF%kDjbl#CD$Or13M%lMa6wQEYk2py;QYGH9`UiozbR(x||;Cb_f zI52j@v4r{SNdeBDT+~l;lFg_w#h)^32~)t0)X$$o-wN#wc((hnj9kZw+?Un>ih)HS z7)lh?@tglE{FQpGB4Q6Rd|+nw!uNrFi|HO~Rn3CO(Ce{RAJ|r~m_HU2e+6q#Rb${| zph5iVd_Q!>9C_wrG}01kgn7~k4t5^QEO%mW;Sg)7iZN}lEVY_$-QcdJ zR-g7Qul@28#$o2(C~R-V82Nq~ryAxbk}uKJ!oLFxG=lrX>dK^?=XoqPKgvazqX97H zS=h~{XU;D zT>SBZ$Kgk6(tnw@tTx?qnvbW@&vL^syvd`sj~`aeo{%O`|4wrc-iy^Ulgn!vZ`vh2 z)=p4tuPCCY8~l~mN8RWqY-`|Tms@BPq1~+Y=+biZthCJh_g`G)LorW7!lr4bq@far zw0dmiXD$5gw#G?r*$KLu>PwJ*RtZPST`&&6i;ueilPsyGZoT^iKjXT8`Pzo~jyJ$- zoBbKde8KOVaO;c4ia&g$Oy*=!TBKv(j_!)}Wom=R+P0H(Se@bDNVFLj68?E%LYQpR z$6wroy>fBwSBhtJl1_a!E!xMQeX69|MlJf&+0CPvV{Ao@UNo%e%8-x_Ec>gJcFUkw zMoe4PeSz{!>A`_kP(Ze}p0#26tZ_i^>zZ^sZbfj$lae=w&U1B_ix-~ANhB@k_hNBw z)?0#;OYzWAH#Wtf)N-s@IMkfrMK#0CZG079GwmhTeOmP6 zm&+RI$I^z=(;(r4O9`{hcZ;9j9Y6c9LSd3fdpZP-3PltNJ;IyUsfWtfOo^-%EiSod zI?mIKG%7x@4o;sxTXZ5yjXYrH{q!Yu<-w#}QOKn!wBtYWoKw7SMk(GwpU}xoZt95|vv_Inc;QrIYNAG+*aW5A!ImI^B3!RoiM?IN@_d(d){ekk`|I0pS;) zTkgK|Fn`OD_1yH8{f1^kzG`_RHWz2MX16G+MvV(%Pp)iB&FB1*BiRx8OQrt=-AQmB w%s2n7MEft8vL8XH)VtK%4RFhhXhKMbTvPp2CUyfK4F5qC6;y9zTsMC8e@A?<8vp Date: Sat, 18 Jul 2026 19:36:20 -0700 Subject: [PATCH 36/79] docs(the-workshop): install dashboard via awesome-copilot, not jennyf19 repo The signals-dashboard canvas extension bundles with the-workshop plugin (x-awesome-copilot.extensions), so installing the plugin from awesome-copilot includes the dashboard. Drop the pointers telling users to install from jennyf19/the-workshop. Addresses PR review comments on README (Cairn Dashboard section), signal-write SKILL note, and workshop-ta agent viewing-signals note. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62 --- agents/workshop-ta.agent.md | 9 ++++----- plugins/the-workshop/README.md | 2 +- skills/signal-write/SKILL.md | 9 ++++----- 3 files changed, 9 insertions(+), 11 deletions(-) diff --git a/agents/workshop-ta.agent.md b/agents/workshop-ta.agent.md index 2974cd0a..6dae1d9e 100644 --- a/agents/workshop-ta.agent.md +++ b/agents/workshop-ta.agent.md @@ -105,11 +105,10 @@ Use `signal-write` when something needs the operator's attention: ### Viewing signals If the Workshop's canvas extension (🪨 Cairn) is installed — it -ships with the full plugin at -[jennyf19/the-workshop](https://github.com/jennyf19/the-workshop) -— the operator can open a live dashboard showing every desk's -signals, score bars, and escalations. The canvas reads -`desks/*/.signals/` for the latest signal JSON per desk. +ships bundled with the-workshop plugin — the operator can open a +live dashboard showing every desk's signals, score bars, and +escalations. The canvas reads `desks/*/.signals/` for the latest +signal JSON per desk. Without the canvas, you can still read signals by scanning the `.signals/` directories directly and summarizing for the operator. diff --git a/plugins/the-workshop/README.md b/plugins/the-workshop/README.md index 055f5404..5dadb901 100644 --- a/plugins/the-workshop/README.md +++ b/plugins/the-workshop/README.md @@ -34,7 +34,7 @@ A **desk** isn't a sub-agent — it's a peer with a history. Sub-agents inherit ## The Cairn Dashboard -The Workshop ships a **canvas extension** (🪨 Cairn) that shows the pulse of every desk — score bars, patterns, escalations — auto-refreshing in the GHCP app. Install the full plugin from [jennyf19/the-workshop](https://github.com/jennyf19/the-workshop) to get the dashboard. +The Workshop ships a **canvas extension** (🪨 Cairn) that shows the pulse of every desk — score bars, patterns, escalations — auto-refreshing in the GHCP app. It's bundled with the plugin: `copilot plugin install the-workshop@awesome-copilot` includes the dashboard — nothing else to install. ## Works With Ember diff --git a/skills/signal-write/SKILL.md b/skills/signal-write/SKILL.md index 70a163a9..c6252cee 100644 --- a/skills/signal-write/SKILL.md +++ b/skills/signal-write/SKILL.md @@ -86,11 +86,10 @@ The `subtype` field preserves the specific signal state for dashboard consumers. `signal_type` controls sort priority (escalation → top). -> **Note:** The signals-dashboard extension (shipped with the full -> source repo, not the awesome-copilot package) reads `subtype` -> when present and falls back to `signal_type` for display. If -> consuming signals in your own tooling, prefer `subtype` for the -> specific state. +> **Note:** The signals-dashboard canvas extension (bundled with +> the-workshop plugin) reads `subtype` when present and falls back +> to `signal_type` for display. If consuming signals in your own +> tooling, prefer `subtype` for the specific state. ### 2. Note the signal in the journal From 967f0d8ede481d91d36d715cb0981edd7fbef689 Mon Sep 17 00:00:00 2001 From: jennyf19 <19942418+jennyf19@users.noreply.github.com> Date: Sat, 18 Jul 2026 19:44:45 -0700 Subject: [PATCH 37/79] fix(signals-dashboard): harden canvas against XSS, path traversal, and malformed signals Address PR review findings on the Cairn canvas extension: - XSS: replace inline onclick handlers (which used HTML-escape that does not escape single quotes) with event delegation via data-act/data-desk attributes and one document click listener that survives the innerHTML auto-refresh. - Path traversal: add isValidDeskName() and enforce it in every HTTP and canvas-action handler that takes a desk name (reject empty, /, \\, null byte, '.' and '..'). - Crash safety: String()-coerce in esc()/truncate() and guard outcomeIssues with Array.isArray so a malformed signal cannot take down the whole dashboard render. - Honest UI: the per-desk button no longer claims to 'open' a desk; it is relabeled 'path' and copies the desk's filesystem path to the clipboard with an accurate toast built via textContent (not innerHTML). - Correctness: outcome signals only pair with a signal when emitted at or after it (within 1hr), and activeCount is computed by excluding stashed desks instead of subtracting counts (no longer goes negative). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62 --- extensions/signals-dashboard/extension.mjs | 94 +++++++++++++++++----- 1 file changed, 76 insertions(+), 18 deletions(-) diff --git a/extensions/signals-dashboard/extension.mjs b/extensions/signals-dashboard/extension.mjs index 39a593c0..74d0ab6e 100644 --- a/extensions/signals-dashboard/extension.mjs +++ b/extensions/signals-dashboard/extension.mjs @@ -11,6 +11,14 @@ import { joinSession, createCanvas } from "@github/copilot-sdk/extension"; const servers = new Map(); const STASH_TTL_MS = 48 * 60 * 60 * 1000; +// Desk names are single path segments (folder names under desks/ or classroom/). +// Reject anything that could escape the workshop dir via path traversal. +function isValidDeskName(name) { + return typeof name === "string" && name.length > 0 && name.length <= 128 && + !name.includes("/") && !name.includes("\\") && !name.includes("\0") && + name !== "." && name !== ".."; +} + // --- Stash management --- async function readStash(workshopDir) { @@ -116,8 +124,8 @@ async function scanSignals(workshopDir) { // Also check for any recent outcome (within 1hr of latest signal) if no run_id match if (!outcome) { const recentOutcomes = allSignals - .filter(s => s.parsed.signal_type === "outcome" && Math.abs(s.mtimeMs - latestTime) < 3600000) - .sort((a, b) => b.mtimeMs - a.mtimeMs); + .filter(s => s.parsed.signal_type === "outcome" && s.mtimeMs >= latestTime && (s.mtimeMs - latestTime) < 3600000) + .sort((a, b) => a.mtimeMs - b.mtimeMs); if (recentOutcomes.length > 0) outcome = recentOutcomes[0].parsed; } @@ -155,7 +163,7 @@ async function scanSignals(workshopDir) { // Outcome signal fields outcomeRating: outcome?.quality_rating || null, outcomeEffort: outcome?.effort_to_merge || null, - outcomeIssues: outcome?.issues_found || [], + outcomeIssues: Array.isArray(outcome?.issues_found) ? outcome.issues_found : [], outcomeAgent: outcome?.agent_name || null, honestyGap: honestyGap, }); @@ -188,10 +196,11 @@ function sortSignals(signals) { // --- HTML rendering --- function esc(s) { - return s.replace(/&/g, "&").replace(//g, ">").replace(/"/g, """); + return String(s).replace(/&/g, "&").replace(//g, ">").replace(/"/g, """).replace(/'/g, "'"); } function truncate(s, len) { - return s.length > len ? s.slice(0, len) + "…" : s; + const str = String(s); + return str.length > len ? str.slice(0, len) + "…" : str; } function formatTokens(n) { if (!n) return null; @@ -308,7 +317,7 @@ function renderSignalCard(sig) { ? `✓ done` : `✓ checkpoint`; - const stashBtn = ``; + onmouseout="this.style.background='${isEscalation ? '#7f1d1d' : 'transparent'}'" + title="Copy this desk's filesystem path to the clipboard">path`; let escalationBlock = ""; if (isEscalation && sig.escalationReason) { @@ -440,7 +450,7 @@ function renderStashedCard(entry) { ${esc(entry.name)} ${timeRemaining(entry.stashedAt)} - `; + title="Open this desk as a Copilot CLI session in its folder">open`; let escalationBlock = ""; if (isEscalation && sig.escalationReason) { @@ -637,11 +734,14 @@ function renderDashboard(signals, stashed) { const data = await res.json(); if (data.ok) { const path = data.deskPath || name; - try { - await navigator.clipboard.writeText(path); + // Copy the path either way, so there's always a usable handle. + try { await navigator.clipboard.writeText(path); } catch {} + if (data.launched) { + showToast('opening ' + name + ' desk…', path); + } else { + // No terminal could be launched from here — fall back to the + // path so the user (or the TA) can open the desk themselves. showToast(name + ' · path copied', path); - } catch { - showToast(name, path); } } else { showToast(name + ' · not found', ''); @@ -741,8 +841,9 @@ async function startServer(instanceId, workshopDir) { try { const s = await stat(deskPath); if (s.isDirectory()) { + const launched = await launchDeskConsole(deskPath, deskName); res.writeHead(200, { "Content-Type": "application/json" }); - res.end(JSON.stringify({ ok: true, deskName, deskPath })); + res.end(JSON.stringify({ ok: true, deskName, deskPath, launched })); return; } } catch {} @@ -865,6 +966,31 @@ const session = await joinSession({ return { error: `Desk '${ctx.input.deskName}' not found` }; }, }, + { + name: "open_desk", + description: "Open a desk as an in-place Copilot CLI session: launches a terminal in the desk's folder (inside the workshop repo) running copilot, oriented to read the desk journal and continue. This is the Model A 'sit down at the desk' — no new worktree, no session spun off elsewhere. Returns the desk path and whether a terminal was launched.", + inputSchema: { + type: "object", + properties: { deskName: { type: "string", description: "Name of the desk to open" } }, + required: ["deskName"], + }, + handler: async (ctx) => { + const entry = servers.get(ctx.instanceId); + if (!entry) return { error: "Dashboard not open" }; + if (!isValidDeskName(ctx.input.deskName)) return { error: "Invalid desk name" }; + for (const subdir of ["desks", "classroom"]) { + const deskPath = join(entry.workshopDir, subdir, ctx.input.deskName); + try { + const s = await stat(deskPath); + if (s.isDirectory()) { + const launched = await launchDeskConsole(deskPath, ctx.input.deskName); + return { ok: true, deskName: ctx.input.deskName, deskPath, launched, workshopDir: entry.workshopDir }; + } + } catch {} + } + return { error: `Desk '${ctx.input.deskName}' not found` }; + }, + }, ], open: async (ctx) => { const workshopDir = ctx.input?.workshopDir || process.cwd(); diff --git a/plugins/the-workshop/README.md b/plugins/the-workshop/README.md index b038e093..16c88a88 100644 --- a/plugins/the-workshop/README.md +++ b/plugins/the-workshop/README.md @@ -37,6 +37,9 @@ A **desk** isn't a sub-agent — it's a peer with a history. Sub-agents inherit The Workshop's live view is a **canvas extension** (🪨 Cairn) — `signals-dashboard` — that shows the pulse of every desk (score bars, patterns, escalations), auto-refreshing in the GitHub Copilot app. +Each desk card also has an **open** button that launches a Copilot CLI right in +that desk's folder, so you can sit down at a desk straight from the board. + It ships as a separate extension. Install it alongside the plugin to get the live canvas: ``` From c2beef4b4942e6d7a881390cc807f93720c30b7c Mon Sep 17 00:00:00 2001 From: jennyf19 <19942418+jennyf19@users.noreply.github.com> Date: Mon, 20 Jul 2026 10:55:35 -0700 Subject: [PATCH 50/79] Address review: state cairn's separate install/registration, not 'unbundled' The plugin manifest lists signals-dashboard under x-awesome-copilot.extensions and eng/materialize-plugins.mjs copies it into the materialized plugin, so the canvas files do ship with the plugin. Reworded the TA 'Viewing signals' section to drop the 'installed separately from the plugin' claim and instead state only that the canvas does not auto-load and must be installed and registered separately to show the live board. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62 --- agents/workshop-ta.agent.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/agents/workshop-ta.agent.md b/agents/workshop-ta.agent.md index 38a969bd..9dbaead7 100644 --- a/agents/workshop-ta.agent.md +++ b/agents/workshop-ta.agent.md @@ -110,9 +110,10 @@ The Workshop has a canvas extension — **🪨 Cairn** — that shows a live das of every desk's signals, score bars, and escalations. It reads `desks/*/.signals/` for the latest signal JSON per desk. -Cairn is a **companion canvas, installed separately from the plugin** — it does -**not** auto-load when the plugin is installed. If the operator asks you to "run -cairn" / "open the dashboard" and it isn't already showing: +The canvas does **not** auto-load when the plugin is installed. To see the live +board, install and register the `signals-dashboard` extension separately. If the +operator asks you to "run cairn" / "open the dashboard" and it isn't already +showing: 1. Install the `signals-dashboard` canvas extension. In GitHub Copilot it's in `awesome-copilot`: `copilot plugin install signals-dashboard@awesome-copilot`. From d4656d988d80fe7c2ef9aab641cd7593a0716fb8 Mon Sep 17 00:00:00 2001 From: jennyf19 <19942418+jennyf19@users.noreply.github.com> Date: Mon, 20 Jul 2026 11:09:46 -0700 Subject: [PATCH 51/79] fix(the-workshop): harden signals-dashboard desk launch Addresses the Copilot review on this PR: - deskAgentArgv: an explicit WORKSHOP_DESK_AGENT override is now authoritative. =agency insists on the wrapper even when it isn't on PATH; the PATH check is only used for automatic selection when unset. - launchDeskConsole: restrict the desk name to a conservative slug before it reaches any shell, and drop the double quotes from the orientation prompt, so the cmd.exe `start` fallback can no longer be turned into command execution by a desk directory named e.g. "review&calc". - macOS: drive Terminal via AppleScript to actually cd into the desk and exec the agent (POSIX single-quoted), instead of only opening Terminal and falsely reporting the CLI launched. - Linux: pass the agent command after each emulator's exec flag, so the desk comes up running its agent instead of a bare shell. - Client openDesk: track whether the clipboard write succeeded and stop claiming "path copied" when the browser blocked it. Synced from the-workshop@8e22ce84b2b28d9c2205730b1cd52db8586a0416 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62 --- extensions/signals-dashboard/extension.mjs | 92 +++++++++++++++++----- 1 file changed, 73 insertions(+), 19 deletions(-) diff --git a/extensions/signals-dashboard/extension.mjs b/extensions/signals-dashboard/extension.mjs index b4748919..0fed4a7f 100644 --- a/extensions/signals-dashboard/extension.mjs +++ b/extensions/signals-dashboard/extension.mjs @@ -45,7 +45,7 @@ function isValidDeskName(name) { // (a real Windows path cannot contain one), mirroring ConsoleLauncher.SafeDir, // so a planted workshop path can never break out of the -d "..." argument. function deskOrientPrompt(deskName) { - return `You are sitting down at the "${deskName}" desk in this workshop. ` + + return `You are sitting down at the ${deskName} desk in this workshop. ` + `Read journal.md in this folder first to pick up where the last session ` + `left off, then continue the desk's work. Write your journal before you stop.`; } @@ -99,31 +99,78 @@ function isOnPath(command) { // force vanilla, or =agency to insist on the wrapper. function deskAgentArgv(deskName) { const pref = (process.env.WORKSHOP_DESK_AGENT || "").trim().toLowerCase(); - const useAgency = pref === "copilot" ? false : isOnPath("agency"); + // An explicit override is authoritative: =agency insists on the wrapper even + // when it isn't detected on PATH, and =copilot forces vanilla. Only when the + // override is unset do we auto-detect and prefer Agency if it's installed. + const useAgency = pref === "agency" ? true + : pref === "copilot" ? false + : isOnPath("agency"); return useAgency ? ["agency", "copilot"] : ["copilot", "--name", deskName]; } +// A desk name flows onto a command line, and on the no-wt Windows fallback +// through cmd.exe. isValidDeskName still allows shell metacharacters such as +// & | > % ^, so the launcher additionally requires a conservative slug before +// any shell can see the name; anything else refuses to launch and the caller +// falls back to copying the path. Combined with the quote-free orientation +// prompt, no untrusted text ever reaches a shell parser. +function isSafeDeskNameForLaunch(name) { + return isValidDeskName(name) && /^[A-Za-z0-9._-]+$/.test(name); +} + +// POSIX single-quote a value for the macOS `do script` command line, escaping +// any embedded single quotes. +function shSingleQuote(s) { + return "'" + String(s).replace(/'/g, "'\\''") + "'"; +} + +// AppleScript string literal: escape backslashes and double quotes. +function osaStringLiteral(s) { + return '"' + String(s).replace(/\\/g, "\\\\").replace(/"/g, '\\"') + '"'; +} + async function launchDeskConsole(deskPath, deskName) { + // deskPath can't contain a double quote (a real Windows path never does and + // it would break out of a quoted argument). deskName must be a plain slug so + // it is safe on every command line and shell below. if (!deskPath || deskPath.includes('"')) return false; - const orient = deskOrientPrompt(deskName); - const run = [...deskAgentArgv(deskName), "-i", orient]; // agent + orientation + if (!isSafeDeskNameForLaunch(deskName)) return false; + const run = [...deskAgentArgv(deskName), "-i", deskOrientPrompt(deskName)]; if (process.platform === "win32") { // Windows Terminal is a GUI app, so it always surfaces its own visible - // window even though the extension host itself is windowless — opened in - // the desk folder, running the desk's agent oriented to the desk. + // window even though the extension host is windowless. It is spawned via + // argv (no shell), so the contents of run are passed literally. if (await trySpawn("wt.exe", ["-d", deskPath, ...run])) return true; - // Fallback when wt.exe is absent: a fresh console window via `start`, - // with the working directory set to the desk folder. + // Fallback when wt.exe is absent: a fresh console window via `start`. + // `start` re-parses its tail through cmd, so this path is only safe + // because deskName is a slug and the orientation prompt carries no shell + // metacharacters or quotes; nothing untrusted reaches the parser. return await trySpawn("cmd.exe", ["/c", "start", "", ...run], { cwd: deskPath }); } if (process.platform === "darwin") { - // macOS: open Terminal.app in the desk folder. `open` can't inject the - // agent command, so it drops the user into the desk to run it. - return await trySpawn("open", ["-a", "Terminal", deskPath]); + // macOS: `open` can't inject a command, so drive Terminal via AppleScript + // to cd into the desk and exec the agent. Each argv element is POSIX + // single-quoted so the shell can't reinterpret it, and osascript itself + // is spawned via argv (no shell). + const line = "cd " + shSingleQuote(deskPath) + " && exec " + + run.map(shSingleQuote).join(" "); + const script = 'tell application "Terminal"\n' + + " activate\n" + + " do script " + osaStringLiteral(line) + "\n" + + "end tell"; + return await trySpawn("osascript", ["-e", script]); } - // Linux/other: best-effort across common terminal emulators, cwd = desk. - for (const term of ["x-terminal-emulator", "gnome-terminal", "konsole", "xterm"]) { - if (await trySpawn(term, [], { cwd: deskPath })) return true; + // Linux/other: best-effort across common terminal emulators. Each is spawned + // via argv (no shell) with the agent command after the emulator's exec flag, + // so the desk actually comes up running its agent instead of a bare shell. + const linuxTerms = [ + ["x-terminal-emulator", ["-e", ...run]], + ["gnome-terminal", ["--", ...run]], + ["konsole", ["-e", ...run]], + ["xterm", ["-e", ...run]], + ]; + for (const [term, args] of linuxTerms) { + if (await trySpawn(term, args, { cwd: deskPath })) return true; } return false; } @@ -734,14 +781,21 @@ function renderDashboard(signals, stashed) { const data = await res.json(); if (data.ok) { const path = data.deskPath || name; - // Copy the path either way, so there's always a usable handle. - try { await navigator.clipboard.writeText(path); } catch {} + // Copy the path either way so there's always a usable handle, but + // remember whether it actually succeeded so we never claim a copy + // that the browser blocked. + let copied = false; + try { await navigator.clipboard.writeText(path); copied = true; } catch {} if (data.launched) { showToast('opening ' + name + ' desk…', path); - } else { - // No terminal could be launched from here — fall back to the - // path so the user (or the TA) can open the desk themselves. + } else if (copied) { + // No terminal could be launched from here, so the copied path + // is the fallback the user (or the TA) opens the desk with. showToast(name + ' · path copied', path); + } else { + // Neither launch nor clipboard worked; the toast still shows + // the path below so it stays usable. + showToast(name + ' · copy this path', path); } } else { showToast(name + ' · not found', ''); From 055dda167292238892d34ac3d012aefbc72479a9 Mon Sep 17 00:00:00 2001 From: jennyf19 <19942418+jennyf19@users.noreply.github.com> Date: Mon, 20 Jul 2026 11:28:43 -0700 Subject: [PATCH 52/79] signals-dashboard: harden desk launch (round 2 review) Synced from the-workshop@8106dd4. Addresses the second GHCP review pass on #2363: - isOnPath now requires a runnable file (X_OK / PATHEXT), not just existsSync. - launchDeskConsole adds a realpath-containment check (symlink escape) and takes workshopDir. - Dashboard copies the path only on the non-launch fallback. - Mutating /api/* routes now require the canonical loopback Host plus a per-server capability token (DNS-rebinding defense), mirroring connector-namespaces. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62 --- extensions/signals-dashboard/extension.mjs | 130 ++++++++++++++++----- 1 file changed, 99 insertions(+), 31 deletions(-) diff --git a/extensions/signals-dashboard/extension.mjs b/extensions/signals-dashboard/extension.mjs index 0fed4a7f..962b6d6b 100644 --- a/extensions/signals-dashboard/extension.mjs +++ b/extensions/signals-dashboard/extension.mjs @@ -4,10 +4,11 @@ // Supports stashing desks (48hr hold) and restoring them. import { createServer } from "node:http"; -import { existsSync } from "node:fs"; +import { existsSync, statSync, accessSync, realpathSync, constants as fsConstants } from "node:fs"; import { readdir, readFile, writeFile, stat } from "node:fs/promises"; -import { join, delimiter } from "node:path"; +import { join, delimiter, sep } from "node:path"; import { spawn } from "node:child_process"; +import { randomBytes } from "node:crypto"; import { joinSession, createCanvas } from "@github/copilot-sdk/extension"; const servers = new Map(); @@ -74,6 +75,18 @@ function trySpawn(cmd, args, opts = {}) { // Resolve an executable on PATH (honoring PATHEXT on Windows), mirroring // WorkshopRoom's AgentClis.IsOnPath. Used to prefer Agency when the machine has // it installed, falling back to vanilla Copilot. +// A PATH hit only counts if it resolves to a real, runnable file. existsSync +// alone would treat a directory or a non-executable file named `agency` as a +// match, so auto-detection would pick the wrapper and the terminal would then +// fail to run it with no fallback. +function isExecutableFile(p) { + try { + if (!statSync(p).isFile()) return false; + if (process.platform !== "win32") accessSync(p, fsConstants.X_OK); + return true; + } catch { return false; } +} + function isOnPath(command) { try { const dirs = (process.env.PATH || "").split(delimiter); @@ -82,10 +95,13 @@ function isOnPath(command) { : []; for (const dir of dirs) { if (!dir) continue; - try { - if (existsSync(join(dir, command))) return true; - for (const ext of exts) if (existsSync(join(dir, command + ext))) return true; - } catch {} + // On Windows only a PATHEXT match is runnable; on POSIX check the bare + // name, and isExecutableFile confirms the execute bit either way. + if (exts.length) { + for (const ext of exts) if (isExecutableFile(join(dir, command + ext))) return true; + } else if (isExecutableFile(join(dir, command))) { + return true; + } } } catch {} return false; @@ -129,12 +145,28 @@ function osaStringLiteral(s) { return '"' + String(s).replace(/\\/g, "\\\\").replace(/"/g, '\\"') + '"'; } -async function launchDeskConsole(deskPath, deskName) { +// Resolve symlinks on both sides and confirm the target is the workshop root +// itself or lives beneath it. The callers locate a desk with stat(), which +// follows symlinks, so a committed desks/foo -> /outside symlink would otherwise +// launch the agent with an external working directory, breaking the inside-repo +// guarantee. +function isInsideRoot(root, target) { + try { + const r = realpathSync(root); + const t = realpathSync(target); + return t === r || t.startsWith(r + sep); + } catch { return false; } +} + +async function launchDeskConsole(deskPath, deskName, workshopDir) { // deskPath can't contain a double quote (a real Windows path never does and // it would break out of a quoted argument). deskName must be a plain slug so - // it is safe on every command line and shell below. + // it is safe on every command line and shell below, and the resolved desk + // must still live inside the workshop root (which defeats a symlinked desk + // that escapes the repo). if (!deskPath || deskPath.includes('"')) return false; if (!isSafeDeskNameForLaunch(deskName)) return false; + if (!isInsideRoot(workshopDir, deskPath)) return false; const run = [...deskAgentArgv(deskName), "-i", deskOrientPrompt(deskName)]; if (process.platform === "win32") { // Windows Terminal is a GUI app, so it always surfaces its own visible @@ -219,6 +251,24 @@ function isCrossSiteRequest(req) { return site === "cross-site" || site === "same-site"; } +// Pin the Host header to the exact loopback authority we bound. A DNS-rebinding +// page reaches us under its own hostname (Host: attacker.example:), so an +// exact match against 127.0.0.1: refuses those requests before any state +// change — Origin/Host equality alone doesn't, since the attacker controls both. +function isCanonicalHost(req, canonicalHost) { + return String(req.headers.host || "").toLowerCase() === String(canonicalHost || "").toLowerCase(); +} + +// Capability check for the per-server token minted at startup and embedded in +// the page we serve. Only the loopback document we rendered knows it, so a blind +// cross-origin/rebinding caller can't forge a mutating request even if it +// reached the socket. +function hasCapabilityToken(req, token) { + const header = req.headers["x-workshop-token"]; + const provided = Array.isArray(header) ? header[0] : header; + return typeof provided === "string" && provided.length > 0 && provided === token; +} + // --- Stash management --- async function readStash(workshopDir) { @@ -675,7 +725,7 @@ function renderStashedCard(entry) { `; } -function renderDashboard(signals, stashed) { +function renderDashboard(signals, stashed, capabilityToken) { const activeSignals = sortSignals(signals.filter(s => !stashed.some(e => e.name === s.deskName))); const cards = activeSignals.length > 0 @@ -747,12 +797,17 @@ function renderDashboard(signals, stashed) { `; } @@ -592,11 +778,6 @@ export function renderCatalogHtml(instanceId, catalog, { filter, category, sourc .restart-banner .rb-dismiss { flex:none; appearance:none; border:0; background:transparent; color:var(--fg-muted); font:inherit; font-size:.78rem; cursor:pointer; padding:.1rem .35rem; border-radius:4px; } .restart-banner .rb-dismiss:hover { color:var(--accent); background:var(--bg-hover); } .is-hidden { display:none !important; } -/* The [hidden] attribute must always win. A class rule like .restart-banner{display:flex} - has the same (0,1,0) specificity as the UA [hidden]{display:none} rule and, being an - author rule, overrides it -- so setting el.hidden=true does nothing and dismiss silently - breaks. This reset restores the attribute's authority for every element. */ -[hidden] { display:none !important; } /* ---- split "remove" control + its popover menu + delete-confirm dialog ---- */ /* main + caret read as one pill; the shared 1px border between them is the @@ -688,7 +869,7 @@ export function renderCatalogHtml(instanceId, catalog, { filter, category, sourc ${sectionsHtml} @@ -866,9 +1047,9 @@ if (input.value) applyFilters(); // for now because it writes a plaintext API key into a git-tracked .mcp.json. const installScope = "profile"; -// --- Restart-required banner (tools load at session start) --- +// --- Restart-required banner (tools load at app start) --- // Visibility is driven by the server's in-process pendingRestart flag via -// /api/state, not local storage — a real session restart spawns a fresh +// /api/state, not local storage — a full app restart spawns a fresh // extension process and clears it, so the banner can't go stale. const restartBanner = document.getElementById("restart-banner"); // Once the user dismisses the banner, a late/racing hydrateState (its @@ -1068,7 +1249,7 @@ function openSignInModal(displayName, consentUrl) { cancellable = false; icon.innerHTML = '
\u2713
'; title.textContent = "Connected"; - sub.textContent = displayName + " is configured. Restart your Copilot session to load its tools."; + sub.textContent = displayName + " is configured. Restart the GitHub Copilot app to load its tools."; meta.textContent = ""; }, close() { doClose(); }, @@ -1116,7 +1297,7 @@ async function onConnect(btn) { pendingConn = null; } - await showConnectionSuccess(modal, item, 'Connected "' + displayName + '". Restart your session to use its tools.'); + await showConnectionSuccess(modal, item, 'Connected "' + displayName + '". Restart the GitHub Copilot app to use its tools.'); } catch (err) { const recovery = await recoverConnectorFailure( err, @@ -1128,7 +1309,7 @@ async function onConnect(btn) { true ); if (recovery.complete) { - await showConnectionSuccess(modal, item, 'Connected "' + displayName + '". Restart your session to use its tools.'); + await showConnectionSuccess(modal, item, 'Connected "' + displayName + '". Restart the GitHub Copilot app to use its tools.'); return; } if (modal) modal.close(); @@ -1218,7 +1399,7 @@ async function onReauth(btn) { await showConnectionSuccess( modal, item, - (isConnect ? 'Connected "' : 'Re-authenticated "') + displayName + '". Restart your session to use its tools.' + (isConnect ? 'Connected "' : 'Re-authenticated "') + displayName + '". Restart the GitHub Copilot app to use its tools.' ); } catch (err) { const recovery = await recoverConnectorFailure( @@ -1234,7 +1415,7 @@ async function onReauth(btn) { await showConnectionSuccess( modal, item, - (isConnect ? 'Connected "' : 'Re-authenticated "') + displayName + '". Restart your session to use its tools.' + (isConnect ? 'Connected "' : 'Re-authenticated "') + displayName + '". Restart the GitHub Copilot app to use its tools.' ); return; } diff --git a/extensions/connector-namespaces/renderer.test.mjs b/extensions/connector-namespaces/renderer.test.mjs index d0c464e4..3a3899cb 100644 --- a/extensions/connector-namespaces/renderer.test.mjs +++ b/extensions/connector-namespaces/renderer.test.mjs @@ -7,7 +7,7 @@ // loaders without a visible fallback. Reduced motion now stops the // animation while forcing each loader into a visible static busy state; // nearby text continues to communicate progress. -// 2. The "Restart your Copilot session" banner ignoring Dismiss. The real +// 2. The "Restart the GitHub Copilot app" banner ignoring Dismiss. The real // root cause was CSS specificity: `.restart-banner{display:flex}` is an // author rule with the same (0,1,0) specificity as the UA // `[hidden]{display:none}` rule, so it overrode the hidden attribute and @@ -56,6 +56,33 @@ test("setup subscription label names its select", () => { assert.match(html, /