- extension.mjs: serialize stash read-modify-write behind a per-desk mutex;
order signals by explicit ISO timestamp (clone-safe) not mtime; keep desks
with malformed latest signal as 'awaiting'; gate calibration badge on a real
gap value; add prefers-reduced-motion CSS; toast aria-live region; rename
open_desk -> get_desk_path (returns path, no session); handle server.listen errors.
- signal-write/SKILL.md: document timestamp + run_id, ordering guidance, and the
outcome (calibration) signal schema.
- workshop-ta.agent.md: a desk is a persistent workstream picked up by independent
sessions, not one long-running process.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
The signals-dashboard canvas is a standalone extension, not bundled in
the-workshop plugin. Removes the same inaccurate 'bundled' phrasing the
README fix corrected, keeping the subtype guidance intact.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
Two follow-up review findings:
- signals-dashboard: the async createServer callback had no top-level
error boundary, so a malformed %-encoded path, a stash write on a
read-only workshop, or a scan failure rejected a promise the server
never awaits — hanging the request and risking an unhandled-rejection
crash. Wrap the handler and return a controlled 500.
- workshop-create: Path A treated finding a marker (desks/, CAIRN.md,
etc.) as 'just use it', an early stop that left partially initialized
workshops incomplete. Make it detection-only and continue scaffolding
whatever is missing, per the 'only add what's missing' principle.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
Address the remaining doc/skill review findings:
- workshop-create: 'gh repo create --clone' clones into the CWD, which
nests the new repo when run from inside a checkout. Add an explicit
clone-parent selection + 'rev-parse --is-inside-work-tree' guard, and
run the create from that parent.
- workshop-create: desks/ and bench/ were scaffolded empty, so Git drops
them and a later clone loses the scaffold. Scaffold .gitkeep in each
and commit the placeholders.
- bench-read: make <workshop>/bench/ the primary shared location (the
directory workshop-create actually establishes) with desk-local
artifacts as a secondary source, instead of treating the repo root as
the bench.
- the-workshop README: add the Workshop Create skill to the component
table so all six packaged components are documented.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
The signals-dashboard canvas extension bundles with the-workshop
plugin (x-awesome-copilot.extensions), so installing the plugin from
awesome-copilot includes the dashboard. Drop the pointers telling
users to install from jennyf19/the-workshop.
Addresses PR review comments on README (Cairn Dashboard section),
signal-write SKILL note, and workshop-ta agent viewing-signals note.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
Syncs with jennyf19/the-workshop PR #8 (merged). Adds the
workshop-create skill with Path A (existing dir) and Path B
(new GitHub repo), explicit guard against repo-in-repo nesting.
TA agent updated with workshop-create section.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
Never initialize over existing journal.md — if the desk directory
already exists, resume it instead. Operator must explicitly rename
or archive before reusing a desk name.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
- desk-open: add 'Session orientation' section explaining the
session→journal→signals lifecycle. Desks are long-running in
state (journal), not runtime (each session is independent).
- workshop-ta: partnership signals write to desks/_ta/.signals/
so they appear on the dashboard without replacing any desk's
latest signal. TA uses the _ta prefix to indicate coordinator.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
- desk-open: standard desk structure now creates .signals/ directory
(prevents first signal-write from failing on missing parent dir)
- signal-write: note that dashboard reads subtype field, falls back
to signal_type for backward compat
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
- plugin.json: use ./agents/workshop-ta.md path format (matches all other plugins)
- workshop-ta front matter: name 'Workshop TA' preserves acronym (was 'workshop-ta')
- signal-write: add subtype field (hands-up/blocked/done/checkpoint/partnership)
so dashboard consumers can distinguish specific signal states
- npm run build: regenerated docs/README.agents.md
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
- Add YAML front matter to workshop-ta agent (name + description)
- Fix agent path: use 'workshop-ta' not './agents/workshop-ta.agent.md'
- Sort skills alphabetically in plugin.json
- Make Cairn dashboard reference conditional (full plugin from source repo)
- Update signal-write: write JSON to .signals/ AND note in journal
- Add partnership signal type to signal-write skill
- Inline CAIRN disposition in agent (treat external CAIRN.md as optional)
- Run npm run build to regenerate marketplace.json and docs
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
The Workshop puts long-running AI agents (desks) in the same room,
on the same work, each with its own memory and history, sharing one
workspace so you direct the work instead of relaying it.
Components:
- Workshop TA agent (room coordinator)
- Skills: desk-open, desk-journal, signal-write, bench-read
- Marketplace entry for one-command install
Install: copilot plugin install the-workshop@awesome-copilot
Complements Ember (partnership for one agent) with coordination
for many agents. Install both for the full stack.
Source: https://github.com/jennyf19/the-workshop
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
* feat: add convert-excel-to-md, convert-pdf-to-md, and convert-word-to-md skills
Add three new agent skills that convert common document formats to Markdown
using bundled Python scripts powered by MarkItDown:
- convert-excel-to-md: Converts .xlsx workbooks to Markdown with per-sheet
tables and embedded image extraction via a bundled Python script.
- convert-pdf-to-md: Converts .pdf documents to Markdown with text/table
extraction and embedded image extraction via PyMuPDF.
- convert-word-to-md: Converts .docx documents to Markdown with proper
image extraction replacing MarkItDown's base64 placeholders.
Each skill includes:
- SKILL.md with detailed usage instructions, output structure docs, and
a troubleshooting table
- scripts/ with the conversion Python script and requirements.txt
- references/setup.md with environment setup instructions
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix: remove Markdown image syntax from convert-word-to-md SKILL.md
The CI valid-refs linter flagged the literal Markdown image syntax
containing a data URI as an invalid file reference. Replaced it with
a plain text description of the placeholder format.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix: update pip install command to use scripts/requirements.txt for setup
* fix: clarify installation instructions for requirements-file in setup documentation
* fix: correct indentation in image extraction function
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* feat: add comprehensive documentation and setup instructions for convert-to-md skills
* fix: add trailing slashes to skill paths in plugin.json
* fix: reorder skills in plugin.json for consistency
* fix: update plugin.json and README.md for clarity and consistency
* feat: add convert-to-md plugin and update related documentation
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* fix: enhance conversion skills to handle mixed file types and improve error handling
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Add a skill covering Helidon SE and MP patterns, Helidon 3 to 4 API migration guidance, and examples for HTTP, service, data, testing, security and observability in Java 21+ projects.
* Add tm7-threat-model skill for valid TM7 file generation
Adds a skill that generates valid Microsoft Threat Modeling Tool (.tm7)
files using the correct WCF DataContractSerializer format, with a minimal
reference file. Includes STRIDE threat generation workflow and a checklist
of common serialization mistakes that corrupt .tm7 files.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address PR review: sanitize reference model, fix dangling refs, move to assets
- Move example-minimal.tm7 into assets/ per repo convention (aaronpowell).
- Remove personal/corporate metadata from the reference model (Owner,
Contributors, ChangedBy domain account, project names).
- Make the reference model self-contained: add a second stencil so the data
flow and threat SourceGuid/TargetGuid/FlowGuid all resolve to real elements.
- Fix SKILL.md threat contract (KeyValueOfstringThreatpc_P0_PhOB with
b:-prefixed KnowledgeBase fields) to match the bundled reference.
- Reconcile guidance: MetaInformation/Notes/KnowledgeBase are valid schema
elements and must be preserved; only SecurityGaps/Mitigations are invalid.
- Regenerate docs/README.skills.md and normalize line endings to LF.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address 2nd review: correct KnowledgeBase placement, valid TypeIds, z:Id uniqueness
- Document KnowledgeBase as a top-level sibling after ThreatMetaData (not embedded)
- Update skeleton to show <ThreatMetaData/>, sibling <KnowledgeBase>, and <Profile>
- Replace TypeIds absent from the bundled KB: AzureCosmosDB -> AzureSQLDB,
HumanUser -> Mobile, GenericDataFlow -> Request
- Require z:Id uniqueness across the file in the common-mistakes checklist
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* ci: exclude *.tm7 exports from codespell
MTM DataContract .tm7 exports embed base64 icon blobs whose substrings
(oT, bu, wth, mKe, ...) trigger codespell false positives. Skip *.tm7,
matching the existing convention for binary/asset files.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: prasad <prasaddharaskar@gmail.com>
Co-authored-by: Aaron Powell <me@aaron-powell.com>
- Update migration agent guidelines to prioritize extension tool usage for code migration.
- Refine migration phases with detailed steps for pre-migration review and schema migration.
- Add new reviewing skill references for PostgreSQL materialized view refresh and UNION ALL planner risks.
- Ensure consistency in collation handling and testing strategies across skills.
Co-authored-by: TCPrimedPaul <paul.delannoy@tc.gc.ca>
font.getbbox() returns (left, top, right, bottom), so text line height must
be bottom - top (bbox[3] - bbox[1]). The label placement code used
bbox[3] - bbox[0] (bottom - left), mixing an x-coordinate into a height and
producing a slightly wrong label-box height (empirically off by 0-4px
depending on font). The debug heatmap labeling in the same module already
uses the correct bbox[3] - bbox[1], so this brings placement in line.
* Add arch plugin (architecture + modernization skills)
Add the `arch` plugin with two skills:
- `arch:document` — produce a single, cited architecture document for a
locally-cloned repo, reading files on disk only.
- `arch:modernize` — generate a phased modernization plan, auto-running the
document workflow first when no architecture doc exists.
Skill sources live in top-level skills/ and are referenced declaratively
from plugins/arch/.github/plugin/plugin.json, per the repo's plugin model.
Regenerated docs/README.plugins.md, docs/README.skills.md and marketplace.json.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Merge arch skills into single doc-and-modernize skill
Collapse the document and modernize skills into one standalone skill
(doc-and-modernize) with Documentation and Modernization modes, keeping
the plugin named arch. Modernization mode now runs the Documentation
workflow inline instead of invoking a separate arch:document skill,
fixing standalone-install cross-skill references. Reframe Documentation
mode as local-first (remote/API lookups are a flagged last resort)
rather than local-only. Regenerate docs and marketplace.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address PR review: list skill by bare ID in arch README
Use 'doc-and-modernize' (repo convention) instead of the namespaced
'arch:doc-and-modernize', noting it surfaces as arch:doc-and-modernize
when installed via the plugin.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address PR review: use non-HTML placeholder in instructions template
Change plain-text <PROJECT NAME> to [PROJECT NAME] in the header and
first paragraph so Markdown renderers don't parse it as an HTML tag and
drop it. The code-span `<N>` on the phase line is unaffected.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address PR review + fix codespell CI failure
- Fix codespell: pre-empts -> preempts in the instructions template
- Consistent terminology: replace 'research step/workflow' with
'Documentation mode' in SKILL.md, README, and plugin.json description
- Fix run-on: add 'that' before 'Modernization mode must surface'
- Regenerate docs/marketplace for the updated plugin description
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address PR review feedback
- Instruct redacting credentials/tokens from git remote URLs before recording
- CI enforcement: ask user or mark [UNVERIFIED]; remote lookup is flagged last resort
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: samqbush <samqbush@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Renames the skill so its name makes the source-code-review scope explicit and
distinct from the existing config-focused `mcp-security-audit` skill (the
duplicate-detection check flagged the shared `mcp-security-` prefix; it is
advisory only). Also sharpens the description's first line to lead with
"implementation source code of MCP servers, clients, and tool handlers".
- Rename folder skills/mcp-security-baseline -> skills/mcp-implementation-security-review
- Update name field and H1 heading to match
- Regenerate docs/README.skills.md
Co-authored-by: Swetha Kumar <16600902+Swethakumar1@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add foundry-hosted-agent-copilotkit skill (development-focused)
Reworked from PR #2090 feedback: drops all scaffolding/sample-template
content and focuses on ongoing development with CopilotKit + AG-UI +
Azure AI Foundry hosted agents — adding/gating tools, human-in-the-loop
approvals, generative UI and shared state, event-stream debugging,
pre-1.0 dependency upgrades, and the hosted-agent deploy loop.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Add HITL code examples to foundry-hosted-agent-copilotkit skill
Address review feedback: the .NET approval paragraph was prose-only.
Add a .NET snippet from the official Step04_HumanInLoop sample and
correct the type/behavior (ToolApprovalRequestContent; convert—not
remove—the request_approval call/result). Also add live-verified
Python snippets for hosted-agent approval-forwarding (#6652) and the
previous_response_id #6851 guard.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Add mcp-security-baseline skill
An Agent Skill that reviews MCP server and client source code against a security
baseline (5 controls, 7 RCE vectors, OWASP MCP Top 10) and produces a compliance
report with file/line evidence. Complements mcp-security-audit, which checks
.mcp.json configuration.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address review feedback: remove ignored keywords field, link MCP spec
- Remove the top-level `keywords` field: it is not a recognized skill
front-matter field and is ignored (skills are indexed for search by
name + description only). The keyword terms are already present in the
description, so discovery is unaffected.
- Link the MCP 2025-03-26 specification at the protocol-version check so
the agent has it for quick reference.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address review feedback: fix unsafe-deserialization example, link current MCP spec
- Change the unsafe-deserialization example from `yaml.load(..., Loader=yaml.FullLoader)`
to `Loader=yaml.UnsafeLoader` to reflect genuinely unsafe usage.
- Add a link to the current MCP spec revision (2025-11-25) alongside the 2025-03-26
baseline on the protocol-version check.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Swetha Kumar <16600902+Swethakumar1@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Aaron Powell <me@aaron-powell.com>
* Add pester-should-migration skill (experimental)
Companion to the pester-migration skill. Focuses on the optional move from
the classic v5 `Should -Be` assertion syntax to the new v6 `Should-*`
assertions (e.g. `Should -Be` -> `Should-Be`). Includes a full
operator-by-operator mapping and the behavioral gotchas (negation as a
separate command, BeExactly -> Should-BeString -CaseSensitive, truthy/falsy
vs strict bool, BeNullOrEmpty split, collections, pipeline unwrapping).
Marked experimental/preview: verified against Pester 6.0.0-rc2; the new
Should-* assertions may still change before the 6.0 release.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Trim experimental status callout in pester-should-migration
Address review feedback: drop the time-based, human-oriented preview guidance (release-candidate timing, "as of mid-2026", release-notes link) from the status callout, keeping a lean experimental marker. The agent has no concept of time, so that prose is just extra tokens.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Awesome Copilot Community <awesome-copilot-community@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Aaron Powell <me@aaron-powell.com>
* Add pester-migration skill
A self-contained, experimental skill that helps upgrade PowerShell Pester
test suites across major versions (v3->v4, v4->v5, v5->v6). One router
SKILL.md plus per-jump references. The v5->v6 guidance tracks Pester 6,
which is still a release candidate.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Regenerate skills index for pester-migration
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address review feedback on pester-migration skill
- Pin the stable-v5 install to -MaximumVersion 5.99.99 so it keeps
installing v5 after Pester 6 goes GA (SKILL.md).
- Make the baseline run command version-agnostic (bare Invoke-Pester)
and note that parameters differ across majors (SKILL.md).
- Replace the '->' mapping arrows inside powershell fences with
comment + valid replacement lines so snippets are copy/paste-safe
(SKILL.md v5->v6 cheat sheet, v5-to-v6.md, and v3-to-v4.md).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address review: scope -SkipPublisherCheck, trim status callout, order references
- Drop -SkipPublisherCheck from the default install commands; scope it to
Windows PowerShell 5.1 (installing over the OS's Microsoft-signed built-in
Pester 3) per pester.dev install docs, instead of an unconditional default.
- Trim the experimental status callout: keep the preview marker, drop the
date-based, human-oriented wording.
- Reorder the References table into version progression order (v3->v4, v4->v5,
v5->v6).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: nohwnd <jakub@jares.cz>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Aaron Powell <me@aaron-powell.com>
Ayan Gupta
jennyf19
Simon He
Jenny Ferries
Samuel Bushi
Suren K
Augustin Popa
Augustin Popa
Anton Standrik
Willie Yao
Suren K
prasadgd9022
Akash Dwivedi
Paul Delannoy
Artur Spychaj
Gijs Reijn
samqbush
Swetha Kumar
Sunil Sattiraju
Jakub Jareš