* feat(plugins): add fluentui-blazor plugin bundling skill and MCP server
Bundle the existing skills/fluentui-blazor skill with the official Fluent UI
Blazor MCP server (NuGet: Microsoft.FluentUI.AspNetCore.McpServer, launched via
dnx) so users get usage guidance plus live component, enum, icon, documentation,
and v4-to-v5 migration lookup from a single plugin install.
The skill is referenced, not copied; skills/fluentui-blazor/ is unchanged.
Regenerated marketplace.json and docs/README.plugins.md via npm run build.
* fix(eng): count MCP servers in README plugin item totals
update-readme.mjs summed agents, skills and extensions but ignored
composition.mcpServers, while generate-website-data.mjs already counted MCP
entries. The README and website catalogs therefore disagreed for any plugin
declaring an MCP server.
Mirror the website generator logic, including the .mcp.json path form and
multi-server files, so both catalogs report the same totals. Affects
awesome-copilot (4 to 5 items) and fluentui-blazor (1 to 2 items).
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* refactor(plugins): align fluentui-blazor MCP config with the Agent Plugin spec
Rename .mcp.json to mcp.json at the plugin root and add the
https://agent-plugins.org/schemas/1.0.0/mcp.schema.json reference, matching the
Agent Plugin MCP server specification. Drop the manifest mcpServers reference,
since clients discover mcp.json without it.
Also correct a README claim that the server reads the library version in use.
Its documentation is generated at package build time and serves the version it
was built against, which is what the Prerequisites section already stated.
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* chore: regenerate plugins README after restoring the mcpServers manifest reference
Re-adding extensions[com.github.awesome-copilot].mcpServers to plugin.json makes
the item counter include the bundled MCP server, so the fluentui-blazor row goes
from 1 to 2 items. The generated file was not refreshed at the time, which failed
the validate-readme check.
* refactor(plugins): drop the mcpServers manifest reference for fluentui-blazor
Clients discover the plugin-root mcp.json on their own, and the
com.github.awesome-copilot namespace is stripped from the served manifest by
materialize-plugins.mjs, so the field had no effect on the published plugin.
Regenerate docs/README.plugins.md in the same commit: the item counter keys off
the manifest field, so the row goes back from 2 to 1 item and validate-readme
would otherwise fail.
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* refactor(plugins): scope the fluentui-blazor PR to the plugin itself
Drop extensions[com.github.awesome-copilot].mcpServers from plugin.json as
requested in review: clients discover the plugin-root mcp.json on their own, and
materialize-plugins.mjs strips this namespace from the served manifest, so the
field never reached clients.
Revert the item-counter change to eng/update-readme.mjs and regenerate. Counting
MCP servers is a repo-wide concern and now lives in its own pull request, so this
one only adds the plugin.
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* fix(plugins): discover MCP servers from spec-mandated mcp.json at plugin root
MCP config was declared via an extensions.com.github.awesome-copilot.mcpServers
pointer to a .mcp.json file. That namespace is stripped from the served manifest,
so nothing carried the MCP declaration through materialization.
Per Agent Plugins v1.0.0 the fixed location is mcp.json at the plugin root, which
already ships as-is. Drop the pointer, rename both .mcp.json files, and validate
mcp.json (schema, closed top-level fields, server transport variants).
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Validate mcp.json against the full v1.0.0 schema with Ajv
Replace the hand-rolled MCP checks with Ajv validation against the
canonical Agent Plugins v1.0.0 MCP schema, so non-spec configs (empty
command/url, non-string args, reserved PLUGIN_ROOT/PLUGIN_DATA env keys,
invalid cwd, unknown server fields) are rejected. Per-server errors are
re-derived from the matching discriminated branch to avoid unhelpful
oneOf output.
Also reject a top-level extensions.mcpServers placement, which slipped
through because the manifest schema allows arbitrary object-valued
extension keys.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9
* Strengthen mcpServers and stdio semantic validation
Reject mcpServers under any extensions namespace in plugin.json so
inline MCP config cannot bypass root-level mcp.json enforcement.
Also run stdio semantic checks after schema validation to reject
absolute command paths and cwd values that escape the plugin root,
with regression tests for both cases.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9
* Enforce MCP path containment across platform path styles
Resolve plugin-relative commands and placeholder-rooted cwd values
against the plugin root, normalize Windows separators, and reject
lexical or symlink escapes. Add regression coverage for traversal,
placeholders, Windows paths, and symlink targets.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9
* Align MCP semantics with the v1.0.0 specification
Restore the canonical cwd pattern and literal ./ command prefix.
Validate remote HTTP URLs and headers, including HTTPS requirements,
header syntax, control characters, and case-insensitive duplicates.
Keep PLUGIN_DATA checks lexical-only so it is not conflated with the
plugin filesystem root.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9
* Reject unsafe MCP symlink paths
Resolve mcp.json through the filesystem and require a regular file
inside the real plugin root, reporting dangling links explicitly.
Harden command and PLUGIN_ROOT containment checks to inspect symlink
ancestors with lstat and realpath instead of treating unresolved paths
as ordinary missing segments. Add regression coverage for outside,
dangling, and ancestor symlink cases.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9
* Handle mixed separators in MCP data paths
Split PLUGIN_DATA traversal checks on both slash types so mixed
separators cannot bypass lexical containment on Windows clients.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9
* Reject credentials in MCP package headers
MCP headers are visible package data, so reject credential-bearing
headers including authorization, proxy authorization, cookies, and
common API-key or token names. Preserve ordinary custom headers and
add focused regression coverage.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9
* feat: add fail-closed Local Delegation to Cairn dashboard
Port the-workshop Local Delegation seam into signals-dashboard 0.3.0.
Orthogonal off/on control beside repo/connected profiles; enable only when
local-agent-delegation is installed and a qualified route receipt is present.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
* fix: address Local Delegation review (skill path + README catalog)
- Walk marketplace/plugin and _direct install roots for local-agent-delegation
- Update plugins/signals-dashboard README and regenerate docs/README.plugins.md
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
* fix: keep Local Delegation Windows launches from reparsing -i prompt
Long LD orientation text split under wt/cmd on Windows (0x80070002). Keep
-i short/quote-free; rely on WORKSHOP_LOCAL_DELEGATION=enabled (+ skill)
for policy. Add charset/length guard tests.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
* fix: surface Local Delegation effective state on open toast and badge
Keep -i short with one optional ASCII line. Show operators
"Local Delegation effective · route <id>" on open and in the summary control.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
* fix: address Local Delegation GHCP review comments
- Cross-platform path.join in receipt fixture
- Atomic .local-delegation.json write (no symlink follow)
- Case-insensitive WORKSHOP_LOCAL_DELEGATION env clear
- Windows Terminal: set/clear env via cmd before agent
- aria-pressed on Local toggle
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
* fix: store Local Delegation preference user-locally, not in the workshop repo
A cloned workshop must not be able to ship preference:on. Key operator intent
under ~/.copilot/workshop-local-delegation/ by canonical workshop path.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
* fix: preserve path case in Local Delegation preference key
Lowercasing collided distinct workshops on case-sensitive filesystems.
Normalize separators only; realpath already supplies a stable path.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
* fix: allow parentheses in quoted Windows Local Delegation launches
Args are quote-wrapped; only block % and ! expanders inside quotes so paths
like C:\Work\Project (1) still launch.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
* fix: apply quoted-arg Windows safety guard in launch path
Complete the parentheses fix: use isSafeQuotedWindowsCmdArg for cmdSafe.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
---------
Co-authored-by: Jenny Ferries <jenny.ferries@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Michael Recachinas <mrecachinas@github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
* Bump gem-team plugin version to 1.102.0 and add entry
Updated marketplace.json and plugin.json to version 1.102.0, added gem-team plugin entry with 16 items, refined argument hints in multiple agent definitions, and updated planner, reviewer, and skill creator configurations.
* Bump gem-team plugin version to 1.103.0 and update acceptance_criteria references
* refactor: simplify agent definitions and add gem-design-md-guidelines and gem-devops-guidelines skills
* feat: optimize orchstrator for faster workflows
* chore: optimize skills
* chore: update readme
* chore: bump version to 1.108.0
* chore: streamline planner
* chore: upgrade microsoft-foundry plugin to 1.0.7
Update the external plugin catalog to the 1.0.7 source commit and regenerate the marketplace output.
* chore: update microsoft-foundry 1.0.7 source SHA
Point the external plugin catalog and generated marketplace output to the replacement 1.0.7 source commit.
Updated marketplace.json and plugin.json to version 1.102.0, added gem-team plugin entry with 16 items, refined argument hints in multiple agent definitions, and updated planner, reviewer, and skill creator configurations.
* feat: add Windows app storage inspector canvas
* Apply suggestions from code review
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* fix: address storage inspector review findings
* Correction to package and plugin
* fix: harden storage inspector cleanup
* Harden cleanup operation outcomes
* Add select a file or folder path in the result tabs to navigate the treemap to its deepest visible parent folder.
* Fixes to ensure selftesst pass
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Enhance Oracle-to-PostgreSQL migration skills and documentation
- Update migration agent guidelines to prioritize extension tool usage for code migration.
- Refine migration phases with detailed steps for pre-migration review and schema migration.
- Add new reviewing skill references for PostgreSQL materialized view refresh and UNION ALL planner risks.
- Ensure consistency in collation handling and testing strategies across skills.
* - Review migration phases to ensure correct order of execution
- Add exit criteria to each migration phase
- Remove invocation of `ms-ossdata.vscode-pgsql` extension due to dependency on VSCode
- Update README.md to reflect changes in migration phases and exit criteria
- Update broken reference to custom agent in plugin.json
* Enhance downstream migration skills and following custom agent improvements
- Added new skill for migrating .NET data access code from Oracle to PostgreSQL.
- Updated README to include new migration skill.
- Improved existing skills with clearer file naming conventions and migration actions.
- Added reference documents for handling Oracle-specific functions and pagination.
- Created detailed guides for NVL, DECODE, ROWNUM, SYSDATE, and DUAL replacements.
* Clarify PostgreSQL schema immutability and stored procedure migration risks
* Update target schema path in migration documentation for clarity
* fix(skills): clarify Phase 3-only scope for Oracle test skills
Both Oracle test skills were ambiguously worded in ways that could
cause a model to invoke them during Phase 6 (PostgreSQL test migration)
instead of using them exclusively in Phase 3.
Key changes:
- Rewrite descriptions to explicitly state Phase 3-only usage and
warn against invoking during Phase 6
- Replace "scaffold for Oracle first" with "Oracle only" to remove
the false implication of a second PostgreSQL scaffolding step
- Replace "Tests validate behavior consistency when running against
Oracle or PostgreSQL" with clear Oracle-only framing
- Rename "DB-agnostic assertions" → "Assertion portability" and
explain the why (survive Phase 6 migration without rewrites)
- Fix datetime bullet in integration tests skill to use generic
Oracle column precision language instead of PostgreSQL type syntax
- Name Oracle NuGet package explicitly (Oracle.ManagedDataAccess.Core)
* feat(oracle-to-postgres): gate Phase 1 on DDL presence; add DDL scan to Phase 2 risk analysis
- Phase 1 success criteria now requires Oracle DDL artifacts to be
confirmed present at the recorded location before proceeding.
If missing, the agent stops and prompts the user to provide them.
- Phase 2 risk analysis now explicitly scans DDL/Oracle/{ProjectName}/
as supplemental context, summarising procedure complexity indicators
(dynamic SQL, DBMS_* / UTL_* references, autonomous transactions,
pipelined functions, BULK COLLECT/FORALL, REF CURSOR, TYPE bodies)
rather than ingesting DDL files wholesale. This ensures schema-level
migration risk is captured even when it isn't visible in application
code alone.
* - Merge in latest 'main' changes
- Update custom agent plugin (eg resolve conflict and add new skill)
- Validate skills
- Run build
* chore(plugin.json): update version to 1.1.0
* feat(oracle-to-postgres): update version to 1.1.0 for migration expert plugin
* fix: add INOUT to ignore-words-list for PostgreSQL migration
---------
Co-authored-by: TCPrimedPaul <paul.delannoy@tc.gc.ca>
* chore: upgrade microsoft-foundry plugin to 1.0.6
Update the external plugin catalog to the 1.0.6 source commit and regenerate the marketplace output.
* chore: update microsoft-foundry 1.0.6 source SHA
Point the external plugin catalog and generated marketplace output to the replacement 1.0.6 source commit.
Adopt the Agent Plugins v1.0.0 namespaced composition model from #2546. Bundle the reusable daily-focus-board canvas into Ember only and remove its obsolete standalone catalog manifest.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 52be9c67-3ae4-4610-93d0-fe0b7ab95ccb
* Bump gem-team plugin version to 1.94.0 and update gem-designer-mobile agent documentation to align with Google DESIGN.md spec
* chore: improve replan workflow
* chore: minor adjustments
* fix: plan route list
* chore: add model routing section to gem-orchestrator.agent.md and update plan access rule; bump gem-team plugin version to 1.97.0; add Intelligent Model Routing section to README
* chore: context cache tweaks
Resolve the .codespellrc conflict by retaining both the daily-focus-board checkin key and upstream ACI term.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: fd1eae93-cc9f-4777-812c-a2a9872e1c2b
Update the external plugin catalog to the 1.0.5 source commit and regenerate the marketplace output.
Co-authored-by: Aaron Powell <me@aaron-powell.com>
Adds a canvas version of the daily-focus-board alongside the skill, addressing
@aaronpowell's review suggestion. The canvas renders the board in the Copilot
app and is backed by a JSON state file the assistant reads and writes, so you
can mark tasks done, add tasks, log progress, and recap your day from chat --
the file-backed "close the loop" upgrade over the localStorage skill.
The skill stays as the zero-install universal fallback for anyone not in the
Copilot app (same both-not-either pattern as the-workshop's signals-dashboard).
- extensions/daily-focus-board/: extension.mjs (canvas + session wiring) +
board-core.mjs (loopback server, JSON state file, mutations, recap) +
assets/board.html (file-backed UI) + preview.png + manifests.
- plugins/ember: register via x-awesome-copilot.extensions, bump 1.1.0 -> 1.2.0,
add a Components row.
Note: assets/preview.png is a placeholder pending a real board screenshot.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cb356aa8-0af2-48f3-b3c6-8086c69d5308
Executive-function-friendly daily focus board (self-contained HTML) you run by
talking to Ember. Registers it in the ember plugin (1.1.0) and regenerates the
skills index + marketplace.json.
Review fixes: emoji XSS escaping; keyboard a11y (semantic buttons + aria, plus
up/down move controls); tagc label colors; local-date storage key + recap
date/filename; guarded execCommand and localStorage; confetti animates only
while active and stops on reduce-motion; loopback serve bind + quoted dir;
JSON config injection with '<' escaped; minute rounding; reorder-to-end; clear
stale focus; counter goal guard; and doc corrections (id charset, sample
reference, counter contract, option-b, frontmatter length).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 07e720ee-ca02-419e-9adb-300738b6fc76
* chore: standardize agent documentation markdown, fix formatting, add MANDATORY clauses, and update output formats across agents
* chore: Update gem-team plugin version to 1.84.0 and refine concurrency language in agent execution steps
* Bump gem-team plugin version to 1.86.0 and update README
* Bump gem-team plugin version to 1.87.0 and update README
Update external plugin registration: rename identity and source.path to
microsoft-foundry, bump version to 1.0.3, refresh description and source.sha,
and regenerate marketplace.json.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 68571581-f9d1-4b01-a5d7-0a49c4a6b3b5
Samuel Bushi
Adrien Clerbois
Aaron Powell
Antonio Villanueva
zhoufenqin
John Haugabook
jennyf19
tomshafir-sonarsource
Muhammad Ubaid Raza
qinezh
github-actions[bot]
Daniel Scott-Raynsford
Paul Delannoy
Artsiom Chmutau
Jenny Ferries
Gaetan Semet
Florian Vogt
Jenny Ferries
denis-a-evdokimov
jennyf19
Qinen Zhu
Ayan Gupta