* feat(plugins): add fluentui-blazor plugin bundling skill and MCP server
Bundle the existing skills/fluentui-blazor skill with the official Fluent UI
Blazor MCP server (NuGet: Microsoft.FluentUI.AspNetCore.McpServer, launched via
dnx) so users get usage guidance plus live component, enum, icon, documentation,
and v4-to-v5 migration lookup from a single plugin install.
The skill is referenced, not copied; skills/fluentui-blazor/ is unchanged.
Regenerated marketplace.json and docs/README.plugins.md via npm run build.
* fix(eng): count MCP servers in README plugin item totals
update-readme.mjs summed agents, skills and extensions but ignored
composition.mcpServers, while generate-website-data.mjs already counted MCP
entries. The README and website catalogs therefore disagreed for any plugin
declaring an MCP server.
Mirror the website generator logic, including the .mcp.json path form and
multi-server files, so both catalogs report the same totals. Affects
awesome-copilot (4 to 5 items) and fluentui-blazor (1 to 2 items).
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* refactor(plugins): align fluentui-blazor MCP config with the Agent Plugin spec
Rename .mcp.json to mcp.json at the plugin root and add the
https://agent-plugins.org/schemas/1.0.0/mcp.schema.json reference, matching the
Agent Plugin MCP server specification. Drop the manifest mcpServers reference,
since clients discover mcp.json without it.
Also correct a README claim that the server reads the library version in use.
Its documentation is generated at package build time and serves the version it
was built against, which is what the Prerequisites section already stated.
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* chore: regenerate plugins README after restoring the mcpServers manifest reference
Re-adding extensions[com.github.awesome-copilot].mcpServers to plugin.json makes
the item counter include the bundled MCP server, so the fluentui-blazor row goes
from 1 to 2 items. The generated file was not refreshed at the time, which failed
the validate-readme check.
* refactor(plugins): drop the mcpServers manifest reference for fluentui-blazor
Clients discover the plugin-root mcp.json on their own, and the
com.github.awesome-copilot namespace is stripped from the served manifest by
materialize-plugins.mjs, so the field had no effect on the published plugin.
Regenerate docs/README.plugins.md in the same commit: the item counter keys off
the manifest field, so the row goes back from 2 to 1 item and validate-readme
would otherwise fail.
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* refactor(plugins): scope the fluentui-blazor PR to the plugin itself
Drop extensions[com.github.awesome-copilot].mcpServers from plugin.json as
requested in review: clients discover the plugin-root mcp.json on their own, and
materialize-plugins.mjs strips this namespace from the served manifest, so the
field never reached clients.
Revert the item-counter change to eng/update-readme.mjs and regenerate. Counting
MCP servers is a repo-wide concern and now lives in its own pull request, so this
one only adds the plugin.
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* fix(plugins): discover MCP servers from spec-mandated mcp.json at plugin root
MCP config was declared via an extensions.com.github.awesome-copilot.mcpServers
pointer to a .mcp.json file. That namespace is stripped from the served manifest,
so nothing carried the MCP declaration through materialization.
Per Agent Plugins v1.0.0 the fixed location is mcp.json at the plugin root, which
already ships as-is. Drop the pointer, rename both .mcp.json files, and validate
mcp.json (schema, closed top-level fields, server transport variants).
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Validate mcp.json against the full v1.0.0 schema with Ajv
Replace the hand-rolled MCP checks with Ajv validation against the
canonical Agent Plugins v1.0.0 MCP schema, so non-spec configs (empty
command/url, non-string args, reserved PLUGIN_ROOT/PLUGIN_DATA env keys,
invalid cwd, unknown server fields) are rejected. Per-server errors are
re-derived from the matching discriminated branch to avoid unhelpful
oneOf output.
Also reject a top-level extensions.mcpServers placement, which slipped
through because the manifest schema allows arbitrary object-valued
extension keys.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9
* Strengthen mcpServers and stdio semantic validation
Reject mcpServers under any extensions namespace in plugin.json so
inline MCP config cannot bypass root-level mcp.json enforcement.
Also run stdio semantic checks after schema validation to reject
absolute command paths and cwd values that escape the plugin root,
with regression tests for both cases.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9
* Enforce MCP path containment across platform path styles
Resolve plugin-relative commands and placeholder-rooted cwd values
against the plugin root, normalize Windows separators, and reject
lexical or symlink escapes. Add regression coverage for traversal,
placeholders, Windows paths, and symlink targets.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9
* Align MCP semantics with the v1.0.0 specification
Restore the canonical cwd pattern and literal ./ command prefix.
Validate remote HTTP URLs and headers, including HTTPS requirements,
header syntax, control characters, and case-insensitive duplicates.
Keep PLUGIN_DATA checks lexical-only so it is not conflated with the
plugin filesystem root.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9
* Reject unsafe MCP symlink paths
Resolve mcp.json through the filesystem and require a regular file
inside the real plugin root, reporting dangling links explicitly.
Harden command and PLUGIN_ROOT containment checks to inspect symlink
ancestors with lstat and realpath instead of treating unresolved paths
as ordinary missing segments. Add regression coverage for outside,
dangling, and ancestor symlink cases.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9
* Handle mixed separators in MCP data paths
Split PLUGIN_DATA traversal checks on both slash types so mixed
separators cannot bypass lexical containment on Windows clients.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9
* Reject credentials in MCP package headers
MCP headers are visible package data, so reject credential-bearing
headers including authorization, proxy authorization, cookies, and
common API-key or token names. Preserve ordinary custom headers and
add focused regression coverage.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9
* Add repo-standardizer skill: polish any GitHub repo surface
* fix(skill): remove non-string metadata and fix template README refs for vally lint
* docs(skill): drop markdown relative links from README language-switcher example
Vally valid-refs flagged ./README.md and ./README.zh.md as missing file
references; they are generated artifacts, not skill files. Keep the
example as plain text to satisfy the linter.
* fix(template): add missing language switcher to English README template
Align with README.zh.md template and SKILL.md switcher convention:
current language as plain text, other languages as relative links.
---------
Co-authored-by: programmingWTF <programmingWTF@users.noreply.github.com>
The MCP Apps sample HTML bundle imported ext-apps from esm.sh using an
unpinned major-version tag (@1), which Snyk flags as an unverifiable
external dependency / third-party content exposure risk (indirect
prompt-injection surface, since the imported module can call
app.updateModelContext and app.callServerTool). Pin it to the current
release (1.7.5).
Also pin the sample `dotnet add package` commands for the
ModelContextProtocol* and Microsoft.Extensions.Hosting packages to
their current exact versions (2.2.0 / 10.0.11), and correct a stale
"2.0.0 is current" note in packages.md.
* feat: add fail-closed Local Delegation to Cairn dashboard
Port the-workshop Local Delegation seam into signals-dashboard 0.3.0.
Orthogonal off/on control beside repo/connected profiles; enable only when
local-agent-delegation is installed and a qualified route receipt is present.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
* fix: address Local Delegation review (skill path + README catalog)
- Walk marketplace/plugin and _direct install roots for local-agent-delegation
- Update plugins/signals-dashboard README and regenerate docs/README.plugins.md
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
* fix: keep Local Delegation Windows launches from reparsing -i prompt
Long LD orientation text split under wt/cmd on Windows (0x80070002). Keep
-i short/quote-free; rely on WORKSHOP_LOCAL_DELEGATION=enabled (+ skill)
for policy. Add charset/length guard tests.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
* fix: surface Local Delegation effective state on open toast and badge
Keep -i short with one optional ASCII line. Show operators
"Local Delegation effective · route <id>" on open and in the summary control.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
* fix: address Local Delegation GHCP review comments
- Cross-platform path.join in receipt fixture
- Atomic .local-delegation.json write (no symlink follow)
- Case-insensitive WORKSHOP_LOCAL_DELEGATION env clear
- Windows Terminal: set/clear env via cmd before agent
- aria-pressed on Local toggle
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
* fix: store Local Delegation preference user-locally, not in the workshop repo
A cloned workshop must not be able to ship preference:on. Key operator intent
under ~/.copilot/workshop-local-delegation/ by canonical workshop path.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
* fix: preserve path case in Local Delegation preference key
Lowercasing collided distinct workshops on case-sensitive filesystems.
Normalize separators only; realpath already supplies a stable path.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
* fix: allow parentheses in quoted Windows Local Delegation launches
Args are quote-wrapped; only block % and ! expanders inside quotes so paths
like C:\Work\Project (1) still launch.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
* fix: apply quoted-arg Windows safety guard in launch path
Complete the parentheses fix: use isSafeQuotedWindowsCmdArg for cmdSafe.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
---------
Co-authored-by: Jenny Ferries <jenny.ferries@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Michael Recachinas <mrecachinas@github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
* Bump gem-team plugin version to 1.102.0 and add entry
Updated marketplace.json and plugin.json to version 1.102.0, added gem-team plugin entry with 16 items, refined argument hints in multiple agent definitions, and updated planner, reviewer, and skill creator configurations.
* Bump gem-team plugin version to 1.103.0 and update acceptance_criteria references
* refactor: simplify agent definitions and add gem-design-md-guidelines and gem-devops-guidelines skills
* feat: optimize orchstrator for faster workflows
* chore: optimize skills
* chore: update readme
* chore: bump version to 1.108.0
* chore: streamline planner
Restore label and comment synchronization after the PRT migration by granting the downstream writer workflows the pull request permission required for fork-originated PRs.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 512eb347-ec89-4250-8bf1-87048974b01d
* chore: upgrade microsoft-foundry plugin to 1.0.7
Update the external plugin catalog to the 1.0.7 source commit and regenerate the marketplace output.
* chore: update microsoft-foundry 1.0.7 source SHA
Point the external plugin catalog and generated marketplace output to the replacement 1.0.7 source commit.
Place Copilot-specific content in com.github.copilot and remove unsupported command handling.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 04c14c3f-d248-4a7f-93ab-93fd8b2b119e
Updated marketplace.json and plugin.json to version 1.102.0, added gem-team plugin entry with 16 items, refined argument hints in multiple agent definitions, and updated planner, reviewer, and skill creator configurations.
* feat: add Windows app storage inspector canvas
* Apply suggestions from code review
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* fix: address storage inspector review findings
* Correction to package and plugin
* fix: harden storage inspector cleanup
* Harden cleanup operation outcomes
* Add select a file or folder path in the result tabs to navigate the treemap to its deepest visible parent folder.
* Fixes to ensure selftesst pass
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Enhance Oracle-to-PostgreSQL migration skills and documentation
- Update migration agent guidelines to prioritize extension tool usage for code migration.
- Refine migration phases with detailed steps for pre-migration review and schema migration.
- Add new reviewing skill references for PostgreSQL materialized view refresh and UNION ALL planner risks.
- Ensure consistency in collation handling and testing strategies across skills.
* - Review migration phases to ensure correct order of execution
- Add exit criteria to each migration phase
- Remove invocation of `ms-ossdata.vscode-pgsql` extension due to dependency on VSCode
- Update README.md to reflect changes in migration phases and exit criteria
- Update broken reference to custom agent in plugin.json
* Enhance downstream migration skills and following custom agent improvements
- Added new skill for migrating .NET data access code from Oracle to PostgreSQL.
- Updated README to include new migration skill.
- Improved existing skills with clearer file naming conventions and migration actions.
- Added reference documents for handling Oracle-specific functions and pagination.
- Created detailed guides for NVL, DECODE, ROWNUM, SYSDATE, and DUAL replacements.
* Clarify PostgreSQL schema immutability and stored procedure migration risks
* Update target schema path in migration documentation for clarity
* fix(skills): clarify Phase 3-only scope for Oracle test skills
Both Oracle test skills were ambiguously worded in ways that could
cause a model to invoke them during Phase 6 (PostgreSQL test migration)
instead of using them exclusively in Phase 3.
Key changes:
- Rewrite descriptions to explicitly state Phase 3-only usage and
warn against invoking during Phase 6
- Replace "scaffold for Oracle first" with "Oracle only" to remove
the false implication of a second PostgreSQL scaffolding step
- Replace "Tests validate behavior consistency when running against
Oracle or PostgreSQL" with clear Oracle-only framing
- Rename "DB-agnostic assertions" → "Assertion portability" and
explain the why (survive Phase 6 migration without rewrites)
- Fix datetime bullet in integration tests skill to use generic
Oracle column precision language instead of PostgreSQL type syntax
- Name Oracle NuGet package explicitly (Oracle.ManagedDataAccess.Core)
* feat(oracle-to-postgres): gate Phase 1 on DDL presence; add DDL scan to Phase 2 risk analysis
- Phase 1 success criteria now requires Oracle DDL artifacts to be
confirmed present at the recorded location before proceeding.
If missing, the agent stops and prompts the user to provide them.
- Phase 2 risk analysis now explicitly scans DDL/Oracle/{ProjectName}/
as supplemental context, summarising procedure complexity indicators
(dynamic SQL, DBMS_* / UTL_* references, autonomous transactions,
pipelined functions, BULK COLLECT/FORALL, REF CURSOR, TYPE bodies)
rather than ingesting DDL files wholesale. This ensures schema-level
migration risk is captured even when it isn't visible in application
code alone.
* - Merge in latest 'main' changes
- Update custom agent plugin (eg resolve conflict and add new skill)
- Validate skills
- Run build
* chore(plugin.json): update version to 1.1.0
* feat(oracle-to-postgres): update version to 1.1.0 for migration expert plugin
* fix: add INOUT to ignore-words-list for PostgreSQL migration
---------
Co-authored-by: TCPrimedPaul <paul.delannoy@tc.gc.ca>
Disable the all-contributors usage footer because the pinned CLI emits an invalid closing img tag. Keep the usage link outside the generated contributor block.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 936cc10e-06f7-440c-96e7-51d1e94476ce
* Add Azure API Management AI Gateway instructions
APIM as a GenAI gateway for Microsoft Foundry and OpenAI-compatible LLM APIs:
llm-* token-limit/token-metric policies, managed-identity auth, backend pools
with circuit breakers, semantic caching, and content safety. Corrects the
azure-openai-*/api-key/element-ordering defaults the model produces unprompted.
Regenerates docs/README.instructions.md.
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Address Copilot review feedback on APIM AI gateway instructions
* Fix AI gateway auth scope and Consumption-tier note per review
* Fix circuit-breaker 429, auth-role contradiction, and malformed XML per review
* Harden semantic cache isolation, logging privacy, and policy order per review
* Complete emit-token-metric prerequisites and Foundry private-networking requirement
* Fix Bicep array syntax and use supported JWT accessor per review
* Correct content-safety tier support and response-screening default per review
* Fix cache-partition identity, skeleton isolation, and metric cardinality per review
* Make policy expressions valid XML and clarify content-safety timing
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* docs: update Copilot app learning hub page with recent features
Adds documentation for stacked pull request support in Agent Merge,
requesting/re-requesting Copilot code reviews from the app, background
running via tray/dock, and the Worktree location setting. Adds a
Further Reading section linking to the app and CLI changelogs.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Update website/src/content/docs/learning-hub/github-copilot-app.md
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Aaron Powell <me@aaron-powell.com>
github-actions[bot]
Sepuri Sai Krishna
Samuel Bushi
Adrien Clerbois
Aaron Powell
Rez
Andrew Arnott
Antonio Villanueva
zhoufenqin
Guiyu Li
jeanpaulhassane-225
John Haugabook
Anton Standrik
jennyf19
tomshafir-sonarsource
Muhammad Ubaid Raza
Michael Recachinas
Mamdouh Ibrahim
qinezh
Pavel Putrenkov
dependabot[bot]
DevNode-09
Daniel Scott-Raynsford
allcontributors[bot]
Paul Delannoy
Konstantinos Passadis | Azure MVP | MCT
Alex Sokol
Massimo Bonanni