trigger_live_flow now runs scheduled (Recurrence) flows on demand;
list_live_connections requires environmentName and applies top after search;
the ChatGPT/claude.ai connector path is documented in the mcp skill; the
brand reads FlowStudio (one word) across the skills and plugin README; the
build skill is back under the 500-line lint limit.
Co-authored-by: Aaron Powell <me@aaron-powell.com>
The last row carries eight <td> elements while all fifty-three others carry
seven. Each cell is fixed at width="14.28%" (one seventh), so eight of them
overflow the table: the final avatar renders narrower than the rest and sits
past the edge, reachable only by scrolling horizontally.
Moving that one cell onto its own row restores the invariant. Verified by
counting cells per row before and after: the distribution goes from {7, 8} to
{7, 1}, the 1 being the new trailing row that the next contributor fills.
* Add dev container configuration instructions
Twelve sourced rules for reviewing and authoring devcontainer.json, Dev
Container Features, and Codespaces lifecycle configuration. Every rule
cites the Dev Container specification, the reference CLI source, or
official vendor documentation, and needs only file reading rather than a
container build.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KZ5Ak8ifbxDC6zQvJQt26T
* Regenerate instructions index
Output of `npm start` (eng/update-readme.mjs + eng/generate-marketplace.mjs)
after adding instructions/devcontainers.instructions.md.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KZ5Ak8ifbxDC6zQvJQt26T
* Allow two source-faithful spellings in codespell
`implementors` is a path segment in the containers.dev specification URLs
that instructions/devcontainers.instructions.md cites, and `evaulated` is
spelled that way inside a verbatim quotation from the Dev Container
Features specification. Neither can be corrected without breaking a link
or falsifying a quote.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KZ5Ak8ifbxDC6zQvJQt26T
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: bump keep-the-why to 0.10.0
* chore: bump keep-the-why to 0.10.1
0.10.1 released after this PR was opened for 0.10.0 - updates
version/source.ref to v0.10.1 and regenerates
.github/plugin/marketplace.json to match.
Points the listed rayfin entry at plugin-v0.4.0. That release sources the
getting-started template from the microsoft/awesome-rayfin gallery rather
than a personal repository, and puts the documented scaffold command back
on one line so it parses under PowerShell.
marketplace.json is regenerated via npm run build.
Co-authored-by: Chris Caruso <chcaruso@microsoft.com>
Points the figma external plugin entry at tag v2.2.96-figquery.1 in
figma/mcp-server-guide instead of tracking the default branch, and updates
the listed version to match the plugin manifests on that tag.
Regenerates .github/plugin/marketplace.json.
* Add research experiment discipline instructions
* Convert to a custom agent per review feedback
* Drop accidental generator churn from README.agents.md
`-f labels[]="bug"` fails under zsh, the default shell on macOS, because `[]`
is a glob pattern. The argument never reaches gh. Quote the whole
`name[]=value` pair instead.
The skill also states the MCP server cannot create, update, or comment on
issues. github-mcp-server ships issue_write, add_issue_comment, and
sub_issue_write. Documented them and reworded the CLI section; the gh api
examples are unchanged.
Regenerate the agentic workflow with gh-aw v0.86.2 so the Copilot CLI is resolved from PATH and staged in the runner temp directory.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 5135482d-49dc-4ff7-a2e8-c086ea1eeae4
* feat: update Apple App Store reviewer guidance
* refactor: narrow App Store guideline checks
---------
Co-authored-by: Jimmy Stridh <jimmystridh@users.noreply.github.com>
The sentry-triage canvas's setup gate previously told users to ask
Copilot to install its optional `sentry` dependency and reload
extensions, and to run `sentry auth login` from a terminal. Both
flows were unreliable or high-friction in practice.
This adds real one-click buttons for both steps:
- sentryClient.mjs — installPackage() runs npm install (async, via
execFile so the shared extension process's event loop isn't
blocked) rooted at the file's own directory via import.meta.url, so
the path is never guessed. loadFactory() falls back to importing
the package's resolved entry file by absolute path when the bare
import('sentry') fails, since Node caches a negative resolution for
a bare specifier for the life of the process — while still
distinguishing a genuinely missing package from a transitive-
dependency defect so the latter isn't masked as "package missing."
login() fails fast with a clear message when SENTRY_AUTH_TOKEN/
SENTRY_TOKEN is active in the environment (which takes precedence
over the OAuth login this button drives), and treats an empty/
falsy auth.login() result as a failed sign-in instead of silently
re-probing.
- preflight.mjs — installDependencies() runs the install and
re-probes the connection; authenticate() classifies the new error
codes for gate messaging.
- server.mjs / extension.mjs — wire POST /api/install-dependencies
and POST /api/auth-login routes (through the existing CSRF/Host
gate) to the new preflight functions, publishing refreshed
connection state to the canvas.
- components/page.mjs / styles.mjs — the install and sign-in
buttons, with loading/success/failure states and accessible live-
region status updates; a live multi-org <select> dropdown that
rebuilds in place once org discovery completes post-signin,
without requiring a canvas reopen.
- README.md — documents the one-click flow; manual npm install /
sentry auth login kept as a fallback.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
FlowStudio MCP 1.2.42 delivers trigger inputs to Button, PowerApps, and Skills
triggers; the skills still said trigger_live_flow was HTTP-only and told agents
to build an HTTP twin. Verified live against server 1.2.43.
Adds a skill that converts text, markdown, or the output of another
skill into an MP3 using Kyutai pocket-tts, a small neural TTS model
that runs on CPU.
No existing skill in the collection generates audio, so this fills a
gap rather than duplicating one. It is designed as a terminal step in
a chain: roundup, daily-prep, or meeting-minutes produce the text,
speak-summary makes it listenable.
Two details worth calling out:
- The bulk of SKILL.md is guidance on rewriting written prose for the
ear before synthesising. Feeding markdown straight into a TTS engine
produces something technically correct and unlistenable, so that
step carries most of the value.
- Synthesis is local and CPU-only, so nothing is sent to a cloud
speech service and the skill works unattended in a headless
container as well as on a laptop.
The bundled script bootstraps pocket-tts into a cached virtualenv on
first use, selecting a Python in the supported >=3.10,<3.15 range
rather than assuming python3 qualifies, and failing with actionable
guidance when none is available.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 1a70aa08-b622-4825-ad63-5a12370add1f
* Add Advanced Copilot CLI course to the Learning Hub
Mirror the github-samples/advanced-copilot-cli course into the Learning
Hub and add a weekly sync workflow to keep it aligned, matching the
pattern used for the CLI for Beginners series.
- New agentic workflow advanced-copilot-cli-sync (+ compiled lock) that
checks the upstream course weekly and opens a PR when content changes
- Source-faithful mirror of the 9 course modules plus an overview page
under learning-hub/advanced-copilot-cli/, with route-safe links and
localized chapter-03 diagrams
- Sidebar group and Learning Hub landing-page entry for the new course
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 3a4d8212-b18b-446f-bb8d-a0a81241fa05
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: GeekTrainer <GeekTrainer@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Aaron Powell <me@aaron-powell.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Copilot-Session: 3a4d8212-b18b-446f-bb8d-a0a81241fa05
* Fix sentry-triage canvas crash when the `sentry` package isn't bundled
Published awesome-copilot plugins ship extension source only, so the optional
`sentry` npm package the canvas depends on at runtime may be absent. Previously
that made the canvas crash on open instead of guiding the user through setup.
- Load the optional `sentry` package lazily and translate only the top-level
ERR_MODULE_NOT_FOUND for `sentry` into a package-missing setup state; any other
import failure (missing transitive dep, entrypoint throwing) is rethrown so a
real defect isn't masked behind a misleading "reinstall" message.
- Add a dedicated package-missing branch to the connection preflight and a
matching setup gate, kept distinct from the auth and transient-network gates so
the user never sees contradictory guidance. The canvas now opens and explains
what to do rather than crashing.
- Clear `configured` for the package-missing state so the status is no longer the
contradictory `configured:true` + `setup:'package-missing'`.
- Tell users to sign in with the package-local CLI via `npx sentry auth login`
run from the extension folder — the only form that resolves after a local
`npm install`, since a package-local binary isn't on the shell PATH.
- Update the README so the sign-in step and install guidance cover the
published-plugin layout (`com.github.copilot/extensions/sentry-triage`), not
just the standalone user/project extension paths.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Add an exact-slug Sentry project resolver to the sentry-triage canvas
The project picker previously only offered projects from the paged list the
canvas had already loaded. Teams with many projects (or a project outside the
first page) had no way to target one by slug. This adds a verify-on-commit
resolver: when a user types a slug that isn't a local match, pressing Enter
checks it against Sentry and only commits the canonical slug once verified,
so a scan never runs against an unverified or wrong-org project.
Canvas / UX (components/page.mjs, styles.mjs):
- Autocomplete accepts an exact slug not in the local list; Enter is the
explicit commit that triggers resolution (never an as-typed lookup).
- A visually-hidden aria-live region announces checking / verified / not
found / couldn't-check state, and the resolved state is rendered before
commit so screen readers hear the outcome.
- Footer/menu surfaces checking, prompt, missing, and error states, including
when local partial matches are present.
- Project choices are read from an org-keyed cache so a slug from a previously
selected org can never be treated as local after a free-text org switch;
the stale-completion guard also compares the org captured for the request.
Server / resolution (server.mjs, sentry.mjs, sentryClient.mjs, extension.mjs):
- CSRF-gated /api/resolve-project verifies a single slug against Sentry.
- Resolution runs on the shared serial request chain and is hardened against
Sentry outages and queue contention (transient errors are retryable, a
confirmed miss is cached as "missing").
Also bumps sentry-triage to 1.1.0 (package.json, plugin.json,
marketplace.json).
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Harden sentry-triage repo/URL metadata validation and split issue/PR repos
The canvas relays model-reported GitHub artifact URLs and numbers (from a
turn that also ingests untrusted Sentry text) into tracking badges and the
"Fix with Copilot" flow. Validate that data against trusted, outside-the-model
anchors so injected text can't mint misleading badges or steer a write to the
wrong repo, and support issue/PR repos that legitimately differ.
- Add path-type-aware URL validation (repoRefNumber/urlInRepo): a URL must be
http(s), on the trusted host, in the expected owner/repo, and match the exact
artifact kind (/issues/<n> vs /pull/<n>) with a path-segment boundary after
the id. The id must be a positive safe integer. This rejects look-alikes like
/pull/123evil, cross-kind spoofs (an issue URL minting a "PR #N" badge), and
overflow/zero ids.
- Split the issue anchor from the PR anchor (deriveRepoAnchors): the tracking
issue and the fix PR can live in different repos. Cloud mode anchors the PR on
the issue/cloud repo; an explicitly selected local project anchors it on that
project's config-time repo (frozen at save time); "Current project" anchors it
on the trusted current-project repo from the git remote — never the issue repo.
A missing/malformed PR repo fails closed with a clear, actionable error.
- Derive tracking issue/PR numbers from the validated URLs (not the model), and
strip every pr* field when no concrete /pull/<n> in the PR repo is present, so
a badge can't point at a different artifact than the one verified.
- Freeze the selected project's repo into PR-target config at save time
(page.mjs/state.mjs/server.mjs) and include mode + local.repo in the
repo-change identity so switching projects re-derives annotations.
- Roll the optimistic rescan overlay back on a failed /api/refresh POST instead
of leaving a blocking overlay up until the fallback timer expires.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Derive displayed numbers from validated URLs; isolate project enumeration
Address Copilot review on #2815.
Comment #2: every displayed issue/PR number is now re-extracted from the
same URL that was validated against the expected repo, instead of trusting
the model-reported *Number field. Fixes the skipped/dedup, done, and
submit_work_pr paths so a reply pairing /pull/1 with prNumber 999 can no
longer render "PR #999" linking to PR 1. Numbers with no concrete anchor
(placeholder repo / non-GitHub tracker) keep the model value.
Comment #1: the projectId->repo mapping is a security anchor (it decides
which repo fix-session PRs are validated against), so it must not be
produced in a turn that also ingests untrusted Sentry titles. Enumeration
now runs in its own Sentry-free turn (loadProjectOptions), and the save
path re-binds the repo/name server-side from the selected projectId against
trusted project state; the browser no longer supplies the auth repo.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Demote sentry-triage project map from an authorization anchor
The projectId->repo map returned by the model's list_projects tool was
being used as the trust anchor for fix-session PR validation, and was
isolated into a separate "project enumeration" turn to keep untrusted
Sentry titles out of the prompt that produced it. But that turn joins the
same foreground conversation, so it is not a real trust boundary.
The SDK exposes no isolated model context and no trusted project-
enumeration API, so instead stop treating the model-relayed repo as an
authorization anchor at all. An explicitly selected project is authorized
by its host-resolved project_id (a trusted handle at create_session time),
so deriveRepoAnchors now returns prExpectedRepo='' + prProjectSelected for
that case and the preflight/URL gates skip the unbackable repo check. The
map is now display/dedup-search only, so enumeration is folded back into
the triage round-trip and the separate turn is removed.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fix fallout from demoting the sentry-triage project map
Follow-ups from review after the project-map demotion:
- Reject stale/forged local project IDs in set-pr-config. An unknown
non-empty projectId left boundProject null but was still stored, and
deriveRepoAnchors treats any non-empty id as an explicit selection —
which skips the missing-repo/PR-URL preflight. Store the id only when it
resolves to a known project, so an unresolvable id fails closed to ''
(Current-project mode, which requires a trusted git remote).
- Restore tracked-PR badges for split-repo selected projects. The tracked
badge validated the model-reported PR URL against the now-empty trusted
PR anchor, so repoRefNumber always returned null and every discovered PR
was stripped. The badge is read-only display, not a write gate, so anchor
its search + URL/number validation on the model-declared project repo
when there is no trusted anchor (still pins number->URL and host).
- Update set-pr-config and page.mjs comments: the bound repo/name are
display + dedup-search metadata, not PR authorization, and drop the stale
loadProjectOptions / "Sentry-free turn" references.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fail closed on an unconfirmable dedup skip for selected projects
After demoting the project map, prExpectedRepo is '' for an explicitly
selected project, so the dedup "already being worked on" skip accepted a
bare model-reported PR number as authoritative. Because the dedup result
and the project list come from the same Sentry-bearing model turn, injected
text could forge a skip to both suppress the trusted host-resolved
create_session flow and surface an arbitrary PR link.
An authoritative skip suppresses the trusted flow and surfaces a PR link,
so it now requires a trusted PR-repo anchor: a URL-bearing PR validated
against a concrete prExpectedRepo. A selected project has no trusted anchor,
so its skip is unconfirmable and fails closed to a retryable error instead
of being honored. The downstream dedup validation is now only reached with a
concrete PR anchor, so its dead no-anchor branches are removed.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Anchor Current-project PR repo to the checkout cwd, not GITHUB_REPOSITORY
runtimeDefaults.repo prefers GITHUB_REPOSITORY, which is the configured ISSUE
target and may point at a separate cloud repo; seedDefaultsFromSession() does not
overwrite an explicit GITHUB_REPOSITORY. All three deriveRepoAnchors calls passed
that value as currentProjectRepo, so when the issue repo differed from the driving
checkout, Current-project mode gated PR validation and dedup on the issue repo and
rejected legitimate PRs from the current project.
Derive the Current-project anchor unconditionally from the resolved session cwd via
currentCheckoutRepo(defaults) = repoFromPath(localPath), which co-derives from the
same git remote as the trusted host, and use it at all three anchor derivations.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Restrict local Copilot handoff to the current project
Remove the model-relayed "selected project" local write-handoff and its
whole plumbing (the Settings project dropdown, submit_projects/list_projects
enumeration, projectOptions state, and the server-side projectId re-bind).
The dropdown was the only thing feeding a model-supplied project_id into
create_session, and the only local mode whose PR repo came solely from the
untrusted Sentry triage turn. That made it both the write-steering vector the
reviewer flagged (server.mjs set-pr-config / deriveRepoAnchors) and the one
local mode where a dedup "skip" could never be verified against a trusted repo.
Local "Work on selected" now always runs the fix session in the CURRENT
project (the canvas's own checkout, host-trusted from its git remote), so the
PR repo is always a trusted anchor and dedup is always verifiable. Cross-repo
work goes through Cloud mode, whose repo the user types directly in Settings.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Published awesome-copilot plugins ship extension source only, so the optional
`sentry` npm package the canvas depends on at runtime may be absent. Previously
that made the canvas crash on open instead of guiding the user through setup.
- Load the optional `sentry` package lazily and translate only the top-level
ERR_MODULE_NOT_FOUND for `sentry` into a package-missing setup state; any other
import failure (missing transitive dep, entrypoint throwing) is rethrown so a
real defect isn't masked behind a misleading "reinstall" message.
- Add a dedicated package-missing branch to the connection preflight and a
matching setup gate, kept distinct from the auth and transient-network gates so
the user never sees contradictory guidance. The canvas now opens and explains
what to do rather than crashing.
- Clear `configured` for the package-missing state so the status is no longer the
contradictory `configured:true` + `setup:'package-missing'`.
- Tell users to sign in with the package-local CLI via `npx sentry auth login`
run from the extension folder — the only form that resolves after a local
`npm install`, since a package-local binary isn't on the shell PATH.
- Update the README so the sign-in step and install guidance cover the
published-plugin layout (`com.github.copilot/extensions/sentry-triage`), not
just the standalone user/project extension paths.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Catherine HanandAaron Powell
Tim Mulholland
Guo Cheng
Oliver Zehentleitner AIgent
dependabot[bot]andPretaSOFT
Dariusz Porowski
qinezh
github-actions[bot]andPretaSOFT
Emil DanandClaude Opus 5
Cahid Arda
ChrisandChris Caruso
Pierce BogganandCopilot App
Gautam Jethwani
Muhammad Ubaid Raza
Muhammad Moiz
Alex Sokol
Jimmy StridhandJimmy Stridh
John HaugabookandCopilot Autofix powered by AI
Liz TomandCopilot App
Sam RoweandCopilot App
Andrew Arnott
zhoufenqin