Adds a canvas version of the daily-focus-board alongside the skill, addressing
@aaronpowell's review suggestion. The canvas renders the board in the Copilot
app and is backed by a JSON state file the assistant reads and writes, so you
can mark tasks done, add tasks, log progress, and recap your day from chat --
the file-backed "close the loop" upgrade over the localStorage skill.
The skill stays as the zero-install universal fallback for anyone not in the
Copilot app (same both-not-either pattern as the-workshop's signals-dashboard).
- extensions/daily-focus-board/: extension.mjs (canvas + session wiring) +
board-core.mjs (loopback server, JSON state file, mutations, recap) +
assets/board.html (file-backed UI) + preview.png + manifests.
- plugins/ember: register via x-awesome-copilot.extensions, bump 1.1.0 -> 1.2.0,
add a Components row.
Note: assets/preview.png is a placeholder pending a real board screenshot.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cb356aa8-0af2-48f3-b3c6-8086c69d5308
The issue-body template was wrapped in a three-backtick fence while
containing three-backtick HCL and Bash blocks, so the HCL example's
closing fence terminated the wrapper early and the following fence
swallowed the remaining workflow sections. Use a four-backtick wrapper
so the nested blocks render intact.
Co-authored-by: Aaron Powell <me@aaron-powell.com>
* fix: exclude auto-generated README files from PR risk scan
The scanner was processing README.md and docs/README.*.md which are
auto-generated by \
pm run build\ and shouldn't be reviewed for risk
patterns.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: a278c6bb-22ad-4d43-8e68-60432773f987
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Copilot-Session: a278c6bb-22ad-4d43-8e68-60432773f987
npm install warnings (EBADENGINE, deprecated) were leaking into both
the Summary findings table and the full linter output block, making
the comment noisy. Filter them out when processing raw vally output.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4c3ca9da-500e-464e-88d3-4c09535ec45c
* Add azure-well-architected-review skill
Adds a skill that performs a structured Azure Well-Architected Framework
review of a workload's IaC (Bicep, Terraform, ARM) and deployed
infrastructure across the 5 WAF pillars, then creates GitHub issues to
track remediation. Mirrors the existing aws-well-architected-review
skill, which had no Azure equivalent.
* Address Copilot review feedback on azure-well-architected-review
- Step 2: always inventory live Azure resources and compare with IaC to
surface drift, instead of scanning IaC only
- Step 5: add an explicit confirmation gate before any GitHub issue
creation; ambiguous or negative responses stop with a console report
- Fix nested code fences in the issue-body template by using a
four-backtick wrapper
Add action-oriented aria-labels to the suggest-mantra, focus, remove, add-note, park-thought,
and log-win buttons so screen readers announce the action instead of the emoji (template + sample).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 07e720ee-ca02-419e-9adb-300738b6fc76
Add a task-specific aria-label to the quadrant <select> and the editable label input so
screen-reader users know which task the control belongs to (template + regenerated sample).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 07e720ee-ca02-419e-9adb-300738b6fc76
- Validate task ids (^[A-Za-z0-9_-]+$) and dedupe before interpolating into data-* attributes,
so a malformed configured/persisted id can't break out of an attribute (template + sample).
- Seeded counters (current value >0 and below goal) now render as 'in progress', not 'to do'.
- Hide the 'not today' carryover control on done tasks; it was flipping a completed task to
carried and dropping it from the recap's Done tally.
- #eodmsg is now role=status aria-live=polite so screen-reader users hear save/copy results.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 07e720ee-ca02-419e-9adb-300738b6fc76
- Sanitize tagc to [A-Za-z0-9_-] before class-attribute interpolation, so a custom
class name cannot break out of the attribute and inject markup/handlers (template + sample).
- customize.md now points at .tagedit.<name> (the class the renderer actually applies).
- serve-board.ps1: fail when the port is already in use, capture and report the server PID
(with a stop command), and verify the process did not exit before opening the URL.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 07e720ee-ca02-419e-9adb-300738b6fc76
Executive-function-friendly daily focus board (self-contained HTML) you run by
talking to Ember. Registers it in the ember plugin (1.1.0) and regenerates the
skills index + marketplace.json.
Review fixes: emoji XSS escaping; keyboard a11y (semantic buttons + aria, plus
up/down move controls); tagc label colors; local-date storage key + recap
date/filename; guarded execCommand and localStorage; confetti animates only
while active and stops on reduce-motion; loopback serve bind + quoted dir;
JSON config injection with '<' escaped; minute rounding; reorder-to-end; clear
stale focus; counter goal guard; and doc corrections (id charset, sample
reference, counter contract, option-b, frontmatter length).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 07e720ee-ca02-419e-9adb-300738b6fc76
- Add /ask and /refine to Essential Slash Commands table
- Add /ask tip and /refine tip after the table
- Add /env to Agent Environment commands table
- Fix shell quoting example: use single quotes for $HOME
- Add 'Esc twice to cancel' to Common Mistakes table
- Update Summary key takeaway to list all essential commands
- Bump lastUpdated to 2026-07-17
Upstream commits:
- 349aac6: fix shell quoting in Common Mistakes table
- 5ae1cbb: docs: add /refine command and /plugins dashboard documentation
- a67a260: docs: remove unverified /plugins command documentation
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add gitmoji skill and gitmoji-setup agent
Adds two complementary artifacts for the gitmoji commit convention
(https://gitmoji.dev):
- skills/gitmoji: generates gitmoji commit messages from a diff, staged
changes, or a change description. Message-only by design (never runs
git commands), with disambiguation rules and a full reference table of
the 75 official gitmojis generated from the official gitmojis.json.
- agents/gitmoji-setup: sets up gitmoji tooling in a repository. Audits
the existing hook manager and commit convention, then installs either
a non-interactive prepare-commit-msg prefill hook (default, works in
GUI clients and CI), the gitmoji-cli interactive picker, or commitlint
enforcement, without clobbering existing hooks.
Generated README indexes updated via npm start.
* Use local commitlint binary instead of npx in verify step
Addresses the package-exec-command finding from the PR risk scan: the
verification example now calls the locally installed
./node_modules/.bin/commitlint rather than npx, which could fetch and
execute a package on the fly.
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Address Copilot review feedback
- Quote the agent description in single quotes per AGENTS.md convention
- Resolve the effective hooks directory via git rev-parse --git-path
hooks for both audit and installation, instead of hard-coding
.git/hooks (core.hooksPath, linked worktrees)
- Correct the prefill-hook compatibility claim: it prefills only when
the message editor opens and silently no-ops for -m/-F, GUI message
boxes, and CI
- Match the official gitmoji set explicitly when detecting an existing
emoji, instead of treating any non-ASCII start as one
- Drop .txt from the docs heuristic (it shadowed requirements.txt) and
remove the dependency-manifest fallback entirely: filenames cannot
distinguish upgrade/add/remove/pin/downgrade
- Restrict gitmoji -i to repos whose effective hooks dir is .git/hooks;
wire the picker through the hook manager otherwise
- Merge gitmoji into an existing commitlint config instead of
overwriting commitlint.config.mjs
- Fix the verification sequence: clean starting state, non-colliding
scratch file, abort by clearing the editor, explicit unstage/remove/
switch-back/branch-delete cleanup
- Skill: ask the user for commit history instead of running git log,
honoring the message-only contract
* Address second round of Copilot review feedback
- Pair the prefill hook with a commit-msg guard: prefilling an empty
COMMIT_EDITMSG defeats git abort-on-empty-message, so an untouched
prefill would create a commit named only with the emoji. The guard
rejects messages that contain nothing but the prefilled gitmoji.
- Extract the gitmoji alternation into a GITMOJI_RE variable shared by
both hooks.
- Document the commitlint-config-gitmoji format mismatch: it enforces
the hybrid <gitmoji> type(scope?): subject format and rejects the
plain gitmoji format produced by Options A/B and the gitmoji skill.
Option C now asks the team to choose a format first, and the
verification example uses a valid hybrid message.
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* website: add legal links and privacy-aware analytics
Add Terms, Privacy, and Security links to the website footer and remove the experimental cookie consent popup to avoid cross-site consent drift with github.com.
Gate Hydro analytics loading on browser privacy signals (Do Not Track and Global Privacy Control) so tracking-disabled users are respected without adding custom consent state.
Update website security notes to match the current non-modal rendering flow.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d0fdad70-4820-4c24-9e4a-35c82faf31ed
* Adopting the footer design from #2327
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Copilot-Session: d0fdad70-4820-4c24-9e4a-35c82faf31ed
* chore: standardize agent documentation markdown, fix formatting, add MANDATORY clauses, and update output formats across agents
* chore: Update gem-team plugin version to 1.84.0 and refine concurrency language in agent execution steps
* Bump gem-team plugin version to 1.86.0 and update README
* Bump gem-team plugin version to 1.87.0 and update README
runVersionMatchGate and runCanvasStructureGate read locator content with git show/cat-file. For a tag-name locator, `git fetch origin <tag>` only updates FETCH_HEAD and never creates refs/tags/<tag>, so `git show <tag>:...` died with 'invalid object name' and produced a false infra_error.
Read the primary locator via HEAD (already checked out during clone) and non-primary locators via FETCH_HEAD after fetching, instead of the bare locator. This handles SHAs, short tag names, and fully-qualified tag refs uniformly without classifying the locator.
Adds regression coverage for the tag-locator path in both gates.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Update external plugin registration: rename identity and source.path to
microsoft-foundry, bump version to 1.0.3, refresh description and source.sha,
and regenerate marketplace.json.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 68571581-f9d1-4b01-a5d7-0a49c4a6b3b5
The instruction tells Copilot to verify PyPI/npm package and symbol names
against the attester.dev existence oracle (free keyless tier, 25 calls/day
per client IP) before installing or importing, catching hallucinated
dependency names (5.2-21.7% of LLM suggestions per USENIX Security 2025).
The preToolUse hook enforces the same check on code the agent writes:
stdlib-only script, blocks only on a confident oracle negative, fails open
on quota or network trouble, caches answers on disk. README tables
regenerated with npm start.
Jenny Ferries
jennyf19
Adrien Clerbois
Aaron Powell
jennyf19
github-actions[bot]
Matt Soucoup
Ayan Gupta
Qinen Zhu
Alex Yang (DevDiv)
Himanshu bamoria
NeilChen
Muhammad Ubaid Raza
John Haugabook
Alex Yang [MSFT]
Florian Vogt
Samuel Bushi
Antonio Villanueva
Tim Mulholland
Jonas Tüchler
qinezh
dependabot[bot]
Timothy Harrington
Mostafa Amini
Baiqing Lyu