These files don't exist anywhere in the repo (verified via the GitHub
Contents API against skills/phoenix-tracing/references/), so an agent
following the Reference Files list would hit a missing file instead of
the documented attribute schema.
Fixes#2567
Impacted by AI (Agent mode: copilot | Prompts: 1)
Co-authored-by: Yoav Lax <ylax+varonis@varonis.com>
While implementing the Agent Plugin v1 spec in https://github.com/stbenjam/skillsaw/pull/483, I used this repository as a canonical real-world source for tests. Along the way its checks surfaced genuine correctness issues worth fixing regardless of tooling:
- Internal links that do not resolve (22): wrong relative paths, links whose targets are runtime output paths rather than bundled files (now inline code), a schemeless external URL parsed as a relative path, and links to files that do not exist (removed).
- Bundled skill files never referenced from their SKILL.md (14): each is now cited from the section where it is used, so nothing ships unreachable from the skill's instructions.
- Unclosed or mis-nested code fences (11): markdown templates embedding code blocks now use four-backtick outer fences so inner fences nest instead of closing the template early and leaking example content as live markdown; also removed stray orphan fences and closed an unterminated block at end of file.
- Invisible unicode (1): removed a zero-width space from a code example, a copy-paste artifact invisible to reviewers.
* chore: upgrade microsoft-foundry plugin to 1.0.6
Update the external plugin catalog to the 1.0.6 source commit and regenerate the marketplace output.
* chore: update microsoft-foundry 1.0.6 source SHA
Point the external plugin catalog and generated marketplace output to the replacement 1.0.6 source commit.
* Add Microsoft Foundry (azure-ai-projects v2) Python instructions
* Address Copilot review: raise version floor, add endpoint routing, fix auth/cost/logging notes
* Remove stray closing code fence at end of file
* Address reviewer feedback: add explicit ManagedIdentityCredential pattern for production
* Clarify credential patterns: separate AKS workload identity from managed identity
* Fix credential order and add user-assigned identity example for managed identity and AKS patterns
* Fix credential chain description, logging level clarity, and use correct RBAC role name
* Refine RBAC documentation link, complete function-tool loop, and qualify az login requirement
Accept reusable canvas sources that are referenced by an existing parent plugin, matching the post-#2546 scaffolding guidance, while continuing to reject orphaned sources. Cover parent-only, standalone, and orphaned registrations.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 52be9c67-3ae4-4610-93d0-fe0b7ab95ccb
Adopt the Agent Plugins v1.0.0 namespaced composition model from #2546. Bundle the reusable daily-focus-board canvas into Ember only and remove its obsolete standalone catalog manifest.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 52be9c67-3ae4-4610-93d0-fe0b7ab95ccb
* Add Azure Developer CLI skill and related documentation
* Add Azure Developer CLI skill to README with usage instructions and bundled assets
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Bump gem-team plugin version to 1.94.0 and update gem-designer-mobile agent documentation to align with Google DESIGN.md spec
* chore: improve replan workflow
* chore: minor adjustments
* fix: plan route list
* chore: add model routing section to gem-orchestrator.agent.md and update plan access rule; bump gem-team plugin version to 1.97.0; add Intelligent Model Routing section to README
* chore: context cache tweaks
The workflows were doing their own vally installs, which means that we had the potential for drift in the version of Vally being used. Now we do a npm ci and get the version from there, removing the ambiguity
* Seed Copilot Workshops Learning Hub mirror
Perform the initial import of github-samples/copilot-workshops
(@b543d2f) into the Learning Hub, since a first-run import from the
scheduled sync workflow exceeds the 100-file safe-output PR cap.
Also update the sync workflow prompt so future runs are always
incremental and stay under the file cap.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Stop codespell flagging mirrored workshop content
codespell only knows English, so the localized Learning Hub mirrors
(es-es, ja-jp, ko-kr, pt-br, zh-cn) produce ~150 false positives such as
"comando ==> commando". Skip those locale directories, and allow the two
valid English words the mirrored pages use verbatim.
Mirrored pages must stay source-faithful, so the fix belongs in
.codespellrc rather than in the content. Note that in the sync workflow
so future runs handle new false positives the same way.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
An array is typeof "object", so progress:[] (or a top-level array state file) was kept as the container; JSON.stringify then drops the non-index props (counters, t, day...), the API returns progress:[] and the canvas crashes reading state.counters. Guard both with !Array.isArray, matching looksLikeBoard. Headless regression tests added (48/48).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: fd1eae93-cc9f-4777-812c-a2a9872e1c2b
A state file with a non-string txt (e.g. {"txt":1}) previously loaded, then esc(n.txt) in the canvas threw (numbers have no .replace) and the whole board failed to render. Filter day/brain entries to require a string txt, mirroring the existing task-notes filter. Verified with a headless regression test (45/45).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: fd1eae93-cc9f-4777-812c-a2a9872e1c2b
* Update dotnet-mcp-builder skill to ModelContextProtocol 2.x
Align the skill with the C# SDK 2.0.0 release and the MCP 2026-07-28
spec: stable line is now 2.x, HttpServerTransportOptions.Stateless
defaults to true, roots/sampling/MCP-channel logging are [Obsolete]
(MCP9005) with the multi-round-trip input_required pattern as the
replacement, discovery-first negotiation (server/discover) supersedes
the initialize handshake, Mcp-Method/Mcp-Name routable headers, raw
structuredContent for non-object results, required Tool.inputSchema,
and the new ModelContextProtocol.Extensions.Tasks and
ModelContextProtocol.Extensions.Apps packages (typed MCP Apps support
replacing the hand-rolled _meta/ui:// pattern on 1.x).
* Address Copilot review: Apps extension accuracy, header scope, capability ownership
- packages.md: the Apps package replaces the manual _meta wiring, not the
ui:// resource; note the experimental MCPEXP003 diagnostic; label the
1.x -> 2.0 list as highlights and add the OAuth/SSE runtime changes
with a pointer to the full release notes.
- transport-http.md: Mcp-Method is on every POST, Mcp-Name only on named
invocations (tools/call, prompts/get, resources/read) - do not require
it globally at gateways.
- mcp-apps.md: current MIME type is text/html;profile=mcp-app (skybridge
is a legacy draft value); document [McpAppUi] + WithMcpApps().
- server-features.md: roots/sampling are client capabilities, only
logging sits on ServerCapabilities.
* Correct stateful HTTP guidance: 2026-07-28 has no HTTP sessions
Per the official SDK v2 elicitation docs, a server with Stateless=false
refuses the 2026-07-28 revision so dual-path clients fall back to an
initialize-capable revision; ElicitAsync cannot be used on 2026-07-28
Streamable HTTP at all. Reframe stateful HTTP as down-level
compatibility mode and document the multi-round-trip pattern
(InputRequiredException / InputRequest.ForElicitation, retry with
InputResponses -> ElicitResult) as the current-protocol way to ask
mid-tool, across SKILL.md, transport-http.md, and elicitation.md.
* Update typescript-mcp-server-generator skill to MCP TypeScript SDK v2
Replace the retired monolithic @modelcontextprotocol/sdk with the v2
focused packages (server, node, core, framework adapters), require
zod@^4.2 and Node 20+, document the registerTool config-object API,
the ctx handler context, the new error hierarchy, removed SSE/WebSocket
transports, and the v1-to-v2 codemod migration path.
* Address Copilot review: adapter peer frameworks and sampling consistency
Framework adapters now note their required peer framework install
(e.g. @modelcontextprotocol/express + express), and the two remaining
sampling recommendations are replaced with the multi-round
input_required pattern that v2 recommends over the deprecated
sampling subsystem.
- copilot-configuration-basics: document /model plan command (v1.0.74+) for
per-phase model selection in plan mode, and note Claude Opus 5 availability
- installing-and-using-plugins: add Open Plugin Spec v1 compatibility section
documenting mcp.json bundle support (v1.0.74+)
Sources:
- https://github.com/github/copilot-cli/blob/main/changelog.md (v1.0.74, v1.0.75)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Harden external plugin validation: semver, SPDX, email, unknown fields
Extend the canonical external-plugin validator with Open-Plugins-aligned
rules, reusing the shared validation functions rather than duplicating checks:
- version: enforce Semantic Versioning (allows prerelease/build metadata)
- license: validate SPDX identifiers/expressions; warn (not error) on
well-formed-but-unrecognized ids so existing entries like SSAL-1.0 pass
- author.email: validate format when present
- unknown-field detection: warn on typo'd top-level/author/source keys
- immutable locator: marketplace warns when source lacks ref/sha;
publicSubmission keeps the existing hard error
Add eng/external-plugin-validation.test.mjs (node:test) covering each rule
plus a regression that committed external.json passes marketplace policy
with zero errors. Update CONTRIBUTING.md accordingly.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: eaa5eed6-5b65-4b28-9904-24f380d26728
* Make license non-SPDX a warning and share license check with local plugins
The agent-plugins-spec schema does not enforce SPDX, and plugins may use
proprietary/non-OSS licenses. Relax license validation so any non-empty
license string that isn't a recognized SPDX identifier/expression produces a
warning rather than an error.
Extract the license check into a reusable validateLicenseField() and apply it
to both external plugins and local plugin.json manifests via
eng/validate-plugins.mjs, so licenses are validated consistently in one place.
Update tests and CONTRIBUTING.md accordingly.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: eaa5eed6-5b65-4b28-9904-24f380d26728
* Extract shared license validation into eng/lib/license.mjs
Move the SPDX constants and license validation (validateLicenseField,
isRecognizedSpdxExpression) out of external-plugin-validation.mjs into a
dedicated eng/lib/license.mjs module. Both the external plugin catalog
validator and the local plugin.json validator now import license logic
from this neutral shared module instead of one validator importing from
the other. Behavior is unchanged; tests import from the new home.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: eaa5eed6-5b65-4b28-9904-24f380d26728
* Fix SPDX license parsing correctness and warning-message injection
Rewrite isRecognizedSpdxExpression as a recursive-descent SPDX license
expression parser to address PR review feedback:
- Validate LicenseRef-/DocumentRef- grammar (non-empty idstring; DocumentRef
requires the ":LicenseRef-<id>" suffix) instead of accepting any token with
that prefix.
- Parse parentheses with balance and placement checks rather than stripping
them, so malformed groupings like "(MIT", "MIT)", and "MIT OR (Apache-2.0))"
are no longer silently treated as valid.
- Treat WITH as a distinct operator whose right operand must be a known SPDX
license exception, so "MIT WITH Apache-2.0" and "GPL-2.0-only WITH MIT" are
rejected while "GPL-2.0-only WITH Classpath-exception-2.0" is recognized.
- Sanitize the untrusted license value in the non-SPDX warning (collapse
whitespace, truncate, escape backticks, wrap as inline code) since the
warning is rendered verbatim into a Markdown bot comment during intake.
Malformed SPDX stays a warning (never an error) so proprietary and non-OSS
license strings remain allowed. Adds targeted grammar and sanitization tests.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: eaa5eed6-5b65-4b28-9904-24f380d26728
* Complete backslash escaping and run source unknown-field check for all sources
Address two PR review findings:
- eng/lib/license.mjs: sanitizeForMessage now escapes backslashes before
backticks so the inline-code warning value is fully escaped, resolving a
CodeQL "incomplete string escaping" alert. A raw backslash in a license
value is now doubled rather than left to combine with a following escaped
backtick.
- eng/external-plugin-validation.mjs: move the source unknown-field check out
of validateGitHubSource into the outer source-object branch so it runs for
every object source and then dispatch by source.source. A typo in the source
discriminator (e.g. "soruce") or an unsupported source type now still
surfaces the unknown-field warning instead of being silently skipped.
Adds regression tests for both behaviors.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: eaa5eed6-5b65-4b28-9904-24f380d26728
* Harden Markdown safety of validation warnings via inlineCode helper
External-plugin validation warnings are rendered verbatim as Markdown
list items in the intake bot comment, so untrusted values interpolated
into them are an injection vector.
Add eng/lib/markdown.mjs exporting inlineCode(), which wraps a value in
a code span fenced with more backticks than any run in the content (and
pads leading/trailing backticks). This cannot be broken out of, unlike
the previous backslash escaping, which does not work inside code spans.
- lib/license.mjs: replace sanitizeForMessage with inlineCode for the
non-SPDX license warning.
- external-plugin-validation.mjs: wrap unknown-field keys (attacker
controlled JSON object keys) with inlineCode so newlines/Markdown in a
key can no longer inject a new list item.
- Add inlineCode unit tests and injection-neutralization tests for both
the license value and unknown-field key paths.
Addresses PR review comments 3679379606 and 3679434134.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: eaa5eed6-5b65-4b28-9904-24f380d26728
* Fixing codespell
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: eaa5eed6-5b65-4b28-9904-24f380d26728
Resolve the .codespellrc conflict by retaining both the daily-focus-board checkin key and upstream ACI term.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: fd1eae93-cc9f-4777-812c-a2a9872e1c2b
* Add flight-map-canvas extension
A canvas port of the Flight Map VSCode extension: a first-person
satellite terrain map flown with flight simulator controls, for
session breaks while an agent works.
The simulator under game/ is copied verbatim from the source
extension's media/ folder. That page already reached its host through
one seam - an acquireVsCodeApi() object and a placeholder in its head -
so extension.mjs fills that seam for the canvas: a loopback server that
injects a policy, the render configuration, and a shim translating
Server-Sent Events into the messages the page already handles.
Two agent actions: fly_to sends the flight to a capital, a geocoded
city, or a raw lat/lng, and picks a random capital when called with no
input; report_job shows the current job step under the HUD.
Adds the vendored three.min.js to the codespell skip list, matching the
existing entry for arcade-canvas's phaser.min.js.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Apply suggestions from code review
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Matt Soucoup
Jenny Ferries
github-actions[bot]
Yoav Lax
Stephen Benjamin
Jason Colapietro
qinezh
Aaron Powell
Konstantinos Passadis | Azure MVP | MCT
Gaetan Semet
Massimo Bonanni
Kerolos Atallah
Anton Standrik
alfredtech2026
Subin Kim
alsoleg89
RJ
dependabot[bot]
jennyf19
Muhammad Ubaid Raza
Ashley Grant
Florian Vogt
Christopher Harrison
Antonio Villanueva
Jenny Ferries
Copilot
Adrien Clerbois
John Haugabook
Burak Bayır
denis-a-evdokimov