* Harden sentry-triage repo/URL metadata validation and split issue/PR repos
The canvas relays model-reported GitHub artifact URLs and numbers (from a
turn that also ingests untrusted Sentry text) into tracking badges and the
"Fix with Copilot" flow. Validate that data against trusted, outside-the-model
anchors so injected text can't mint misleading badges or steer a write to the
wrong repo, and support issue/PR repos that legitimately differ.
- Add path-type-aware URL validation (repoRefNumber/urlInRepo): a URL must be
http(s), on the trusted host, in the expected owner/repo, and match the exact
artifact kind (/issues/<n> vs /pull/<n>) with a path-segment boundary after
the id. The id must be a positive safe integer. This rejects look-alikes like
/pull/123evil, cross-kind spoofs (an issue URL minting a "PR #N" badge), and
overflow/zero ids.
- Split the issue anchor from the PR anchor (deriveRepoAnchors): the tracking
issue and the fix PR can live in different repos. Cloud mode anchors the PR on
the issue/cloud repo; an explicitly selected local project anchors it on that
project's config-time repo (frozen at save time); "Current project" anchors it
on the trusted current-project repo from the git remote — never the issue repo.
A missing/malformed PR repo fails closed with a clear, actionable error.
- Derive tracking issue/PR numbers from the validated URLs (not the model), and
strip every pr* field when no concrete /pull/<n> in the PR repo is present, so
a badge can't point at a different artifact than the one verified.
- Freeze the selected project's repo into PR-target config at save time
(page.mjs/state.mjs/server.mjs) and include mode + local.repo in the
repo-change identity so switching projects re-derives annotations.
- Roll the optimistic rescan overlay back on a failed /api/refresh POST instead
of leaving a blocking overlay up until the fallback timer expires.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Derive displayed numbers from validated URLs; isolate project enumeration
Address Copilot review on #2815.
Comment #2: every displayed issue/PR number is now re-extracted from the
same URL that was validated against the expected repo, instead of trusting
the model-reported *Number field. Fixes the skipped/dedup, done, and
submit_work_pr paths so a reply pairing /pull/1 with prNumber 999 can no
longer render "PR #999" linking to PR 1. Numbers with no concrete anchor
(placeholder repo / non-GitHub tracker) keep the model value.
Comment #1: the projectId->repo mapping is a security anchor (it decides
which repo fix-session PRs are validated against), so it must not be
produced in a turn that also ingests untrusted Sentry titles. Enumeration
now runs in its own Sentry-free turn (loadProjectOptions), and the save
path re-binds the repo/name server-side from the selected projectId against
trusted project state; the browser no longer supplies the auth repo.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Demote sentry-triage project map from an authorization anchor
The projectId->repo map returned by the model's list_projects tool was
being used as the trust anchor for fix-session PR validation, and was
isolated into a separate "project enumeration" turn to keep untrusted
Sentry titles out of the prompt that produced it. But that turn joins the
same foreground conversation, so it is not a real trust boundary.
The SDK exposes no isolated model context and no trusted project-
enumeration API, so instead stop treating the model-relayed repo as an
authorization anchor at all. An explicitly selected project is authorized
by its host-resolved project_id (a trusted handle at create_session time),
so deriveRepoAnchors now returns prExpectedRepo='' + prProjectSelected for
that case and the preflight/URL gates skip the unbackable repo check. The
map is now display/dedup-search only, so enumeration is folded back into
the triage round-trip and the separate turn is removed.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fix fallout from demoting the sentry-triage project map
Follow-ups from review after the project-map demotion:
- Reject stale/forged local project IDs in set-pr-config. An unknown
non-empty projectId left boundProject null but was still stored, and
deriveRepoAnchors treats any non-empty id as an explicit selection —
which skips the missing-repo/PR-URL preflight. Store the id only when it
resolves to a known project, so an unresolvable id fails closed to ''
(Current-project mode, which requires a trusted git remote).
- Restore tracked-PR badges for split-repo selected projects. The tracked
badge validated the model-reported PR URL against the now-empty trusted
PR anchor, so repoRefNumber always returned null and every discovered PR
was stripped. The badge is read-only display, not a write gate, so anchor
its search + URL/number validation on the model-declared project repo
when there is no trusted anchor (still pins number->URL and host).
- Update set-pr-config and page.mjs comments: the bound repo/name are
display + dedup-search metadata, not PR authorization, and drop the stale
loadProjectOptions / "Sentry-free turn" references.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fail closed on an unconfirmable dedup skip for selected projects
After demoting the project map, prExpectedRepo is '' for an explicitly
selected project, so the dedup "already being worked on" skip accepted a
bare model-reported PR number as authoritative. Because the dedup result
and the project list come from the same Sentry-bearing model turn, injected
text could forge a skip to both suppress the trusted host-resolved
create_session flow and surface an arbitrary PR link.
An authoritative skip suppresses the trusted flow and surfaces a PR link,
so it now requires a trusted PR-repo anchor: a URL-bearing PR validated
against a concrete prExpectedRepo. A selected project has no trusted anchor,
so its skip is unconfirmable and fails closed to a retryable error instead
of being honored. The downstream dedup validation is now only reached with a
concrete PR anchor, so its dead no-anchor branches are removed.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Anchor Current-project PR repo to the checkout cwd, not GITHUB_REPOSITORY
runtimeDefaults.repo prefers GITHUB_REPOSITORY, which is the configured ISSUE
target and may point at a separate cloud repo; seedDefaultsFromSession() does not
overwrite an explicit GITHUB_REPOSITORY. All three deriveRepoAnchors calls passed
that value as currentProjectRepo, so when the issue repo differed from the driving
checkout, Current-project mode gated PR validation and dedup on the issue repo and
rejected legitimate PRs from the current project.
Derive the Current-project anchor unconditionally from the resolved session cwd via
currentCheckoutRepo(defaults) = repoFromPath(localPath), which co-derives from the
same git remote as the trusted host, and use it at all three anchor derivations.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Restrict local Copilot handoff to the current project
Remove the model-relayed "selected project" local write-handoff and its
whole plumbing (the Settings project dropdown, submit_projects/list_projects
enumeration, projectOptions state, and the server-side projectId re-bind).
The dropdown was the only thing feeding a model-supplied project_id into
create_session, and the only local mode whose PR repo came solely from the
untrusted Sentry triage turn. That made it both the write-steering vector the
reviewer flagged (server.mjs set-pr-config / deriveRepoAnchors) and the one
local mode where a dedup "skip" could never be verified against a trusted repo.
Local "Work on selected" now always runs the fix session in the CURRENT
project (the canvas's own checkout, host-trusted from its git remote), so the
PR repo is always a trusted anchor and dedup is always verifiable. Cross-repo
work goes through Cloud mode, whose repo the user types directly in Settings.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Published awesome-copilot plugins ship extension source only, so the optional
`sentry` npm package the canvas depends on at runtime may be absent. Previously
that made the canvas crash on open instead of guiding the user through setup.
- Load the optional `sentry` package lazily and translate only the top-level
ERR_MODULE_NOT_FOUND for `sentry` into a package-missing setup state; any other
import failure (missing transitive dep, entrypoint throwing) is rethrown so a
real defect isn't masked behind a misleading "reinstall" message.
- Add a dedicated package-missing branch to the connection preflight and a
matching setup gate, kept distinct from the auth and transient-network gates so
the user never sees contradictory guidance. The canvas now opens and explains
what to do rather than crashing.
- Clear `configured` for the package-missing state so the status is no longer the
contradictory `configured:true` + `setup:'package-missing'`.
- Tell users to sign in with the package-local CLI via `npx sentry auth login`
run from the extension folder — the only form that resolves after a local
`npm install`, since a package-local binary isn't on the shell PATH.
- Update the README so the sign-in step and install guidance cover the
published-plugin layout (`com.github.copilot/extensions/sentry-triage`), not
just the standalone user/project extension paths.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* fix(eng): list nested skill assets instead of directory names
* test(eng): clean up temp dirs and cover nested SKILL.md assets
* fix(eng): do not follow symlinks when listing bundled assets
* fix(eng): keep file symlinks in bundled asset lists
* Add Git Worktree Explorer canvas
Add an interactive repository, worktree, branch, and commit graph with GitHub PR enrichment, safe inspection actions, and shared lane visualization.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 69dd5824-7094-4b82-8cfa-83c2fbe53307
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Address review feedback for Git Worktree Explorer
Security
- Quote copied shell commands (git -C / git log) with shell-safe single quoting and --end-of-options via new public/shell-quote.mjs
- Move repository path into the untrusted data block of the commit Ask Copilot prompt
Performance
- Compute branch divergence with a single `git for-each-ref %(ahead-behind:...)` query (Git 2.41+), falling back to rev-list with bounded concurrency (8) instead of one process per branch
- Drop the unused `git show --stat` summary from commit details
Correctness
- Only attach same-repository pull requests to local branches (filter isCrossRepository / headRepositoryOwner)
- Resolve the default branch by full name or upstream instead of a suffix match (server + client)
- Preserve already-loaded commit pages when a load-more request fails; only reset requests show the error state
- Size the lane graph from the widest row (lanes + branch badges + text) and collapse >3 branch tips into a "+N more" badge
Accessibility / UX
- Add aria-pressed to view toggles and graph nodes; replace the unimplemented ARIA tree with group/button semantics
- preventDefault on Space/Enter for branch badges so keyboard activation does not scroll
- Use a lane palette that meets 3:1 contrast in both light and dark themes (tested)
- Mobile inspector no longer auto-opens on snapshot load and gains a close button
Tests: 19 -> 29
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 18350039-5e2b-40f0-b537-bc22cabcbb1b
* Migrate git-worktree-explorer to plugins/ manifest layout
Move the manifest from extensions/git-worktree-explorer/.github/plugin/plugin.json to plugins/git-worktree-explorer/plugin.json with README and copilot-extension.json, matching the extensions-container migration (#2334). Regenerated marketplace.json and docs.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 18350039-5e2b-40f0-b537-bc22cabcbb1b
* Address follow-up review: shell-specific quoting and sibling row controls
- quoteShellArg/formatShellCommand take a target shell; PowerShell doubles apostrophes while POSIX uses '\\''. app.js detects the platform and reports which syntax was copied.
- Commit rows no longer nest branch badge buttons inside the row button; the row button and badges are sibling controls.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 18350039-5e2b-40f0-b537-bc22cabcbb1b
* Make the closed mobile inspector inert and restore focus to the graph
When the inspector overlay is dismissed on narrow viewports it is now marked inert/aria-hidden so its controls leave the tab order and accessibility tree, focus returns to the selected graph control, Escape closes it, and viewport changes re-sync the state.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 18350039-5e2b-40f0-b537-bc22cabcbb1b
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Aaron Powell <me@aaron-powell.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Copilot-Session: 69dd5824-7094-4b82-8cfa-83c2fbe53307
Copilot-Session: 18350039-5e2b-40f0-b537-bc22cabcbb1b
* Add worktree context collector
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 2d224e01-e53f-46f8-beb2-0b8b64c5ee89
* Fix Where Was I worktree state
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 2d224e01-e53f-46f8-beb2-0b8b64c5ee89
* Collect git graph and change details
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 2d224e01-e53f-46f8-beb2-0b8b64c5ee89
* Add worktree git graph
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 2d224e01-e53f-46f8-beb2-0b8b64c5ee89
* Add uncommitted change inspector
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 2d224e01-e53f-46f8-beb2-0b8b64c5ee89
* Release Where Was I 1.1.0
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 2d224e01-e53f-46f8-beb2-0b8b64c5ee89
* Normalize diff paths on Windows
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 2d224e01-e53f-46f8-beb2-0b8b64c5ee89
* Fix change inspector clicks
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 2d224e01-e53f-46f8-beb2-0b8b64c5ee89
* Collapse base branch graph history
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 2d224e01-e53f-46f8-beb2-0b8b64c5ee89
* Keep diff drawer across context renders
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 2d224e01-e53f-46f8-beb2-0b8b64c5ee89
* Fix Where Was I review feedback
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c161d734-edb5-4707-a48c-966d4e83a2cf
* Address follow-up Where Was I review
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c161d734-edb5-4707-a48c-966d4e83a2cf
* Harden Where Was I canvas against title injection and fix graph/diff edge cases
- Remove inline onclick handlers; PR/issue cards are buttons wired with addEventListener
from data, the refresh/resume buttons use ids, and the page is served with a nonce-based
CSP (script-src 'nonce-...', default-src 'none'). escapeHtml now also escapes apostrophes.
- Collapse only the graph suffix after the final branch commit (splitCommitGraph, computed
server-side as baseGraphStart) so --topo-order interleaving never hides worktree commits.
- Preserve the selected status record through the UI, /file-diff, and get_file_diff so a path
that appears twice (e.g. staged deletion + untracked re-creation) previews the right record.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 18350039-5e2b-40f0-b537-bc22cabcbb1b
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 2d224e01-e53f-46f8-beb2-0b8b64c5ee89
Copilot-Session: c161d734-edb5-4707-a48c-966d4e83a2cf
Copilot-Session: 18350039-5e2b-40f0-b537-bc22cabcbb1b
An on-call error-triage canvas for GitHub Copilot: scans live Sentry
issues, groups them by urgency, and hands issues off for tracking or a
fix PR. Registers a reusable canvas extension under extensions/ with a
matching plugins/sentry-triage manifest.
The extension runs a loopback HTTP/SSE server per canvas instance
(host-allow-listed, per-instance capability token never broadcast over
SSE), renders the triage board server- and client-side, and drives
model turns over a single shared Copilot session serialized so scan and
work turns can't interleave. Work state is prototype-pollution-guarded
against agent-controlled tracking keys, and sendAndWait timeouts are
handled without duplicating external side effects.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Add poka-yoke skill: make misuse unrepresentable rather than warned against
Mistake-proofing, applied to code. The skill pushes toward devices that make
a wrong action impossible or self-announcing, rather than instructions asking
someone to avoid it, and refuses to accept a comment or a convention as a fix.
The gap it addresses. Given a design, models readily list what to fix and
rarely state what the fix makes impossible. Measured across 591 blind-graded
runs and six model families, responses named the foreclosed set 42% of the
time unprompted and 81% with this skill applied. Assertions were written
before the runs and graded blind to configuration.
Stated with its limits, because they matter: every run was the first turn of
a fresh session, so this measures the ceiling rather than what survives a
long working session; the comparison was against no methodology rather than a
different one, so it does not establish that this particular method caused
the gain; and the skill costs something measurable, making responses somewhat
worse at spotting the specific defect already on the page while better at
changing the shape that allowed it. All of that is in the skill body rather
than omitted.
Bundled, all self-contained, no network access and no dependencies:
scripts/detect_hazards.py standard-library scanner, 42 pattern rules
across 20 hazard shapes, five languages
references/hazard-catalog.md the taxonomy with device per shape
references/lang-*.md Python, TypeScript, Go and Rust patterns
Verified with npm run skill:validate and npm run build. Raw benchmark runs,
the harness and the assertion checklists are public at
https://github.com/rainmanjam/poka-yoke
* Rename HasTable to HasFrom in the TypeScript typestate example
codespell failed the PR: it reads HasTable as a misspelling of hashtable.
The identifier is a legitimate generic parameter on a typestate builder,
QueryBuilder<HasTable, HasWhere>, so this is a false positive, but it is our
file breaking their gate and the fix costs nothing.
HasFrom is also the better name: the flag tracks whether .from() has been
called, not whether a table exists.
Renamed in the upstream repository too, so the two copies do not diverge on
day one. Verified the whole bundle is codespell-clean locally.
* Correct the effect figures in the poka-yoke skill
The submitted numbers (42% -> 81%) could not be reproduced from the upstream
gradings. Recomputed over the six models the sentence describes: 45% -> 80%
across 132 verdicts. Adds the per-scenario breakdown, which is the more useful
claim: the gains are in tasks where nobody asked for a design review.
* feat(plugins): add fluentui-blazor plugin bundling skill and MCP server
Bundle the existing skills/fluentui-blazor skill with the official Fluent UI
Blazor MCP server (NuGet: Microsoft.FluentUI.AspNetCore.McpServer, launched via
dnx) so users get usage guidance plus live component, enum, icon, documentation,
and v4-to-v5 migration lookup from a single plugin install.
The skill is referenced, not copied; skills/fluentui-blazor/ is unchanged.
Regenerated marketplace.json and docs/README.plugins.md via npm run build.
* fix(eng): count MCP servers in README plugin item totals
update-readme.mjs summed agents, skills and extensions but ignored
composition.mcpServers, while generate-website-data.mjs already counted MCP
entries. The README and website catalogs therefore disagreed for any plugin
declaring an MCP server.
Mirror the website generator logic, including the .mcp.json path form and
multi-server files, so both catalogs report the same totals. Affects
awesome-copilot (4 to 5 items) and fluentui-blazor (1 to 2 items).
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* refactor(plugins): align fluentui-blazor MCP config with the Agent Plugin spec
Rename .mcp.json to mcp.json at the plugin root and add the
https://agent-plugins.org/schemas/1.0.0/mcp.schema.json reference, matching the
Agent Plugin MCP server specification. Drop the manifest mcpServers reference,
since clients discover mcp.json without it.
Also correct a README claim that the server reads the library version in use.
Its documentation is generated at package build time and serves the version it
was built against, which is what the Prerequisites section already stated.
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* chore: regenerate plugins README after restoring the mcpServers manifest reference
Re-adding extensions[com.github.awesome-copilot].mcpServers to plugin.json makes
the item counter include the bundled MCP server, so the fluentui-blazor row goes
from 1 to 2 items. The generated file was not refreshed at the time, which failed
the validate-readme check.
* refactor(plugins): drop the mcpServers manifest reference for fluentui-blazor
Clients discover the plugin-root mcp.json on their own, and the
com.github.awesome-copilot namespace is stripped from the served manifest by
materialize-plugins.mjs, so the field had no effect on the published plugin.
Regenerate docs/README.plugins.md in the same commit: the item counter keys off
the manifest field, so the row goes back from 2 to 1 item and validate-readme
would otherwise fail.
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* refactor(plugins): scope the fluentui-blazor PR to the plugin itself
Drop extensions[com.github.awesome-copilot].mcpServers from plugin.json as
requested in review: clients discover the plugin-root mcp.json on their own, and
materialize-plugins.mjs strips this namespace from the served manifest, so the
field never reached clients.
Revert the item-counter change to eng/update-readme.mjs and regenerate. Counting
MCP servers is a repo-wide concern and now lives in its own pull request, so this
one only adds the plugin.
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* fix(plugins): discover MCP servers from spec-mandated mcp.json at plugin root
MCP config was declared via an extensions.com.github.awesome-copilot.mcpServers
pointer to a .mcp.json file. That namespace is stripped from the served manifest,
so nothing carried the MCP declaration through materialization.
Per Agent Plugins v1.0.0 the fixed location is mcp.json at the plugin root, which
already ships as-is. Drop the pointer, rename both .mcp.json files, and validate
mcp.json (schema, closed top-level fields, server transport variants).
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Validate mcp.json against the full v1.0.0 schema with Ajv
Replace the hand-rolled MCP checks with Ajv validation against the
canonical Agent Plugins v1.0.0 MCP schema, so non-spec configs (empty
command/url, non-string args, reserved PLUGIN_ROOT/PLUGIN_DATA env keys,
invalid cwd, unknown server fields) are rejected. Per-server errors are
re-derived from the matching discriminated branch to avoid unhelpful
oneOf output.
Also reject a top-level extensions.mcpServers placement, which slipped
through because the manifest schema allows arbitrary object-valued
extension keys.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9
* Strengthen mcpServers and stdio semantic validation
Reject mcpServers under any extensions namespace in plugin.json so
inline MCP config cannot bypass root-level mcp.json enforcement.
Also run stdio semantic checks after schema validation to reject
absolute command paths and cwd values that escape the plugin root,
with regression tests for both cases.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9
* Enforce MCP path containment across platform path styles
Resolve plugin-relative commands and placeholder-rooted cwd values
against the plugin root, normalize Windows separators, and reject
lexical or symlink escapes. Add regression coverage for traversal,
placeholders, Windows paths, and symlink targets.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9
* Align MCP semantics with the v1.0.0 specification
Restore the canonical cwd pattern and literal ./ command prefix.
Validate remote HTTP URLs and headers, including HTTPS requirements,
header syntax, control characters, and case-insensitive duplicates.
Keep PLUGIN_DATA checks lexical-only so it is not conflated with the
plugin filesystem root.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9
* Reject unsafe MCP symlink paths
Resolve mcp.json through the filesystem and require a regular file
inside the real plugin root, reporting dangling links explicitly.
Harden command and PLUGIN_ROOT containment checks to inspect symlink
ancestors with lstat and realpath instead of treating unresolved paths
as ordinary missing segments. Add regression coverage for outside,
dangling, and ancestor symlink cases.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9
* Handle mixed separators in MCP data paths
Split PLUGIN_DATA traversal checks on both slash types so mixed
separators cannot bypass lexical containment on Windows clients.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9
* Reject credentials in MCP package headers
MCP headers are visible package data, so reject credential-bearing
headers including authorization, proxy authorization, cookies, and
common API-key or token names. Preserve ordinary custom headers and
add focused regression coverage.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9
* Add repo-standardizer skill: polish any GitHub repo surface
* fix(skill): remove non-string metadata and fix template README refs for vally lint
* docs(skill): drop markdown relative links from README language-switcher example
Vally valid-refs flagged ./README.md and ./README.zh.md as missing file
references; they are generated artifacts, not skill files. Keep the
example as plain text to satisfy the linter.
* fix(template): add missing language switcher to English README template
Align with README.zh.md template and SKILL.md switcher convention:
current language as plain text, other languages as relative links.
---------
Co-authored-by: programmingWTF <programmingWTF@users.noreply.github.com>
The MCP Apps sample HTML bundle imported ext-apps from esm.sh using an
unpinned major-version tag (@1), which Snyk flags as an unverifiable
external dependency / third-party content exposure risk (indirect
prompt-injection surface, since the imported module can call
app.updateModelContext and app.callServerTool). Pin it to the current
release (1.7.5).
Also pin the sample `dotnet add package` commands for the
ModelContextProtocol* and Microsoft.Extensions.Hosting packages to
their current exact versions (2.2.0 / 10.0.11), and correct a stale
"2.0.0 is current" note in packages.md.
* feat: add fail-closed Local Delegation to Cairn dashboard
Port the-workshop Local Delegation seam into signals-dashboard 0.3.0.
Orthogonal off/on control beside repo/connected profiles; enable only when
local-agent-delegation is installed and a qualified route receipt is present.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
* fix: address Local Delegation review (skill path + README catalog)
- Walk marketplace/plugin and _direct install roots for local-agent-delegation
- Update plugins/signals-dashboard README and regenerate docs/README.plugins.md
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
* fix: keep Local Delegation Windows launches from reparsing -i prompt
Long LD orientation text split under wt/cmd on Windows (0x80070002). Keep
-i short/quote-free; rely on WORKSHOP_LOCAL_DELEGATION=enabled (+ skill)
for policy. Add charset/length guard tests.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
* fix: surface Local Delegation effective state on open toast and badge
Keep -i short with one optional ASCII line. Show operators
"Local Delegation effective · route <id>" on open and in the summary control.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
* fix: address Local Delegation GHCP review comments
- Cross-platform path.join in receipt fixture
- Atomic .local-delegation.json write (no symlink follow)
- Case-insensitive WORKSHOP_LOCAL_DELEGATION env clear
- Windows Terminal: set/clear env via cmd before agent
- aria-pressed on Local toggle
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
* fix: store Local Delegation preference user-locally, not in the workshop repo
A cloned workshop must not be able to ship preference:on. Key operator intent
under ~/.copilot/workshop-local-delegation/ by canonical workshop path.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
* fix: preserve path case in Local Delegation preference key
Lowercasing collided distinct workshops on case-sensitive filesystems.
Normalize separators only; realpath already supplies a stable path.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
* fix: allow parentheses in quoted Windows Local Delegation launches
Args are quote-wrapped; only block % and ! expanders inside quotes so paths
like C:\Work\Project (1) still launch.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
* fix: apply quoted-arg Windows safety guard in launch path
Complete the parentheses fix: use isSafeQuotedWindowsCmdArg for cmdSafe.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
---------
Co-authored-by: Jenny Ferries <jenny.ferries@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Michael Recachinas <mrecachinas@github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
* Bump gem-team plugin version to 1.102.0 and add entry
Updated marketplace.json and plugin.json to version 1.102.0, added gem-team plugin entry with 16 items, refined argument hints in multiple agent definitions, and updated planner, reviewer, and skill creator configurations.
* Bump gem-team plugin version to 1.103.0 and update acceptance_criteria references
* refactor: simplify agent definitions and add gem-design-md-guidelines and gem-devops-guidelines skills
* feat: optimize orchstrator for faster workflows
* chore: optimize skills
* chore: update readme
* chore: bump version to 1.108.0
* chore: streamline planner
Restore label and comment synchronization after the PRT migration by granting the downstream writer workflows the pull request permission required for fork-originated PRs.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 512eb347-ec89-4250-8bf1-87048974b01d
* chore: upgrade microsoft-foundry plugin to 1.0.7
Update the external plugin catalog to the 1.0.7 source commit and regenerate the marketplace output.
* chore: update microsoft-foundry 1.0.7 source SHA
Point the external plugin catalog and generated marketplace output to the replacement 1.0.7 source commit.
Place Copilot-specific content in com.github.copilot and remove unsupported command handling.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 04c14c3f-d248-4a7f-93ab-93fd8b2b119e
Liz TomandCopilot App
Andrew Arnott
zhoufenqin
Sepuri Sai Krishna
Burak Bayırandkriptoburak
grgy078033
Shannon Atkinson
Matt Soucoup
mbaiza27
Muhammad Ubaid Raza
Oliver Zehentleitner AIgent
github-actions[bot]andPretaSOFT
Samuel Bushi
Adrien ClerboisandCopilot Autofix powered by AI
Rez
Antonio Villanueva
Guiyu LiandprogrammingWTF
jeanpaulhassane-225
John HaugabookandCopilot Autofix powered by AI
Anton Standrik
tomshafir-sonarsourceandtomshafir-sonarsource
Mamdouh Ibrahim
qinezh
Pavel Putrenkov
dependabot[bot]andPretaSOFT