Commit Graph

380 Commits

Author SHA1 Message Date
github-actions[bot] f03ff7eeb9 Add external plugin keep-the-why (#2776)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-08-24 11:37:19 +10:00
Samuel Bushi 22e0e1e504 fix: sync UIZZE skill with canonical workflow (#2771) 2026-08-24 11:34:55 +10:00
Adrien Clerbois 8e03e6abeb feat: add fluentui-blazor plugin bundling the skill and the official MCP server (#2675)
* feat(plugins): add fluentui-blazor plugin bundling skill and MCP server

Bundle the existing skills/fluentui-blazor skill with the official Fluent UI
Blazor MCP server (NuGet: Microsoft.FluentUI.AspNetCore.McpServer, launched via
dnx) so users get usage guidance plus live component, enum, icon, documentation,
and v4-to-v5 migration lookup from a single plugin install.

The skill is referenced, not copied; skills/fluentui-blazor/ is unchanged.
Regenerated marketplace.json and docs/README.plugins.md via npm run build.

* fix(eng): count MCP servers in README plugin item totals

update-readme.mjs summed agents, skills and extensions but ignored
composition.mcpServers, while generate-website-data.mjs already counted MCP
entries. The README and website catalogs therefore disagreed for any plugin
declaring an MCP server.

Mirror the website generator logic, including the .mcp.json path form and
multi-server files, so both catalogs report the same totals. Affects
awesome-copilot (4 to 5 items) and fluentui-blazor (1 to 2 items).

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* refactor(plugins): align fluentui-blazor MCP config with the Agent Plugin spec

Rename .mcp.json to mcp.json at the plugin root and add the
https://agent-plugins.org/schemas/1.0.0/mcp.schema.json reference, matching the
Agent Plugin MCP server specification. Drop the manifest mcpServers reference,
since clients discover mcp.json without it.

Also correct a README claim that the server reads the library version in use.
Its documentation is generated at package build time and serves the version it
was built against, which is what the Prerequisites section already stated.

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* chore: regenerate plugins README after restoring the mcpServers manifest reference

Re-adding extensions[com.github.awesome-copilot].mcpServers to plugin.json makes
the item counter include the bundled MCP server, so the fluentui-blazor row goes
from 1 to 2 items. The generated file was not refreshed at the time, which failed
the validate-readme check.

* refactor(plugins): drop the mcpServers manifest reference for fluentui-blazor

Clients discover the plugin-root mcp.json on their own, and the
com.github.awesome-copilot namespace is stripped from the served manifest by
materialize-plugins.mjs, so the field had no effect on the published plugin.

Regenerate docs/README.plugins.md in the same commit: the item counter keys off
the manifest field, so the row goes back from 2 to 1 item and validate-readme
would otherwise fail.

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* refactor(plugins): scope the fluentui-blazor PR to the plugin itself

Drop extensions[com.github.awesome-copilot].mcpServers from plugin.json as
requested in review: clients discover the plugin-root mcp.json on their own, and
materialize-plugins.mjs strips this namespace from the served manifest, so the
field never reached clients.

Revert the item-counter change to eng/update-readme.mjs and regenerate. Counting
MCP servers is a repo-wide concern and now lives in its own pull request, so this
one only adds the plugin.

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
2026-08-24 10:31:08 +10:00
Aaron Powell 37dcfd2325 fix(plugins): discover MCP servers from mcp.json at plugin root (#2713)
* fix(plugins): discover MCP servers from spec-mandated mcp.json at plugin root

MCP config was declared via an extensions.com.github.awesome-copilot.mcpServers
pointer to a .mcp.json file. That namespace is stripped from the served manifest,
so nothing carried the MCP declaration through materialization.

Per Agent Plugins v1.0.0 the fixed location is mcp.json at the plugin root, which
already ships as-is. Drop the pointer, rename both .mcp.json files, and validate
mcp.json (schema, closed top-level fields, server transport variants).

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Validate mcp.json against the full v1.0.0 schema with Ajv

Replace the hand-rolled MCP checks with Ajv validation against the
canonical Agent Plugins v1.0.0 MCP schema, so non-spec configs (empty
command/url, non-string args, reserved PLUGIN_ROOT/PLUGIN_DATA env keys,
invalid cwd, unknown server fields) are rejected. Per-server errors are
re-derived from the matching discriminated branch to avoid unhelpful
oneOf output.

Also reject a top-level extensions.mcpServers placement, which slipped
through because the manifest schema allows arbitrary object-valued
extension keys.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9

* Strengthen mcpServers and stdio semantic validation

Reject mcpServers under any extensions namespace in plugin.json so
inline MCP config cannot bypass root-level mcp.json enforcement.

Also run stdio semantic checks after schema validation to reject
absolute command paths and cwd values that escape the plugin root,
with regression tests for both cases.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9

* Enforce MCP path containment across platform path styles

Resolve plugin-relative commands and placeholder-rooted cwd values
against the plugin root, normalize Windows separators, and reject
lexical or symlink escapes. Add regression coverage for traversal,
placeholders, Windows paths, and symlink targets.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9

* Align MCP semantics with the v1.0.0 specification

Restore the canonical cwd pattern and literal ./ command prefix.
Validate remote HTTP URLs and headers, including HTTPS requirements,
header syntax, control characters, and case-insensitive duplicates.
Keep PLUGIN_DATA checks lexical-only so it is not conflated with the
plugin filesystem root.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9

* Reject unsafe MCP symlink paths

Resolve mcp.json through the filesystem and require a regular file
inside the real plugin root, reporting dangling links explicitly.

Harden command and PLUGIN_ROOT containment checks to inspect symlink
ancestors with lstat and realpath instead of treating unresolved paths
as ordinary missing segments. Add regression coverage for outside,
dangling, and ancestor symlink cases.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9

* Handle mixed separators in MCP data paths

Split PLUGIN_DATA traversal checks on both slash types so mixed
separators cannot bypass lexical containment on Windows clients.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9

* Reject credentials in MCP package headers

MCP headers are visible package data, so reject credential-bearing
headers including authorization, proxy authorization, cookies, and
common API-key or token names. Preserve ordinary custom headers and
add focused regression coverage.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9
2026-08-24 10:26:18 +10:00
Rez b95e24caae Add preview deployments for PR's (#2755)
* add preview deployments

* remove workflow from paths

* reduce perm for build
2026-08-24 10:00:53 +10:00
Antonio Villanueva bbaa587264 Update upgrade-agent plugin to 1.1.441 (#2744) 2026-08-21 14:20:41 +10:00
zhoufenqin dcf0537114 Update modernize-java to 1.23.0 (#2733)
Co-authored-by: Fenqin Zhou <Fenqin.Zhou@microsoft.com>
2026-08-21 14:20:12 +10:00
John Haugabook 927c1b5b38 canvas-extension: new chat cards extension (#2698)
* canvas-extension: new chat cards extension

* codespell: resolve mispelling

* code review, debug extension finding github app issue

* Apply suggestions from code review

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Apply suggestions from code review

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* apply edits from code review

* apply edits from code review

* apply edits from code review

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
2026-08-21 12:14:17 +10:00
Antonio Villanueva 318066d221 Update upgrade-agent plugin to 1.1.404 (#2695) 2026-08-18 09:49:45 +10:00
Anton Standrik a2c85e3e7b fix(ci): grant contributor check issue read access (#2693)
Signed-off-by: astandrik <astandrik@yandex-team.ru>
2026-08-18 09:37:35 +10:00
jennyf19 5163dc2e4d feat: add fail-closed Local Delegation to Cairn (signals-dashboard 0.3.0) (#2666)
* feat: add fail-closed Local Delegation to Cairn dashboard

Port the-workshop Local Delegation seam into signals-dashboard 0.3.0.
Orthogonal off/on control beside repo/connected profiles; enable only when
local-agent-delegation is installed and a qualified route receipt is present.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750

* fix: address Local Delegation review (skill path + README catalog)

- Walk marketplace/plugin and _direct install roots for local-agent-delegation
- Update plugins/signals-dashboard README and regenerate docs/README.plugins.md

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750

* fix: keep Local Delegation Windows launches from reparsing -i prompt

Long LD orientation text split under wt/cmd on Windows (0x80070002). Keep
-i short/quote-free; rely on WORKSHOP_LOCAL_DELEGATION=enabled (+ skill)
for policy. Add charset/length guard tests.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750

* fix: surface Local Delegation effective state on open toast and badge

Keep -i short with one optional ASCII line. Show operators
"Local Delegation effective · route <id>" on open and in the summary control.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750

* fix: address Local Delegation GHCP review comments

- Cross-platform path.join in receipt fixture
- Atomic .local-delegation.json write (no symlink follow)
- Case-insensitive WORKSHOP_LOCAL_DELEGATION env clear
- Windows Terminal: set/clear env via cmd before agent
- aria-pressed on Local toggle

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750

* fix: store Local Delegation preference user-locally, not in the workshop repo

A cloned workshop must not be able to ship preference:on. Key operator intent
under ~/.copilot/workshop-local-delegation/ by canonical workshop path.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750

* fix: preserve path case in Local Delegation preference key

Lowercasing collided distinct workshops on case-sensitive filesystems.
Normalize separators only; realpath already supplies a stable path.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750

* fix: allow parentheses in quoted Windows Local Delegation launches

Args are quote-wrapped; only block % and ! expanders inside quotes so paths
like C:\Work\Project (1) still launch.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750

* fix: apply quoted-arg Windows safety guard in launch path

Complete the parentheses fix: use isSafeQuotedWindowsCmdArg for cmdSafe.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750

---------

Co-authored-by: Jenny Ferries <jenny.ferries@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Michael Recachinas <mrecachinas@github.com>
Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750
2026-08-17 15:42:37 +10:00
tomshafir-sonarsource 5af5c28fbb Update SonarQube plugin version to 2.5.0 (#2665)
Co-authored-by: tomshafir-sonarsource <tom.shafir@sonarsource.com>
2026-08-17 15:40:05 +10:00
Muhammad Ubaid Raza b732966943 [gem-team] Version 1.109.0 (#2639)
* Bump gem-team plugin version to 1.102.0 and add entry

Updated marketplace.json and plugin.json to version 1.102.0, added gem-team plugin entry with 16 items, refined argument hints in multiple agent definitions, and updated planner, reviewer, and skill creator configurations.

* Bump gem-team plugin version to 1.103.0 and update acceptance_criteria references

* refactor: simplify agent definitions and add gem-design-md-guidelines and gem-devops-guidelines skills

* feat: optimize orchstrator for faster workflows

* chore: optimize skills

* chore: update readme

* chore: bump version to 1.108.0

* chore: streamline planner
2026-08-17 15:28:33 +10:00
Michael Recachinas f48b84e6a2 Fix PRT writer permissions for fork PRs
Restore label and comment synchronization after the PRT migration by granting the downstream writer workflows the pull request permission required for fork-originated PRs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 512eb347-ec89-4250-8bf1-87048974b01d
2026-08-14 09:26:45 -04:00
Aaron Powell 782200e3a4 Removing an unused canvas (#2656) 2026-08-14 13:59:27 +10:00
qinezh 3e66ff3230 Upgrade microsoft-foundry plugin to 1.0.7 (#2647)
* chore: upgrade microsoft-foundry plugin to 1.0.7

Update the external plugin catalog to the 1.0.7 source commit and regenerate the marketplace output.

* chore: update microsoft-foundry 1.0.7 source SHA

Point the external plugin catalog and generated marketplace output to the replacement 1.0.7 source commit.
2026-08-14 11:42:58 +10:00
Michael Recachinas 925dc83735 Migrate pull request automation away from pull_request_target (#2625)
* Migrate pull_request_target workflows

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Address PR duplicate check writer review

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix duplicate-check writer artifact handling

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Make PR duplicate check gh-aw compilable

Configure the agentic workflow source to allow fork PR triggers with staged safe outputs, upload a PR context artifact through supported post-steps, and have the workflow_run writer consume that context before publishing validated comments. This lets gh-aw regenerate the lockfile without restoring pull_request_target or privileged PR-code execution.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 512eb347-ec89-4250-8bf1-87048974b01d

* Harden workflow-run PR writers

Bind privileged artifact processing to trusted workflow-run PR identity, serialize same-PR writers, and cap aggregate quality comments.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 512eb347-ec89-4250-8bf1-87048974b01d

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 512eb347-ec89-4250-8bf1-87048974b01d
2026-08-14 11:22:06 +10:00
github-actions[bot] db17698618 Add external plugin mobile-canvas (#2610)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-08-14 11:21:39 +10:00
Muhammad Ubaid Raza f59e7dbd00 Bump gem-team plugin version to 1.102.0 and add entry (#2627)
Updated marketplace.json and plugin.json to version 1.102.0, added gem-team plugin entry with 16 items, refined argument hints in multiple agent definitions, and updated planner, reviewer, and skill creator configurations.
2026-08-12 10:15:45 +10:00
Aaron Powell 280b05dc88 feat: surface external plugin review signals (#2623)
* feat: surface external plugin review signals

Add repository and homepage heuristics to external plugin intake and use eyes reactions for approval decisions.\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>\nCopilot-Session: b745e915-6c5a-4354-ab77-5b52f9e66fea

* fix: harden external plugin review signals

Validate homepage destinations and bound response reads, and correct repository activity metrics.\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>\nCopilot-Session: b745e915-6c5a-4354-ab77-5b52f9e66fea

* fix: pin external homepage requests

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: b745e915-6c5a-4354-ab77-5b52f9e66fea

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Copilot-Session: b745e915-6c5a-4354-ab77-5b52f9e66fea
2026-08-12 10:07:30 +10:00
Daniel Scott-Raynsford df9116a689 Add Windows app storage inspector canvas 🤖🤖🤖 (#2620)
* feat: add Windows app storage inspector canvas

* Apply suggestions from code review

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* fix: address storage inspector review findings

* Correction to package and plugin

* fix: harden storage inspector cleanup

* Harden cleanup operation outcomes

* Add select a file or folder path in the result tabs to navigate the treemap to its deepest visible parent folder.

* Fixes to ensure selftesst pass

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
2026-08-12 10:06:08 +10:00
github-actions[bot] 35b7b9b0ec Add external plugin apify (#2619)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-08-11 04:02:14 +00:00
github-actions[bot] 552be1c457 Add external plugin foundation-models (#2618)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-08-11 04:01:31 +00:00
github-actions[bot] 0c79f3976f Add external plugin blea (#2617)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-08-11 04:01:16 +00:00
github-actions[bot] 005ecdfc68 Add external plugin catalyst-by-zoho (#2611)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-08-11 03:59:54 +00:00
Paul Delannoy f7e8aaa2d8 'Oracle-to-PostgreSQL Migration Expert' Custom Agent: Update Custom Agent & Plugin & Skills (#2566)
* Enhance Oracle-to-PostgreSQL migration skills and documentation

- Update migration agent guidelines to prioritize extension tool usage for code migration.
- Refine migration phases with detailed steps for pre-migration review and schema migration.
- Add new reviewing skill references for PostgreSQL materialized view refresh and UNION ALL planner risks.
- Ensure consistency in collation handling and testing strategies across skills.

* - Review migration phases to ensure correct order of execution
- Add exit criteria to each migration phase
- Remove invocation of `ms-ossdata.vscode-pgsql` extension due to dependency on VSCode
- Update README.md to reflect changes in migration phases and exit criteria
- Update broken reference to custom agent in plugin.json

* Enhance downstream migration skills and following custom agent improvements

- Added new skill for migrating .NET data access code from Oracle to PostgreSQL.
- Updated README to include new migration skill.
- Improved existing skills with clearer file naming conventions and migration actions.
- Added reference documents for handling Oracle-specific functions and pagination.
- Created detailed guides for NVL, DECODE, ROWNUM, SYSDATE, and DUAL replacements.

* Clarify PostgreSQL schema immutability and stored procedure migration risks

* Update target schema path in migration documentation for clarity

* fix(skills): clarify Phase 3-only scope for Oracle test skills

Both Oracle test skills were ambiguously worded in ways that could
cause a model to invoke them during Phase 6 (PostgreSQL test migration)
instead of using them exclusively in Phase 3.

Key changes:
- Rewrite descriptions to explicitly state Phase 3-only usage and
  warn against invoking during Phase 6
- Replace "scaffold for Oracle first" with "Oracle only" to remove
  the false implication of a second PostgreSQL scaffolding step
- Replace "Tests validate behavior consistency when running against
  Oracle or PostgreSQL" with clear Oracle-only framing
- Rename "DB-agnostic assertions" → "Assertion portability" and
  explain the why (survive Phase 6 migration without rewrites)
- Fix datetime bullet in integration tests skill to use generic
  Oracle column precision language instead of PostgreSQL type syntax
- Name Oracle NuGet package explicitly (Oracle.ManagedDataAccess.Core)

* feat(oracle-to-postgres): gate Phase 1 on DDL presence; add DDL scan to Phase 2 risk analysis

- Phase 1 success criteria now requires Oracle DDL artifacts to be
  confirmed present at the recorded location before proceeding.
  If missing, the agent stops and prompts the user to provide them.

- Phase 2 risk analysis now explicitly scans DDL/Oracle/{ProjectName}/
  as supplemental context, summarising procedure complexity indicators
  (dynamic SQL, DBMS_* / UTL_* references, autonomous transactions,
  pipelined functions, BULK COLLECT/FORALL, REF CURSOR, TYPE bodies)
  rather than ingesting DDL files wholesale. This ensures schema-level
  migration risk is captured even when it isn't visible in application
  code alone.

* - Merge in latest 'main' changes
- Update custom agent plugin (eg resolve conflict and add new skill)
- Validate skills
- Run build

* chore(plugin.json): update version to 1.1.0

* feat(oracle-to-postgres): update version to 1.1.0 for migration expert plugin

* fix: add INOUT to ignore-words-list for PostgreSQL migration

---------

Co-authored-by: TCPrimedPaul <paul.delannoy@tc.gc.ca>
2026-08-11 12:47:51 +10:00
Artsiom Chmutau a7c001d7e6 chore: upgrade timebase plugin to v0.1.3 (#2582) 2026-08-10 11:26:15 +10:00
Jenny Ferries c73936e05e Merge remote-tracking branch 'upstream/main' into add-daily-focus-board-skill 2026-08-07 09:38:12 -07:00
qinezh 3deffe2e89 Upgrade microsoft-foundry plugin to 1.0.6 (#2561)
* chore: upgrade microsoft-foundry plugin to 1.0.6

Update the external plugin catalog to the 1.0.6 source commit and regenerate the marketplace output.

* chore: update microsoft-foundry 1.0.6 source SHA

Point the external plugin catalog and generated marketplace output to the replacement 1.0.6 source commit.
2026-08-07 11:54:14 +10:00
Aaron Powell 7b602c3370 Updating to latest agentic workflows (#2556)
* Updating to latest agentic workflows

* cleaning up tools and more explicit copilot app checks
2026-08-07 11:19:05 +10:00
Gaetan Semet 1dbe7ce16f fix: update copilot-goal-skill to 1.1.2 (#2538)
Signed-off-by: Gaetan Semet <gaetan@xeberon.net>
2026-08-07 10:29:42 +10:00
Jenny Ferries 200213ed4c Merge upstream main and migrate daily focus board plugin
Adopt the Agent Plugins v1.0.0 namespaced composition model from #2546. Bundle the reusable daily-focus-board canvas into Ember only and remove its obsolete standalone catalog manifest.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 52be9c67-3ae4-4610-93d0-fe0b7ab95ccb
2026-08-06 09:18:07 -07:00
Aaron Powell a7fdcd5006 Migrate plugins and canvas extensions to Agent Plugins spec (#2546)
* feat: migrate plugins and extensions to Agent Plugins v1.0.0 spec

- Add \ to all 69 curated plugin manifests
- Migrate all 18 extension manifests: add \, move logo into
  xtensions.com.github.copilot.logo namespace, remove top-level
  logo and string xtensions: '.'
- Update eng/validate-plugins.mjs: require \, validate
  namespace-keyed extensions object for canvas extensions, widen
  name pattern to allow dots (spec §5.5, max 64 chars)
- Update eng/materialize-plugins.mjs: emit spec-clean served manifests
  (only spec fields: \, name, version, description, author,
  homepage, repository, license, keywords, extensions)
- Update eng/generate-website-data.mjs: read logo from namespace
  with fallback to top-level logo for compatibility
- Update eng/create-plugin.mjs: scaffold emits \
- Add .github/workflows/validate-plugins.yml: blocking CI for PRs
  touching plugins/** or extensions/**
- Add spec compliance check to external plugin quality gates:
  non-blocking warnings with /⚠️/🛑 emoji legend
- Update AGENTS.md: document new extension manifest shape,
  add \ to plugin checklist

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 8f3a88cb-e01e-4760-8125-460490dc1a76

* refactor: consolidate canvas extension plugins

- Move all extension plugin manifests from extensions/<name> to plugins/<name>
- Keep extensions/<name> as reusable source only
- Remove standalone extension discovery from marketplace and website plugin catalogs
- Auto-bundle same-name extension sources during materialization
- Add build-only extensions.json references for sharing extensions across plugins
- Remove x-awesome-copilot extension metadata support
- Update validation and contributor documentation

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 8f3a88cb-e01e-4760-8125-460490dc1a76

* feat: add canvas extension scaffolding skill

- Add repo-local skill for creating canvas extension sources
- Generate spec-compliant plugin manifests under plugins/
- Support registering reusable extensions with multiple plugins
- Remove guidance for extension-local plugin manifests and custom fields

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 8f3a88cb-e01e-4760-8125-460490dc1a76

* fix: align extension namespaces with current guidance

- Use each extension ID as its manifest namespace key
- Update validation and website generation to resolve extension-specific namespaces
- Upsert plugin validation PR comments using the existing repository pattern

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 8f3a88cb-e01e-4760-8125-460490dc1a76

* fix: use Copilot extension namespace

- Adopt com.github.copilot for all canvas extension manifests
- Require the namespace during validation and website generation
- Update extension scaffolding guidance

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 8f3a88cb-e01e-4760-8125-460490dc1a76

* docs: regenerate plugin catalog after merge

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 8f3a88cb-e01e-4760-8125-460490dc1a76

* refactor(plugins): move manifests to plugin roots

Use root plugin.json manifests and namespaced extension directories throughout local tooling, validation, generation, and contributor documentation. Restore materialize-plugins.mjs line breaks so the source remains readable in GitHub.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 8f3a88cb-e01e-4760-8125-460490dc1a76

* feat(plugins): migrate manifests to namespaced composition

Move repository composition metadata under com.github.awesome-copilot, materialize reusable extensions into the plugin extensions directory, and improve contributor and PR validation guidance.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 8f3a88cb-e01e-4760-8125-460490dc1a76

* fix(validation): address plugin review findings

Restore executable build scripts, validate namespaced manifests and hook directories, improve README item counts, and manage validation comments across reruns.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 8f3a88cb-e01e-4760-8125-460490dc1a76

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Copilot-Session: 8f3a88cb-e01e-4760-8125-460490dc1a76
2026-08-06 22:29:31 +10:00
jennyf19 4af329f943 Add cost-aware Workshop desk profiles (#2532)
* feat: add cost-aware Workshop desk profiles

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 83dd4f49-a03d-44a0-bdd1-8c4f54da8ec2

* fix: address Copilot review feedback

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 83dd4f49-a03d-44a0-bdd1-8c4f54da8ec2

* fix: isolate Agency MCP discovery

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 83dd4f49-a03d-44a0-bdd1-8c4f54da8ec2

* fix: label desk launch profile controls

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 83dd4f49-a03d-44a0-bdd1-8c4f54da8ec2

---------

Co-authored-by: Jenny Ferries <jenny.ferries@microsoft.com>
Copilot-Session: 83dd4f49-a03d-44a0-bdd1-8c4f54da8ec2
2026-08-05 13:58:54 +10:00
Muhammad Ubaid Raza b3d1718165 [gem-team] Introduce model routing (#2522)
* Bump gem-team plugin version to 1.94.0 and update gem-designer-mobile agent documentation to align with Google DESIGN.md spec

* chore: improve replan workflow

* chore: minor adjustments

* fix: plan route list

* chore: add model routing section to gem-orchestrator.agent.md and update plan access rule; bump gem-team plugin version to 1.97.0; add Intelligent Model Routing section to README

* chore: context cache tweaks
2026-08-05 13:57:21 +10:00
Jenny Ferries ece5dc858d Merge upstream main into daily focus board
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 83dd4f49-a03d-44a0-bdd1-8c4f54da8ec2
2026-08-04 14:29:58 -07:00
Aaron Powell dab758a392 Bumping to latest Vally release and standardising on package.json version (#2535)
The workflows were doing their own vally installs, which means that we had the potential for drift in the version of Vally being used. Now we do a npm ci and get the version from there, removing the ambiguity
2026-08-04 16:49:17 +10:00
Florian Vogt d99609ee1a deps(external.json): Update UI5 plugins to v0.1.8 (#2525) 2026-08-04 16:34:53 +10:00
Christopher Harrison cb87dae678 Seed Copilot Workshops Learning Hub mirror (#2527)
* Seed Copilot Workshops Learning Hub mirror

Perform the initial import of github-samples/copilot-workshops
(@b543d2f) into the Learning Hub, since a first-run import from the
scheduled sync workflow exceeds the 100-file safe-output PR cap.

Also update the sync workflow prompt so future runs are always
incremental and stay under the file cap.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Stop codespell flagging mirrored workshop content

codespell only knows English, so the localized Learning Hub mirrors
(es-es, ja-jp, ko-kr, pt-br, zh-cn) produce ~150 false positives such as
"comando ==> commando". Skip those locale directories, and allow the two
valid English words the mirrored pages use verbatim.

Mirrored pages must stay source-faithful, so the fix belongs in
.codespellrc rather than in the content. Note that in the sync workflow
so future runs handle new false positives the same way.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
2026-08-04 15:55:03 +10:00
github-actions[bot] 842b32bb5f Add external plugin modern-web-guidance (#2533)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-08-04 05:34:39 +00:00
Antonio Villanueva 4b6430ee3e Update upgrade-agent plugin to 1.1.290 (#2531)
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 084fc8dc-c246-4427-ab40-d24e769453dd
2026-08-04 11:31:32 +10:00
Jenny Ferries 96ca38efa1 Merge upstream/main into add-daily-focus-board-skill
Resolve the .codespellrc conflict by retaining both the daily-focus-board checkin key and upstream ACI term.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: fd1eae93-cc9f-4777-812c-a2a9872e1c2b
2026-07-29 21:22:17 -07:00
John Haugabook c46b4a919a Add flight-map-canvas extension (#2482)
* Add flight-map-canvas extension

A canvas port of the Flight Map VSCode extension: a first-person
satellite terrain map flown with flight simulator controls, for
session breaks while an agent works.

The simulator under game/ is copied verbatim from the source
extension's media/ folder. That page already reached its host through
one seam - an acquireVsCodeApi() object and a placeholder in its head -
so extension.mjs fills that seam for the canvas: a loopback server that
injects a policy, the render configuration, and a shim translating
Server-Sent Events into the messages the page already handles.

Two agent actions: fly_to sends the flight to a capital, a geocoded
city, or a raw lat/lng, and picks a random capital when called with no
input; report_job shows the current job step under the HUD.

Adds the vendored three.min.js to the codespell skip list, matching the
existing entry for arcade-canvas's phaser.min.js.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* Apply suggestions from code review

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-07-30 13:32:55 +10:00
Aaron Powell 43527d1336 chore: bump contributor check AGT to v4.1.0 (#2484)
Update contributor-check workflow to fetch AGT scripts from v4.1.0.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4b935b0a-90c8-454f-958f-93b468fd4e17
2026-07-30 12:13:36 +10:00
denis-a-evdokimov 7968055c17 Simplify AI Team Orchestration workflow 🤖 (#2439)
* Simplify AI Team Orchestration workflow

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Clarify recovery context sources

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-30 11:49:48 +10:00
David Pine 5b6da4c588 Add PR Artifact Explorer canvas 🤖🤖🤖 (#2341)
* Add PR Artifact Explorer canvas

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 33fefd65-ed18-4eda-9c7d-48008f4a9c9d

* Address PR #2341 review feedback and codespell CI failures

PR review fixes:

- zip.mjs: bounded streaming inflate for readZipEntry (output cap = entry.uncompressedSize) to prevent memory exhaustion from malformed entries

- zip.mjs: new bounded verify Transform in streamZipEntry that enforces decompressed byte cap and verifies CRC32 on flush

- zip.mjs: new readEntryPrefix() helper that inflates only up to a byte cap for indexing use cases

- preview.mjs: move URL/path parsing inside the try block so URIError becomes a 400 response instead of an unhandled rejection

- cache.mjs: buildMetadata uses bounded readEntryPrefix (8 KiB) instead of full readEntry+slice, eliminating unbounded decompression during indexing

- cache.mjs: clearArtifactCache aborts and awaits in-flight downloads via AbortController before removing cache dirs so clear cannot be repopulated

- server.mjs / preview.mjs: track static preview servers by canvas origin and stop them on canvas close, preventing loopback server leaks

- trx-preview.js: prefer authoritative ResultSummary.outcome when it is a recognized TRX value; only infer from counters when unknown

- extension.mjs: set_account validates the requested id resolves to the active account before persisting; unknown ids now return an error

- server.mjs: reject progressive-pull offsets that are not multiples of PROGRESSIVE_PULL_BATCH_SIZE to prevent caching incomplete pulls as complete

- README.md: remove Markdown-rendering claim (files are shown as escaped text)

CI fix:

- .codespellrc: skip vendored asciinema-player(*.min.js) and primer-*.css bundles

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 47369ff4-859a-425f-8a47-763cc1a5f25f

* Address second round of PR #2341 review feedback

- github.mjs: request isDraft in the pullRequestSignals GraphQL enrichment and propagate draft into search-sourced pulls (search REST API has no draft field)

- cache.mjs: give each writeJsonAtomic write a unique temp filename via a module sequence and clean up the temp file on failure to avoid concurrent-write races

- cache.mjs: deleteCachedArtifact now aborts and awaits any in-flight download for the artifact before removing files; internal mismatched-metadata purge uses a raw removeArtifactFiles helper to avoid aborting its own operation

- accounts.mjs: skip non-github.com CLI accounts before reading tokens so GitHub Enterprise Server credentials are never sent to api.github.com

- preview.mjs: require the requested entry to be the root index.html before launching a static preview (previously any nested HTML file could start one)

- zip.mjs: validate the EOCD comment length ends exactly at the archive tail so a file comment containing the EOCD signature is not mistaken for the record

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 47369ff4-859a-425f-8a47-763cc1a5f25f

* Address remaining PR artifact explorer feedback

Fix malformed preference normalization, replace artifact-presence request fanout with cached repository artifact pagination, restrict static previews to the root index, and derive completed TRX outcomes from counters. Add focused regression coverage for all four behaviors.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: db486df1-17f1-4623-ac7e-61eff2c76da4

* Fix PR artifact explorer review feedback

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6ee2bc81-2114-4b1f-987a-cb47ea35e132

* Stabilize artifact discovery and cache cleanup

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6ee2bc81-2114-4b1f-987a-cb47ea35e132

---------

Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 33fefd65-ed18-4eda-9c7d-48008f4a9c9d
Copilot-Session: 47369ff4-859a-425f-8a47-763cc1a5f25f
Copilot-Session: db486df1-17f1-4623-ac7e-61eff2c76da4
Copilot-Session: 6ee2bc81-2114-4b1f-987a-cb47ea35e132
2026-07-30 10:16:58 +10:00
Jenny Ferries 1f8b7c7ec3 Merge remote-tracking branch 'upstream/main' into add-daily-focus-board-skill 2026-07-29 08:17:11 -07:00
Aaron Powell 8ae5a99109 Enforce external plugin ref/sha consistency (#2463)
* Enforce external plugin ref/sha consistency

Extract shared ref/sha normalization and consistency checks into eng/lib and reuse them in intake plus quality gate flows.

Add a dedicated ref/sha consistency quality gate surfaced in PR/intake summaries, and add targeted tests for matching and mismatched refs.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6afe21ad-eafa-4c90-a1f2-053dedac7625

* Address review: tree/blob ref errors and PR workflow ref/sha column

- resolveCommitShaAtReadRef: classify rev-parse failure as 'fail'
  instead of 'infra_error' because a successfully-fetched ref that
  doesn't dereference to a commit is a submitter problem, not infra.
- validateRemoteRepository (intake): treat HTTP 422 from the commit
  endpoint as a submitter error; all other non-404 errors remain
  transient warnings requiring maintainer re-run.
- external-plugin-pr-quality-gates.yml: add ref/sha consistency
  column to the per-plugin quality table and failure details block.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6afe21ad-eafa-4c90-a1f2-053dedac7625

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6afe21ad-eafa-4c90-a1f2-053dedac7625
2026-07-29 15:28:13 +10:00
qinezh 1e14bd4faa chore: upgrade microsoft-foundry plugin to 1.0.5 (#2464)
Update the external plugin catalog to the 1.0.5 source commit and regenerate the marketplace output.

Co-authored-by: Aaron Powell <me@aaron-powell.com>
2026-07-29 14:07:08 +10:00
github-actions[bot] b34ac0918c Add external plugin timebase (#2462)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-07-29 11:40:52 +10:00