- Fix real typos flagged by codespell: 'Couldn't' -> 'Couldn't'
(plain apostrophe, matching convention elsewhere in JSX) and
'Unparseable' -> 'Unparsable' in catalogFilters.ts
- DetailChassis.tsx: replace sequential HTML entity unescaping with a
single-pass replace to avoid double-unescape/injection risk flagged
by CodeQL
- SyntaxHighlightedCode.tsx: make the markup HTML comment regex match
newlines so multi-line comments cannot break out of the token
(Bad HTML filtering regexp)
- pagefindSearch.ts: strip HTML tags in a loop until stable so nested/
malformed markup can't survive a single-pass strip (Incomplete
multi-character sanitization)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 80686fef-efe3-4cdd-8cd6-bfa61a5d0af6
Silently falling back to 0 is how the contributor badge regressed before,
so a missing or malformed .all-contributorsrc now throws in production
builds and warns in dev instead of shipping a wrong count.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 80686fef-efe3-4cdd-8cd6-bfa61a5d0af6
Astro 7 deprecates markdown.remarkPlugins in favour of passing a
unified() processor from @astrojs/markdown-remark. Moves the GitHub
admonitions plugin into markdown.processor, clearing the startup
deprecation warning. shikiConfig stays at the markdown level as it is
not part of UnifiedProcessorOptions.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 80686fef-efe3-4cdd-8cd6-bfa61a5d0af6
Plugin detail pages exposed only a copyable CLI command. They now lead
with a ghapp://plugins/install deep link in the same split-button
ActionMenu the other detail pages use, keeping the CLI command available
as a Copy action in the menu.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 80686fef-efe3-4cdd-8cd6-bfa61a5d0af6
The filter option lists only set scrollbar-width: thin, so they rendered
the platform default scrollbar. They now use the same muted, transparent
track treatment as the article sidebar, which resolves through
--brand-color-border-muted in both colour modes.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 80686fef-efe3-4cdd-8cd6-bfa61a5d0af6
The contributor badge rendered 0 on Playbook, Cookbook, home and custom
pages, and reverted to 0 on hydration everywhere else.
Two causes:
- Shells that bypass PageShell (LearningArticleLayout, PlaybookIndex,
PlaybookArticleBody, CookbookIndex, HomePage, TopNav, Custom) defaulted
contributorsTotal to 0 instead of the site-data value.
- site-data read .all-contributorsrc with node:fs at module scope. Those
shells are client:load hydrated, so the read threw in the browser and
the count reset to 0 after hydration.
The count is now read once in astro.config.mjs and inlined through
vite.define as __CONTRIBUTORS_TOTAL__, so it is a literal in both the
server render and the client bundle.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 80686fef-efe3-4cdd-8cd6-bfa61a5d0af6
Astro's default Shiki config bakes in the fixed 'github-dark' theme's
literal colors, ignoring the site's actual light/dark mode - this made
plain markdown-fenced code blocks (as opposed to the prototype's own
SyntaxHighlightedCode component) always render a hardcoded dark box
regardless of theme.
Switch shikiConfig to the 'css-variables' theme so highlighted tokens
resolve through --astro-code-* custom properties instead, then map
those to the same brand color tokens the prototype's codeBlock uses
(canvas-subtle background, border-muted border, brand text/link/accent
colors for tokens). Raw markdown code blocks now match the prototype's
bordered, canvas-subtle surface in both color modes.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 80686fef-efe3-4cdd-8cd6-bfa61a5d0af6
LearningArticleLayout replaces PageShell for Playbook articles but never
wrapped itself in a ThemeProvider, so its useTheme() call always fell back
to Primer's light default regardless of the site's actual theme preference.
Split the component into a thin ThemeProvider wrapper plus the existing
implementation (now LearningArticleLayoutBody), matching the pattern already
used by PageShell.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 80686fef-efe3-4cdd-8cd6-bfa61a5d0af6
Raw markdown-injected <a> elements previously fell back to the browser's
default blue/purple link colours, which are harsh against the dark-mode
background. Route them through --brand-color-text-link-rest (and the
pressed/hover token) instead.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 80686fef-efe3-4cdd-8cd6-bfa61a5d0af6
Resource detail pages (agent, instruction, skill, plugin, extension) are
not articles, and their markdown headings do not form a meaningful
outline. Playbook and cookbook articles keep their TOC.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 80686fef-efe3-4cdd-8cd6-bfa61a5d0af6
Injected markdown inherited color from body, which sits outside the
ThemeProvider and always resolved the light-mode token, making body
copy unreadable in dark mode.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 80686fef-efe3-4cdd-8cd6-bfa61a5d0af6
Two issues surfaced by review of the redesigned site:
Catalog facets rendered every option. The prototype's filter groups were
built from small hardcoded arrays, but real data produces 193 tool options
on /agents/ and 245 "Applies to" values on /instructions/. The sidebar grew
to ~10,000px and stretched the whole catalog row, pushing the (already
present) pagination control far below the fold so it read as missing.
Adopt the prototype's own solution for this, which it had already applied to
the extensions page: collapse groups past 10 options behind a "Show N more"
toggle, and cap .filterOptions with an internal scroll area. Ported verbatim
to the agents, instructions, skills, and plugins catalogs.
Detail pages scroll inside .scrollHost rather than the document, but the
footer came from PageShell, outside that element, so it stayed pinned over
the content instead of appearing at the end. The prototype renders its
footer inside the scroll host; PageShell now takes a renderFooter flag so
DetailChassis can do the same. LearningArticleLayout already did this.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 80686fef-efe3-4cdd-8cd6-bfa61a5d0af6
Fixes the three axe violations surfaced by the a11y audit after the
Primer Brand redesign:
- aria-prohibited-attr: `aria-label` was set on roleless `div`s in
InstructionDetail and PluginDetail. The "Applies to" list now uses
list/listitem roles; plugin provenance uses a group role.
- scrollable-region-focusable: the install command `code` element
overflows horizontally but was not keyboard reachable. Added
tabIndex to all three render sites.
- color-contrast: the Playbook "New" label used the brand's
success-fg on success-subtle, reaching only 4.09:1 in light mode.
Stepped one down the same green ramp for 6.14:1. Scoped to light
mode; dark mode already passed and its green-7 is near-black.
Also corrects the stale route list in the audit script: /hooks/,
/workflows/ and /tools/ have never existed as pages.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 80686fef-efe3-4cdd-8cd6-bfa61a5d0af6
Replace the Astro + Starlight site with the Brand Engineering design
prototype, ported component-for-component onto plain Astro + React
islands. The prototype is treated as the authority on markup and
styling; dynamic data is injected into its components rather than the
components being reinterpreted.
Framework:
- Remove @astrojs/starlight entirely, along with its document shell,
search, footer and language selector. BaseLayout.astro now owns the
document head, CSP, social meta and analytics.
- Add @primer/react-brand and @astrojs/react. Alias the package to its
ESM build in vite.resolve, since the default CJS entrypoint breaks
named-export detection during SSR, and mark it noExternal so its
stylesheet imports resolve.
- Promote pagefind to an explicit devDependency; it was previously
pulled in transitively by Starlight.
Pages: home, the five catalogs, the five detail routes, contributors,
Playbook index and articles, and the cookbook are all rendered by
ported prototype components inside a shared PageShell.
Detail pages share a DetailChassis (hero, breadcrumbs, sticky TOC with
scroll-spy, prev/next) while keeping what makes each type distinct: a
file switcher over bundled skill assets, an included-items grid and
external provenance for plugins, and a hero-scale preview for
extensions.
i18n: resolve translated Playbook entries via Astro.currentLocale
inside the shared article route instead of separate [locale] routes.
The explicit routes collided with the i18n fallback routes, so
translated articles were being shadowed by their English originals and
900 nonsensical double-locale pages were emitted.
Search: TopNavSearch now queries the Pagefind index client-side in
addition to the static resource index, merging on href and degrading
to the static index in dev, where no index has been built.
Also delete the superseded vanilla-TS page renderers and Astro
partials, which the ported React components fully replace.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 80686fef-efe3-4cdd-8cd6-bfa61a5d0af6
Disable the all-contributors usage footer because the pinned CLI emits an invalid closing img tag. Keep the usage link outside the generated contributor block.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 936cc10e-06f7-440c-96e7-51d1e94476ce
* docs: update Copilot app learning hub page with recent features
Adds documentation for stacked pull request support in Agent Merge,
requesting/re-requesting Copilot code reviews from the app, background
running via tray/dock, and the Worktree location setting. Adds a
Further Reading section linking to the app and CLI changelogs.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Update website/src/content/docs/learning-hub/github-copilot-app.md
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Aaron Powell <me@aaron-powell.com>
* Seed Copilot Workshops Learning Hub mirror
Perform the initial import of github-samples/copilot-workshops
(@b543d2f) into the Learning Hub, since a first-run import from the
scheduled sync workflow exceeds the 100-file safe-output PR cap.
Also update the sync workflow prompt so future runs are always
incremental and stay under the file cap.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Stop codespell flagging mirrored workshop content
codespell only knows English, so the localized Learning Hub mirrors
(es-es, ja-jp, ko-kr, pt-br, zh-cn) produce ~150 false positives such as
"comando ==> commando". Skip those locale directories, and allow the two
valid English words the mirrored pages use verbatim.
Mirrored pages must stay source-faithful, so the fix belongs in
.codespellrc rather than in the content. Note that in the sync workflow
so future runs handle new false positives the same way.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
- copilot-configuration-basics: document /model plan command (v1.0.74+) for
per-phase model selection in plan mode, and note Claude Opus 5 availability
- installing-and-using-plugins: add Open Plugin Spec v1 compatibility section
documenting mcp.json bundle support (v1.0.74+)
Sources:
- https://github.com/github/copilot-cli/blob/main/changelog.md (v1.0.74, v1.0.75)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix: add @astrojs/markdown-remark dep and fix build-website CI paths
Astro 7.1.x introduced 'Satteri' as the default Markdown processor and
no longer bundles @astrojs/markdown-remark by default. The website config
uses markdown.remarkPlugins which requires this package to be installed
explicitly.
Also update build-website.yml paths to use explicit ** glob patterns
and include root package.json/package-lock.json changes as triggers,
so dependabot package bumps always run the website build check.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: ed2219f7-f30c-4e24-95af-9c216166f285
* refactor: use explicit unified() processor in astro.config
Astro 7.1+ changed the markdown.remarkPlugins shorthand to require
@astrojs/markdown-remark. Update to the explicit unified() processor API
which is the supported way to use remark/rehype plugins in Astro 7.1+.
Sätteri (the new default processor) is incompatible with remark plugins,
so we stay on unified() to keep remark-github-admonitions-to-directives
working for Learning Hub GitHub admonition syntax.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: ed2219f7-f30c-4e24-95af-9c216166f285
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Copilot-Session: ed2219f7-f30c-4e24-95af-9c216166f285
- Add /ask and /refine to Essential Slash Commands table
- Add /ask tip and /refine tip after the table
- Add /env to Agent Environment commands table
- Fix shell quoting example: use single quotes for $HOME
- Add 'Esc twice to cancel' to Common Mistakes table
- Update Summary key takeaway to list all essential commands
- Bump lastUpdated to 2026-07-17
Upstream commits:
- 349aac6: fix shell quoting in Common Mistakes table
- 5ae1cbb: docs: add /refine command and /plugins dashboard documentation
- a67a260: docs: remove unverified /plugins command documentation
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* website: add legal links and privacy-aware analytics
Add Terms, Privacy, and Security links to the website footer and remove the experimental cookie consent popup to avoid cross-site consent drift with github.com.
Gate Hydro analytics loading on browser privacy signals (Do Not Track and Global Privacy Control) so tracking-disabled users are respected without adding custom consent state.
Update website security notes to match the current non-modal rendering flow.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d0fdad70-4820-4c24-9e4a-35c82faf31ed
* Adopting the footer design from #2327
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Copilot-Session: d0fdad70-4820-4c24-9e4a-35c82faf31ed
Adds an agentic (gh-aw) workflow that mirrors the multi-harness workshop
from github-samples/copilot-workshops into the Learning Hub, plus the
Starlight infrastructure it needs: GitHub-admonition rendering, i18n
locales with English at the site root, and a language picker that only
appears when a page has a non-English translation.
Copilot-Session: 9e1d1a4c-a422-4cae-8ea7-b3d5171f58e3
Co-authored-by: GeekTrainer <GeekTrainer@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Removing some features from the home page of the website
hooks, agentic workflows, and tools are removed - these are minimally used parts of the website
* Removing the pages and their references
* removing from the readme
* Adding the awesome copilot MCP server to our plugin and showing that in the rendered page
* Fix broken docs links and MCP plugin docs
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4215785a-7e6e-49c5-abaa-c39b0793a11e
* sync: update cli-for-beginners ch04 and ch06 from upstream
- Chapter 04: Add @-style imports section under Custom Instruction Files
(released in v1.0.66, 2026-06-30). Users can now reference other files
inside AGENTS.md or instruction files with @filepath syntax.
- Chapter 06: Add /mcp list to the Additional MCP Commands reference table.
Released in v1.0.69-1 (2026-07-04), /mcp list shows currently attached MCP
servers and can be run while Copilot is working. Also add /mcp auth command
and update enable/disable descriptions to note session persistence.
- Bump lastUpdated to 2026-07-10 in both files.
Upstream commits: c559ab4953a0 (2026-07-09)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix: revert ch04 content changes, keep only date update
Co-authored-by: aaronpowell <434140+aaronpowell@users.noreply.github.com>
* Apply suggestion from @aaronpowell
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: aaronpowell <434140+aaronpowell@users.noreply.github.com>
Co-authored-by: Aaron Powell <me@aaron-powell.com>
* feat(website): dedicated agent detail pages instead of modal
Replace the popup/modal viewer for agents with dedicated per-agent pages at /agent/<id>/ for real URLs and better deep linking.
- Build-time rendered docs (marked + gray-matter) with a details sidebar
- Sidebar Actions card: Install split-button (VS Code/Insiders/Download/Copy markdown), Share, View on GitHub
- Cards now link natively via anchors (no modal); card-render gains optional href (backward compatible for other types)
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* feat(website): dedicated instruction detail pages + shared detail layout
Extend the dedicated detail-page pattern (introduced for agents) to
instructions, and factor the shared behavior/styles out for reuse:
- Add instruction/[id].astro with build-time markdown render, breadcrumb,
install split-button (VS Code/Insiders/Download/Copy markdown), Share,
View on GitHub, and a details sidebar (Applies to / Source / Last updated)
plus collapsible frontmatter.
- Extract shared client behavior into resource-detail.ts (renamed from
agent-detail.ts) keyed on [data-resource-detail].
- Move detail-page CSS into global.css under .resource-detail-page.
- Point the agent detail page at the shared script/styles.
- Instruction cards now link to /instruction/<id>/ and the modal is removed
from the instructions listing.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* refactor(website): extract shared detail-page components
Break the agent and instruction detail pages down into reusable Astro
components under src/components/pages: Breadcrumb, Header, Main, Sidebar,
SidebarChips, InstallButtons, and RawMarkdown. Both detail pages now
compose these components instead of duplicating markup.
Fix RawMarkdown to read the `markdown` prop (matching both call sites) and
emit exact text via set:text, which restores the Copy markdown action that
had silently broken when the hidden textarea stopped rendering.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* refactor(website): share detail-page build logic in lib/detail-page
Both detail pages duplicated the install/GitHub URL builders, the
build-time markdown read+render, and the last-updated formatting. Move all
of it into a DOM-free build-time helper (src/lib/detail-page.ts) exposing
loadDetailPage(item, type), and reduce each [id].astro to a single call plus
its type-specific chip data.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Add dedicated skill detail pages with multi-file browser
Migrate skills from the popup/modal viewer to dedicated per-item pages
(/skill/<id>/) matching the agent and instruction detail pages.
Skills need a few skill-specific mechanics:
- Install via `gh skills install github/awesome-copilot <id>` (copyable),
since skills have no VS Code install URL.
- Download ZIP for the multi-file skill contents.
- A file browser that defaults to SKILL.md and lets you inspect other
files, with Shiki syntax highlighting for code and marked-rendered
markdown. SKILL.md is embedded (rendered + raw) at build time; other
files are lazy-fetched on demand and cached. Deep links via #file=.
Also fixes a production build regression in the shared detail-page
helper: repoRoot now resolves via process.cwd() instead of import.meta
.url, which resolved incorrectly once bundled and silently returned
empty markdown (breaking rendered docs + copy-markdown for agents and
instructions too).
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Replace skill file list with a dropdown selector
The two-column file browser (side list + content pane) was cramped,
splitting the already-narrow main column in half. Replace the side list
with a dropdown in the file view header so the content pane spans the
full width.
- Multi-file skills get a <select> grouped by folder via <optgroup>,
SKILL.md first. Single-file skills keep a static filename label.
- Client script drives selection from the <select> change event instead
of the removed file buttons; deep links, copy-file, Download ZIP, and
Share all read the file list from the select options.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fix skill sidebar card overflowing its column
The install command in the actions card used white-space: nowrap, which
gave the grid tracks a large min-content size. Grid items default to
min-width: auto (won't shrink below content), so the actions card grew
past the 352px sidebar, making it look wider than the agent/instruction
sidebars. Add min-width: 0 down the sidebar grid chain so the command
box stays within the column and scrolls horizontally instead.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Make skill file content pane grow to full page height
Remove the fixed max-height/overflow on .skill-file-content so file
content flows to natural height and the page scrolls, instead of a
nested inner scroll region. Shiki <pre> keeps its own horizontal scroll.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Center-align skill file picker label with the select
Reset the Starlight-injected margin-top on .skill-file-select so the
'File' label and the dropdown share a common vertical midline.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Render code files edge-to-edge in skill file viewer
For code files, drop the container padding and the pre border/radius so
the highlighted code fills the full column width. Markdown files keep
their padded, bordered layout. Toggled via an is-code class on the
content pane based on the selected file kind.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Add dedicated detail pages for hooks with a reusable file browser
Hooks had no good install path (manual copy or ZIP), so mirror the
Skills dedicated-page pattern: a multi-file browser plus a Download ZIP
action, replacing the modal on the hooks listing.
Generalise the Skills-specific file browser so both resource types share
one implementation:
- Rename SkillFileBrowser.astro -> FileBrowser.astro with neutral props.
- Rename skill-detail.ts -> file-browser.ts with neutral data attributes
(data-file-browser-page, data-bundle-id, data-primary-file).
- Rescope install-slot styles under a shared .bundle-detail-page class.
- generate-website-data: rename getSkillFiles -> getFolderFiles and emit a
files[] + readmeFileName for each hook.
Hooks list cards now deep-link to /hook/<id>/ instead of opening a modal.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Add dedicated detail pages for workflows
Migrate agentic workflows from the popup/modal viewer to dedicated per-item pages (/workflow/<id>/) with deep linking, matching the pattern used for agents, instructions, skills, and hooks.
Workflows are single .md files, so they reuse the single-file detail components (Main, Sidebar, Header, Breadcrumb, RawMarkdown) and the resource-detail client script. Since workflows have no VS Code install, the install slot instead documents the gh aw CLI flow and offers Download + Copy markdown actions.
Also rescope the shared install-slot CSS from .bundle-detail-page to .detail-actions-card so skill, hook, and workflow pages share it without a page-specific class, and drop the now-unused bundle-detail-page class from the skill and hook pages.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Format workflow install note
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Add dedicated plugin detail pages
Replace the plugins modal with dedicated /plugin/<id>/ pages that deep link, render the bundled README, and surface an Included items section linking each constituent agent/skill/instruction/hook to its own detail page (falling back to GitHub for items without a page, e.g. extensions).
- generate-website-data: resolve plugin items to detail URLs + titles, add readmeFile for local and extension-derived plugins
- new IncludedItems component groups bundled resources by kind
- plugin/[id].astro handles local, extension-derived, and external plugins with VS Code + CLI install actions
- resource-detail: copy-install handler shared with detail pages
- plugins list cards now deep link; modal wiring removed
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Show plugin version, ref, and commit in detail sidebar
Capture version from plugin.json (local + extension-derived) and external.json, and surface it in the plugin detail Details card. For external plugins, also show the pinned source ref and short commit SHA when present.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Add dedicated canvas extension detail pages with preview gallery
Replace the extensions modal with per-extension pages at /extension/<id>/,
mirroring the skill/plugin detail layout. Each page shows a preview image
gallery, README docs (or an About fallback), and a sidebar with install
actions and details (version, canvas ID, keywords, author, commit).
- generate-website-data.mjs: emit readmeFile for extensions
- extensions-render.ts: deep-link cards to detail pages
- extensions.ts: strip modal/gallery wiring, keep filter/sort/copy actions
- resource-detail.ts: add copy-install-url action
- extension-gallery.ts: thumbnail switching for multi-image previews
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Add VS Code Insiders and GitHub Copilot app install links
Introduce a shared PluginInstall component used by both plugin and canvas
extension detail pages. It renders a split-button dropdown deep-linking into
VS Code, VS Code Insiders, and the GitHub Copilot app (ghapp://), plus the
CLI command for internal items.
- Internal plugins/extensions: ghapp://plugins/install?source=<id>@awesome-copilot
- External plugins: ghapp://plugins/marketplace/add?source=<owner/repo>
- ghapp source values are URL-encoded per the app's deep-link contract
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Make GitHub Copilot app the default install option
Promote the ghapp:// deep link to the primary split-button action and list
it first in the dropdown, ahead of VS Code and VS Code Insiders.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Ignoring impeccable files
* Make Extensions grid Copy Install a direct Copilot app install
Replace the CLI-command copy button on extension cards with an
'Install in Copilot app' deep link (ghapp://plugins/install) for internal
extensions, matching the detail page. External extensions keep the Copy URL
fallback since they have no Copilot app install path.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address PR review feedback on detail pages
- Remove DOM innerHTML read/write round trip in file browser cache
(CodeQL js/xss-through-dom); seed primary file from raw text and
render lazily.
- Use Shiki dual light/dark themes in the file browser and add dark
mode CSS overrides.
- Guard decodeURIComponent for #file= deep links against malformed
percent-encoding.
- Slugify SidebarChips title before using it in the tag class name.
- Use a neutral aria-label on the shared detail Sidebar.
- URL-encode the external plugin source in VS Code and Insiders
install links.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Prevent client-side path traversal in file deep links
Addresses the CSPT-to-XSS class reported in github/open-source#1739.
A '#file=' hash value containing '../' sequences could resolve outside
the awesome-copilot repo prefix once normalized by fetch, loading
attacker-controlled content that was then rendered into the page.
- Add isSafeRepoFilePath() and enforce it at the raw-URL choke point
(getRawGitHubUrl, fetchFileContent, downloadFile, getVSCodeInstallUrl),
so no consumer can escape the repo prefix.
- Validate the decoded '#file=' path in the modal hash handler and guard
its decodeURIComponent against malformed input.
The new hash-based file browser already restricts deep links to an
allowlist of build-time file descriptors; the choke-point guard is an
additional backstop.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fix accessibility violations on resource detail pages
Run the a11y audit against the new detail pages and resolve every
critical/serious axe violation it surfaced:
- Nest the detail column as a <div> instead of a second <main>, fixing the
duplicate/non-top-level/non-unique landmark rules on every detail page.
- Add a shared enhanceMarkdownA11y() helper that makes rendered <pre>/<table>
blocks keyboard focusable and gives task-list checkboxes a state-based
accessible name; apply it at build time and in the client file browser.
- Make Shiki-highlighted code and install-command <code> blocks focusable.
- Underline links inside rendered docs and install notes so they are
distinguishable without color, overriding the global #main-content reset.
- Extend the a11y audit to cover one representative page per detail type.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fix file browser GitHub URL handling
Encode selected file paths before assigning GitHub detail links and render load errors with DOM APIs so DOM-derived file names are not reinterpreted as markup.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address PR review feedback on detail pages and file browser
- Deep-link plugin extension items to their /extension/<id>/ detail pages:
generate canvas extensions before building the resource index, and index
extensions (by id and folder basename) so resolvePluginItem can resolve them.
- Render image files in the bundle file browser via an <img> tag built from the
safe raw URL instead of decoding binary assets as UTF-8 text; skip the
copy-file action for images.
- Use a neutral 'Install' heading on internal plugin and extension pages so the
split-button primary label accurately communicates the target.
- Warn (with the file path) when readResourceMarkdown fails instead of swallowing
the error silently, keeping the build unbroken.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address PR review feedback on install links, dropdown a11y, and ZIP downloads
- externalRepoUrl (plugin detail pages) now builds the 'View on GitHub' tree
URL from the pinned source.ref or source.sha, falling back to main only when
neither is present, so the link matches the sidebar Ref/Commit chips.
- Install split-button dropdown on resource detail pages is now keyboard
accessible: opening focuses the first item, ArrowUp/ArrowDown wrap, Home/End
jump, and Escape closes and restores focus to the toggle, mirroring modal.ts.
- downloadZipBundle fetches each file as an ArrayBuffer and hands it to JSZip so
binary assets (PNG/JPG/etc.) are preserved instead of corrupted by UTF-8 text
decoding.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address PR review feedback on external repo links and workflow install note
- externalRepoUrl now uses a pinned source.ref/sha even when the external
plugin has no path, returning /tree/<ref> so "View on GitHub" points at the
pinned revision and stays consistent with the sidebar Ref/Commit chips.
- Reflow the workflow install note so each inline code and link element stays on
a single line (using explicit whitespace expressions for word spacing),
removing the split end-tag artifacts while preserving the exact rendered text
and spacing.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Harden repo path validation and fix Included Items file links
- isSafeRepoFilePath now fails closed on any "%" so percent-encoded dot-segments
(%2e%2e and double-encoded %252e%252e) cannot be normalized back into path
traversal by the browser URL parser during fetch, and also rejects "." and
empty path segments. Legitimate repo paths never contain these.
- IncludedItems githubHref now links file paths via /blob/ and directories via
/tree/, detecting files by a trailing extension on the last path segment, so
the fallback links for agent/instruction/command items no longer 404.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Harden detail pages: sanitize markdown, fix search deep-links and external URLs
Addresses rubber-duck review items 1-5 for the detail-page migration:
1. Sanitize rendered markdown as untrusted HTML. Add isomorphic
sanitize-html helper (isomorphic-dompurify) applied in the build-time
pipeline (detail-page.ts) and the client file browser before a11y
enhancement, so marked output can no longer inject scripts/handlers.
2. Point Pagefind search results at canonical /type/id/ detail pages
instead of inert #file= listing hashes for types that have a detail page.
3. Sanitize external/generated URLs on plugin and extension detail pages
and their render scripts so only http(s) links are emitted.
4. Add a shared externalRepoUrl helper that pins GitHub links to the
source ref/sha (preferring sha) with encoded path segments, replacing
the duplicated always-main logic in the pages, modal, and renderers.
5. Handle #file= hash navigation after initial load in the file browser
via a hashchange listener.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Detail pages: clickable filter chips + code-block copy buttons (#2255)
* Add clickable filter chips on detail pages
Turn read-only metadata chips into navigation: tags (hooks/plugins),
keywords (extensions), and extensions (instructions) now link to their
list page pre-filtered by that value (e.g. /hooks/?tag=testing).
SidebarChips gains optional filterBase/filterParam props; when both are
set each chip renders as an <a> with an aria-label and hover/focus
styling, otherwise it stays a plain <span>. Agent/skill/workflow chips
are unchanged. Filtering was verified end to end against each list
page's existing query-param handling.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Add copy buttons to documentation code blocks
Detail-page markdown is rendered as plain <pre><code> with no syntax
highlighter, so code and config snippets had no copy affordance. Add a
hover-revealed copy button to every code block in the rendered docs:
copies to the clipboard, shows a toast, and swaps to a check icon for
confirmation. Buttons are keyboard-accessible, always visible on touch
devices, and respect reduced-motion. The sidebar frontmatter block is
left untouched.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Fix detail-page GitHub links, empty-state link contrast, and file cache
Addresses four PR review comments on the detail-page migration:
- skill/hook detail pages: build the sidebar "View on GitHub" link from a
/tree/main base instead of /blob/main, since item.path is a directory and
/blob/<dir> URLs 404. The FileBrowser githubBase stays on /blob for
individual file links.
- global.css: include .detail-empty a in the underline override so links in
empty-state notes stay distinguishable without relying on color alone
(WCAG 1.4.1 / axe link-in-text-block).
- file-browser.ts: seed the primary file's cache with its already-rendered
(frontmatter-stripped) HTML in addition to raw text, so re-selecting the
primary file after navigating away no longer re-renders the raw source and
surfaces frontmatter. Copy still uses the full raw text.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Ayan Gupta <74832088+ayangupt@users.noreply.github.com>
Per v1.0.69-3 (2026-07-07), the /allow-all auto mode now requires
experimental features to be active (/experimental on or --experimental).
The previous AUTO_APPROVAL env var approach has been removed.
Update the auto allow-all mode note in Copilot Configuration Basics
to document the experimental mode requirement and activation steps.
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Add /mcp list command (shows attached servers mid-turn) to understanding-mcp-servers
- Add stayInAutopilot setting to CLI settings table in copilot-configuration-basics
- Add auto allow-all mode (LLM judge-based approval) to copilot-configuration-basics
- Add kimi-k2.7-code model to the model selection table in building-custom-agents
- Update lastUpdated dates on all three modified pages
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Aaron Powell
dependabot[bot]
github-actions[bot]
allcontributors[bot]
Christopher Harrison
Copilot
Ayan Gupta