- extension.mjs: serialize stash read-modify-write behind a per-desk mutex;
order signals by explicit ISO timestamp (clone-safe) not mtime; keep desks
with malformed latest signal as 'awaiting'; gate calibration badge on a real
gap value; add prefers-reduced-motion CSS; toast aria-live region; rename
open_desk -> get_desk_path (returns path, no session); handle server.listen errors.
- signal-write/SKILL.md: document timestamp + run_id, ordering guidance, and the
outcome (calibration) signal schema.
- workshop-ta.agent.md: a desk is a persistent workstream picked up by independent
sessions, not one long-running process.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
The signals-dashboard canvas is a standalone extension, not bundled in
the-workshop plugin. Removes the same inaccurate 'bundled' phrasing the
README fix corrected, keeping the subtype guidance intact.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
The dashboard is a canvas extension that ships standalone, not bundled
in the plugin. Installing the-workshop delivers skills/agent/desks only;
the signals-dashboard canvas installs separately and renders in the
GitHub Copilot app. Replaces the false 'bundled... nothing else to
install' claim with the real two-install path.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
signals-dashboard imports '@github/copilot-sdk/extension' but shipped
without a package.json — the only SDK-importing extension in the repo
missing one (every peer that imports the SDK declares it). Without the
manifest the host has no dependency to resolve at load time. Add a
package.json matching the peer shape (type: module, main: extension.mjs,
'@github/copilot-sdk': latest — the modal peer convention).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
Two follow-up review findings:
- signals-dashboard: the async createServer callback had no top-level
error boundary, so a malformed %-encoded path, a stash write on a
read-only workshop, or a scan failure rejected a promise the server
never awaits — hanging the request and risking an unhandled-rejection
crash. Wrap the handler and return a controlled 500.
- workshop-create: Path A treated finding a marker (desks/, CAIRN.md,
etc.) as 'just use it', an early stop that left partially initialized
workshops incomplete. Make it detection-only and continue scaffolding
whatever is missing, per the 'only add what's missing' principle.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
Address the remaining doc/skill review findings:
- workshop-create: 'gh repo create --clone' clones into the CWD, which
nests the new repo when run from inside a checkout. Add an explicit
clone-parent selection + 'rev-parse --is-inside-work-tree' guard, and
run the create from that parent.
- workshop-create: desks/ and bench/ were scaffolded empty, so Git drops
them and a later clone loses the scaffold. Scaffold .gitkeep in each
and commit the placeholders.
- bench-read: make <workshop>/bench/ the primary shared location (the
directory workshop-create actually establishes) with desk-local
artifacts as a secondary source, instead of treating the repo root as
the bench.
- the-workshop README: add the Workshop Create skill to the component
table so all six packaged components are documented.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
Second review round on the Cairn canvas extension:
- XSS via numeric fields: self-assessment scores, quality rating, and
token counts are read from unvalidated agent JSON and interpolated
into HTML/style/title. Coerce them at the source in scanSignals via
toScore (clamped 0..5) and toCount (finite nonnegative int), and
esc() the effort label, so a nonnumeric value can neither inject
markup nor break layout/width.
- CSRF: /api/stash, /api/restore, /api/open are state-changing loopback
POSTs that previously accepted any origin, so a web page that guessed
the port could mutate .desk-stash.json. Add isCrossSiteRequest() and
reject cross-site POST /api/* (Origin / Sec-Fetch-Site check), mirroring
the loopback protection in connector-namespaces/server.mjs.
- Accessibility: the 5s auto-refresh replaced the whole #content subtree,
dropping keyboard focus. Skip the swap when markup is unchanged and
restore focus to the same desk/action button when it does change.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
Address PR review findings on the Cairn canvas extension:
- XSS: replace inline onclick handlers (which used HTML-escape that
does not escape single quotes) with event delegation via
data-act/data-desk attributes and one document click listener that
survives the innerHTML auto-refresh.
- Path traversal: add isValidDeskName() and enforce it in every HTTP
and canvas-action handler that takes a desk name (reject empty, /,
\\, null byte, '.' and '..').
- Crash safety: String()-coerce in esc()/truncate() and guard
outcomeIssues with Array.isArray so a malformed signal cannot take
down the whole dashboard render.
- Honest UI: the per-desk button no longer claims to 'open' a desk;
it is relabeled 'path' and copies the desk's filesystem path to the
clipboard with an accurate toast built via textContent (not innerHTML).
- Correctness: outcome signals only pair with a signal when emitted at
or after it (within 1hr), and activeCount is computed by excluding
stashed desks instead of subtracting counts (no longer goes negative).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
The signals-dashboard canvas extension bundles with the-workshop
plugin (x-awesome-copilot.extensions), so installing the plugin from
awesome-copilot includes the dashboard. Drop the pointers telling
users to install from jennyf19/the-workshop.
Addresses PR review comments on README (Cairn Dashboard section),
signal-write SKILL note, and workshop-ta agent viewing-signals note.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
The signals-dashboard extension was missing its required screenshot asset, so it failed awesome-copilot's validateExtensionManifest (logo must equal "assets/preview.png" and the file must exist) and never materialized -- meaning the Cairn canvas would not ship to the GHCP app. Adds the 1024x1024 preview.png and the convention logo field. Validated locally: node eng/validate-plugins.mjs -> extension signals-dashboard is valid; all 70 plugins + 19 extensions pass.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
The dashboard is the centerpiece — real-time agent coordination
view showing desk status, signal types, intent text, outcome
pairing with honesty gap, token usage, and stash/restore controls.
Includes all updates from the-workshop PRs #3-#7:
- Empty state guidance for new users
- Token usage display per desk
- TA partnership signals + Cairn awareness
- Intent-as-text (execution signals use descriptive text)
- Outcome signal pairing with honesty gap calibration
- Open desk button
- Subtype labels (done/checkpoint/blocked/hands-up)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
Syncs with jennyf19/the-workshop PR #8 (merged). Adds the
workshop-create skill with Path A (existing dir) and Path B
(new GitHub repo), explicit guard against repo-in-repo nesting.
TA agent updated with workshop-create section.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
* Migrate extension plugin materialization layout
Materialize extension plugins into a dedicated extensions/ container, validate the new manifest convention, and bump extension plugin versions.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d26008fb-9928-4ba7-b7c8-36f35320f7c1
* Keep extension manifests source-compatible
Restore source extension manifests to "extensions": "." while preserving materialization-time rewrite to "extensions" in distribution output.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d26008fb-9928-4ba7-b7c8-36f35320f7c1
* Validate canvas extension layout for external submissions
Add intake and quality-gate checks for canvas-tagged external plugins so they must include extensions/extension.mjs and optional manifest extensions is validated when present.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d26008fb-9928-4ba7-b7c8-36f35320f7c1
* Fix plugin clean extension pass and typo guard text
Declare EXTENSIONS_DIR in clean-materialized-plugins and run extension cleanup once after plugin cleanup. Also normalize misspelled-key detection strings to satisfy spelling checks without changing validation behavior.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d26008fb-9928-4ba7-b7c8-36f35320f7c1
* Proper codespell fix
* Separate canvas structure quality gate status
Track canvas structure as its own gate status and output, include it in aggregate summaries, and enforce Git object types so extensions/ is a tree and extensions/extension.mjs is a blob.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d26008fb-9928-4ba7-b7c8-36f35320f7c1
* Move extension bundles during materialization
Change extension-plugin materialization to move root bundle entries into extensions/ instead of copying them, and assert originals are removed in test coverage.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d26008fb-9928-4ba7-b7c8-36f35320f7c1
* Nest materialized extension bundles by plugin name
Materialize extension plugins into extensions/<plugin-name>/... (moved entries) so resulting paths are duplicated by design, and bump extension plugin versions to the next patch release.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d26008fb-9928-4ba7-b7c8-36f35320f7c1
* Fix extension materialization publish and cleanup
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d26008fb-9928-4ba7-b7c8-36f35320f7c1
* Preserve root extension logo asset
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d26008fb-9928-4ba7-b7c8-36f35320f7c1
The awesome-copilot validator (eng/validate-plugins.mjs:107-148)
strips .md from the plugin.json path and appends .agent.md to
find the source file. The rename to workshop-ta.md broke this
convention. Reverting to workshop-ta.agent.md so validation,
materialization, and README generation all work correctly.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
The .agent.md suffix leaked into the component ID registered
with the marketplace. Renaming gives a clean 'workshop-ta'
identifier while the frontmatter display name stays unchanged.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
Never initialize over existing journal.md — if the desk directory
already exists, resume it instead. Operator must explicitly rename
or archive before reusing a desk name.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
- desk-open: add 'Session orientation' section explaining the
session→journal→signals lifecycle. Desks are long-running in
state (journal), not runtime (each session is independent).
- workshop-ta: partnership signals write to desks/_ta/.signals/
so they appear on the dashboard without replacing any desk's
latest signal. TA uses the _ta prefix to indicate coordinator.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
- desk-open: standard desk structure now creates .signals/ directory
(prevents first signal-write from failing on missing parent dir)
- signal-write: note that dashboard reads subtype field, falls back
to signal_type for backward compat
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
- plugin.json: use ./agents/workshop-ta.md path format (matches all other plugins)
- workshop-ta front matter: name 'Workshop TA' preserves acronym (was 'workshop-ta')
- signal-write: add subtype field (hands-up/blocked/done/checkpoint/partnership)
so dashboard consumers can distinguish specific signal states
- npm run build: regenerated docs/README.agents.md
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
- Add YAML front matter to workshop-ta agent (name + description)
- Fix agent path: use 'workshop-ta' not './agents/workshop-ta.agent.md'
- Sort skills alphabetically in plugin.json
- Make Cairn dashboard reference conditional (full plugin from source repo)
- Update signal-write: write JSON to .signals/ AND note in journal
- Add partnership signal type to signal-write skill
- Inline CAIRN disposition in agent (treat external CAIRN.md as optional)
- Run npm run build to regenerate marketplace.json and docs
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
The Workshop puts long-running AI agents (desks) in the same room,
on the same work, each with its own memory and history, sharing one
workspace so you direct the work instead of relaying it.
Components:
- Workshop TA agent (room coordinator)
- Skills: desk-open, desk-journal, signal-write, bench-read
- Marketplace entry for one-command install
Install: copilot plugin install the-workshop@awesome-copilot
Complements Ember (partnership for one agent) with coordination
for many agents. Install both for the full stack.
Source: https://github.com/jennyf19/the-workshop
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62
* Migrate extension plugin materialization layout
Materialize extension plugins into a dedicated extensions/ container, validate the new manifest convention, and bump extension plugin versions.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d26008fb-9928-4ba7-b7c8-36f35320f7c1
* Keep extension manifests source-compatible
Restore source extension manifests to "extensions": "." while preserving materialization-time rewrite to "extensions" in distribution output.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d26008fb-9928-4ba7-b7c8-36f35320f7c1
* Validate canvas extension layout for external submissions
Add intake and quality-gate checks for canvas-tagged external plugins so they must include extensions/extension.mjs and optional manifest extensions is validated when present.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d26008fb-9928-4ba7-b7c8-36f35320f7c1
* Fix plugin clean extension pass and typo guard text
Declare EXTENSIONS_DIR in clean-materialized-plugins and run extension cleanup once after plugin cleanup. Also normalize misspelled-key detection strings to satisfy spelling checks without changing validation behavior.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d26008fb-9928-4ba7-b7c8-36f35320f7c1
* Proper codespell fix
* Separate canvas structure quality gate status
Track canvas structure as its own gate status and output, include it in aggregate summaries, and enforce Git object types so extensions/ is a tree and extensions/extension.mjs is a blob.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d26008fb-9928-4ba7-b7c8-36f35320f7c1
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* chore: standardize agent documentation markdown, fix formatting, add MANDATORY clauses, and update output formats across agents
* chore: Update gem-team plugin version to 1.84.0 and refine concurrency language in agent execution steps
Adds an agentic (gh-aw) workflow that mirrors the multi-harness workshop
from github-samples/copilot-workshops into the Learning Hub, plus the
Starlight infrastructure it needs: GitHub-admonition rendering, i18n
locales with English at the site root, and a language picker that only
appears when a page has a non-English translation.
Copilot-Session: 9e1d1a4c-a422-4cae-8ea7-b3d5171f58e3
Co-authored-by: GeekTrainer <GeekTrainer@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Removing some features from the home page of the website
hooks, agentic workflows, and tools are removed - these are minimally used parts of the website
* Removing the pages and their references
* removing from the readme
* Adding the awesome copilot MCP server to our plugin and showing that in the rendered page
* Fix broken docs links and MCP plugin docs
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4215785a-7e6e-49c5-abaa-c39b0793a11e
* Add external plugin version-match gate
Enforce external.json version matching against remote plugin.json for source ref and/or sha in shared quality gates, and surface the new gate status/output in intake and PR workflows.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 8aa3e98d-1873-4cab-8866-1b2efd0f24ad
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Matt Soucoup
jennyf19
Jenny Ferries
Aaron Powell
jennyf19
github-actions[bot]
Xiaoyun Ding
Tim Mulholland
Fenqin Zhou
qinezh
Muhammad Ubaid Raza
tomshafir-sonarsource
Christopher Harrison
Copilot
Ari LiVigni ContinuousG33k