* Add APNG Studio canvas extension
APNG Studio is an interactive GitHub Copilot canvas extension for building
Animated PNG (APNG) files from frames: draw or upload frames, tune per-frame
timing and compositing, preview live, send the result to a phone by QR, and
export an animated .png.
Adds extensions/apng-studio/ with the required .github/plugin/plugin.json and
assets/preview.png, and regenerates .github/plugin/marketplace.json.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address review feedback for APNG Studio
Security and robustness (extension.mjs):
- Reject "." and ".." project ids so canvas/action input cannot resolve
outside artifacts/.
- Bound request bodies (1 MiB JSON, 40 MiB frame upload); return 413 when
exceeded.
- Reject malformed JSON with 400 instead of coercing to {}, so a truncated
body cannot trigger destructive routes such as /frames/clear.
- Scope shares per project so one canvas cannot rotate or stop another's
share; the LAN server is shared and torn down once no shares remain.
- get_state treats hiddenFirst as active only with >=2 frames, matching the
encoder, so a single-frame project reports the correct duration.
Accessibility (web/):
- Expose Pen/Eraser state with aria-pressed and keep it in sync in setTool.
- Mark the toast as an aria-live status region.
Packaging:
- Add extensions/apng-studio/.gitignore with artifacts/ so the documented
runtime-data exclusion holds for this extension.
- Update the README install section to reference the committed awesome-copilot
extension path.
Regenerated .github/plugin/marketplace.json.
* Use "GitHub Copilot app" wording
Update the plugin description (and regenerated marketplace entry) to refer to
the host as the GitHub Copilot app.
* Address deeper review for APNG Studio
Security:
- Require a per-server access token on every loopback data/mutation request
(minted per canvas server, carried in the iframe URL, attached to every
renderer request). Static assets stay public. Blocks a local process or
cross-origin page from reading state or driving mutations.
Concurrency and durability:
- Serialize the load-mutate-save cycle per project; dedupe concurrent first
loads; write project.json via temp file + rename.
Lifecycle:
- Track SSE clients per instance and end them before server.close().
- Stop a project's LAN share only when no other panel references it.
Correctness:
- Report exact numerator/denominator total duration; handle pointercancel.
QR and accessibility:
- Place QR version bits least-significant-bit first (versions 7-10).
- Associate delay/fps/dispose/blend labels with their inputs via for=.
* Address deeper concurrency and validation review for APNG Studio
- Run assemble() under the project lock; add_color_frame renders and appends
within one lock.
- Validate uploaded frames (PNG chunk scan, size + dimension checks) before
writing; first frame stores real dimensions; CanvasError maps to 400.
- Validate move delta; clear frames in memory before deleting files.
- Route the open-handler rename through applySettings.
- Deduplicate LAN share startup; clean up if the canvas closes mid-start.
- End SSE streams before server.close(); skip dead streams in broadcast.
- Exact fractional duration; drawing surface stays >= 1px; refresh state before
re-seeding "start from last frame".
* Address review: PNG format validation, share bind, limits, a11y
- Validate uploaded frames are 8-bit RGBA non-interlaced PNGs (standard
compression/filter); reject formats the codec can't encode.
- Cap projects at 600 frames (add + duplicate).
- Bind the LAN share server to the private address, not 0.0.0.0; require a
private address and rebind when it changes while idle; build the URL from the
bound address.
- Align width/height inputs and clampSize to the 2048 maximum.
- Size the drawing surface by width + aspect ratio for narrow panels.
- set_frame with an unknown frameId returns a validation error.
* Address review: encoded-byte budget, timing modes, id keys, load errors
- 256 MiB aggregate encoded-byte budget (add + duplicate); per-frame size
tracked and backfilled on load, so a frame count alone no longer bounds
assembly memory.
- Frame timing is one exclusive mode (delayMs | fps | delayNum/delayDen);
combinations are rejected instead of producing hybrid delays.
- Collision-resistant project storage keys: safe ids are used verbatim (existing
projects still load) and only unsafe ids get a hash suffix, so "foo/bar" and
"foo?bar" can't share a directory.
- Load only treats a missing file as a new project; other read/parse errors
surface instead of silently overwriting real data.
- Share server binds to a real LAN interface (skips virtual/VPN/container,
prefers physical NICs and common ranges).
- Generated export names get millisecond + random suffix to avoid same-second
overwrite.
- PNG validator accepts the encoder's Uint8Array so agent solid-color frames
aren't rejected.
* Address review: crash-safe frame writes, server startup, APNG first frame
- Write the PNG before mutating project metadata on add/duplicate, and delete
after persisting, so an interrupted disk op can't dangle a reference or
advance unsaved state.
- Evict a project from the in-memory cache if its save fails, so a transient
write error can't desync the live session from disk.
- Reject on the loopback server's listen error and drop a half-initialized
instance so startup failures clean up and can retry.
- Normalize APNG dispose_op PREVIOUS to BACKGROUND on the first animated frame
(spec requirement).
- Release decoded ImageBitmaps after use so a large upload batch doesn't retain
native image memory.
- Surface otherwise-silent async UI failures via a toast; check the state
response is ok before parsing it.
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add arch plugin (architecture + modernization skills)
Add the `arch` plugin with two skills:
- `arch:document` — produce a single, cited architecture document for a
locally-cloned repo, reading files on disk only.
- `arch:modernize` — generate a phased modernization plan, auto-running the
document workflow first when no architecture doc exists.
Skill sources live in top-level skills/ and are referenced declaratively
from plugins/arch/.github/plugin/plugin.json, per the repo's plugin model.
Regenerated docs/README.plugins.md, docs/README.skills.md and marketplace.json.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Merge arch skills into single doc-and-modernize skill
Collapse the document and modernize skills into one standalone skill
(doc-and-modernize) with Documentation and Modernization modes, keeping
the plugin named arch. Modernization mode now runs the Documentation
workflow inline instead of invoking a separate arch:document skill,
fixing standalone-install cross-skill references. Reframe Documentation
mode as local-first (remote/API lookups are a flagged last resort)
rather than local-only. Regenerate docs and marketplace.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address PR review: list skill by bare ID in arch README
Use 'doc-and-modernize' (repo convention) instead of the namespaced
'arch:doc-and-modernize', noting it surfaces as arch:doc-and-modernize
when installed via the plugin.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address PR review: use non-HTML placeholder in instructions template
Change plain-text <PROJECT NAME> to [PROJECT NAME] in the header and
first paragraph so Markdown renderers don't parse it as an HTML tag and
drop it. The code-span `<N>` on the phase line is unaffected.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address PR review + fix codespell CI failure
- Fix codespell: pre-empts -> preempts in the instructions template
- Consistent terminology: replace 'research step/workflow' with
'Documentation mode' in SKILL.md, README, and plugin.json description
- Fix run-on: add 'that' before 'Modernization mode must surface'
- Regenerate docs/marketplace for the updated plugin description
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address PR review feedback
- Instruct redacting credentials/tokens from git remote URLs before recording
- CI enforcement: ask user or mark [UNVERIFIED]; remote lookup is flagged last resort
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: samqbush <samqbush@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add Tiny Tool Town submission canvas
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Add generated description choices
Resolve picker opens from the active session working directory so linked worktrees work without an explicit repository path.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address Tiny Tool review comments
Detect root .csproj files as build signals and hide canvas access tokens from the visible URL after first load.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address latest Tiny Tool review comments
Handle root-relative README images, preserve drafts during refresh, and suppress GitHub mentions before public issue creation.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address canvas shutdown and CSP review
Close all canvas servers during shutdown, use nonce-based CSP, make theme optional, and hide decorative preview dots from assistive tech.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Remove pluginRoots property from marketplace.json
The pluginRoots property is not used by install tooling and was only
informational about the extension/plugin source directories. Removing it
simplifies the marketplace.json structure while maintaining all functionality.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Migrate java-modernization-studio to plugin.json and update validation workflow
- Create .github/plugin/plugin.json for java-modernization-studio extension
- Remove legacy canvas.json from java-modernization-studio
- Update validate-canvas-extensions.yml workflow to check for plugin.json instead of canvas.json
- Update workflow to trigger on .schemas/plugin.schema.json changes (instead of canvas.schema.json)
- Remove schema validation logic that relied on canvas.schema.json
- All 12 extensions now use plugin.json for metadata
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Add extensions field to all extension plugin.json files
Per https://github.com/github/copilot-agent-runtime/pull/9929, plugins that ship
extensions need to include an extensions field specifying where the extension code
is located. All 12 extensions now have extensions set to '.' to reference the
current directory where extension.mjs is located.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Enforce convention-based extension metadata and remove x-awesome-copilot
- Remove x-awesome-copilot.screenshots from all extension plugin.json files
- Enforce logo=assets/preview.png convention for all extensions
- Enforce extensions=. per copilot-agent-runtime#9929
- Update validate-plugins.mjs to enforce conventions
- Update validate-canvas-extensions.yml workflow with convention checks
- Update AGENTS.md and CONTRIBUTING.md documentation
All 12 extensions validated successfully.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Use standard plugin validation for extensions
Remove the custom extension schema and schema validation helper, and
validate extension plugin.json files through the existing plugin validator
instead. Update workflows to stop depending on the removed schema.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Reframe the external catalog entry to reflect the plugin's polyglot
test-generation pipeline (.NET/C#, Python, TypeScript/JavaScript, Java, Go,
Ruby, Rust, C++, Kotlin, Swift, PowerShell) and add polyglot keywords so
non-.NET developers can discover it. Mirrors the dotnet/skills 0.2.0 bump.
Edits the source (plugins/external.json) and regenerates the generated
.github/plugin/marketplace.json via npm run build. source stays unpinned
(tracks main), so no behavior change.
* chore(deps, docs): bump marketplace version to 1.46.0
- Refine execution priority guidance in agent documentation
- Imrpvoe discovery guidance
- Improve context cache guidance
- Add script usage guidelines to agent documentation
- Simplify agent input references
* feat: bump marketplace version to 1.47.0 and enhance agent workflows
- Add Bug‑Fix Mode with validation gate for `debugger_diagnosis` tasks
- Expand allowed task types to include `research`
- Reduce subagent concurrency limit from 4 to 2
- Update design validation handling for flagged tasks
- Update marketplace plugin version reference to 1.47.0
* chore: bump marketplace version to 1.48.0 and refine agent context envelope workflow documentation
- Enhance the Init section in gem-browser-tester.agent.md, gem-code-simplifier.agent.md, and gem-critic.agent.md with detailed context envelope handling, active context treatment, and reuse_notes trust/verification logic.
- Add explicit steps for safe assumption, verification before use, and controlled re‑reading of context notes.
* chore: refine verification of symbol usages before modifying shared components
* chore(marketplace): bump version to 1.50.0; refactor(gem-browser-tester): simplify workflow steps
* chore(docs): simplify Phase 0 task classification and streamline initialization
* chore: Merges teps for batching
* feat: Enhcanc esuport for trivial/ low complex tasks
* chore: bump version to 1.56.0 and add config settings for visual regression, devops approvals, and orchestrator complexity
* chore: fix toc links
* chore: Remove emojis from headings
* chore: Update readme
* chore: Enforce orchestration
* chore: clarify orchestrator role and bump version to 1.59.0
* chore: bump version to 1.61.0 and refine agent documentation
* chore: bump version to 1.62.0 and refine agent documentation
* chore: bump version to 1.63.0 and add mandatory rules notice to all agent documentation files
* chore: Improve batching instructions
- bump version to 1.64.0
* chore: refactor gem-planner agent definition and JSON output to remove redundant fields and simplify structure
* chore: bump marketplace version to 1.66.0 and refactor gem-planner plan format, update agent documentation to clarify reuse_notes and simplify structures
* aws plugin and adding few more aws agents
* updating the agent def
* fixed around skill validator results.
---------
Co-authored-by: Preyas Prakasan <preyasprakasan@Preyass-MacBook-Pro.local>
* chore(deps, docs): bump marketplace version to 1.46.0
- Refine execution priority guidance in agent documentation
- Imrpvoe discovery guidance
- Improve context cache guidance
- Add script usage guidelines to agent documentation
- Simplify agent input references
* feat: bump marketplace version to 1.47.0 and enhance agent workflows
- Add Bug‑Fix Mode with validation gate for `debugger_diagnosis` tasks
- Expand allowed task types to include `research`
- Reduce subagent concurrency limit from 4 to 2
- Update design validation handling for flagged tasks
- Update marketplace plugin version reference to 1.47.0
* chore: bump marketplace version to 1.48.0 and refine agent context envelope workflow documentation
- Enhance the Init section in gem-browser-tester.agent.md, gem-code-simplifier.agent.md, and gem-critic.agent.md with detailed context envelope handling, active context treatment, and reuse_notes trust/verification logic.
- Add explicit steps for safe assumption, verification before use, and controlled re‑reading of context notes.
* chore: refine verification of symbol usages before modifying shared components
* chore(marketplace): bump version to 1.50.0; refactor(gem-browser-tester): simplify workflow steps
* chore(docs): simplify Phase 0 task classification and streamline initialization
* chore: Merges teps for batching
* feat: Enhcanc esuport for trivial/ low complex tasks
* chore: bump version to 1.56.0 and add config settings for visual regression, devops approvals, and orchestrator complexity
* chore: fix toc links
* chore: Remove emojis from headings
* chore: Update readme
* chore: Enforce orchestration
* chore: clarify orchestrator role and bump version to 1.59.0
* chore: bump version to 1.61.0 and refine agent documentation
* fix(pm-skills): use plain tag name for ref, not refs/tags/
`apm install pm-skills@awesome-copilot` invokes `git clone --depth=1 --branch=<ref>` against the source repo. `git clone --branch` rejects `refs/tags/v2.1.0` ("Remote branch not found in upstream origin") and only accepts the plain tag name.
Matches the convention used by the other entries in this file - `chrome-devtools-plugin` uses `chrome-devtools-mcp-v1.0.1`, `ai-ready` uses a SHA. `pm-skills` was the only entry with the `refs/tags/` prefix, inherited from the placeholder example in the external-plugin issue form.
Tested locally: with the fix applied, `apm install pm-skills@awesome-copilot --target claude` resolves cleanly (12 skills + MCP server + 2 hooks integrated).
Original submission: github/awesome-copilot#1767 / github/awesome-copilot#1770
* fix: regenerate marketplace.json after pm-skills ref fix
The previous force-push (7fbf75a) updated plugins/external.json only.
.github/plugin/marketplace.json is a derived artifact regenerated by
`npm start` and must be kept in sync. The Validate README.md workflow
detected the mismatch and failed.
Ran `npm ci && npm start` locally; produces a single 1-line update to
marketplace.json matching the plugins/external.json change.
* Add visual-pr plugin: screenshot capture, annotation, PR embedding, and screen recording
Four skills that teach Copilot to capture UI screenshots (Playwright + PIL),
annotate them with algorithmic label placement, embed before/after images
in PR descriptions, and record animated GIF demos.
Includes demo images showing the annotation engine on GitHub Issues.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Update generated README tables and marketplace.json
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Embed annotate.py module in image-annotations skill
The full working module (annotate_image, grid_image, diff_images) is now
included as a code block so users can save it as annotate.py and import
directly. Scrubbed project-specific labels from examples.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address review feedback: mss.mss() context manager, fix RECT struct, consistent placeholder
- Use mss.mss() context manager instead of mss.MSS() (ui-screenshots, screen-recording)
- Fix broken RECT struct in window+GIF combining example (screen-recording)
- Consistent projectId placeholder in AzDO upload example (pr-screenshots)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fixing path on chrome devtools external pluginPath is to the folder in the repo where the plugin structure starts, not where the plugin.json file lives.
* Updating validation scripts and guidance to avoid this mistake again
Adds a skill that lets users generate images (icons, sprites, textures,
mockups) directly from their coding workflow using OpenAI gpt-image-2 or
Google Gemini. BYO API key — the skill guides users through setup on
first use.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
github-actions[bot]
Andrea Liliana Griffiths
Aaron Powell
samqbush
Muhammad Ubaid Raza
James Montemagno
David Gilbert
David Gilbert
Ari LiVigni ContinuousG33k
Petr Pokorny
Sanyam
Florian Vogt
Sophio Japharidze
Preyas Prakasan
Sanyam Vipul Savla
Parth Sangani
Antonio Villanueva
Jakub Jareš
Adam
Jaylyn Barbee