mirror of
https://github.com/dotnet/skills.git
synced 2026-09-20 09:49:54 +08:00
eval-exec-opus48
6 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Abhitej John
|
ca1b47371f |
Add automated per-plugin versioning (NBGV) with /version-bump + weekly backstop (#813)
* Add automated per-plugin versioning (NBGV) with /version-bump + weekly backstop WHY Tools that surface skills (Copilot CLI, Claude Code, Codex, Cursor) read a plugin's version directly from its checked-in manifest. With no versioning discipline, a plugin's behavior can change while its advertised version stays flat, so clients never learn to re-pull, and there is no human-readable signal of what changed. We want correct, current versions in the repo with minimal manual work and without bloating the marketplace clone. WHAT - Per-plugin semantic versioning via Nerdbank.GitVersioning (NBGV). Each plugin owns a version.json whose pathFilters exclude the generated manifests and the version.json itself, so version height tracks real content changes only. - The computed version is materialized into the checked-in manifests (plugin.json and .codex-plugin/plugin.json) so every consumer reads a current value with no build step on their side. - eng/version/Sync-PluginVersions.ps1 is the single workhorse. It resolves the set of changed plugins from a git diff, computes each version with nbgv (predicting the squash-merge height for PRs), and either reports or stamps. AUTOMATIONS (two, low-touch by design) - /version-bump: an admin/maintainer comments the command on a PR and the affected plugins are stamped on the PR branch. Gated on collaborator permission (admin/write/maintain); forks are rejected before any privileged step. No other PRs are auto-modified. - weekly-version-sync: a Monday backstop (and workflow_dispatch) that stamps any drift on main, opens/updates a single bot PR, and explains the per-plugin reason. This self-heals anything that merged without a bump. We deliberately did NOT auto-edit contributor PRs or add a noisy advisory comment bot; maintainers stay in control and the signal stays clean. SECURITY (multi-model adversarial review: GPT-5.5 + Gemini 3.1 Pro) - Supply chain (High, both models): dotnet tool restore would have honored a nuget.config authored in the PR tree, letting an attacker remap the nbgv package source to a malicious feed and run code in the privileged contents:write context. Mitigated with a trusted eng/version/nuget.config (clear + nuget.org-only + packageSourceMapping), overlaid from main and used via --configfile so PR-supplied configs are ignored. No nuget.config is tracked in the repo today, so this path was genuinely exploitable. - TOCTOU (Medium): /version-bump now checks out the authorized head SHA rather than the mutable branch name; a racing push fails non-fast-forward, which is the safe outcome. - Injection: Set-ManifestVersion uses a MatchEvaluator (not a replacement string) so a "$"-bearing version cannot re-expand, plus a strict major.minor.patch guard that throws on a malformed base, leaving manifests untouched. - A base-only version.json bump (0.1 -> 0.2) is correctly detected and stamped. VERIFIED End-to-end against a real NBGV git harness: content-scoped predict, base-only bump -> x.y.0, docs-only -> [], weekly drift stamping, malformed-base guard, and --configfile restore (exit 0). actionlint passes on both workflows. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address Copilot review feedback - Add missing plugins/dotnet-test-migration/version.json so it participates in versioning (it was the only plugin without one; manifests are at 0.1.0). - CONTRIBUTING: the two manifests are not byte-identical; say the version is duplicated across two manifest files instead. - weekly-version-sync: include version.json in commit attribution so a base-only bump is explained rather than showing 'no attributable commits'. - Get-NbgvInfo: capture nbgv stderr and include it in the thrown error so CI failures are diagnosable, while keeping stdout clean for JSON parsing. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> |
||
|
Abhitej John
|
2ab3501158 |
Add .codex-plugin/plugin.json manifests for Codex CLI plugin install (#726)
The Codex CLI requires .codex-plugin/plugin.json as the plugin manifest entry point. Without it, 'codex plugin add' fails with 'missing plugin.json' even though the marketplace listing works. This adds .codex-plugin/plugin.json to all 14 plugin directories, with paths relative to the plugin root per the Codex docs. Also updates the agents marketplace to use dotnet-aspnetcore (per #711 rename) and adds missing dotnet-blazor and dotnet11 entries. Fixes #578 Fixes #724 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> |
||
|
Jan Krivanek
|
05aeb657e6 | Add license to agent files (#568) | ||
|
David Ortinau
|
c4b6819dda |
Add 7 core .NET MAUI development skills to dotnet-maui plugin (#456)
* Add 7 core .NET MAUI development skills to dotnet-maui plugin Add maui-shell-navigation, maui-collectionview, maui-data-binding, maui-dependency-injection, maui-app-lifecycle, maui-safe-area, and maui-theming skills with eval.yaml tests and reference docs. Update plugin.json, marketplace.json (both copies), and CODEOWNERS. Resolves #455 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix cross-skill references to non-existent skills Replace 10 dangling references to skills not in this repo (maui-deep-linking, maui-platform-invoke, maui-unit-testing, maui-maps, maui-animations, maui-accessibility, maui-app-icons-splash, maui-bootstrap-theme, maui-localization) with plain-English guidance or references to skills that exist in this PR. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix code correctness bugs and remaining cross-references Address PR review feedback and skeptic review findings: Code correctness: - Fix BackgroundColor="Primary" (XAML crash) → use {StaticResource Primary} - Fix MergedDictionaries.Clear() (nukes all styles) → remove-then-add pattern - Fix HorizontalStackLayout Fill (no effect) → use Grid with ColumnDefinitions - Fix AncestorType with ViewModel type → use ContentPage (visual element) - Fix Frame usage → replace with Border (recommended control) - Remove redundant MultiBinding StringFormat="{}{0}" - Fix OnStart reference → use CreateWindow for theme restore - Soften lifecycle OnStart/OnSleep characterization (compat shims, not absent) - Qualify ResourceDictionary code-behind requirement (only for x:Class) Cross-references: - Remove all remaining body-text refs to non-existent skills - Replace with Microsoft Learn doc links or generic guidance Eval: - Relax SafeAreaRegions assertion to accept SafeAreaEdges or SafeAreaRegions - Relax theming rubric for ResourceDictionary code-behind Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Restore Clear() theme pattern with clarifying comment The Clear()+Add() pattern is intentional — theme dictionaries are designed to be the only merged dictionaries in this architecture. Added comment explaining the assumption and what to do if non-theme dictionaries exist. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix second-pass review findings: API accuracy and eval robustness Code correctness: - ScrollView SafeAreaEdges="All" → "Container" (ScrollView only honors Container and None; All silently fails for keyboard avoidance) - DI CreateWindow example: add comment noting AppShell must be registered - AddHttpClient: add comment noting Microsoft.Extensions.Http NuGet required - MultiBinding: remove redundant StringFormat from reference doc (matches SKILL.md) - RelativeSource Self table: Path=Width → Path=WidthRequest (Width is read-only -1 before layout; WidthRequest is the correct bindable property) - CollectionView StackLayout warning: clarify it refers to BindableLayout on StackLayout vs CollectionView ItemsLayout types - SafeAreaEdges: fix "attached property" → "property" (it's a regular property) - ios:NavigationPage example: add xmlns comment for ios namespace Eval assertions: - DI Scoped regex: accept "doesn't"/"lacks"/"without" not just "no" - CollectionView ViewCell: match negation in either direction around ViewCell - Lifecycle events: require 3+ distinct events instead of any single one Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix final PR review comments - safe-area eval: tighten Container assertion to require SafeAreaEdges context - DI: merge #else fallback into single compilable #if block - lifecycle: behaviour → behavior (American English consistency) - theming: macOS Catalyst minimum 10.14 → 10.15 (Catalina required) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> |
||
|
Copilot
|
6face98ff6 |
Change agents and skills fields in plugin.json to array format for Claude Code CLI compatibility (#407)
* Initial plan * Remove agents string field from plugin.json and handle array format in parser Claude Code CLI validates `agents` as array-of-strings per its plugin manifest schema. Our plugin.json files had `"agents": "./agents/"` (a string), which caused "agents: Invalid input" validation errors on install. Remove the field from the 3 affected plugin.json files — agents are still discovered by convention from the `agents/` directory. Also make ParsePluginJson resilient to both string and array formats for forward-compatibility. Co-authored-by: ViktorHofer <7412651+ViktorHofer@users.noreply.github.com> * Remove `agents` string field from plugin.json for Claude Code CLI compatibility Co-authored-by: ViktorHofer <7412651+ViktorHofer@users.noreply.github.com> * Change agents field to array format in plugin.json, update validator to read array-first with string fallback Plugin.json files now declare agents as an array of file paths: "agents": ["./agents/foo.agent.md", "./agents/bar.agent.md"] ParsePluginJson reads the array first (preferred, Claude Code schema), falls back to a string path (legacy). PluginInfo gains an AgentPaths field. Validator and discovery use the array when present, else fall back to directory-based convention. Co-authored-by: ViktorHofer <7412651+ViktorHofer@users.noreply.github.com> * Simplify agents to directory-path array form ["./agents/"], handle directories in array entries Per Copilot CLI spec, agents field values are "Path(s) to agent directories" — no need to list individual files. Use ["./agents/"] to mirror how skills uses "./skills/". Updated validator and discovery to handle both directory and file entries in the array. Co-authored-by: ViktorHofer <7412651+ViktorHofer@users.noreply.github.com> * Delete .nuget/nuget.exe * Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Convert skills field to array format in plugin.json, update validator to handle both forms Co-authored-by: ViktorHofer <7412651+ViktorHofer@users.noreply.github.com> * Align AgentPaths null checks to use { Count: > 0 } pattern for consistency Co-authored-by: ViktorHofer <7412651+ViktorHofer@users.noreply.github.com> * Change `agents` and `skills` fields in plugin.json to array format for Claude Code CLI compatibility Co-authored-by: ViktorHofer <7412651+ViktorHofer@users.noreply.github.com> * Delete .nuget/nuget.exe * Consolidate SkillsPath/SkillPaths and AgentsPath/AgentPaths into single array fields Remove dual string/array fields from PluginInfo. The parser now normalizes legacy string values into single-element arrays, so all downstream code uses only SkillPaths and AgentPaths (IReadOnlyList<string>). This eliminates all array-vs-string fallback branching. Co-authored-by: ViktorHofer <7412651+ViktorHofer@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: ViktorHofer <7412651+ViktorHofer@users.noreply.github.com> Co-authored-by: Viktor Hofer <viktor.hofer@microsoft.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
Gerald Versluis
|
ebe71e2f06 |
Add dotnet-maui plugin with dotnet-maui-doctor skill (#199)
* Add dotnet-maui-doctor skill and refs Add a new .agents/skills/dotnet-maui-doctor skill bundle. Includes SKILL.md describing an autonomous workflow to detect and remediate .NET MAUI environment issues and platform-specific reference docs for installation commands, platform requirements, troubleshooting, Microsoft OpenJDK guidance, and a WorkloadDependencies discovery guide that pulls authoritative versions from NuGet. Documents validation/remediation steps for .NET SDK, workloads, JDK, Android SDK, Xcode, and Windows SDK (macOS/Windows/Linux) and includes a temporary recommendation to prefer Microsoft OpenJDK (JDK 21) until manifests are updated. * MAUI doesn't quite yet support dotnet run * Add dotnet-maui plugin and dotnet-maui-doctor skill Introduce the dotnet-maui plugin and move the dotnet-maui-doctor skill under plugins/ layout. Update marketplace, CODEOWNERS, and README accordingly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add comprehensive eval scenarios for dotnet-maui-doctor 10 scenarios covering: macOS/Linux/Windows setup, JDK vendor enforcement, workload update/repair guardrails, dynamic version discovery, JAVA_HOME misconception, Android SDK diagnosis, out-of-scope decline, and stale workload remediation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Refine eval scenarios: remove weak scenarios, fix overfitting Remove 'Resist hardcoding' (penalizes skill — baseline gives more useful direct answer) and 'Decline runtime bug' (skill makes agent refuse to help). Rework Android SDK scenario to test CI-oriented package discovery where baseline lacks knowledge. Replace vocabulary-level NuGet/API assertions with outcome-focused rubric items across all scenarios. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Remove hardcoded JDK version workarounds in favor of dynamic discovery Replace temporary JDK 21 workaround notes with guidance to use the version from WorkloadDependencies.json. Replace hardcoded JDK paths in troubleshooting.md with {VERSION} placeholders. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Improve eval scenarios: fix JAVA_HOME timeout, macOS tie, reduce overfitting - JAVA_HOME: rewrite prompt to request conceptual answer (prevents tool timeout) - macOS Xcode: add installation source guidance, remove equal-penalty assertion - Remove irrelevant workload update/repair assertions from 3 off-topic scenarios - Keep workload assertions in 5 scenarios where workload management is the topic Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Reframe JAVA_HOME scenario as prevent-harmful-action pattern Rewrite prompt from conceptual yes/no question (which the agent answered from wrong general knowledge without activating the skill) to a scenario where the user is about to apply incorrect Stack Overflow advice. This mirrors the successful workload guardrail pattern. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Reduce overfitting: rephrase assertions and rubric to be outcome-focused - Replace literal '--version' assertions with broader 'version|pin' pattern - Rephrase Xcode rubric from skill-specific source to version control risk - Rephrase version discovery rubric from 'NuGet API' to outcome-focused - Rephrase workload install rubric from '--version flag' to 'pinned version' Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Inline critical JAVA_HOME auto-detection guidance into SKILL.md The JAVA_HOME eval scenario scored poorly because the agent couldn't read the reference file (references/microsoft-openjdk.md) and fell back on general knowledge, which incorrectly says JAVA_HOME must be set. Changes: - Task 5: Add inline JAVA_HOME guidance with decision table showing that JAVA_HOME is NOT required and MAUI auto-detects JDK installations - Common Pitfalls: Add 'Unnecessary JAVA_HOME' entry with unset commands This ensures the agent knows JAVA_HOME is unnecessary even when reference files can't be loaded. File stays at 210 lines (limit: 500). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Inline JAVA_HOME auto-detection knowledge into SKILL.md Add JAVA_HOME guidance directly to Task 5, Task 9, and Common Pitfalls so the agent knows JAVA_HOME is not required even when reference files can't be read. Based on Redth's original microsoft-openjdk.md reference. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address code review feedback from Copilot - Fix cmd.exe syntax in installation-commands.md (use PowerShell $env:) - Replace hardcoded simulator device/runtime with placeholders - Add System.IO.Compression.FileSystem assembly load for PS 5.1 compat - Clarify workload reinstall example is macOS-specific (omit ios on Linux) - Replace hardcoded android-35 with $API_LEVEL placeholder Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address jonathanpeppers review feedback - Add Apple Developer login/2FA note for Xcode downloads - Fix Windows SDK detection: extract KitsRoot10 and version subkeys instead of dumping full registry (was outputting noise) - Replace manual NuGet API approach with dotnet workload search version CLI command for discovering workload versions - Reframe JAVA_HOME guidance: report as anomaly rather than prescribing unset/set commands (per jonathanpeppers recommendation) - Use $env:ProgramFiles instead of hardcoded C:\Program Files paths in PowerShell commands - Update SKILL.md to match: softer JAVA_HOME guidance, improved Windows SDK detection command Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address Redth review feedback - Remove Windows SDK detection commands — installed automatically via MAUI workload/VS Installer (per Redth recommendation) - Use dotnet workload search version --format json --take 1 for workload version discovery instead of NuGet search API (per both Redth and jonathanpeppers) - Update workload-dependencies-discovery.md Step 2 to match - Expand Android SDK detection with known filesystem paths instead of relying solely on environment variables Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Align eval rubric with reviewer feedback to reduce overfitting Replace technique-specific rubric items with outcome-focused criteria: - Replace PowerShell API query check with dotnet CLI discovery check - Replace manifest extraction check with workload-version-based discovery - Replace prescriptive version discovery with CLI/docs verification - Convert workload update/repair regex assertions to rubric criteria - Remove Invoke-RestMethod assertion (no longer using API queries) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Align JAVA_HOME guidance with reviewer consensus, add Xcode download expectations - Consistently use ⚠️ anomaly approach for non-Microsoft JAVA_HOME across microsoft-openjdk.md and troubleshooting.md (matching SKILL.md) - Remove contradictory Note in microsoft-openjdk.md that conflicted with table - Reframe unset commands as user's choice, not automatic action - Add Xcode download size (~12GB) and time expectations per Redth's feedback Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Update plugins/dotnet-maui/skills/dotnet-maui-doctor/references/workload-dependencies-discovery.md Co-authored-by: Jonathan Peppers <jonathan.peppers@gmail.com> * Update JDK example to version 21 per jonathanpeppers feedback Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: redth <jondick@gmail.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Jonathan Peppers <jonathan.peppers@gmail.com> |