CopilotAtelier
5.0.0-preview0015
Portable GitHub Copilot customization library. Ships custom agents, auto-applied instructions, on-demand skills, prompt templates, and lifecycle hooks, and installs them into the well-known ~/.copilot discovery folders that VS Code, the GitHub Copilot CLI, and Claude Code read.
Minimum PowerShell version
5.1
Installation Options
Owners
Copyright
(c) raandree. All rights reserved.
Package Details
Author(s)
- raandree
Tags
Copilot GitHubCopilot VSCode Agents Skills Prompts Instructions Hooks AI Windows Linux MacOS
Functions
Get-CopilotAtelierClientAdapter Get-CopilotAtelierFootprint Get-CopilotAtelierProfile Get-CopilotAtelierSkillHealth Get-CopilotAtelierVersion Install-CopilotAtelier Test-CopilotAtelier Uninstall-CopilotAtelier Update-CopilotAtelier
Dependencies
This module has no dependencies.
Release Notes
## [5.0.0-preview0015] - 2026-09-08
### Removed
- **The `.github/hooks` smoke-test probe, which had been failing on every turn since it was committed** (2026-09-02). `stop-probe.json` and `Test-HookLoaded.ps1` were scratch: a `Stop` hook that appended one line to `%TEMP%\workspace-hook-probe.log` to prove the workspace hook location loads at all. They answered that question on 2026-08-10 and the answer is written into [`com.github.copilot/hooks/README.md`](com.github.copilot/hooks/README.md) and the changelog entry below — the files themselves had no further job.
They were not merely idle. The `windows` override hardcoded `D:\Git\CopilotAtelier\.github\hooks\Test-HookLoaded.ps1`, the drive the repository sat on when the probe was written, and on Windows that override wins. Every turn on any other machine ended with *"The argument … to the -File parameter does not exist"*. The POSIX `command` was no better in principle: `./.github/hooks/Test-HookLoaded.ps1` is relative, and the same README says VS Code does not guarantee the working directory, which is why every shipped hook resolves its own path.
Nothing caught it because nothing looked. The `Hook configuration` suite in [`tests/Hooks.Tests.ps1`](tests/Hooks.Tests.ps1) — which asserts exactly this, that a hook command resolves to a script that exists and carries no shell-interpolated token — is scoped to `com.github.copilot/hooks/hooks.json`. A second hook file one directory away was outside every gate the repository owns. That suite now enumerates every tracked `*.json` sitting directly inside a folder named `hooks` and requires the shipped configuration to be the only one, so the next stray hook file fails the build instead of the chat. The guard was proven by planting one and watching it go red.
### Added
- Add `tools/plan-review`, an optional local review surface for a Design Concept: it renders the Markdown and its Mermaid diagrams, anchors comments to stable sections, and records a verdict against one specific revision hash. It is opt-in in the strong sense — it is absent from `CustomizationDirectory`, so the built module and a Gallery install never carry it; no PowerShell source references it; and its Node dependencies are installed explicitly by whoever wants the feature, never by an install, an update, or a validation run.
**A browser verdict is feedback, not sign-off, and the code says so rather than the documentation.** An HTTP request proves that something holding the session cookie and the CSRF token posted a content hash; it proves neither identity nor authority to start implementation. Every verdict is therefore persisted with `authority: "local-http-feedback"` beneath a store header of `approvalAuthority: "chat-sign-off-required"`, the header is repeated on the response and shown above the document, and there is no endpoint that writes a Decision record, triggers a handoff, or runs a command. A `--state` root resolving inside `.memory-bank/decisions` is refused at launch. The existing chat sign-off in the Software Architect workflow stays the only thing that authorizes implementation, and the agent body now says that where it points at the tool.
Revision hashes cover the original document bytes. Comments retain section identity; ambiguous duplicate headings require one exact content match and otherwise stay unanchored. **A section key is unique across the whole document**, not merely per heading slug: an occurrence ordinal on its own issues `risks-2` twice for `Risks`, `Risks`, `Risks 2`, and two sections sharing a key anchor a comment to the wrong heading. Section splitting follows the CommonMark fence rules, so a shorter fence nested inside a longer one cannot expose a fake heading and mis-anchor a comment. Verdict dialogs retain the document and revision they displayed, so a background refresh cannot approve newer content. Requests against stale hashes are refused with `409`, **and the hash is checked a second time inside the serialized store write** — a file edited while the request waits for the lock is refused rather than approved for the bytes it no longer has. The source is read once more after the commit, so a change landing in that last window is reported as `superseded` instead of being presented as current approval.
Loopback binding is treated as a reachability reduction, not an authorization boundary. A non-loopback bind address is refused outright, and the allowed authority follows the address actually bound, so `::1` produces `[::1]:<port>` rather than a hard-coded `127.0.0.1`. Every request must carry a `Host` matching the bound authority; every mutation must additionally carry the exact server `Origin`, a `Sec-Fetch-Site` of `same-origin` or `none` when the browser sends one, a JSON content type, the per-launch session cookie, and a matching `X-CSRF-Token`. The session secret is generated per launch and never persisted, so a cookie minted by an earlier server is rejected by the next one even when it reuses the same feedback store. **Because cookies are scoped by host and not by port, the cookie name carries a per-launch identifier**: opening a second review server in the same browser no longer signs the first one out, and neither server accepts the other's cookie.
Documents are authorized at launch and addressed on the wire by an opaque sixteen-character identifier, so no request parameter ever names a path. There is no directory listing, no URL fetcher, no shell endpoint, and no generic static handler — vendor assets come from an exact filename allow-list mapped onto `node_modules`. Every path is realpath-resolved, required to sit inside the declared root, and rejected when any ancestor from the root down is a symbolic link or junction, and the check runs again at read time rather than only at launch, so a link swapped in afterwards still fails.
Rendering disables raw HTML at the parser instead of filtering it afterwards: `markdown-it` runs with `html: false`, and DOMPurify then applies a tag, attribute, and URI allow-list that admits only `http`, `https`, and `mailto`. An image is never fetched — its alternative text is rendered instead, because an image is an implicit external load. Mermaid runs client-side with `securityLevel: 'strict'` and its SVG is sanitized again before insertion. Responses carry `Content-Security-Policy: default-src 'none'` with `script-src 'self'` and no `unsafe-eval`. The page's own stylesheet, script, and vendor bundles are snapshotted at launch and served from memory, so an asset deleted or swapped afterwards can neither change what the page runs nor leave a request hanging on a broken read.
Bodies cap at 64 KiB, comment text at 4000 characters, notes at 2000, comments at 200 per document, and documents at 1 MiB. The store is read under a 2 MiB byte bound and fully validated — schema, document identity, every comment field, and the verdict, including its `authority`, which a stored file can therefore never use to promote itself to sign-off, and every hash, which must be a lowercase SHA-256 digest rather than any bounded string. **The write path enforces the same byte bound on the serialized UTF-8 payload**, because the count and length bounds do not imply it: 4000 characters of multibyte text cost up to three bytes each, so 200 legal comments could otherwise produce a file the next read refuses. A write that would cross the bound is refused as `store-capacity` before the temporary file exists, and the stored feedback is left unchanged. **A store file that fails any of those checks is reported and left byte-for-byte intact, and the next mutation is refused rather than overwriting somebody's pending review**; recovery is a deliberate act by the operator. The exclusive write lock records its owning process: a lock held by a live process is waited on and then refused, a lock is reclaimed only when its named owner is provably gone, the reclaim removes the entries this tool wrote rather than deleting a directory tree it does not own, and a mutation that loses ownership refuses to commit. Server lifetime is bounded by `--ttl`, and `Ctrl+C`, the page's **Stop server** button, and the printed process id all stop it cleanly.
Add revision-scoped draft recovery, retryable connection errors, an authorized-document selector, and wrapping mobile status text. A draft written against a revision or a section that is no longer current is never re-attached to new content: it is listed under *Unsent drafts from an earlier revision* with the section and revision it was written on, for explicit discard, and a pending verdict note survives a stale refusal. Switching documents takes a request ticket, so a slow response for one document cannot render under another document's actions. The section outline is a disclosure that starts collapsed on a narrow viewport, and the permanent keyboard tutorial line is gone — the shortcuts remain, named in tooltips and announced to assistive technology. Apply input limits at launch and reload, reject invalid UTF-8, and reject linked feedback roots before reads or writes. Portable Node test commands and desktop/mobile browser regressions cover these boundaries. The ordinary repository gate runs dependency-free Node tests when Node is available and never installs npm dependencies.
Documented in [`docs/plan-review.md`](docs/plan-review.md), with the trust analysis in [`docs/plan-review-threat-model.md`](docs/plan-review-threat-model.md). Rollback is deletion: nothing else in the repository depends on it.
- Add read-only `Get-CopilotAtelierClientAdapter`, a thin compatibility adapter that reports how a Custom agent profile is composed for each supported Copilot client and, more importantly, what that client cannot do. The VS Code files under `com.github.copilot/agents` stay the only source of every shared workflow; the composed body is byte-identical, and only frontmatter is rewritten, so there is no second catalog to drift.
Discovery is not parity, and
FileList
- CopilotAtelier.nuspec
- skills\grill-me\SKILL.md
- skills\windows-gui-screenshot-capture\references\external-win32-executables.md
- skills\datum-configuration\references\datum-yml-reference.md
- CopilotAtelier.psm1
- skills\changed-file-validation\SKILL.md
- skills\windows-gui-screenshot-capture\scripts\WindowCapture.ps1
- skills\datum-configuration\references\common-tasks.md
- skills\send-outlook-email\SKILL.md
- skills\windows-gui-screenshot-capture\scripts\DialogCapture.ps1
- skills\datum-configuration\references\projectdagger-patterns.md
- CopilotAtelier.psd1
- skills\agent-evals\SKILL.md
- skills\german-tax-research\references\vorlagen.md
- skills\skill-creator\references\authoring-patterns.md
- keybindings\keybindings.json
- skills\elster-form-capture\SKILL.md
- skills\german-tax-research\references\belegaufforderung-antwort.md
- skills\skill-creator\references\scripts-and-evaluation.md
- skills\pester-patterns\notes-evals.md
- skills\mecm-dsc-deployment\SKILL.md
- skills\german-tax-research\references\vermietung-und-afa.md
- skills\long-running-job-monitor\references\out-of-band-verification.md
- skills\pester-patterns\SKILL.md
- com.github.copilot\hooks\hooks.json
- skills\german-tax-research\references\kennzahlen.md
- skills\long-running-job-monitor\references\heartbeat-protocol.md
- skills\windows-gui-screenshot-capture\notes-evals.md
- com.github.copilot\hooks\README.md
- skills\german-tax-research\references\werbungskosten-und-abzuege.md
- skills\long-running-job-monitor\scripts\Start-JobHeartbeat.ps1
- skills\windows-gui-screenshot-capture\SKILL.md
- com.github.copilot\agents\tax-researcher.agent.md
- skills\german-tax-research\references\fristen-und-verfahren.md
- skills\long-running-job-monitor\scripts\Start-JobMonitor.ps1
- skills\german-tax-research\SKILL.md
- com.github.copilot\agents\software-engineer.agent.md
- skills\german-tax-research\scripts\Get-SteuerFrist.ps1
- skills\long-running-job-monitor\scripts\Start-DetachedPowerShell.ps1
- skills\memory-bank\notes-evals.md
- com.github.copilot\agents\spec-work-implementer.agent.md
- skills\memory-bank\evals\routing-cases.json
- skills\brand-logo-system\scripts\Export-BrandLogoSet.ps1
- skills\memory-bank\SKILL.md
- com.github.copilot\agents\career-coach.agent.md
- skills\memory-bank\scripts\Invoke-MemoryBankRoleMigration.ps1
- skills\authenticated-web-extraction\bootstrap\package.json
- skills\automatedlab-deployment\SKILL.md
- com.github.copilot\agents\technical-writer.agent.md
- skills\memory-bank\scripts\Invoke-MemoryBankRouteSelectionEval.ps1
- skills\marp-slide-overflow\references\overflow-detector.md
- skills\sampler-migration\SKILL.md
- com.github.copilot\agents\spec-completion-reviewer.agent.md
- skills\memory-bank\scripts\New-MemoryBankRoleMigrationPlan.ps1
- skills\marp-slide-overflow\references\png-verification.md
- skills\sampler-framework\SKILL.md
- com.github.copilot\agents\software-architect.agent.md
- skills\memory-bank\scripts\Test-MemoryBankHealth.ps1
- skills\marp-slide-overflow\references\speaker-note-guard.md
- skills\outlook-email-export\SKILL.md
- com.github.copilot\agents\research-analyst.agent.md
- skills\memory-bank\scripts\Initialize-MemoryBank.ps1
- skills\marp-slide-overflow\references\mermaid-prerender.md
- skills\xlsx-to-markdown\SKILL.md
- com.github.copilot\agents\training-writer.agent.md
- skills\memory-bank\scripts\Test-MemoryBankRouting.ps1
- skills\winrm-troubleshooting\references\post-restart-readiness.md
- skills\subagent-dispatch\SKILL.md
- com.github.copilot\agents\qc-inspector.agent.md
- skills\memory-bank\assets\role-record-migration-map.json
- skills\winrm-troubleshooting\references\advanced-diagnostics.md
- skills\whisper-pyannote-transcription\diarize.py
- com.github.copilot\agents\spec-completion-controller.agent.md
- skills\automatedlab-deployment\references\troubleshooting.md
- skills\evidence-package-assembly\scripts\merge-and-verify.py
- skills\whisper-pyannote-transcription\transcribe-segment.py
- com.github.copilot\agents\troubleshooter.agent.md
- skills\automatedlab-deployment\references\post-deployment-operations.md
- skills\evidence-package-assembly\scripts\Build-EvidencePackage.ps1
- skills\whisper-pyannote-transcription\transcribe.py
- com.github.copilot\agents\legal-researcher.agent.md
- skills\automatedlab-deployment\references\cmdlet-reference.md
- skills\changed-file-validation\evals\validation-cases.json
- skills\whisper-pyannote-transcription\SKILL.md
- com.github.copilot\agents\software-engineer-contoso.agent.md
- skills\automatedlab-deployment\references\vm-operations.md
- skills\changed-file-validation\scripts\Invoke-ChangedFileValidation.ps1
- skills\pswritehtml-reporting\SKILL.md
- com.github.copilot\agents\README.md
- skills\automatedlab-deployment\references\lab-management.md
- skills\changed-file-validation\scripts\Invoke-ChangedFileValidationWorker.ps1
- skills\reviewed-learning-inbox\SKILL.md
- com.github.copilot\agents\security-reviewer.agent.md
- skills\automatedlab-deployment\references\networking.md
- skills\changed-file-validation\scripts\ChangedFileValidationCommon.ps1
- skills\docx-to-markdown\SKILL.md
- com.github.copilot\agents\devops-training-writer.agent.md
- skills\automatedlab-deployment\references\roles-and-services.md
- skills\changed-file-validation\scripts\Clear-ChangedFileBatch.ps1
- skills\german-legal-research\SKILL.md
- com.github.copilot\commands\lab-deploy.prompt.md
- skills\sampler-framework\references\troubleshooting.md
- skills\changed-file-validation\scripts\Add-ChangedFile.ps1
- skills\pdf-to-markdown\SKILL.md
- com.github.copilot\commands\brand-logo.prompt.md
- skills\sampler-framework\references\dsc-datum.md
- skills\changed-file-validation\scripts\Get-ChangedFileBatch.ps1
- skills\microsoft-todo-tasks\SKILL.md
- com.github.copilot\commands\usage.prompt.md
- skills\sampler-framework\references\multi-module.md
- skills\agent-evals\references\eval-artifacts.md
- skills\sampler-build-debug\notes-evals.md
- com.github.copilot\commands\audit-case-file.prompt.md
- skills\sampler-framework\references\dependency-resolution.md
- skills\agent-evals\scripts\run-evals.ps1
- skills\sampler-build-debug\SKILL.md
- com.github.copilot\commands\pr-description.prompt.md
- skills\sampler-framework\references\vscode-integration.md
- skills\agent-evals\scripts\run-trigger-evals.ps1
- skills\doc-coauthoring\SKILL.md
- com.github.copilot\commands\refactor.prompt.md
- skills\sampler-framework\references\ci-cd-pipelines.md
- skills\agent-evals\assets\trigger-queries.pester-patterns.json
- skills\test-driven-development\notes-evals.md
- com.github.copilot\commands\complete-specifications.prompt.md
- skills\sampler-framework\references\build-yaml.md
- skills\agent-evals\assets\trigger-queries.elster-form-capture.json
- skills\test-driven-development\SKILL.md
- com.github.copilot\commands\export-emails.prompt.md
- skills\sampler-framework\references\community-files.md
- skills\agent-evals\assets\trigger-queries.test-driven-development.json
- skills\automatedlab-proxmox\notes-evals.md
- com.github.copilot\commands\module-scaffold.prompt.md
- skills\sampler-framework\references\module-manifest.md
- skills\agent-evals\assets\trigger-queries.sampler-build-debug.json
- skills\automatedlab-proxmox\SKILL.md
- com.github.copilot\commands\session-handoff.prompt.md
- skills\sampler-framework\references\custom-build-tasks.md
- skills\agent-evals\assets\trigger-queries.brand-logo-system.json
- skills\mcp-builder\SKILL.md
- com.github.copilot\commands\peer-review.prompt.md
- skills\sampler-framework\references\gitversion.md
- skills\agent-evals\assets\trigger-queries.sampler-migration.json
- skills\gilb-requirements-engineering\SKILL.md
- com.github.copilot\commands\sync-project-emails.prompt.md
- skills\sampler-framework\references\dependency-management.md
- skills\agent-evals\assets\evals.output.sample.json
- skills\debugging-and-error-recovery\notes-evals.md
- com.github.copilot\commands\deadline-action-handoff.prompt.md
- skills\sampler-framework\references\project-structure.md
- skills\agent-evals\assets\evals.sample.json
- skills\debugging-and-error-recovery\SKILL.md
- com.github.copilot\commands\code-review.prompt.md
- skills\sampler-framework\references\testing-patterns.md
- skills\agent-evals\assets\trigger-queries.copilot-usage-stats.json
- skills\social-signal-sweep\SKILL.md
- com.github.copilot\rules\changelog.instructions.md
- skills\sampler-framework\references\bootstrap.md
- skills\agent-evals\assets\trigger-queries.changed-file-validation.json
- skills\grammar-check\SKILL.md
- com.github.copilot\rules\yaml.instructions.md
- skills\sampler-framework\references\commands-reference.md
- skills\agent-evals\assets\trigger-queries.sample.json
- skills\copilot-usage-stats\SKILL.md
- com.github.copilot\rules\postflight.instructions.md
- skills\reviewed-learning-inbox\evals\candidate-cases.json
- skills\agent-evals\assets\trigger-queries.sampler-framework.json
- skills\datum-configuration\SKILL.md
- com.github.copilot\rules\json.instructions.md
- skills\reviewed-learning-inbox\scripts\New-LearningPromotionProposal.ps1
- skills\agent-evals\assets\trigger-queries.long-running-job-monitor.json
- skills\skill-creator\SKILL.md
- com.github.copilot\rules\preflight.instructions.md
- skills\reviewed-learning-inbox\scripts\Add-LearningCandidate.ps1
- skills\agent-evals\assets\trigger-queries.skill-creator.json
- skills\code-review-and-quality\notes-evals.md
- com.github.copilot\rules\ubiquitous-language.instructions.md
- skills\reviewed-learning-inbox\scripts\Get-LearningCandidate.ps1
- skills\agent-evals\assets\trigger-queries.reviewed-learning-inbox.json
- skills\code-review-and-quality\SKILL.md
- com.github.copilot\rules\csharp.instructions.md
- skills\reviewed-learning-inbox\scripts\Invoke-LearningPromotion.ps1
- skills\elster-form-capture\references\feldkarte-est.md
- skills\agent-security-review\SKILL.md
- com.github.copilot\rules\sampler.instructions.md
- skills\reviewed-learning-inbox\scripts\Set-LearningCandidateStatus.ps1
- com.github.copilot\hooks\scripts\Block-RemoteMutation.ps1
- skills\devils-advocate-review\SKILL.md
- com.github.copilot\rules\powershell.instructions.md
- skills\reviewed-learning-inbox\scripts\LearningInboxCommon.ps1
- com.github.copilot\hooks\scripts\Get-SessionElapsed.ps1
- skills\long-running-job-monitor\notes-evals.md
- com.github.copilot\rules\git.instructions.md
- skills\reviewed-learning-inbox\scripts\Remove-LearningCandidate.ps1
- com.github.copilot\hooks\scripts\Write-CompactionCheckpoint.ps1
- skills\long-running-job-monitor\SKILL.md
- com.github.copilot\rules\pester.instructions.md
- skills\sampler-build-debug\evals\evals.json
- com.github.copilot\hooks\scripts\Add-SessionContext.ps1
- skills\create-outlook-draft\SKILL.md
- com.github.copilot\rules\versioning.instructions.md
- skills\sampler-build-debug\references\wiki-commit-timeout.md
- com.github.copilot\hooks\scripts\Write-SessionClose.ps1
- skills\brand-logo-system\SKILL.md
- com.github.copilot\rules\azurepipelines.instructions.md
- skills\automatedlab-proxmox\references\evidence-and-readiness.md
- skills\sampler-build-debug\evals\grading\wiki-commit-timeout.md
- skills\authenticated-web-extraction\SKILL.md
- com.github.copilot\rules\markdown.instructions.md
- skills\automatedlab-proxmox\references\windows-sysprep.md
- skills\sampler-build-debug\evals\grading\wiki-incident.md
- skills\outlook-calendar-export\SKILL.md
- com.github.copilot\rules\copilot-authoring.instructions.md
- skills\automatedlab-proxmox\references\module-development.md
- skills\sampler-build-debug\evals\fixtures\wiki-commit-timeout.md
- skills\citation-integrity\SKILL.md
- com.github.copilot\rules\powershell-execution-safety.instructions.md
- skills\gilb-requirements-engineering\references\impact-estimation.md
- skills\sampler-build-debug\evals\files\wiki-incident.md
- skills\pandoc-docx-export\SKILL.md
- skills\pester-patterns\references\mocking-external-dependencies.md
- skills\gilb-requirements-engineering\references\evo-planning.md
- skills\authenticated-web-extraction\bootstrap\scripts\open.mjs
- skills\marp-slide-overflow\SKILL.md
- skills\pester-patterns\references\testing-powershell-constructs.md
- skills\gilb-requirements-engineering\references\spec-quality-control.md
- skills\authenticated-web-extraction\bootstrap\scripts\extract.mjs
- skills\winrm-troubleshooting\notes-evals.md
- skills\pester-patterns\references\migrating-pester-v4-to-v5.md
- skills\gilb-requirements-engineering\references\planguage-keywords.md
- skills\authenticated-web-extraction\bootstrap\tasks\dump-cookies.mjs
- skills\winrm-troubleshooting\SKILL.md
- skills\pester-patterns\scripts\Find-PesterV4Pattern.ps1
- skills\datum-configuration\references\dscworkshop-reference.md
- skills\authenticated-web-extraction\bootstrap\tasks\check-logins.mjs
- skills\evidence-package-assembly\SKILL.md
- skills\windows-gui-screenshot-capture\references\engine-recipes.md
- skills\dsc-troubleshooting\SKILL.md