Merge pull request #46107 from github/repo-sync

Repo sync

Author: docs-bot

.github/workflows/check-for-non-english.yml

@@ -0,0 +1,87 @@
+name: Check for non-English titles
+
+# **What it does**: Closes issues/PRs whose title contains non-Latin-script
+#   characters, which is a common pattern for spam/scam submissions (e.g.
+#   fake certificate/badge issues written in Arabic, Cyrillic, CJK, etc.)
+# **Why we have it**: We get spam in the open-source repo with titles in
+#   scripts our triage team can't read, making it hard to evaluate intent.
+# **Who does it impact**: Open-source contributors.
+
+on:
+  issues:
+    types: [opened]
+  pull_request_target:
+    types: [opened]
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+jobs:
+  non-english-title-check:
+    name: Flag and close non-English titles
+    if: github.repository == 'github/docs'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3
+        with:
+          github-token: ${{ secrets.DOCS_BOT_PAT_BASE }}
+          script: |
+            const isIssue = !!context.payload.issue
+            const item = context.payload.issue || context.payload.pull_request
+            const owner = 'github'
+            const repo = 'docs'
+            const title = item.title || ''
+
+            // Allow: basic Latin letters/digits/punctuation, common symbols,
+            // and emoji (surrogate pairs), so normal English titles pass.
+            // Flag titles containing letters from non-Latin scripts
+            // (Arabic, CJK, Cyrillic, Devanagari, Hebrew, Thai, etc.)
+            const nonLatinScriptRegex = /(?!\p{Script=Latin})\p{Letter}/u
+
+            if (!nonLatinScriptRegex.test(title)) {
+              return
+            }
+
+            try {
+              await github.rest.teams.getMembershipForUserInOrg({
+                org: 'github',
+                team_slug: 'employees',
+                username: context.payload.sender.login,
+              })
+              // Don't action GitHub employees
+              return
+            } catch (err) {
+              // Not an employee — continue
+            }
+
+            const commentBody =
+              `Thanks for your contribution! It looks like the title of this ${isIssue ? 'issue' : 'pull request'} contains non-English characters. ` +
+              `To help our team triage effectively, please resubmit with an English-language title describing the change or problem. ` +
+              `I'm closing this for now, but feel free to open a new one!`
+
+            if (isIssue) {
+              await github.rest.issues.update({
+                owner, repo,
+                issue_number: item.number,
+                labels: ['invalid'],
+                state: 'closed',
+              })
+              await github.rest.issues.createComment({
+                owner, repo,
+                issue_number: item.number,
+                body: commentBody,
+              })
+            } else {
+              await github.rest.pulls.update({
+                owner, repo,
+                pull_number: item.number,
+                state: 'closed',
+              })
+              await github.rest.issues.createComment({
+                owner, repo,
+                issue_number: item.number,
+                body: commentBody,
+              })
+            }

.github/workflows/check-for-spammy-prs.yml

@@ -6,7 +6,7 @@ name: Check for Spammy PRs
 
 on:
   pull_request_target:
-    types: [opened]
+    types: [opened, edited, reopened, synchronize]
 
 permissions:
   contents: read

.github/workflows/triage-unallowed-contributions.yml

@@ -19,6 +19,7 @@ jobs:
         github.repository == 'github/docs' &&
         github.event.pull_request.user.login != 'docs-bot' &&
         github.event.pull_request.user.login != 'dependabot[bot]'
+        && !contains(github.event.pull_request.labels.*.name, 'skip-unallowed-check')
       }}
     runs-on: ubuntu-latest
     steps:

content/copilot/reference/copilot-cli-reference/cli-command-reference.md

@@ -28,8 +28,8 @@ You can use the following commands in the terminal to manage plugins for {% data
 | `copilot plugin uninstall NAME` (aliases `remove`, `rm`) | Remove a plugin |
 | `copilot plugin list`                          | List installed plugins |
 | `copilot plugin update NAME`                   | Update a named plugin. Use `--all` to update all installed plugins at once. |
-| `copilot plugin enable NAME`                   | Enable a previously disabled plugin |
-| `copilot plugin disable NAME`                  | Disable a plugin without uninstalling it |
+| `copilot plugin enable NAME`                   | Enable a previously disabled plugin. The change persists to configuration and applies to future sessions. This works for marketplace installs and direct installs (from `owner/repo`, a URL, or a local path) alike. |
+| `copilot plugin disable NAME`                  | Disable a plugin without uninstalling it. A `--plugin-dir` mount stays read-only since it has no persisted activation to change. |
 | `copilot plugin marketplace add SPECIFICATION` | Register a marketplace. The marketplace's own name, from its `marketplace.json` manifest, becomes its registration key—there is no option to set a custom local name. |
 | `copilot plugin marketplace list`              | List registered marketplaces |
 | `copilot plugin marketplace browse NAME`       | Browse marketplace plugins |
@@ -111,9 +111,9 @@ In interactive mode, run `/plugin marketplace update [NAME]` (alias `/plugin mar
 
 ## `plugin.json`
 
-All plugins consist of a plugin directory containing a manifest file named `plugin.json`. Agent Plugins 1.0 requires the manifest at the plugin root. Legacy plugins support the alternative locations listed in [File locations](#file-locations). See [AUTOTITLE](/copilot/how-tos/copilot-cli/customize-copilot/plugins-creating).
+All plugins consist of a plugin directory containing a manifest file named `plugin.json`. Agent Plugins requires the manifest at the plugin root. A root `plugin.json` that targets Agent Plugins takes precedence over `.plugin/plugin.json` and `.claude-plugin/plugin.json` per spec §5.1. Legacy plugins support the alternative locations listed in [File locations](#file-locations). See [AUTOTITLE](/copilot/how-tos/copilot-cli/customize-copilot/plugins-creating).
 
-{% data variables.copilot.copilot_cli_short %} supports both the legacy plugin manifest and the Agent Plugins 1.0 manifest. The exact `$schema` value `https://agent-plugins.org/schemas/1.0.0/plugin.schema.json` opts a plugin into Agent Plugins 1.0 semantics. A manifest without this value uses the legacy format and loads as before.
+{% data variables.copilot.copilot_cli_short %} supports both the legacy plugin manifest and the Agent Plugins manifest. {% data variables.copilot.copilot_cli_short %} recognizes the canonical `$schema` values for Agent Plugins (Open Plugin Spec) v1.0.0 (`https://agent-plugins.org/schemas/1.0.0/plugin.schema.json`) and v1.1.0 (`https://agent-plugins.org/schemas/1.1.0/plugin.schema.json`), opting a plugin into Agent Plugins semantics. A manifest without one of these exact values uses the legacy format and loads as before. If a plugin declares an Agent Plugins version that {% data variables.copilot.copilot_cli_short %} doesn't support, the CLI rejects the plugin instead of silently falling back to legacy mode. A rejected plugin contributes no hooks, LSP servers, MCP servers, skills, commands, agents, rules, or extension directories.
 
 ### Agent Plugins 1.0 manifest fields
 
@@ -123,7 +123,7 @@ The following fields are allowed:
 
 | Field         | Type     | Required | Description |
 |---------------|----------|----------|-------------|
-| `$schema`     | string   | Yes | Must be `https://agent-plugins.org/schemas/1.0.0/plugin.schema.json`. |
+| `$schema`     | string   | Yes | Must be a recognized Agent Plugins `$schema` URL (v1.0.0 or v1.1.0). Unsupported Agent Plugins versions are rejected. |
 | `name`        | string   | Yes | Plugin name. See [Name constraints](#name-constraints). |
 | `version`     | string   | No | Version string. Semantic Versioning is recommended. |
 | `description` | string   | No | Brief description. |
@@ -152,9 +152,9 @@ Agent Plugins 1.0 defines two portable component types:
 * Skills in immediate subdirectories of `skills/` that contain a `SKILL.md` file.
 * MCP servers in `mcp.json` at the plugin root.
 
-These locations are fixed and cannot be configured in `plugin.json`. The root `mcp.json` must declare `https://agent-plugins.org/schemas/1.0.0/mcp.schema.json` in its `$schema` field. The CLI accepts `stdio`, `streamable-http`, and `sse` MCP transport names.
+These locations are fixed and cannot be configured in `plugin.json`. Skills load only from `skills/`—there is no root `SKILL.md` fallback (legacy plugins fall back to a root `SKILL.md` when no `skills/` directory exists). The root `mcp.json` must declare a recognized Agent Plugins `$schema` version (matching the same version as `plugin.json`) in its `$schema` field. The top-level envelope is closed, and each server entry is validated against its transport schema; invalid server entries are skipped individually while valid entries still load. The CLI accepts `stdio`, `streamable-http`, and `sse` MCP transport names.
 
-For `stdio` servers, the CLI provides `PLUGIN_ROOT` and `PLUGIN_DATA` in the subprocess environment. It expands `${PLUGIN_ROOT}` and `${PLUGIN_DATA}` in the server's `args`, `env` values, and `cwd`. `PLUGIN_DATA` points to a persistent, writable directory for the installed plugin.
+For `stdio` servers, the CLI provides `PLUGIN_ROOT` and `PLUGIN_DATA` in the subprocess environment. It expands `${PLUGIN_ROOT}` and `${PLUGIN_DATA}` (plus the `CLAUDE_PLUGIN_DATA` and `COPILOT_PLUGIN_DATA` aliases) in the server's `args`, `env` values, and `cwd`. `PLUGIN_DATA` points to a persistent, writable directory for the installed plugin. Remote `http`, `sse`, and `streamable-http` server config values are passed through literally, with no placeholder or environment-variable expansion.
 
 Agent Plugins 1.0 does not define portable agents, hooks, commands, rules, or LSP servers. These remain client-specific. Client-specific manifest data belongs in `extensions`, keyed by reverse-domain namespace. Client-specific files belong in a top-level directory with the same namespace. Clients ignore namespaces they do not support.
 
@@ -367,12 +367,12 @@ Both the `github` and `url` source types accept an optional `sha` field to pin i
 |----------------------|------|
 | Installed plugins    | `~/.copilot/installed-plugins/MARKETPLACE/PLUGIN-NAME` (installed via a marketplace) and `~/.copilot/installed-plugins/_direct/SOURCE-ID/` (installed directly) |
 | Marketplace cache    | Platform cache directory: `~/.cache/copilot/marketplaces/` (Linux), `~/Library/Caches/copilot/marketplaces/` (macOS). Overridable with `COPILOT_CACHE_HOME`. |
-| Plugin manifest      | Agent Plugins 1.0: `plugin.json` at the plugin root. Legacy plugins: `.plugin/plugin.json`, `plugin.json`, `.github/plugin/plugin.json`, or `.claude-plugin/plugin.json` (checked in this order). |
+| Plugin manifest      | Agent Plugins (v1.0.0 or v1.1.0): `plugin.json` at the plugin root. A root manifest targeting Agent Plugins takes precedence over `.plugin/plugin.json` and `.claude-plugin/plugin.json` per spec §5.1. Legacy plugins: `.plugin/plugin.json`, `plugin.json`, `.github/plugin/plugin.json`, or `.claude-plugin/plugin.json` (checked in this order). |
 | Marketplace manifest | `marketplace.json`, `.plugin/marketplace.json`, `.github/plugin/marketplace.json`, or `.claude-plugin/marketplace.json` (checked in this order) |
 | Agents               | Legacy plugins: `agents/` (default, overridable in manifest). |
-| Skills               | Agent Plugins 1.0: `skills/` (fixed). Legacy plugins: `skills/` (default, overridable in manifest). |
+| Skills               | Agent Plugins: `skills/` (fixed, no root `SKILL.md` fallback). Legacy plugins: `skills/` (default, overridable in manifest), falling back to a root `SKILL.md` when no `skills/` directory exists. |
 | Hooks configuration  | Legacy plugins: `hooks.json` or `hooks/hooks.json`. |
-| MCP configuration    | Agent Plugins 1.0: `mcp.json`. Legacy plugins: `.mcp.json`, `.github/mcp.json`, or the `mcpServers` manifest field. |
+| MCP configuration    | Agent Plugins: `mcp.json`. Legacy plugins: `.mcp.json`, `.github/mcp.json`, or the `mcpServers` manifest field. |
 | LSP configuration    | Legacy plugins: `lsp.json` or `.github/lsp.json`. |
 | Plugin data          | For Agent Plugins 1.0 MCP servers, `${PLUGIN_DATA}` (also available as `${COPILOT_PLUGIN_DATA}` and `${CLAUDE_PLUGIN_DATA}`) points to a persistent, writable directory unique to each installed plugin. Use this for plugin-specific runtime data instead of paths inside the installed-plugins cache directory. |
 

content/copilot/reference/copilot-cli-reference/cli-config-dir-reference.md

@@ -290,6 +290,18 @@ Each hook event delivers a JSON payload to the hook handler. Two payload formats
 }
 ```
 
+**Output:**
+
+```typescript
+{
+    additionalContext?: string;
+}
+```
+
+Only `additionalContext` is consumed for `sessionStart` (command and HTTP variants). Return `{}` or empty for no action.
+
+When multiple `sessionStart` hooks run, successful hooks that return a non-empty string `additionalContext` contribute in execution order, separated by exactly `"\n\n"`. An empty or whitespace-only string does not erase already-accumulated context; if every hook returns only empty or whitespace-only strings, the last one is kept. The combined string (including separators) is bounded by the same 10 MiB hook-output limit—a contribution that would cross it is dropped, the previously accumulated context is kept, and a size-only warning is logged and raised in the session.
+
 ### `sessionEnd` / `SessionEnd`
 
 > [!NOTE]
@@ -551,6 +563,20 @@ Tools with no Claude equivalent keep their runtime names.
 }
 ```
 
+**Output:**
+
+```typescript
+{
+    additionalContext?: string;
+}
+```
+
+If `additionalContext` is returned, it is prepended to the subagent's first user message, giving hooks a way to inject project-specific context, policies, or instructions into every subagent invocation.
+
+When multiple `subagentStart` hooks run, they accumulate the same way as `sessionStart`: successful hooks with a non-empty string `additionalContext` contribute in execution order joined by `"\n\n"`, empty or whitespace-only strings don't erase already-accumulated context, and the combined string is bounded by the 10 MiB hook-output limit (an over-limit contribution is dropped, the prior context is kept, and a size-only warning is logged and raised in the session).
+
+**Matcher:** Supports an optional `matcher` field that filters by agent name. The value is treated as a regular expression wrapped as `^(?:matcher)$` and tested against `agentName`. The pattern must match the **entire** agent name, not just a substring. If the pattern is not a valid regular expression, the hook is skipped entirely (it will not fire for any agent).
+
 ### `subagentStop` / `SubagentStop`
 
 Fires when a subagent completes normally, before returning results to the parent. `stopReason` is currently always `"end_turn"`. This hook fires before large-response spill handling, so `response` (or `last_assistant_message` in the {% data variables.product.prodname_vscode_shortname %} compatible format) carries the full final subagent response text.

content/copilot/reference/copilot-cli-reference/cli-plugin-reference.md

@@ -15,17 +15,12 @@ interface TocItem extends LinkData {
   childTocItems?: TocItem[]
 }
 
-/**
- * Recursively gathers all TOC items from a page and its descendants.
- * This mirrors the behavior of getTocItems() in the generic-toc middleware
- * but works with the page.children frontmatter property.
- */
+// Mirrors getTocItems() in src/frame/middleware/context/generic-toc.ts for frontmatter children.
 export async function getAllTocItems(
   page: Page,
   context: Context,
   options: {
-    /** Only recurse into children whose resolved path starts with this prefix.
-     *  Prevents cross-product traversal (e.g. /en/rest listing /enterprise-admin). */
+    // Prevents cross-product traversal, such as /en/rest listing /enterprise-admin.
     basePath?: string
   } = {},
 ): Promise<TocItem[]> {
@@ -41,8 +36,7 @@ export async function getAllTocItems(
   )
   const pathname = pagePermalink ? pagePermalink.href : `/${languageCode}`
 
-  // On the first call, set basePath to this page's path so recursion
-  // stays within the same product section.
+  // Keeps recursive children within the first page's product section.
   const basePath = options.basePath ?? pathname
 
   const resolvedChildren = pageWithChildren.children
@@ -69,7 +63,6 @@ export async function getAllTocItems(
 
       const category = childPage.category || []
 
-      // Only recurse if the child is within the same product section
       const withinSection = href.startsWith(basePath)
       const childTocItems =
         withinSection && childPage.children && childPage.children.length > 0
@@ -83,14 +76,10 @@ export async function getAllTocItems(
   return items
 }
 
-/**
- * Flattens nested TOC items into a single array.
- * Only includes leaf nodes (items without children) or all items based on options.
- */
 export function flattenTocItems(
   tocItems: TocItem[],
   options: {
-    excludeParents?: boolean // If true, only include items without children
+    excludeParents?: boolean
   } = {},
 ): LinkData[] {
   const { excludeParents = true } = options
@@ -101,9 +90,7 @@ export function flattenTocItems(
     for (const item of items) {
       const hasChildren = item.childTocItems && item.childTocItems.length > 0
 
-      // Include this item if it's a leaf or if we're including parents
-      // Deduplicate by href - needed when a page lists both individual
-      // articles and their parent group as children (e.g., bespoke landing pages)
+      // Bespoke landing pages can list both articles and their parent group.
       if (!hasChildren || !excludeParents) {
         if (!seen.has(item.href)) {
           seen.add(item.href)
@@ -125,13 +112,7 @@ export function flattenTocItems(
   return result
 }
 
-/**
- * Check whether a string contains markdown link syntax that would need
- * processing by the unified pipeline (e.g. link rewriting, AUTOTITLE).
- *
- * Use this to short-circuit expensive rendering when the text is
- * Liquid-only and contains no markdown that needs transformation.
- */
+// Liquid-only properties can skip the full unified pipeline.
 function hasMarkdownLinks(text: string): boolean {
   return text.includes('[') && text.includes('](/')
 }
@@ -141,11 +122,7 @@ const RAW_PROP_MAP = {
   intro: 'rawIntro',
 } as const
 
-/**
- * Fast-path rendering for page properties. Renders Liquid only, skipping
- * the full unified pipeline. Falls back to page.renderProp() when the
- * Liquid output contains markdown links that need rewriting.
- */
+// Falls back to page.renderProp() when Liquid output still has markdown links.
 async function renderPropFast(
   page: PageWithChildren,
   prop: keyof typeof RAW_PROP_MAP,

content/copilot/reference/hooks-reference.md

@@ -1,14 +1,6 @@
 import type { Context, Page } from '@/types'
 import type { LinkData } from '@/article-api/transformers/types'
 
-/**
- * Resolves link data (title, href, intro) for a given href and page
- *
- * This helper is used by landing page transformers to build link lists.
- * It resolves the page from an href (relative or absolute), renders its title
- * and intro, and
- * returns the canonical permalink.
- */
 export async function getLinkData(
   href: string,
   languageCode: string,

src/article-api/lib/get-all-toc-items.ts

@@ -2,7 +2,6 @@ import type { Context, Page } from '@/types'
 import { renderContent } from '@/content-render/index'
 import matter from '@gr2m/gray-matter'
 
-// Returns the part of the page markdown before the auto-generated marker.
 export async function extractManualContent(page: Page, context: Context): Promise<string> {
   if (!page.markdown) return ''