CopilotAtelier
5.0.0-preview0003
Portable GitHub Copilot customization library. Ships custom agents, auto-applied instructions, on-demand skills, prompt templates, and lifecycle hooks, and installs them into the well-known ~/.copilot discovery folders that VS Code, the GitHub Copilot CLI, and Claude Code read.
Minimum PowerShell version
5.1
Installation Options
Owners
Copyright
(c) raandree. All rights reserved.
Package Details
Author(s)
- raandree
Tags
Copilot GitHubCopilot VSCode Agents Skills Prompts Instructions Hooks AI Windows Linux MacOS
Functions
Get-CopilotAtelierVersion Install-CopilotAtelier Update-CopilotAtelier
Dependencies
This module has no dependencies.
Release Notes
## [5.0.0-preview0003] - 2026-08-27
### Added
- **`software-engineer-contoso` — a corporate overlay on the Software Engineer agent** (2026-08-27). [`com.github.copilot/agents/software-engineer-contoso.agent.md`](com.github.copilot/agents/software-engineer-contoso.agent.md) carries the whole [`software-engineer.agent.md`](com.github.copilot/agents/software-engineer.agent.md) contract inline and then only tightens it: where the overlay is stricter it wins, where the base is silent the overlay governs, and where both are silent the stricter reading applies. It exists both as a usable agent for regulated work and as the copy-and-rename template for `software-engineer-<company>`.
Inheritance is by **inlining, not linking**, and the first attempt proved why. Modelled on `devops-training-writer` — which states its inheritance from `training-writer` in prose — the overlay originally opened with a Markdown link to its base and the sentence "read it as part of your operating instructions". Nothing was inherited. VS Code resolves referenced *instructions* files into the prompt, which is what `chat.includeReferencedInstructions` governs and what the documentation means by "reference other files by using Markdown links, for example to reuse instructions files"; an `.agent.md` is not an instructions file, so the link is inert and the overlay ran as a bare fragment with the base contract missing. The setting being enabled is not the fix, and the failure is silent — the agent loads, answers, and simply has none of the engineering rules its own text claims to apply.
Inlining is also the correct design here rather than a workaround, and the agent's own doctrine is the argument: a rule the model can route around is not a control. An overlay whose base contract depends on the model choosing to open a second file has exactly that weakness, in the one agent least able to afford it. One file now holds the complete envelope, which is also what an auditor needs in a regulated environment. The cost is a duplicate that can drift, so [`tests/AgentInheritance.Tests.ps1`](tests/AgentInheritance.Tests.ps1) compares the inlined block byte-for-byte against the base body — dropping its H1 and demoting its H2s, the one documented transformation — and fails the moment the base moves. Line endings are normalised before the comparison because git rewrites them on checkout; without that the test fails on encoding rather than content, which it did on the first run.
The containment is in the frontmatter, not only in the prose. The base agent's 45 tools drop to 36: `web/fetch`, `web/githubRepo`, `web/githubTextSearch`, `openSimpleBrowser`, `github`, `useMcp`, `vscode/installExtension`, `vscode/extensions`, and `codeInterpreter` are removed, so private-data access and untrusted content cannot combine into the lethal trifecta because the third leg is gone. Prose then closes the three ways an agent reconstructs a removed capability: the terminal (`curl`, `Invoke-WebRequest`, `ssh`, a public-registry install), the user ("switch agents and paste it for me"), and a handoff — which is worth naming explicitly, because a handoff moves the user into another agent's toolset and stops this file binding at that moment.
The subagent rule is the one that is easy to get wrong. `agents` is narrowed to `security-reviewer`, and `technical-writer` is dropped — but `security-reviewer` itself holds `web/fetch`, `github`, and `useMcp`, so delegating to it re-opens the channel the toolset just closed. Removing it was not an option, since the same overlay makes its review *mandatory* rather than risk-scaled for security-relevant diffs, new dependencies, new network paths, and first-time repositories. The rule that ships instead constrains the dispatch: hand it repository paths, symbol names, and the question, never pasted source, configuration values, hostnames, or data samples, and write every dispatch prompt as if it will leave the boundary.
The rest is the control set a regulated employer actually imposes: secrets by reference from the vault with a discovered credential treated as burned (rotate, then scrub — never silently deleted, which hides a leak without revoking it); internal-mirror-only dependencies that need a pinned version, integrity verification, an approved license, and an SBOM entry, all four or none; a "never ship" Blocker list covering hand-rolled crypto, disabled TLS verification, dynamic execution, injection-prone concatenation, wildcard authorization, swallowed security failures, sensitive logging, and — the one usually left implicit — weakening an existing control as a side effect of a feature; synthetic-only test data; separation of duties that ends the agent's entitlements at the local working tree; and a seven-item hard stop whose escalation report names what state was left behind and who must act.
The Memory Bank extension adds `contoso-controls.md` and `data-classification.md` and explicitly refuses `threat-model.md`, `assessment-log.md`, and `security-playbooks.md`, which `security-reviewer` owns — the house rule that an agent does not write another agent's role files is only enforceable if each overlay states which files are not its own. [`tests/SharedLifecycle.Tests.ps1`](tests/SharedLifecycle.Tests.ps1) carries the per-agent baseline so the toolset, the handoff targets, and the Memory Bank section cannot drift without a test naming the change.
The subagent rule is the one that is easy to get wrong. `agents` is narrowed to `security-reviewer`, and `technical-writer` is dropped — but `security-reviewer` itself holds `web/fetch`, `github`, and `useMcp`, so delegating to it re-opens the channel the toolset just closed. Removing it was not an option, since the same overlay makes its review *mandatory* rather than risk-scaled for security-relevant diffs, new dependencies, new network paths, and first-time repositories. The rule that ships instead constrains the dispatch: hand it repository paths, symbol names, and the question, never pasted source, configuration values, hostnames, or data samples, and write every dispatch prompt as if it will leave the boundary.
The rest is the control set a regulated employer actually imposes: secrets by reference from the vault with a discovered credential treated as burned (rotate, then scrub — never silently deleted, which hides a leak without revoking it); internal-mirror-only dependencies that need a pinned version, integrity verification, an approved license, and an SBOM entry, all four or none; a "never ship" Blocker list covering hand-rolled crypto, disabled TLS verification, dynamic execution, injection-prone concatenation, wildcard authorization, swallowed security failures, sensitive logging, and — the one usually left implicit — weakening an existing control as a side effect of a feature; synthetic-only test data; separation of duties that ends the agent's entitlements at the local working tree; and a seven-item hard stop whose escalation report names what state was left behind and who must act.
The Memory Bank extension adds `contoso-controls.md` and `data-classification.md` and explicitly refuses `threat-model.md`, `assessment-log.md`, and `security-playbooks.md`, which `security-reviewer` owns — the house rule that an agent does not write another agent's role files is only enforceable if each overlay states which files are not its own. [`tests/SharedLifecycle.Tests.ps1`](tests/SharedLifecycle.Tests.ps1) carries the per-agent baseline so the toolset, the handoff targets, and the Memory Bank section cannot drift without a test naming the change.
### Fixed
- **Hook commands no longer carry a `$` token for the host to eat** (2026-08-27). Every hook died at startup with `An expression was expected after '('`, and the only trace was a *Warning from Session Start hook* balloon — so the never-push block, the Memory Bank probe, and the compaction checkpoint were all silently absent while looking installed. The cause is that the host substitutes `$` tokens in the command string before the child process parses it. `"$b = if ($env:PLUGIN_ROOT) { ... } else { Join-Path $env:USERPROFILE '.copilot\hooks' }"` reached PowerShell as `" = if () { ... } else { Join-Path C:\Users\install '.copilot\hooks' }"`: `$env:USERPROFILE` was resolved by the wrong layer, and `$b`, `$env:PLUGIN_ROOT`, and `$LASTEXITCODE` were resolved to nothing at all. The previous design assumed the opposite — that VS Code spawns the command with no shell, so each command had to expand its own path — and [`com.github.copilot/hooks/README.md`](com.github.copilot/hooks/README.md) said so in as many words.
The commands in [`com.github.copilot/hooks/hooks.json`](com.github.copilot/hooks/hooks.json) are now written without a single `$`, which makes them correct under both readings rather than betting on either. Paths come from `[Environment]::GetEnvironmentVariable('USERPROFILE')` instead of `$env:USERPROFILE`, and the blocking exit code — which `-Command` otherwise flattens to `1` and would have turned a hard block into a warning — comes from `Get-Variable -Name LASTEXITCODE -ValueOnly`. Each candidate path is built with `[IO.Path]::Combine('/', <root>, <relative>)` so that an unset root yields a drive-rooted path rather than a *workspace-relative* one; without the leading `/`, opening an untrusted repository that happened to contain `com.github.copilot/hooks/scripts/` would have executed its scripts on every tool call.
Script resolution also gained the deployment path it was missing. A plugin install materialises at `~/.vscode*/agent-plugins/<host>/<owner>/CopilotAtelier/`, which is not `PLUGIN_ROOT` unless the client chooses to set it — a variable this repository adopted on inference and never confirmed. Each command now probes `PLUGIN_ROOT`, then the module's `~/.copilot/hooks`, then the plugin location, and runs the first script that exists, so both supported installs are covered whether or not the client cooper
FileList
- CopilotAtelier.nuspec
- CopilotAtelier.psm1
- CopilotAtelier.psd1
- skills\gilb-requirements-engineering\SKILL.md
- skills\grill-me\SKILL.md
- skills\sampler-framework\references\ci-cd-pipelines.md
- skills\windows-gui-screenshot-capture\SKILL.md
- skills\pandoc-docx-export\SKILL.md
- skills\sampler-framework\references\community-files.md
- keybindings\keybindings.json
- skills\windows-gui-screenshot-capture\notes-evals.md
- skills\winrm-troubleshooting\SKILL.md
- skills\sampler-framework\references\bootstrap.md
- com.github.copilot\agents\software-engineer-contoso.agent.md
- skills\brand-logo-system\SKILL.md
- skills\winrm-troubleshooting\notes-evals.md
- skills\sampler-framework\references\testing-patterns.md
- com.github.copilot\agents\career-coach.agent.md
- skills\mcp-builder\SKILL.md
- skills\citation-integrity\SKILL.md
- skills\sampler-framework\references\dependency-resolution.md
- com.github.copilot\agents\tax-researcher.agent.md
- skills\doc-coauthoring\SKILL.md
- skills\memory-bank\SKILL.md
- skills\sampler-framework\references\build-yaml.md
- com.github.copilot\agents\training-writer.agent.md
- skills\agent-evals\SKILL.md
- skills\memory-bank\notes-evals.md
- skills\sampler-framework\references\dependency-management.md
- com.github.copilot\agents\software-architect.agent.md
- skills\marp-slide-overflow\SKILL.md
- com.github.copilot\hooks\scripts\Write-CompactionCheckpoint.ps1
- skills\sampler-framework\references\commands-reference.md
- com.github.copilot\agents\technical-writer.agent.md
- skills\microsoft-todo-tasks\SKILL.md
- com.github.copilot\hooks\scripts\Add-SessionContext.ps1
- skills\sampler-framework\references\project-structure.md
- com.github.copilot\agents\troubleshooter.agent.md
- skills\create-outlook-draft\SKILL.md
- com.github.copilot\hooks\scripts\Block-RemoteMutation.ps1
- skills\long-running-job-monitor\references\heartbeat-protocol.md
- com.github.copilot\agents\README.md
- skills\datum-configuration\SKILL.md
- skills\skill-creator\references\scripts-and-evaluation.md
- skills\long-running-job-monitor\references\out-of-band-verification.md
- com.github.copilot\agents\software-engineer.agent.md
- skills\devils-advocate-review\SKILL.md
- skills\skill-creator\references\authoring-patterns.md
- skills\long-running-job-monitor\scripts\Start-JobHeartbeat.ps1
- com.github.copilot\agents\research-analyst.agent.md
- skills\sampler-framework\SKILL.md
- skills\gilb-requirements-engineering\references\evo-planning.md
- skills\long-running-job-monitor\scripts\Start-JobMonitor.ps1
- com.github.copilot\agents\devops-training-writer.agent.md
- skills\sampler-build-debug\SKILL.md
- skills\gilb-requirements-engineering\references\planguage-keywords.md
- skills\long-running-job-monitor\scripts\Start-DetachedPowerShell.ps1
- com.github.copilot\agents\security-reviewer.agent.md
- skills\pswritehtml-reporting\SKILL.md
- skills\gilb-requirements-engineering\references\spec-quality-control.md
- skills\evidence-package-assembly\scripts\Build-EvidencePackage.ps1
- com.github.copilot\agents\legal-researcher.agent.md
- skills\long-running-job-monitor\SKILL.md
- skills\gilb-requirements-engineering\references\impact-estimation.md
- skills\evidence-package-assembly\scripts\merge-and-verify.py
- com.github.copilot\agents\qc-inspector.agent.md
- skills\long-running-job-monitor\notes-evals.md
- skills\windows-gui-screenshot-capture\references\external-win32-executables.md
- skills\pester-patterns\references\migrating-pester-v4-to-v5.md
- com.github.copilot\hooks\hooks.json
- skills\code-review-and-quality\SKILL.md
- skills\windows-gui-screenshot-capture\references\engine-recipes.md
- skills\pester-patterns\references\testing-powershell-constructs.md
- com.github.copilot\hooks\README.md
- skills\code-review-and-quality\notes-evals.md
- skills\windows-gui-screenshot-capture\scripts\WindowCapture.ps1
- skills\pester-patterns\references\mocking-external-dependencies.md
- com.github.copilot\rules\powershell.instructions.md
- skills\send-outlook-email\SKILL.md
- skills\windows-gui-screenshot-capture\scripts\DialogCapture.ps1
- skills\pester-patterns\scripts\Find-PesterV4Pattern.ps1
- com.github.copilot\rules\azurepipelines.instructions.md
- skills\debugging-and-error-recovery\SKILL.md
- skills\brand-logo-system\scripts\Export-BrandLogoSet.ps1
- skills\authenticated-web-extraction\bootstrap\package.json
- com.github.copilot\rules\preflight.instructions.md
- skills\debugging-and-error-recovery\notes-evals.md
- skills\agent-evals\assets\trigger-queries.sampler-build-debug.json
- skills\automatedlab-proxmox\references\evidence-and-readiness.md
- com.github.copilot\rules\markdown.instructions.md
- skills\evidence-package-assembly\SKILL.md
- skills\agent-evals\assets\trigger-queries.sampler-framework.json
- skills\automatedlab-proxmox\references\module-development.md
- com.github.copilot\rules\sampler.instructions.md
- skills\whisper-pyannote-transcription\SKILL.md
- skills\agent-evals\assets\evals.sample.json
- skills\automatedlab-proxmox\references\windows-sysprep.md
- com.github.copilot\rules\yaml.instructions.md
- skills\whisper-pyannote-transcription\transcribe.py
- skills\agent-evals\assets\trigger-queries.copilot-usage-stats.json
- skills\automatedlab-deployment\references\lab-management.md
- com.github.copilot\rules\postflight.instructions.md
- skills\whisper-pyannote-transcription\transcribe-segment.py
- skills\agent-evals\assets\trigger-queries.pester-patterns.json
- skills\automatedlab-deployment\references\troubleshooting.md
- com.github.copilot\rules\versioning.instructions.md
- skills\whisper-pyannote-transcription\diarize.py
- skills\agent-evals\assets\trigger-queries.brand-logo-system.json
- skills\automatedlab-deployment\references\post-deployment-operations.md
- com.github.copilot\rules\copilot-authoring.instructions.md
- skills\pester-patterns\SKILL.md
- skills\agent-evals\assets\trigger-queries.sampler-migration.json
- skills\automatedlab-deployment\references\roles-and-services.md
- com.github.copilot\rules\ubiquitous-language.instructions.md
- skills\pester-patterns\notes-evals.md
- skills\agent-evals\assets\trigger-queries.skill-creator.json
- skills\automatedlab-deployment\references\cmdlet-reference.md
- com.github.copilot\rules\pester.instructions.md
- skills\grammar-check\SKILL.md
- skills\agent-evals\assets\trigger-queries.test-driven-development.json
- skills\automatedlab-deployment\references\networking.md
- com.github.copilot\rules\powershell-execution-safety.instructions.md
- skills\test-driven-development\SKILL.md
- skills\agent-evals\assets\trigger-queries.sample.json
- skills\automatedlab-deployment\references\vm-operations.md
- com.github.copilot\rules\json.instructions.md
- skills\test-driven-development\notes-evals.md
- skills\agent-evals\assets\evals.output.sample.json
- skills\german-tax-research\references\vorlagen.md
- com.github.copilot\rules\csharp.instructions.md
- skills\outlook-email-export\SKILL.md
- skills\agent-evals\references\eval-artifacts.md
- skills\german-tax-research\references\vermietung-und-afa.md
- com.github.copilot\rules\git.instructions.md
- skills\agent-security-review\SKILL.md
- skills\agent-evals\scripts\run-trigger-evals.ps1
- skills\german-tax-research\references\belegaufforderung-antwort.md
- com.github.copilot\rules\changelog.instructions.md
- skills\german-legal-research\SKILL.md
- skills\agent-evals\scripts\run-evals.ps1
- skills\german-tax-research\references\kennzahlen.md
- com.github.copilot\commands\session-handoff.prompt.md
- skills\authenticated-web-extraction\SKILL.md
- skills\marp-slide-overflow\references\speaker-note-guard.md
- skills\german-tax-research\references\fristen-und-verfahren.md
- com.github.copilot\commands\peer-review.prompt.md
- skills\mecm-dsc-deployment\SKILL.md
- skills\marp-slide-overflow\references\mermaid-prerender.md
- skills\german-tax-research\references\werbungskosten-und-abzuege.md
- com.github.copilot\commands\audit-case-file.prompt.md
- skills\outlook-calendar-export\SKILL.md
- skills\marp-slide-overflow\references\png-verification.md
- skills\german-tax-research\scripts\Get-SteuerFrist.ps1
- com.github.copilot\commands\code-review.prompt.md
- skills\xlsx-to-markdown\SKILL.md
- skills\marp-slide-overflow\references\overflow-detector.md
- skills\winrm-troubleshooting\references\post-restart-readiness.md
- com.github.copilot\commands\export-emails.prompt.md
- skills\dsc-troubleshooting\SKILL.md
- skills\datum-configuration\references\common-tasks.md
- skills\winrm-troubleshooting\references\advanced-diagnostics.md
- com.github.copilot\commands\pr-description.prompt.md
- skills\subagent-dispatch\SKILL.md
- skills\datum-configuration\references\datum-yml-reference.md
- skills\memory-bank\scripts\Test-MemoryBankRouting.ps1
- com.github.copilot\commands\usage.prompt.md
- skills\automatedlab-proxmox\SKILL.md
- skills\datum-configuration\references\dscworkshop-reference.md
- skills\memory-bank\scripts\Initialize-MemoryBank.ps1
- com.github.copilot\commands\deadline-action-handoff.prompt.md
- skills\automatedlab-proxmox\notes-evals.md
- skills\datum-configuration\references\projectdagger-patterns.md
- skills\memory-bank\scripts\Invoke-MemoryBankRouteSelectionEval.ps1
- com.github.copilot\commands\lab-deploy.prompt.md
- skills\sampler-migration\SKILL.md
- skills\sampler-framework\references\custom-build-tasks.md
- skills\memory-bank\scripts\Test-MemoryBankHealth.ps1
- com.github.copilot\commands\brand-logo.prompt.md
- skills\copilot-usage-stats\SKILL.md
- skills\sampler-framework\references\troubleshooting.md
- skills\memory-bank\evals\routing-cases.json
- com.github.copilot\commands\refactor.prompt.md
- skills\automatedlab-deployment\SKILL.md
- skills\sampler-framework\references\gitversion.md
- skills\authenticated-web-extraction\bootstrap\tasks\check-logins.mjs
- com.github.copilot\commands\module-scaffold.prompt.md
- skills\docx-to-markdown\SKILL.md
- skills\sampler-framework\references\vscode-integration.md
- skills\authenticated-web-extraction\bootstrap\tasks\dump-cookies.mjs
- com.github.copilot\commands\sync-project-emails.prompt.md
- skills\german-tax-research\SKILL.md
- skills\sampler-framework\references\module-manifest.md
- skills\authenticated-web-extraction\bootstrap\scripts\open.mjs
- skills\skill-creator\SKILL.md
- skills\social-signal-sweep\SKILL.md
- skills\sampler-framework\references\multi-module.md
- skills\authenticated-web-extraction\bootstrap\scripts\extract.mjs
- skills\pdf-to-markdown\SKILL.md
- skills\sampler-framework\references\dsc-datum.md
Version History
| Version | Downloads | Last updated |
|---|---|---|
| 5.0.0-previe... (current version) | 3 | 8/27/2026 |
| 5.0.0-previe... | 3 | 8/27/2026 |
| 5.0.0-previe... | 4 | 8/26/2026 |
| 4.0.0 | 9 | 8/26/2026 |
| 4.0.0-previe... | 2 | 8/26/2026 |
| 4.0.0-previe... | 3 | 8/26/2026 |
| 4.0.0-previe... | 4 | 8/25/2026 |
| 4.0.0-previe... | 3 | 8/25/2026 |
| 4.0.0-previe... | 3 | 8/25/2026 |
| 4.0.0-previe... | 3 | 8/25/2026 |
| 4.0.0-previe... | 3 | 8/25/2026 |
| 4.0.0-previe... | 3 | 8/24/2026 |
| 4.0.0-previe... | 3 | 8/24/2026 |
| 4.0.0-previe... | 18 | 8/19/2026 |
| 4.0.0-previe... | 2 | 8/19/2026 |
| 4.0.0-previe... | 5 | 8/15/2026 |
| 4.0.0-previe... | 4 | 8/12/2026 |
| 4.0.0-previe... | 4 | 8/12/2026 |
| 3.2.0-previe... | 3 | 8/11/2026 |
| 3.1.1-previe... | 6 | 8/11/2026 |
| 3.1.0 | 29 | 8/7/2026 |
| 3.1.0-previe... | 3 | 8/7/2026 |
| 3.1.0-previe... | 3 | 8/5/2026 |
| 3.1.0-previe... | 3 | 8/5/2026 |
| 3.1.0-previe... | 7 | 8/4/2026 |
| 3.0.0 | 16 | 8/1/2026 |
| 3.0.0-previe... | 4 | 8/1/2026 |
| 3.0.0-previe... | 5 | 8/1/2026 |
| 3.0.0-previe... | 5 | 8/1/2026 |
| 2.0.0 | 7 | 7/29/2026 |
| 2.0.0-previe... | 3 | 7/29/2026 |