canvas-extension: new chat cards extension by jhauga · Pull Request #2698 · github/awesome-copilot

jhauga · 2026-08-17T22:07:13Z

Pull Request Checklist

I have read and followed the CONTRIBUTING.md guidelines.
I have read and followed the Guidance for submissions involving paid services.
My contribution adds a new instruction, prompt, agent, skill, workflow, or canvas extension file in the correct directory.
The file follows the required naming convention.
The content is clearly structured and follows the example format.
I have tested my instructions, prompt, agent, skill, workflow, or canvas extension with GitHub Copilot.
I have run npm start and verified that README.md is up to date.
I am targeting the main branch for this pull request.

Description

Interactive HTML card deck for GitHub Copilot canvas.

Agent: Interactive
Model: Claude Sonnet 4.6
Number of Prompts: 1
Post Edits: None

Prompt

I need help with learning the programming language RUST. I want get get a
solid understanding of the language's base. Learn enough to apply the 80/20
rule of producing functional applications from learning the language, and when
to use it vs. when to use other languages. Use chat-cards to help out

Results

Type of Contribution

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.

github-actions · 2026-08-17T22:07:37Z

🔒 PR Risk Scan Results

Scanned 9 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	4
ℹ️ Info	0

Severity	Rule	File	Line	Match
🟠	`unpinned-version-indicator`	`extensions/chat-cards/cards-core.mjs`	1123	`data.headers.length > 0`
🟠	`unpinned-version-indicator`	`extensions/chat-cards/cards-core.mjs`	1196	`series.length > 1`
🟠	`unpinned-version-indicator`	`extensions/chat-cards/cards-core.mjs`	1412	`headings.length > 0`
🟠	`unpinned-version-indicator`	`extensions/chat-cards/package.json`	8	`"@github/copilot-sdk": "latest"`

Skipped non-text or missing files

extensions/chat-cards/assets/icon.png
extensions/chat-cards/assets/preview.png

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

github-actions · 2026-08-17T22:08:09Z

🔴 Contributor Reputation Check: HIGH risk

Check	Risk
Profile	HIGH
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

Copilot

Pull request overview

Adds the Chat Cards canvas extension and packages it for the Awesome Copilot marketplace.

Changes:

Implements interactive cards, forms, charts, and deck management.
Adds the canvas UI, local HTTP/SSE transport, and visual assets.
Registers and documents the extension plugin.

Reviewed changes

Copilot reviewed 10 out of 12 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
`plugins/chat-cards/README.md`	Documents plugin installation.
`plugins/chat-cards/plugin.json`	Defines plugin metadata.
`extensions/chat-cards/README.md`	Documents features and usage.
`extensions/chat-cards/package.json`	Declares the extension package.
`extensions/chat-cards/extension.mjs`	Implements actions, state, and transport.
`extensions/chat-cards/copilot-extension.json`	Provides extension metadata.
`extensions/chat-cards/cards-core.mjs`	Builds and sanitizes card content.
`extensions/chat-cards/assets/canvas.html`	Implements the interactive canvas UI.
`extensions/chat-cards/assets/icon.png`	Provides the extension icon.
`extensions/chat-cards/assets/preview.png`	Provides the marketplace preview.
`docs/README.plugins.md`	Adds the plugin to documentation.
`.github/plugin/marketplace.json`	Registers the marketplace entry.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+        return `<label class="mcc-choice" for="${choiceId}">
+<input type="${type}" id="${choiceId}" name="${name}" value="${escapeHtml(option.value ?? option.label)}"${checked}>
+${escapeHtml(option.label)}</label>`;


+function seriesScale(series) {
+  const values = series.flatMap((s) => s.values).filter((value) => Number.isFinite(value));
+  return niceScale(Math.max(...values, 0), 6, values.every((value) => Number.isInteger(value)));
+}


+          cardId: { type: "string", description: "The id returned when the card was created" },
+          kind: { type: "string", enum: Object.keys(CARD_BUILDERS) },
+        },
+        required: ["cardId", "kind"],
+        additionalProperties: true,


+  document.addEventListener("mouseover", function (event) {
+    var term = event.target.closest(".mcc-term");
+    if (!term) return;


Copilot

Pull request overview

Copilot reviewed 10 out of 12 changed files in this pull request and generated no new comments.

Suppressed comments (6)

extensions/chat-cards/cards-core.mjs:1219

Chart cards expose kinds such as chart-bar, but update_card only accepts builder keys (chart, tabs, etc.) and tells callers to pass the card's returned kind. Consequently, a chart kind returned by create/list cannot be passed back to update. Keep the stored/public kind aligned with the chart builder key; the subtype already remains in the replacement spec's type.

      kind: `chart-${type}`,

extensions/chat-cards/cards-core.mjs:1268

required is calculated but never emitted for checkbox or radio inputs. Therefore form.checkValidity() accepts a required choice group with nothing selected, despite the required marker shown to the user. Apply native required semantics for radio groups and explicitly validate at least one selected value for multi-checkbox groups.

<input type="${type}" id="${choiceId}" name="${name}" value="${escapeHtml(option.value ?? option.label)}"${checked}>

plugins/chat-cards/README.md:14

This fence uses two backticks, so the installation command renders as literal delimiter text instead of a code block. Use a valid Markdown code block.

``bash
copilot plugin install chat-cards@awesome-copilot
``

extensions/chat-cards/cards-core.mjs:116

Caller-supplied HTML can retain extension-reserved classes, allowing sanitized content to trigger privileged delegated handlers. For example, an allowed <a class="mcc-remove-card" href="https://example.com"> survives sanitization, and clicking it removes the enclosing card. Reject reserved mcc- classes when rebuilding untrusted HTML.

  "*": { class: (v) => SAFE_CLASS_PATTERN.test(v), title: () => true },

extensions/chat-cards/extension.mjs:217

Bar/line series values allow negatives, but both renderers use a zero-only scale: negative bars are clamped to zero and negative line points are placed below the plot. This silently misrepresents valid schema input. Either reject negative values in both the action schema and core builder (including updates), or implement a signed min/max axis.

        values: { type: "array", items: { type: "number" } },

extensions/chat-cards/cards-core.mjs:313

Tutor definitions are exposed only through mouseover/mouseout, while this generated span is not focusable and has no accessible description. Keyboard and screen-reader users therefore cannot access an advertised card feature. Make terms keyboard-focusable and mirror tooltip behavior on focus/blur, or associate the tip through accessible descriptive markup.

        `<span class="mcc-term" data-tip="${escapeHtml(term.tip)}">${match[0]}</span>`;

canvas-extension: new chat cards extension

4714e9f

jhauga requested a review from aaronpowell as a code owner August 17, 2026 22:07

Copilot AI balanced review requested due to automatic review settings August 17, 2026 22:07

github-actions Bot added canvas-extension PR touches canvas extensions new-submission PR adds at least one new contribution plugin PR touches plugins labels Aug 17, 2026

Copilot started reviewing on behalf of jhauga August 17, 2026 22:07 View session

github-actions Bot added the needs-review:HIGH Contributor reputation check flagged HIGH risk label Aug 17, 2026

codespell: resolve mispelling

8dd0a6a

Copilot AI reviewed Aug 17, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings August 17, 2026 22:13

Copilot started reviewing on behalf of jhauga August 17, 2026 22:14 View session

jhauga marked this pull request as draft August 17, 2026 22:14

Copilot AI reviewed Aug 17, 2026

View reviewed changes

Navigation Menu

Uh oh!

canvas-extension: new chat cards extension - #2698

canvas-extension: new chat cards extension#2698
jhauga wants to merge 2 commits into
github:mainfrom
jhauga:extension-chat-cards

jhauga commented Aug 17, 2026

Uh oh!

github-actions Bot commented Aug 17, 2026

Uh oh!

github-actions Bot commented Aug 17, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

jhauga commented Aug 17, 2026

Pull Request Checklist

Description

Prompt

Results

Type of Contribution

Uh oh!

github-actions Bot commented Aug 17, 2026

🔒 PR Risk Scan Results

Uh oh!

github-actions Bot commented Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Aug 17, 2026 •

edited

Loading