Add Copilot-assisted dashboard editing mode by Copilot · Pull Request #697 · githubnext/gh-aw-cao

Copilot · 2026-09-03T07:33:19Z

The local dashboard preview lacked an agentic editing path. This adds an optional Copilot mode for prompting changes to the active view and reloading validated updates.

Copilot runtime
- Launches Copilot headlessly through @github/copilot-sdk.
- Creates one session per request with local tool access.
- Logs session activity through console.log.
Browser integration
- Adds a textbox and send button above the preview when enabled.
- Sends the active view name and requested change through a capability-protected endpoint.
- Reports progress and errors without affecting standard preview mode.
Editing workflow
- Directs Copilot to use /generate-dashboard-ir.
- Requires validation until the dashboard passes, then saves the source.
- Reuses the existing file watcher and WebSocket refresh path.
Usage

npm install @github/copilot-sdk
node dashboard/local-server.mjs --copilot

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan

@copilot debug logging extensively

pelikhan · 2026-09-03T07:37:06Z

 }

+function injectCopilotPrompt(html, endpoint) {
+  const prompt = `<form id="dashboard-copilot-prompt" style="display:flex;gap:0.5rem;align-items:center;padding:0.75rem 1rem;border-bottom:1px solid #d0d7de;background:#f6f8fa;font:14px system-ui">


@copilot move this to JavaScript file that gets conditionally loaded and uses the existing rendering infrastructure. DO NOT EVAL

Moved the UI to a conditionally loaded copilot-prompt.js module using the shared DOM helper and dashboard styles, with no eval, in 8640a91.

pelikhan · 2026-09-03T07:37:34Z

+      ...(copilotExecutable ? { path: copilotExecutable } : {}),
+    }),
+    workingDirectory,
+    logLevel: "none",


@copilot enable logging

Enabled Copilot SDK debug logging and added sanitized session lifecycle logging in 8640a91.

pelikhan · 2026-09-03T07:38:40Z

+
+Apply this request: ${request}
+
+Find the dashboard source file that defines this view. Follow the skill and the repository's dashboard specification, run the dashboard validator repeatedly until the edited document passes, and save the source file so the local preview reloads. Complete the edit rather than only describing it.`,


@copilot provide precise file path to dashboard.json and also how to edit the original locations of the package views

The session now receives the exact generated dashboard path, the matched editable source path, every original dashboard source path, and explicit built-in/package editing guidance in 8640a91.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-09-03T07:49:22Z

@copilot debug logging extensively

Implemented extensive sanitized server, rebuild, WebSocket, request, session, and SDK debug logging in 8640a91.

pelikhan · 2026-09-03T11:52:34Z

@copilot inject copilot prompt module should be injected client side at startup with a query flag that the server provides, not dynamically by the server with the current hash. No string concat to generate HTML ever.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-09-03T12:01:50Z

@copilot inject copilot prompt module should be injected client side at startup with a query flag that the server provides, not dynamically by the server with the current hash. No string concat to gen...

Implemented in df7caec: the server now provides a local-preview query flag via redirect, and static client startup conditionally imports/renders the module and initializes the socket. Server-side HTML generation was removed entirely.

pelikhan · 2026-09-03T12:04:28Z

@copilot do a security deep review, add more logging - specially when things fail, misconfigured.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-09-03T12:19:54Z

@copilot do a security deep review, add more logging - specially when things fail, misconfigured.

Implemented in 16f973d with cleanup follow-up eee86d2. Copilot sessions now expose only allowlisted dashboard read/validate/save tools, reject all unexpected permissions, require loopback binding, serialize requests, validate saved output, and log sanitized startup, configuration, denial, validation, session, and cleanup failures. Deep security review and CodeQL reported no findings.

pelikhan · 2026-09-03T12:21:18Z

@copilot remove yaml dependency, only support JSON format. Always country JSON through parse/stringidy 2 spaces to normalize formatting

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-09-03T12:26:09Z

@copilot remove yaml dependency, only support JSON format. Always country JSON through parse/stringidy 2 spaces to normalize formatting

Implemented in 88d7fc7. Copilot editing now accepts JSON only, parses and re-serializes dashboard sources with two-space indentation on read/save/post-session verification, rejects malformed JSON, and no longer imports or packages the YAML validator.

pelikhan · 2026-09-03T12:29:44Z

@copilot use permissions and access control when launching node to guarantee the web server is not reading files outside the workspace. Apply basic secret regex cleaning before reading files back to the browser.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-09-03T12:36:13Z

@copilot use permissions and access control when launching node to guarantee the web server is not reading files outside the workspace. Apply basic secret regex cleaning before reading files back to t...

Implemented in 33d3f09, 0757dd7, and c5a1254. The CLI now relaunches Node with filesystem access limited to the workspace, keeps preview files inside that boundary, rejects canonical and symlink path escapes, clears inherited NODE_OPTIONS, and redacts common secret keys/tokens from JSON, HTML, CSS, and JavaScript before browser delivery and WebSocket updates.

pelikhan · 2026-09-03T12:37:05Z

@copilot only allow reading .md, .json or web files or images. Refuse other file types.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-09-03T12:39:50Z

@copilot only allow reading .md, .json or web files or images. Refuse other file types.

Implemented in ed91790. Browser serving now uses an explicit allowlist for Markdown, JSON, HTML/CSS/JavaScript, and common image formats; unsupported and extensionless files return 404 before content is read. Text secret redaction now also covers Markdown and SVG.

pelikhan · 2026-09-03T12:49:11Z

@copilot fix https://github.com/githubnext/gh-aw-cao/actions/runs/33756458673/job/100653596117

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-09-03T12:57:13Z

@copilot fix https://github.com/githubnext/gh-aw-cao/actions/runs/33756458673/job/100653596117

Fixed in 3fb6753. The focused EU CRA, Advisory, and Software Development Practices package contracts now include the shared .github/workflows/cao.md; all three previously failing tests and the full npm test suite pass.

Copilot AI and others added 2 commits September 3, 2026 07:30

Add optional Copilot dashboard editing mode

b660d2a

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Harden Copilot preview integration

6358c8c

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI assigned Copilot and pelikhan Sep 3, 2026

Copilot AI changed the title ~~Add optional Copilot-assisted dashboard editing~~ Add Copilot-assisted dashboard editing mode Sep 3, 2026

Copilot finished work on behalf of pelikhan September 3, 2026 07:34

Copilot AI requested a review from pelikhan September 3, 2026 07:34

Copilot created this pull request from a session on behalf of pelikhan September 3, 2026 07:34 View session

pelikhan reviewed Sep 3, 2026

View reviewed changes

Copilot started work on behalf of pelikhan September 3, 2026 07:39 View session

Refine Copilot dashboard editing feedback

8640a91

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan September 3, 2026 07:49

Copilot AI requested a review from pelikhan September 3, 2026 07:49

pelikhan marked this pull request as ready for review September 3, 2026 11:49

Copilot started work on behalf of pelikhan September 3, 2026 11:53 View session

Initialize Copilot prompt client-side

df7caec

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan September 3, 2026 12:02

Copilot started work on behalf of pelikhan September 3, 2026 12:04 View session

Copilot AI and others added 2 commits September 3, 2026 12:16

Harden Copilot dashboard editing

16f973d

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Preserve Copilot request failures

eee86d2

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan September 3, 2026 12:20

Copilot started work on behalf of pelikhan September 3, 2026 12:21 View session

Restrict Copilot dashboard edits to JSON

88d7fc7

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan September 3, 2026 12:26

Copilot started work on behalf of pelikhan September 3, 2026 12:30 View session

Copilot AI and others added 3 commits September 3, 2026 12:33

Constrain dashboard server filesystem access

33d3f09

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Canonicalize dashboard workspace paths

0757dd7

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Clarify canonical request paths

c5a1254

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan September 3, 2026 12:36

Copilot started work on behalf of pelikhan September 3, 2026 12:37 View session

Restrict dashboard browser file types

ed91790

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan September 3, 2026 12:40

Copilot started work on behalf of pelikhan September 3, 2026 12:49 View session

Update focused package ownership contracts

3fb6753

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan September 3, 2026 12:57

pelikhan merged commit c17f4fe into main Sep 3, 2026
5 checks passed


		Apply this request: ${request}

		Find the dashboard source file that defines this view. Follow the skill and the repository's dashboard specification, run the dashboard validator repeatedly until the edited document passes, and save the source file so the local preview reloads. Complete the edit rather than only describing it.`,

Uh oh!

Conversation

Copilot AI commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pelikhan left a comment

Choose a reason for hiding this comment

Uh oh!

pelikhan Sep 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 3, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan Sep 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 3, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan Sep 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Sep 3, 2026

Uh oh!

pelikhan commented Sep 3, 2026

Uh oh!

Copilot AI commented Sep 3, 2026

Uh oh!

pelikhan commented Sep 3, 2026

Uh oh!

Copilot AI commented Sep 3, 2026

Uh oh!

pelikhan commented Sep 3, 2026

Uh oh!

Copilot AI commented Sep 3, 2026

Uh oh!

pelikhan commented Sep 3, 2026

Uh oh!

Copilot AI commented Sep 3, 2026

Uh oh!

pelikhan commented Sep 3, 2026

Uh oh!

Copilot AI commented Sep 3, 2026

Uh oh!

pelikhan commented Sep 3, 2026

Uh oh!

Copilot AI commented Sep 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Sep 3, 2026 •

edited

Loading