reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/win-dev-skills/.github/CODEOWNERS

@@ -0,0 +1,20 @@
+# Catalog maintainers review everything by default. They're the repo
+# maintainers who have been landing changes here.
+* @nmetulev @azchohfi @niels9001
+
+# Catalog files: adding, removing, or re-pinning a plugin.
+/.github/plugin/marketplace.json @nmetulev @azchohfi @niels9001
+/.claude-plugin/marketplace.json @nmetulev @azchohfi @niels9001
+/.agents/plugins/marketplace.json @nmetulev @azchohfi @niels9001
+
+# CI and catalog tooling
+/.github/workflows/ @nmetulev @azchohfi @niels9001
+/scripts/ @nmetulev @azchohfi @niels9001
+
+# Plugins stored in this repo: one entry per plugin, owned by two or more
+# people or a team. Template:
+# /plugins/<name>/ @owner1 @owner2
+#
+# winui and winappcli are maintained in microsoft/winappCli and reviewed
+# there; their catalog entries are covered above.
+/plugins/windbg/ @nmetulev @azchohfi @niels9001 @rtrimceski-MS

vendor-new/win-dev-skills/.github/ISSUE_TEMPLATE/bug-report.yml

@@ -0,0 +1,89 @@
+name: Bug report
+description: Report a catalog or plugin install problem
+title: "[Bug]: "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to file a bug report!
+
+        **Problem with a `winui` or `winappcli` skill or agent, WinApp CLI, or the analyzer?** Please [open an issue in microsoft/winappCli](https://github.com/microsoft/winappCli/issues/new/choose), where those plugins are authored. Use this form for catalog and install problems (e.g. `plugin marketplace add`, `plugin install`, or `plugin update` fails).
+  - type: textarea
+    id: description
+    attributes:
+      label: Describe the bug
+      description: A clear and concise description of what the bug is.
+    validations:
+      required: true
+  - type: dropdown
+    id: area
+    attributes:
+      label: Affected host
+      description: Which agent host shows the problem?
+      options:
+        - Not sure
+        - GitHub Copilot
+        - Claude Code
+        - OpenAI Codex
+        - OpenClaw
+        - OpenCode
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: To Reproduce
+      description: Steps to reproduce the behavior.
+      placeholder: |
+        1. Run `copilot plugin marketplace add microsoft/win-dev-skills`
+        2. Run `copilot plugin install winui@win-dev-skills`
+        3. See error
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: A clear and concise description of what you expected to happen.
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Command output
+      description: Paste the full output of the failing command.
+      render: shell
+    validations:
+      required: false
+  - type: input
+    id: copilot-version
+    attributes:
+      label: Host version
+      description: e.g. output of `copilot --version`, `claude --version`, or `codex --version`
+      placeholder: e.g. 1.0.87
+    validations:
+      required: false
+  - type: input
+    id: plugin-version
+    attributes:
+      label: Plugin version
+      description: From your host's plugin list (e.g. `copilot plugin list`)
+      placeholder: e.g. 0.7.1
+    validations:
+      required: false
+  - type: input
+    id: os
+    attributes:
+      label: OS version
+      description: e.g. Windows 11 23H2 (build 22631.4317)
+    validations:
+      required: false
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional context
+      description: Anything else that might help us reproduce or understand the issue.
+    validations:
+      required: false

vendor-new/win-dev-skills/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,14 @@
+blank_issues_enabled: false
+contact_links:
+  - name: winui or winappcli plugin issue
+    url: https://github.com/microsoft/winappCli/issues/new/choose
+    about: The winui and winappcli plugins are authored in microsoft/winappCli. File their skill and agent issues, and WinApp CLI and analyzer issues, there.
+  - name: Question / discussion
+    url: https://github.com/microsoft/win-dev-skills/discussions
+    about: Have a question about how to use a skill, or want to discuss an idea? Start a Discussion.
+  - name: Microsoft Open Source Code of Conduct
+    url: https://opensource.microsoft.com/codeofconduct/
+    about: Read the Microsoft Open Source Code of Conduct.
+  - name: Security vulnerability
+    url: https://aka.ms/SECURITY.md
+    about: Please do NOT file public issues for security vulnerabilities. Use the Microsoft Security Response Center instead.

vendor-new/win-dev-skills/.github/ISSUE_TEMPLATE/documentation.yml

@@ -0,0 +1,38 @@
+name: Documentation
+description: Report a problem with a SKILL.md, README, or other documentation
+title: "[Docs]: "
+labels: ["documentation"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to flag a documentation issue! **Problem in a `winui` or `winappcli` skill or agent?** Please [open it in microsoft/winappCli](https://github.com/microsoft/winappCli/issues/new/choose), where those plugins are authored. Use this form for this repo's README and docs.
+  - type: textarea
+    id: location
+    attributes:
+      label: Where is the issue?
+      description: Link to the specific page, file, or section.
+      placeholder: e.g. README.md, "Install" section
+    validations:
+      required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: What's wrong?
+      description: Describe the documentation problem — broken link, wrong path, outdated example, missing step, unclear wording, etc.
+    validations:
+      required: true
+  - type: textarea
+    id: suggestion
+    attributes:
+      label: Suggested fix
+      description: If you have a concrete suggestion for how to fix it, share it here.
+    validations:
+      required: false
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: Anything else we should know.
+    validations:
+      required: false

vendor-new/win-dev-skills/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,40 @@
+name: Feature request
+description: Suggest a new skill, capability, or improvement
+title: "[Feature]: "
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to suggest a new feature!
+
+        **Idea for the `winui` or `winappcli` skills or agents?** Please [open it in microsoft/winappCli](https://github.com/microsoft/winappCli/issues/new/choose). Use this form to propose a new plugin for this catalog or a catalog improvement.
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem are you trying to solve?
+      description: Describe the developer scenario you're trying to support and why the current skills/tools fall short.
+      placeholder: e.g. When asking the agent to scaffold a charting page, it has no guidance on which charting library to use...
+    validations:
+      required: true
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed solution
+      description: Describe what you'd like to see — a new skill, an extension to an existing skill, a new tool, etc.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: What other approaches did you consider, and why is the proposed solution better?
+    validations:
+      required: false
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: Links to upstream docs, related issues, prior art, screenshots, or anything else that helps frame the request.
+    validations:
+      required: false

vendor-new/win-dev-skills/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,39 @@
+<!--
+Changing winui or winappcli skills, agents, or manifests? Open the PR in microsoft/winappCli
+instead: https://github.com/microsoft/winappCli
+This repo holds the plugin catalog. See CONTRIBUTING.md.
+-->
+
+## Description
+
+<!-- Briefly describe what this PR does and why -->
+
+## Related Issue
+
+<!-- Link to any related issues: Fixes #123, Closes #456, Related to #789 -->
+
+## Type of Change
+
+<!-- Keep the applicable line(s), delete the rest -->
+
+- 📦 Catalog entry added, moved to a new pin, or removed
+- 📝 Documentation
+- 🔧 Config / CI
+
+## Checklist
+
+<!-- Delete the ones that do not apply -->
+
+- [ ] All three catalogs (`.github/plugin`, `.claude-plugin`, `.agents/plugins`) list the same plugins at the same pin
+- [ ] Installed the plugin from this branch on each host and confirmed its skills load
+- [ ] If user-facing: added a bullet to `## [Unreleased]` in `CHANGELOG.md`
+
+## Additional Notes
+
+<!-- Any additional information that reviewers should know -->
+
+## AI Description
+
+<!-- ai-description-start -->
+_This section is auto-generated by AI when the PR is opened or updated. To opt out, delete this entire section including the marker comments._
+<!-- ai-description-end -->

vendor-new/win-dev-skills/.github/codeql/codeql-config.yml

@@ -0,0 +1,2 @@
+paths:
+  - .github/workflows

vendor-new/win-dev-skills/.github/dependabot.yml

@@ -0,0 +1,32 @@
+version: 2
+
+updates:
+  # GitHub Actions used by our workflows
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "github-actions"
+    commit-message:
+      prefix: "ci"
+      include: "scope"
+
+    cooldown:
+      default-days: 7
+
+  # vally skill linter (pinned to match github/awesome-copilot's marketplace gate)
+  - package-ecosystem: "npm"
+    directory: "/scripts/vally"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 2
+    labels:
+      - "dependencies"
+    commit-message:
+      prefix: "ci"
+      include: "scope"

vendor-new/win-dev-skills/.github/plugin/marketplace.json

@@ -0,0 +1,42 @@
+{
+  "name": "win-dev-skills",
+  "owner": {
+    "name": "Microsoft",
+    "url": "https://github.com/microsoft/win-dev-skills"
+  },
+  "metadata": {
+    "description": "Agents and skills for Windows development and debugging.",
+    "version": "0.7.1"
+  },
+  "plugins": [
+    {
+      "name": "windbg",
+      "description": "WinDbg diagnosis workflows and report validation for applications, services, UMDF/user-mode drivers, and kernel-mode drivers.",
+      "version": "1.0.0",
+      "source": "./plugins/windbg"
+    },
+    {
+      "name": "winui",
+      "description": "Agents and skills for WinUI 3 app development. Create new WinUI 3 desktop apps, convert from other frameworks to WinUI 3, or add features to existing WinUI 3 applications.",
+      "version": "0.7.1",
+      "source": {
+        "source": "github",
+        "repo": "microsoft/winappCli",
+        "path": "plugins/winui/agent-plugin",
+        "sha": "5a064a427f1e056822a939b13ddce43b798090fa"
+      }
+    },
+    {
+      "name": "winappcli",
+      "description": "Windows app development, packaging, and distribution. Helps with creating Windows installers (MSIX), code signing, certificates, Windows SDK and Windows App SDK setup, package identity for Windows APIs (push notifications, background tasks, share target), appxmanifest authoring, and Microsoft Store distribution. Supports Electron, .NET, C++, Rust, Flutter, and Tauri apps.",
+      "version": "0.7.1",
+      "source": {
+        "source": "github",
+        "repo": "microsoft/winappCli",
+        "path": "plugins/winapp",
+        "ref": "v0.7.1",
+        "sha": "e3cd0b94f3e7b776ac51ba0564f4908094e979b5"
+      }
+    }
+  ]
+}

vendor-new/win-dev-skills/.github/workflows/codeql.yml

@@ -0,0 +1,46 @@
+name: "CodeQL Advanced"
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '35 20 * * 0'
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      # required for all workflows
+      security-events: write
+
+      # required to fetch internal or private CodeQL packs
+      packages: read
+
+      # only required for workflows in private repositories
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - language: actions
+          build-mode: none
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
+        config-file: ./.github/codeql/codeql-config.yml
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+      with:
+        category: "/language:${{matrix.language}}"

vendor-new/win-dev-skills/.github/workflows/dependency-review.yml

@@ -0,0 +1,22 @@
+name: Dependency Review
+
+on:
+  pull_request:
+    branches: [ "main" ]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Dependency Review
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-severity: high
+          comment-summary-in-pr: on-failure

vendor-new/win-dev-skills/.github/workflows/pr-validation.yml

@@ -0,0 +1,62 @@
+name: PR validation
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  catalog-check:
+    name: Catalog check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+
+      # Every entry resolves (repo, commit, path, manifest, name, version) and
+      # the Copilot, Claude, and Codex catalogs list the same plugins at the same pin.
+      - name: Check catalogs
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: node scripts/check-catalogs.mjs
+
+  vally-lint:
+    name: Local plugin lint (vally)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+
+      # Same linter and version github/awesome-copilot runs on external plugins.
+      # Only plugins stored in this repo are linted; remote plugins are linted
+      # in their own repositories.
+      - name: Install local plugin lint dependencies
+        run: npm ci --prefix scripts/vally --no-audit --no-fund
+
+      - name: Check WinDbg package
+        run: node scripts/validate-windbg.mjs
+
+      - name: Test WinDbg diagnosis validator
+        run: node scripts/tests/test-windbg-validator.mjs
+
+      - name: Lint local plugin skills
+        run: node scripts/vally/lint-skills.mjs
+
+      # Fixture-based self-test: a plugin stored in this repo is checked and linted.
+      - name: Test catalog tooling
+        run: node scripts/tests/test-catalog-tools.mjs

vendor-new/win-dev-skills/.github/workflows/release-post-merge.yml

@@ -0,0 +1,88 @@
+name: Release post-merge
+
+# On every push to main: if the catalog version changed, tag main HEAD as
+# vX.Y.Z. The catalog version is metadata.version in
+# .github/plugin/marketplace.json (the Catalog check keeps the Claude catalog
+# in sync). Pushes that don't change it are skipped.
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: write       # push tags
+
+# Serialize tag-creation across overlapping pushes to main so two workflow runs
+# can't race on the same tag.
+concurrency:
+  group: release-post-merge-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+
+  auto-tag:
+    name: Tag main HEAD as vX.Y.Z
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Read catalog version
+        id: ver
+        env:
+          BEFORE: ${{ github.event.before }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          CATALOG=.github/plugin/marketplace.json
+          VERSION=$(jq -r '.metadata.version' "$CATALOG")
+          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::$CATALOG metadata.version '$VERSION' is not valid semver. Refusing to tag."
+            exit 1
+          fi
+          PREVIOUS=""
+          if [[ -n "$BEFORE" && ! "$BEFORE" =~ ^0+$ ]] && git cat-file -e "$BEFORE:$CATALOG" 2>/dev/null; then
+            PREVIOUS=$(git show "$BEFORE:$CATALOG" | jq -r '.metadata.version // empty')
+          elif git cat-file -e "HEAD^1:$CATALOG" 2>/dev/null; then
+            PREVIOUS=$(git show "HEAD^1:$CATALOG" | jq -r '.metadata.version // empty')
+          fi
+          if [[ "$PREVIOUS" == "$VERSION" ]]; then
+            echo "::notice::Catalog version unchanged ($VERSION) — no tag."
+            echo "tag=" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "tag=v$VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Create and push tag (idempotent, SHA-checked)
+        if: steps.ver.outputs.tag != ''
+        env:
+          TAG: ${{ steps.ver.outputs.tag }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          git fetch --tags origin --quiet
+
+          # Same SHA = idempotent success. A tag on an earlier main commit (e.g.
+          # after reverting a bump) is left alone. Anything else fails loudly;
+          # never overwrite or accept a misplaced tag.
+          if git rev-parse --verify --quiet "refs/tags/$TAG^{}" >/dev/null; then
+            EXISTING_SHA=$(git rev-parse "refs/tags/$TAG^{}")
+            if [[ "$EXISTING_SHA" == "$GITHUB_SHA" ]]; then
+              echo "::notice::Tag $TAG already points at $GITHUB_SHA — nothing to do."
+              exit 0
+            fi
+            if git merge-base --is-ancestor "$EXISTING_SHA" "$GITHUB_SHA"; then
+              echo "::notice::Tag $TAG already exists at earlier commit $EXISTING_SHA — not moving it."
+              exit 0
+            fi
+            echo "::error::Tag $TAG already exists at $EXISTING_SHA but main HEAD is $GITHUB_SHA. Bump the catalog version instead of reusing one."
+            exit 1
+          fi
+
+          git config user.name  "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git tag -a "$TAG" -m "Release $TAG"
+          git push origin "$TAG"
+          echo "::notice::Tagged $GITHUB_SHA as $TAG."

vendor-new/win-dev-skills/.github/workflows/stale-issues.yml

@@ -0,0 +1,54 @@
+name: Close stale issues
+
+on:
+  schedule:
+    - cron: '0 0 * * *'  # Run daily at midnight UTC
+  workflow_dispatch:     # Allow manual trigger for testing
+
+permissions:
+  issues: write
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
+        with:
+          # Only process issues with this label
+          only-issue-labels: 'needs-author-response'
+          
+          # Mark stale after 14 days of no activity
+          days-before-issue-stale: 14
+          
+          # Close 7 days after being marked stale
+          days-before-issue-close: 7
+          
+          # Label to add when marking stale
+          stale-issue-label: 'stale'
+          
+          # Warning message when marking as stale
+          stale-issue-message: >
+            This issue has been automatically marked as stale because it has not had
+            recent activity after requesting information from the author. It will be
+            closed in 7 days if no further activity occurs.
+          
+          # Message when closing
+          close-issue-message: >
+            This issue was closed because it has been stale for 7 days with no activity.
+            Feel free to reopen if you have the requested information.
+          
+          # Remove these labels when issue becomes unstale (any comment/activity)
+          labels-to-remove-when-unstale: 'needs-author-response,stale'
+          
+          # Add this label when issue becomes unstale (author responded)
+          labels-to-add-when-unstale: 'needs-maintainer-response'
+          
+          # Exempt issues with these labels from stale processing
+          exempt-issue-labels: 'exempt-from-stale'
+          
+          # Don't process PRs
+          days-before-pr-stale: -1
+          days-before-pr-close: -1
+          
+          # Enable for testing - remove this line after verifying behavior
+          # debug-only: true