Skip to content

feat: add @aicoach chat participant for AI Engineer Coach data access#16

Open
mc5eamus wants to merge 33 commits into
mainfrom
feat/chat-with-my-data
Open

feat: add @aicoach chat participant for AI Engineer Coach data access#16
mc5eamus wants to merge 33 commits into
mainfrom
feat/chat-with-my-data

Conversation

@mc5eamus
Copy link
Copy Markdown
Collaborator

@mc5eamus mc5eamus commented May 18, 2026

  • Inspect the linked review comment context in src/mcp/tools.ts
  • Implement only the requested paging validation/schema constraints for aiEngineerCoach_sessions
  • Run targeted tests for MCP tools/formatters behavior
  • Run final verification and summarize the minimal change

- Implemented the @aicoach chat participant to provide conversational access to AI Engineer Coach data in VS Code chat.
- Registered tools for summarizing usage, analyzing activity, and providing insights through the chat interface.
- Created system prompts and follow-up suggestions to enhance user interaction.
- Added documentation for the chat participant feature, including usage examples and available commands.
- Developed formatters to transform raw Analyzer output into user-friendly JSON for chat responses.
@mc5eamus mc5eamus marked this pull request as draft May 18, 2026 13:30
@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 18, 2026

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 1 package(s) with unknown licenses.
See the Details below.

License Issues

.github/workflows/dependency-review.yml

PackageVersionLicenseIssue Type
actions/dependency-review-action5.*.*NullUnknown License
Denied Licenses: GPL-3.0, AGPL-3.0

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
actions/actions/dependency-review-action 5.*.* 🟢 7.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy🟢 9security policy file detected
Code-Review🟢 10all changesets reviewed
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 6branch protection is not maximal on development and all release branches
SAST🟢 9SAST tool detected but not run on all commits
npm/@eslint/config-helpers 0.6.0 UnknownUnknown
npm/@oxc-parser/binding-android-arm-eabi 0.130.0 UnknownUnknown
npm/@oxc-parser/binding-android-arm64 0.130.0 UnknownUnknown
npm/@oxc-parser/binding-darwin-arm64 0.130.0 UnknownUnknown
npm/@oxc-parser/binding-darwin-x64 0.130.0 UnknownUnknown
npm/@oxc-parser/binding-freebsd-x64 0.130.0 UnknownUnknown
npm/@oxc-parser/binding-linux-arm-gnueabihf 0.130.0 UnknownUnknown
npm/@oxc-parser/binding-linux-arm-musleabihf 0.130.0 UnknownUnknown
npm/@oxc-parser/binding-linux-arm64-gnu 0.130.0 UnknownUnknown
npm/@oxc-parser/binding-linux-arm64-musl 0.130.0 UnknownUnknown
npm/@oxc-parser/binding-linux-ppc64-gnu 0.130.0 UnknownUnknown
npm/@oxc-parser/binding-linux-riscv64-gnu 0.130.0 UnknownUnknown
npm/@oxc-parser/binding-linux-riscv64-musl 0.130.0 UnknownUnknown
npm/@oxc-parser/binding-linux-s390x-gnu 0.130.0 UnknownUnknown
npm/@oxc-parser/binding-linux-x64-gnu 0.130.0 UnknownUnknown
npm/@oxc-parser/binding-linux-x64-musl 0.130.0 UnknownUnknown
npm/@oxc-parser/binding-openharmony-arm64 0.130.0 UnknownUnknown
npm/@oxc-parser/binding-wasm32-wasi 0.130.0 UnknownUnknown
npm/@oxc-parser/binding-win32-arm64-msvc 0.130.0 UnknownUnknown
npm/@oxc-parser/binding-win32-ia32-msvc 0.130.0 UnknownUnknown
npm/@oxc-parser/binding-win32-x64-msvc 0.130.0 UnknownUnknown
npm/@oxc-project/types 0.130.0 UnknownUnknown
npm/@playwright/test 1.60.0 🟢 6.5
Details
CheckScoreReason
Maintained🟢 1030 commit(s) out of 30 and 6 issue activity out of 30 found in the last 90 days -- score normalized to 10
Code-Review🟢 9GitHub code reviews found for 29 commits out of the last 30 -- score normalized to 9
CII-Best-Practices⚠️ 0no badge detected
Vulnerabilities🟢 10no vulnerabilities detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
License🟢 10license file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1no published package detected
Token-Permissions⚠️ 0non read-only tokens detected in GitHub workflows
Binary-Artifacts🟢 6binaries present in source code
Dependency-Update-Tool🟢 10update tool detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
npm/@rolldown/binding-android-arm64 1.0.1 UnknownUnknown
npm/@rolldown/binding-darwin-arm64 1.0.1 UnknownUnknown
npm/@rolldown/binding-darwin-x64 1.0.1 UnknownUnknown
npm/@rolldown/binding-freebsd-x64 1.0.1 UnknownUnknown
npm/@rolldown/binding-linux-arm-gnueabihf 1.0.1 UnknownUnknown
npm/@rolldown/binding-linux-arm64-gnu 1.0.1 UnknownUnknown
npm/@rolldown/binding-linux-arm64-musl 1.0.1 UnknownUnknown
npm/@rolldown/binding-linux-ppc64-gnu 1.0.1 UnknownUnknown
npm/@rolldown/binding-linux-s390x-gnu 1.0.1 UnknownUnknown
npm/@rolldown/binding-linux-x64-gnu 1.0.1 UnknownUnknown
npm/@rolldown/binding-linux-x64-musl 1.0.1 UnknownUnknown
npm/@rolldown/binding-openharmony-arm64 1.0.1 UnknownUnknown
npm/@rolldown/binding-wasm32-wasi 1.0.1 UnknownUnknown
npm/@rolldown/binding-win32-arm64-msvc 1.0.1 UnknownUnknown
npm/@rolldown/binding-win32-x64-msvc 1.0.1 UnknownUnknown
npm/@rolldown/pluginutils 1.0.1 UnknownUnknown
npm/@types/node 25.9.1 🟢 6.6
Details
CheckScoreReason
Code-Review🟢 9Found 27/30 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
npm/@typescript-eslint/eslint-plugin 8.59.4 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 8Found 21/24 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/parser 8.59.4 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 8Found 21/24 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/project-service 8.59.4 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 8Found 21/24 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/scope-manager 8.59.4 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 8Found 21/24 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/tsconfig-utils 8.59.4 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 8Found 21/24 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/type-utils 8.59.4 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 8Found 21/24 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/types 8.59.4 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 8Found 21/24 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/typescript-estree 8.59.4 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 8Found 21/24 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/utils 8.59.4 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 8Found 21/24 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/visitor-keys 8.59.4 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 8Found 21/24 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@vitest/coverage-v8 4.1.6 UnknownUnknown
npm/@vitest/expect 4.1.6 UnknownUnknown
npm/@vitest/mocker 4.1.6 UnknownUnknown
npm/@vitest/pretty-format 4.1.6 UnknownUnknown
npm/@vitest/runner 4.1.6 UnknownUnknown
npm/@vitest/snapshot 4.1.6 UnknownUnknown
npm/@vitest/spy 4.1.6 UnknownUnknown
npm/@vitest/utils 4.1.6 UnknownUnknown
npm/brace-expansion 5.0.6 🟢 7.2
Details
CheckScoreReason
Code-Review🟢 3Found 9/23 approved changesets -- score normalized to 3
Maintained🟢 1017 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Pinned-Dependencies🟢 10all dependencies are pinned
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 9license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/eslint 10.4.0 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 8Found 20/25 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 9SAST tool detected but not run on all commits
npm/fast-uri 3.1.2 UnknownUnknown
npm/jiti 2.7.0 🟢 5.6
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 1Found 5/27 approved changesets -- score normalized to 1
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Maintained🟢 1028 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Security-Policy⚠️ 0security policy file not detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/knip 6.14.1 UnknownUnknown
npm/lint-staged 17.0.5 UnknownUnknown
npm/oxc-parser 0.130.0 UnknownUnknown
npm/playwright 1.60.0 🟢 6.5
Details
CheckScoreReason
Maintained🟢 1030 commit(s) out of 30 and 6 issue activity out of 30 found in the last 90 days -- score normalized to 10
Code-Review🟢 9GitHub code reviews found for 29 commits out of the last 30 -- score normalized to 9
CII-Best-Practices⚠️ 0no badge detected
Vulnerabilities🟢 10no vulnerabilities detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
License🟢 10license file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1no published package detected
Token-Permissions⚠️ 0non read-only tokens detected in GitHub workflows
Binary-Artifacts🟢 6binaries present in source code
Dependency-Update-Tool🟢 10update tool detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
npm/playwright-core 1.60.0 🟢 6.5
Details
CheckScoreReason
Maintained🟢 1030 commit(s) out of 30 and 6 issue activity out of 30 found in the last 90 days -- score normalized to 10
Code-Review🟢 9GitHub code reviews found for 29 commits out of the last 30 -- score normalized to 9
CII-Best-Practices⚠️ 0no badge detected
Vulnerabilities🟢 10no vulnerabilities detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
License🟢 10license file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1no published package detected
Token-Permissions⚠️ 0non read-only tokens detected in GitHub workflows
Binary-Artifacts🟢 6binaries present in source code
Dependency-Update-Tool🟢 10update tool detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
npm/postcss 8.5.15 🟢 5.5
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Code-Review⚠️ 0Found 2/27 approved changesets -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy🟢 10security policy file detected
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/preact 10.29.2 🟢 5.3
Details
CheckScoreReason
Maintained🟢 1011 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy⚠️ 0security policy file not detected
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/preact-render-to-string 6.7.0 🟢 5.5
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 7Found 7/9 approved changesets -- score normalized to 7
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy⚠️ 0security policy file not detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/rolldown 1.0.1 UnknownUnknown
npm/typescript-eslint 8.59.4 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 8Found 21/24 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/undici-types 7.24.6 🟢 8.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 25 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Security-Policy🟢 10security policy file detected
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 8binaries present in source code
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Vulnerabilities🟢 82 existing vulnerabilities detected
SAST🟢 9SAST tool detected but not run on all commits
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 77 contributing companies or organizations
npm/vite 8.0.13 🟢 7
Details
CheckScoreReason
Code-Review🟢 7Found 19/26 approved changesets -- score normalized to 7
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 5detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 5binaries present in source code
Pinned-Dependencies🟢 9dependency not pinned by hash detected -- score normalized to 9
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST🟢 7SAST tool is not run on all commits -- score normalized to 7
npm/vitest 4.1.6 UnknownUnknown
npm/yaml 2.9.0 🟢 7.2
Details
CheckScoreReason
Maintained🟢 1023 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 0Found 0/11 approved changesets -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST🟢 10SAST tool is run on all commits

Scanned Files

  • .github/workflows/dependency-review.yml
  • package-lock.json

@mc5eamus mc5eamus marked this pull request as ready for review May 18, 2026 15:05
@mc5eamus mc5eamus requested a review from aymenfurter May 18, 2026 15:05
@mc5eamus mc5eamus linked an issue May 18, 2026 that may be closed by this pull request
Comment thread src/mcp/tools.ts
Comment thread src/mcp/tools.ts Fixed
Comment thread src/mcp/tools.ts Fixed
Comment thread src/mcp/tools.ts Fixed
@mc5eamus mc5eamus requested review from aymenfurter and Copilot and removed request for aymenfurter May 20, 2026 21:43
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR adds a new @aicoach VS Code chat participant that can call registered Language Model tools to query the extension’s Analyzer data and synthesize coaching responses, along with supporting tool wrappers/formatters and user-facing documentation.

Changes:

  • Introduces @aicoach chat participant with slash commands and an agentic tool-calling loop (src/chat/*).
  • Adds a suite of vscode.lm tools that expose Analyzer metrics as JSON via formatter functions (src/mcp/*), and wires tool/participant registration into activation (src/extension.ts).
  • Updates extension contributions and docs to surface the chat feature (package.json, docs/*, README.extension.md, cspell.json).

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 9 comments.

Show a summary per file
File Description
src/mcp/tools.ts Registers LM tools and defines schemas/tool behaviors for Analyzer-backed queries.
src/mcp/formatters.ts Converts Analyzer outputs into compact JSON payloads intended for LLM consumption.
src/extension.ts Hooks tool registration and chat participant registration into extension activation.
src/chat/system-prompt.ts Builds the coaching persona prompt and tool-selection heuristics.
src/chat/participant.ts Implements @aicoach participant, slash commands, history handling, and tool-loop orchestration.
README.extension.md Adds a “Chat” section and onboarding step for @aicoach.
package.json Contributes the chat participant + languageModelTools definitions.
package-lock.json Lockfile updates from dependency resolution.
docs/content/features/chat.md Adds feature documentation for the chat participant and tool usage.
docs/content/features/_index.md Adds Chat section entry linking to the new doc page.
cspell.json Adds aicoach to the dictionary.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread src/chat/participant.ts
Comment thread src/chat/participant.ts Outdated
Comment thread src/mcp/formatters.ts Outdated
Comment thread src/mcp/formatters.ts
Comment thread src/mcp/tools.ts
Comment thread docs/content/features/chat.md
Comment thread docs/content/features/chat.md
Comment thread README.extension.md
Comment thread docs/content/features/chat.md
Agent-Logs-Url: https://github.com/microsoft/AI-Engineering-Coach/sessions/10ed291e-f4e4-4728-b87a-cde9736881b7

Co-authored-by: mc5eamus <19579342+mc5eamus@users.noreply.github.com>
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 13 out of 14 changed files in this pull request and generated 5 comments.

Comment thread src/mcp/tools.ts
Comment thread src/mcp/tools.ts
Comment thread src/chat/system-prompt.ts Outdated
Comment thread src/chat/participant.ts Outdated
Comment thread docs/content/features/chat.md
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
mc5eamus and others added 2 commits May 22, 2026 10:53
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Comment thread src/mcp/tools.ts Dismissed
@mc5eamus mc5eamus self-assigned this May 22, 2026
@aymenfurter aymenfurter added the enhancement New feature or request label May 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Coach Chat access

6 participants