Add cost-aware Workshop desk profiles

[jennyf19]

Summary

This updates The Workshop's Cairn canvas with cost-aware topic-desk launch profiles:

• open uses the repo profile: keeps the Workshop root available for cross-desk journals/artifacts while suppressing ambient Copilot plugin MCPs
• connected preserves every configured MCP/tool for work that needs external systems
• preserves the existing Agency-aware launcher for internal users and plain Copilot CLI for everyone else
• discovers plugin MCPs dynamically, so no environment-specific server names are shipped
• adds launch-profile tests and bumps signals-dashboard to 0.2.0

Why

A matched end-to-end Workshop workflow (own journal read, cross-desk artifact read, signal write, journal update, deterministic validation) produced equivalent outcomes across profiles.

On a tool-heavy environment, the interaction-safe repo profile versus the full loadout measured:

• 66.28% less input
• 62.98% less AIU
• 82.87% fewer tool-definition tokens
• 53.58% lower wall-clock

External users without ambient plugin MCPs retain effectively the same tool surface, plus explicit access to the verified Workshop root.

Compatibility and safety

• Agency remains preferred when installed; plain Copilot remains the fallback
• WORKSHOP_DESK_AGENT overrides remain authoritative and fail closed when unavailable
• Copilot plugin-MCP discovery fails open; Agency repo mode still suppresses Agency default MCPs
• explicitly Agency-configured plugins keep their non-MCP contributions
• only enabled Copilot plugin-scoped MCPs are dynamically disabled; user/repository/organization/built-in resources are preserved
• all executable/helper paths are resolved outside the Workshop
• trusted Windows .cmd/.bat shims use System32 cmd.exe with integration-tested quoting
• Windows Terminal App Execution Aliases are supported without trusting repository-local executables
• MCP names and profile inputs are validated
• repeated launch controls include desk/profile-specific accessible names

Canonical source

• Add cost-aware desk launch profiles jennyf19/the-workshop#13
• Support Windows Terminal app execution aliases jennyf19/the-workshop#14
• Address launch profile review feedback jennyf19/the-workshop#15
• Isolate Agency MCP discovery from wrapper processes jennyf19/the-workshop#16
• Label desk launch profile controls jennyf19/the-workshop#17

Validation

• npm run --prefix extensions/signals-dashboard test — 8 passed
• node --check extensions/signals-dashboard/extension.mjs
• npm run plugin:validate
• npm run build
• eng/fix-line-endings.sh
• generated marketplace version/description verified at 0.2.0
• all upstream checks pass
• all active Copilot review threads are resolved

[github-actions]

🔒 PR Risk Scan Results

Scanned 7 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	1
ℹ️ Info	0

Severity	Rule	File	Line	Match
🟠	unpinned-version-indicator	extensions/signals-dashboard/package.json	10	"@​​github/copilot-sdk": "latest"

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[Copilot]

Pull request overview

Adds cost-aware Workshop desk launch profiles while retaining full connectivity when needed.

Changes:

• Adds repo/connected profile selection and MCP discovery.
• Adds launch-profile tests and Windows handling.
• Updates documentation and bumps signals-dashboard to 0.2.0.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
plugins/the-workshop/README.md	Documents launch profiles.
extensions/signals-dashboard/package.json	Adds tests and bumps version.
extensions/signals-dashboard/launch-profile.test.mjs	Tests profile helpers.
extensions/signals-dashboard/launch-profile.mjs	Implements profile argument generation.
extensions/signals-dashboard/extension.mjs	Integrates profile discovery and launching.
extensions/signals-dashboard/.github/plugin/plugin.json	Updates extension metadata.
.github/plugin/marketplace.json	Regenerates marketplace metadata.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Suppressed comments (1)

extensions/signals-dashboard/extension.mjs:180

• exitCode only reflects the direct child. If a wrapper exits while a descendant keeps running (and, for example, keeps the stdout pipe open), timeout/overflow reaches this function with a non-null exitCode and returns without terminating the process group. That can leak an Agency/Copilot descendant even though discovery has already failed. Track and terminate the spawned tree independently of the parent’s exit state, while guarding against stale/reused PIDs.

    if (!child || child.exitCode !== null) return;

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Suppressed comments (1)

extensions/signals-dashboard/extension.mjs:812

• Each new profile control has the accessible name “connected”, so screen-reader users cannot tell which desk it will open when several cards are present. Include the desk name and profile in an aria-label (the visual text can remain unchanged).

        <button data-act="open" data-profile="connected" data-desk="${esc(sig.deskName)}"

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Suppressed comments (1)

extensions/signals-dashboard/launch-profile.mjs:77

• When discovery fails, discoverySucceeded is false but Agency still receives --no-default-mcps, so the resulting launch does not preserve the connected tool surface. This contradicts both the PR’s stated fail-open behavior and the canonical #13 requirement that discovery failure fall back to connected behavior. Gate this flag on successful discovery as well, and update the test that currently codifies removal of defaults after failure.

        if (useAgency) argv.push("--no-default-mcps");