HVE Core is a collection of agents, prompts, coding instructions, and skills for building repeatable software-development workflows with GitHub Copilot. It is intended for individuals and teams that want structured AI-assisted research, planning, implementation, and review, while the catalogue entries provide many of its reusable workflow components.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add microsoft/hve-core --skill session-log-canvas-updategit clone --depth 1 https://github.com/microsoft/hve-coreWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/microsoft/hve-core/session-log-canvas-update)<a href="https://agentmods.dev/skills/microsoft/hve-core/session-log-canvas-update"><img src="https://agentmods.dev/badge/skills/microsoft/hve-core/session-log-canvas-update/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/microsoft/hve-core/session-log-canvas-update"><img src="https://agentmods.dev/badge/skills/microsoft/hve-core/session-log-canvas-update.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00073 | $0.01716 |
| Opus 5.5 | $0.00029 | $0.00686 |
| Sonnet 5.5 | $0.00015 | $0.00343 |
| Haiku 4.5 | $0.00007 | $0.00172 |
Grade A, and why
session-log-canvas-update scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 15d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 71 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Session Log Canvas Update
Goal
Keep the Session Log canvas accurate when a new Copilot version changes what a session records. Find what changed between the schema the canvas was built against and the current one, then update the canvas so new and changed data renders correctly while sessions recorded by earlier versions stay readable.
This skill belongs to the HVE Core repository. Keep it directly under .github/skills/session-log-canvas-update/, outside package directories and plugin or VSIX membership. The canvas it maintains lives at .github/extensions/hve-core/session-log/.
Inputs
mode(optional):checkreports what changed and the work it implies without editing.update(default) also applies the changes and refreshes the baseline.schema(optional): which schema to compare. Accepts a path to asession-events.schema.json, an installed Copilot version, orlatest(default, the newest installed Copilot CLI package).
Success Criteria
- Every change to an event type the canvas handles is classified (needs code, already tolerated, or not used by the canvas) with the diff line that supports it.
- New persisted event types either render through a deliberate log kind or are recorded as intentionally generic; none is silently dropped.
- Sessions recorded by both the baseline version and the new version render without regressions: the canvas tests cover the old and new shapes with synthetic fixtures.
- Storage,
workspace.yaml, system prompt structure, and canvas SDK changes are checked even when the event schema diff is empty. - The baseline (
assets/event-shapes.json) describes the schema the updated canvas was verified against, and the style guide revision log names the change. - No session content appears in fixtures, tests, docs, reports, or responses.
Flow
- Find the versions in play. Run
node scripts/event-schema.mjs listfrom the skill root (ornode .github/skills/session-log-canvas-update/scripts/event-schema.mjs listfrom the repository root) to see installed Copilot CLI schemas. Read the baseline'ssourcein assets/event-shapes.json. For a VS Code session, also locate the schema bundled with VS Code at<VS Code app resources>/app/node_modules.asar.unpacked/@github/copilot-sdk-<platform>/schemas/session-events.schema.json, because the VS Code harness can run a newer runtime than the installed CLI. ThecopilotVersiona session recorded comes from itssession.startevent; the canvasget_session_summaryaction returns it. - Diff the schema. Run
node scripts/event-schema.mjs diff --schema <path|version|latest>for each relevant schema. The report lists handled types that changed (field by field), new event types with whether they persist, removed types, other changed types, and handled types the schema no longer defines. A field that union alternatives share lists every signature it can take, and a signature cut short by the script's size limits ends in…. Use--jsonwhen you need to process the result. - Check real sessions without reading content. Open the canvas on a session from the new version and call its
get_session_summaryaction:eventHealth.unknownTypeslists persisted types the canvas does not handle, andunreadableLinescounts lines it could not parse. The Details tab shows the same counts. Compare a few entries of each changed kind in the log against the expected rendering. - Read the release notes. The CLI package's
changelog.json(beside itsschemas/folder) lists changes per version; scan the versions between the baseline and the new version for session events, compaction, hooks, subagents, system prompt, storage, and extension or canvas changes. - Map each change to canvas code with references/coupling-map.md, and classify it:
- Changed field that the indexer reads: read the new location first and fall back to the old one so earlier sessions still render.
- New persisted type: decide whether it becomes a log entry, enriches an existing entry, updates counts or metadata, or stays generic. Add it to the indexer switch and
HANDLED_EVENT_TYPEStogether; a test enforces that they match. - Removed type or field: keep reading it while sessions recorded by earlier versions can still contain it.
- Ephemeral type: ignore unless it becomes persisted.
In
checkmode, stop here and report.
- Apply the changes. Add synthetic events for each new or changed shape to the canvas test fixtures (never copy real session text), extend the indexer, server, and UI as needed, and keep the log grammar consistent with the style guide. Update the style guide's Log Grammar table and revision log, and the README when user-visible behavior or actions change.
- Validate:
npm run test:extensionsandnode --test ".github/skills/session-log-canvas-update/tests/*.test.mjs". PR validation runs both suites in its Node test lane.node --checkon changed modules, andnpm run plugin:validate.- Markdown lint, spelling, table format, and frontmatter checks on changed Markdown.
- A browser check on synthetic fixtures only: confirm the page URL before each screenshot, and never capture the live canvas because it shows real session content.
- A host reload (
extensions_reload, then reopen the canvas) with the servedui/files matching disk.
- Refresh the baseline. Run
node scripts/event-schema.mjs snapshot --schema <the schema you verified against> --write, rerundiffagainst it to confirm a clean report, and commit the baseline with the canvas changes. Both commands exit non-zero without writing anything when the file defines no session event types.
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 15d ago First seen · 71 lines · 73 tokens per session scan A d9f3dc5d9860
session-log-canvas-update is a skill published in the GitHub repository microsoft/hve-core (1,606 stars, last pushed today), licensed MIT. It adds 73 tokens to every session and 1,716 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-24.
session-log-canvas-update compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| session-log-canvas-updatemicrosoft/hve-core | Skill | 1.6k | today | MIT | A | 73 | Claude Code |
| systematic-debuggingopen-metadata/OpenMetadata | Skill | 16k | today | Apache-2.0 | A | 37 | Claude Code |
| log-error-digestzebbern/claude-code-guide | Skill | 4.7k | yesterday | MIT | A | 71 | Claude Code, Codex |
| cwv-optimizeradobe/skills | Skill | 321 | today | Apache-2.0 | A | 112 | Claude Code |
| ci-fixersipyourdrink-ltd/bernstein | Skill | 1.2k | today | Apache-2.0 | A | 15 | Claude Code, Codex |
| incident-response-incident-responsermyndharis/antigravity-skills | Skill | 2.0k | yesterday | MIT | A | 36 | Claude Code, Codex |
| diagnosing-missing-recordingsPostHog/posthog | Skill | 41k | today | none | A | 76 | Claude Code, Codex |