Generated banner for Hve Core Installer
Generated logo for Hve Core Installer

Hve Core Installer

MicrosoftOfficialPublished by Microsoft

  • Skill
  • Workflow
  • Automation and integrations
  • MIT
  • Low risk
  • Has scripts

From the author

Decision-driven HVE-Core installer for the Copilot harness: the plugin, a team default in repository settings, a full component copy into the repository, the VS Code extension, and clone-based storage, with environment detection, validation, and MCP setup
— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The HVE-Core Installer is a guided, multi-phase tool designed to help users integrate HVE-Core components into their development environment. It supports multiple installation routes, including a direct plugin, team-wide defaults, native repository adoption, a VS Code extension, or a clone-based setup. The skill operates through two personas: an Installer that handles environment detection and execution, and a Validator that ensures the configuration is correctly recognized by Copilot. It includes robust checks for existing installations, environment-specific recommendations, and post-installation setup for MCP servers and repository settings.

What it does

  • Detects existing HVE-Core installations and offers upgrade or cleanup paths.
  • Provides a decision matrix to recommend the optimal installation method based on environment and team needs.
  • Automates the installation of plugins, extensions, or repository-native component copies.
  • Configures repository-level settings for team-wide HVE-Core availability.
  • Validates installations to ensure agents and skills are correctly loaded in Copilot Chat.
  • Handles post-installation tasks like gitignore updates and MCP server configuration.

When to use it

  • When you need to integrate HVE-Core agents and skills into a new or existing project.
  • When you require a team-wide, reproducible HVE-Core configuration.
  • When you need to pin a specific version of HVE-Core for development or customization.
  • When you want to migrate from an older, manual installation to a supported harness-based setup.

Advantages

  • Flexible installation options tailored to specific development environments.
  • Reduces configuration errors through automated validation and environment detection.
  • Supports both plugin-based and native repository-owned installation models.
  • Provides clear guidance on updating and maintaining HVE-Core components.
  • Ensures compatibility with the Copilot harness by managing settings and cleanup.

Usage examples

“Install HVE-Core in my project.”
The agent initiates the environment detection phase, asks for consent, and presents the five available installation routes.
“I want to set up HVE-Core for my whole team.”
The agent recommends the Team Default route and guides the user through creating the necessary .github/copilot/settings.json file.
“How do I update my HVE-Core installation?”
The agent identifies the current installation route and provides the specific commands or steps required to perform an upgrade.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/microsoft/hve-core-installer/download
  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip hve-core-installer.zip -d .agents/skills

Documentation by Microsoft

HVE-Core Installer Skill

Decision-driven installer for HVE-Core in VS Code's Copilot agent harness. It recommends the HVE-Core plugin first, then a team default in .github/copilot/settings.json, then native repository adoption, which copies every HVE-Core component into the project's own .github folders.

The VS Code extension remains an editor option. A clone is a storage choice that Copilot uses as a plugin from source or, for a copy inside the project's checkout, through folders declared in .github/copilot/settings.json. The skill also validates the result and configures MCP servers.

Role Definition

Operate as two collaborating personas:

  • The Installer persona detects the environment, guides route selection, and executes installation steps

  • The Validator persona verifies installed folders and repository settings, then has the user confirm that HVE-Core agents and skills appear in Copilot Chat

The Installer persona handles all detection and execution. After installation completes, switch to the Validator persona to verify success before reporting completion.

Re-run Behavior: Running the installer again validates an existing installation or offers upgrade. Safe to re-run anytime.

Required Phases

PhaseNamePurpose
1Environment DetectionObtain consent and check for earlier HVE-Core installs
2Install Route SelectionChoose the plugin, team default, native adoption, extension, or clone route
3Environment Detection & Decision MatrixFor native adoption and clones: detect the environment and recommend where to keep the clone
4Installation MethodsClone HVE-Core and, for the clone route, connect the clone to Copilot
5ValidationVerify the clone before it is used
6Post-Installation SetupConfigure gitignore and MCP servers, then reload the window and check Copilot Chat
7Component InstallationNative adoption: copy every component into the project's .github folders

Flow paths:

  • Plugin, team default, and extension routes: Phase 1 → Phase 2 → Phase 6 → Complete

  • Native adoption: Phase 1 → Phase 2 → Phase 3 → Phase 4 → Phase 5 → Phase 7 → Phase 6 → Complete

  • Clone route: Phase 1 → Phase 2 → Phase 3 → Phase 4 → Phase 5 → Phase 6 → Complete

For native adoption from a clone the user already has, skip Phases 3 and 4 and validate that clone in Phase 5.

[!IMPORTANT] Install HVE-Core through one route at a time. Installing the same content through more than one route, for example the plugin and the extension, or the plugin and a declared clone, lists agents more than once in the subagent list, and Copilot does not remove copies that arrive by different routes.

Phase 1: Environment Detection

Before presenting options, obtain consent and check what is already installed.

Present the following and await explicit consent:

🚀 HVE-Core Installer

I'll help you install HVE-Core agents, instructions and skills.

Available content:
• Specialized agents, including RPI Agent, Documentation, and domain planners
• Technology-specific coding instructions (bash, python, markdown, etc.)
• Domain-specific skills (pr-reference, etc.)

I'll recommend an install route. If your route needs a clone, I'll ask 2-3 questions about your setup first.

Would you like to proceed?

If user declines, respond: "Installation cancelled. You can invoke this skill anytime to restart."

Existing Install Check

Upon consent, look for HVE-Core content that is already installed:

  • .hve-tracking.json at the workspace root means components were copied into the repository. Offer to upgrade them through native adoption, which runs Phase 7 in upgrade mode.

  • .github/copilot/settings.json that enables hve-core@hve-core or declares folders from an HVE-Core clone means the team default or a declared clone is in place.

  • Ask whether the user has installed the HVE-Core plugin or the HVE Core extension.

  • VS Code settings that list HVE-Core folders come from an earlier version of this installer. Note the files that hold them. Phase 6 offers the cleanup below once the user confirms HVE-Core in a Copilot session.

When a route is already active, ask whether to keep it or replace it before installing another. Then proceed to Phase 2.

Earlier Location Settings Cleanup

Earlier versions of this installer added HVE-Core folders to chat.agentFilesLocations, chat.instructionsFilesLocations, chat.agentSkillsLocations, chat.promptFilesLocations, and chat.hookFilesLocations. Those settings are editor-only: VS Code forwards files from those locations, but Copilot CLI and the GitHub Copilot app do not read them. Kept beside a new route, they deliver the same content twice.

HVE-Core supports only the Copilot harness. VS Code's Local harness doesn't load the skills: preloads that HVE-Core agents depend on, and removing these settings while the user still works in Local hides the agents Local found through them. Offer the cleanup only after the user confirms both of these:

  • Their chat sessions use the Copilot harness. VS Code shows the harness at the start of the chat title.

  • A Copilot session shows HVE-Core, using the agent and skill checks from the final completion report in Phase 6.

When the user is still on Local, explain that HVE-Core supports only the Copilot harness and that they switch by starting a new chat and selecting Copilot in the Session Target control before the first prompt. Keep the settings until the user confirms both points, and report "⏭️ Kept earlier location settings until a Copilot session shows HVE-Core".

Look in .vscode/settings.json, any .code-workspace file, and the customizations.vscode.settings block of .devcontainer/devcontainer.json for entries whose paths point into an HVE-Core clone, such as ../hve-core, .hve-core, /workspaces/hve-core, or lib/hve-core. For each file with such entries:

  1. Show the user the HVE-Core entries it holds.

  2. Get approval under Checkpoint 3 (see Authorization Guardrails).

  3. Remove only the HVE-Core entries. Remove a setting only when it has no entries left, and leave unrelated entries alone.

  4. Report "✅ Removed earlier HVE-Core location settings from [file]", or "⏭️ Kept earlier location settings in [file]" when the user declines.

After removing entries, ask the user to run Developer: Reload Window and repeat the agent and skill checks, so they confirm that the installed route, not the old settings, delivers HVE-Core.

Phase 2: Install Route Selection

Present the route choice before any environment detection. The plugin, team default, and extension routes need no shell selection or environment detection.

Checkpoint 2: Install Route Choice

Present the following choice:

<!-- <install-route-checkpoint> -->

🚀 Choose How to Install HVE-Core

**Option 1: Plugin (Recommended)**
Install the HVE-Core plugin with two commands in Copilot Chat.
• 📦 All agents, skills, and instructions
• 🔄 Updates from the Plugins page

**Option 2: Team Default**
I add .github/copilot/settings.json so Copilot offers the plugin
to everyone who opens this repository.

**Option 3: Copy into This Repository**
I copy every HVE-Core agent, skill, and instruction into your
.github folders. Your repository owns the copies.

**Option 4: VS Code Extension**
Install from the VS Code Marketplace. Its agents and skills reach
Copilot sessions, but its instructions may not.

**Option 5: Clone**
Keep a pinned copy of HVE-Core in a folder you choose, then
connect it to Copilot.

Use one route at a time. Which would you prefer? (1-5)

<!-- </install-route-checkpoint> -->

User input handling:

  • "1", "plugin" → Plugin Route

  • "2", "team", "team default" → Team Default Route

  • "3", "copy", "adopt", "native", "components" → Native adoption: continue to Shell Selection and Prerequisites

  • "4", "extension", "vsix" → Extension Installation Execution

  • "5", "clone", "submodule" → Clone route: continue to Shell Selection and Prerequisites

  • Unclear response → Ask for clarification

Recommend a route other than the plugin when:

  • A team wants Copilot to offer HVE-Core to everyone who opens the repository (Option 2)

  • The repository should own and customize its copy of HVE-Core (Option 3)

  • The user needs a pinned copy of HVE-Core or plans to edit HVE-Core itself (Option 5)

Plugin Route

The plugin carries the full set: agents, skills, and path-specific instructions. Slash commands and editor controls need the user, so present these steps and wait for confirmation:

<!-- <plugin-install-steps> -->

📦 Install the HVE-Core Plugin

In Copilot Chat with the Copilot harness, send these commands one at a time:
  /plugin marketplace add microsoft/hve-core
  /plugin install hve-core@hve-core

Or open the Agent Customizations editor, select Plugins, add the
microsoft/hve-core marketplace, and install hve-core.

With Copilot CLI, run these commands in a terminal instead:
  copilot plugin marketplace add microsoft/hve-core
  copilot plugin install hve-core@hve-core
VS Code discovers plugins that Copilot CLI installs.

Reply "done" when the plugin is installed.

<!-- </plugin-install-steps> -->

Run the Copilot CLI commands only when the user asks you to. After the user confirms, proceed to Phase 6.

Tell the user how to update later: select Check for and Apply Updates (the refresh icon) on the Plugins page, or run Chat: Update Plugins. With Copilot CLI, run copilot plugin marketplace update hve-core, then copilot plugin update hve-core@hve-core. After any update, run Developer: Reload Window.

Team Default Route

A project can commit .github/copilot/settings.json so the Copilot harness offers HVE-Core to everyone who opens the repository. Each person can turn optional plugins off on the Plugins page, and enterprise-managed settings take precedence over these defaults.

Get approval under Checkpoint 3, then create .github/copilot/settings.json with the content below. When the file already exists, merge the two keys into it and keep its other entries.

<!-- <team-default-settings> -->

{
  "extraKnownMarketplaces": {
    "hve-core": {
      "source": {
        "source": "github",
        "repo": "microsoft/hve-core"
      }
    }
  },
  "enabledPlugins": {
    "hve-core@hve-core": true
  }
}

<!-- </team-default-settings> -->

The marketplace key must match the marketplace name, hve-core. Report "✅ Added the HVE-Core plugin default to .github/copilot/settings.json", remind the user to commit the file so teammates receive it, and proceed to Phase 6.

Extension Installation Execution

The ise-hve-essentials.hve-core extension is an editor option. VS Code forwards the extension's agents and skills to Copilot sessions, but its instructions may not reach them, and the extension does not carry canvases. Recommend the plugin when the user needs the instructions.

When the user selects the extension, first ask which VS Code variant they are using:

<!-- <vscode-variant-prompt> -->

Which VS Code variant are you using?

  [1] VS Code (stable)
  [2] VS Code Insiders

Your choice? (1/2)

<!-- </vscode-variant-prompt> -->

User input handling:

  • "1", "code", "stable" → Use code CLI

  • "2", "insiders", "code-insiders" → Use code-insiders CLI

  • Unclear response → Ask for clarification

Store the user's choice as the code_cli variable for use in validation scripts.

Display progress message:

📥 Installing HVE Core extension from marketplace...

Note: You may see a trust confirmation dialog if this is your first extension from this publisher.

Execute VS Code CLI command:

<code_cli> --install-extension ise-hve-essentials.hve-core

After command execution, proceed to Extension Validation.

Extension Validation

Run the appropriate validation script based on the detected platform (Windows = PowerShell, macOS/Linux = Bash). Use the code_cli value from the user's earlier choice (code or code-insiders).

PowerShell: Run scripts/validate-extension.ps1 with the code_cli variable set.

Bash: Run scripts/validate-extension.sh with the code_cli variable set.

Extension Success Report

Upon successful validation, display:

<!-- <extension-success-report> -->

✅ Extension Installation Complete!

The HVE Core extension has been installed from the VS Code Marketplace.

📦 Extension: ise-hve-essentials.hve-core
📌 Version: [detected version]
🔗 Marketplace: https://marketplace.visualstudio.com/items?itemName=ise-hve-essentials.hve-core

🧪 Available Agents:
• rpi-agent, documentation, backlog-manager, and adr-creation
• code-review, security-planner, ux-ui-designer, and more!

ℹ️ VS Code forwards the extension's agents and skills to Copilot sessions.
   Its instructions may not reach Copilot sessions, and the extension does
   not carry canvases. Use the plugin when you need the instructions.

📋 Configuring optional settings...

<!-- </extension-success-report> -->

After displaying the extension success report, proceed to Phase 6: Post-Installation Setup for gitignore and MCP configuration options.

Extension Error Recovery

If extension installation fails, provide targeted guidance:

<!-- <extension-error-recovery> -->

Error ScenarioUser MessageRecovery Action
Trust dialog declined"Installation was cancelled. You may have declined the publisher trust prompt."Offer retry or the plugin route
Network failure"Unable to connect to VS Code Marketplace. Check your network connection."Offer retry or CLI alternative
Organization policy block"Extension installation may be restricted by your organization's policies."Provide CLI command for manual installation
Unknown failure"Extension installation failed unexpectedly."Offer the plugin route as a fallback

<!-- </extension-error-recovery> -->

Flow Control After Failure:

If extension installation fails and user cannot resolve:

  • Offer: "Would you like to install the HVE-Core plugin instead? (yes/no)"

  • If yes: Continue to the Plugin Route

  • If no: End session with manual installation instructions

Shell Selection and Prerequisites

Native adoption and the clone route run scripts, so ask for a shell first:

  • Ask: "Which shell would you prefer? (powershell/bash)"

  • Shell detection rules:

    • "powershell", "pwsh", "ps1", "ps" → PowerShell

    • "bash", "sh", "zsh" → Bash

    • Unclear response → Windows = PowerShell, macOS/Linux = Bash

Before cloning, verify git is available:

  • Run: git --version

  • If fails: "Git is required to clone HVE-Core. Install git, or choose the plugin route instead."

When the user selects Bash, also verify jq is available:

  • Run: jq --version

  • If fails: "jq is required by the Bash component scripts. Install jq or choose PowerShell."

Then run the Environment Detection Script and continue to Phase 3.

Environment Detection Script

Run the appropriate detection script based on the user's shell:

PowerShell: Run scripts/detect-environment.ps1

Bash: Run scripts/detect-environment.sh

Phase 3: Environment Detection & Decision Matrix

Phase 3 recommends where to keep the clone. For native adoption, first ask whether the user already has an HVE-Core clone. When they do, use its path as the copy source and skip to Phase 5.

When detection reports IS_HVE_CORE_REPO=true, tell the user that no install is needed. Copilot discovers the repository's own .github/agents, .github/skills, and .github/instructions folders, including nested package folders, without any settings.

Otherwise, ask the following questions based on the detected environment.

Question 1: Environment Confirmation

Present options filtered by detection results:

<!-- <question-1-environment> -->

### Question 1: What's your development environment?

Based on my detection, you appear to be in: [DETECTED_ENV_TYPE]

Please confirm or correct:

| Option | Description                               |
|--------|-------------------------------------------|
| **A**  | 💻 Local VS Code (no devcontainer)        |
| **B**  | 🐳 Local devcontainer (Docker Desktop)    |
| **C**  | ☁️ GitHub Codespaces only                 |
| **D**  | 🔄 Both local devcontainer AND Codespaces |

Which best describes your setup? (A/B/C/D)

<!-- </question-1-environment> -->

Question 2: Team or Solo

<!-- <question-2-team> -->

### Question 2: Team or solo development?

| Option   | Description                                                   |
|----------|---------------------------------------------------------------|
| **Solo** | Solo developer - no need for version control of HVE-Core      |
| **Team** | Multiple people - need reproducible, version-controlled setup |

Are you working solo or with a team? (solo/team)

<!-- </question-2-team> -->

Question 3: Update Preference

Ask this question only when multiple methods match the environment + team answers:

<!-- <question-3-updates> -->

### Question 3: Update preference?

| Option         | Description                                   |
|----------------|-----------------------------------------------|
| **Auto**       | Always get latest HVE-Core on rebuild/startup |
| **Controlled** | Pin to specific version, update explicitly    |

How would you like to receive updates? (auto/controlled)

<!-- </question-3-updates> -->

Decision Matrix

Use this matrix to recommend where to keep the clone and how Copilot uses it. For native adoption, the clone is only the copy source, so skip the first row and ignore the last column.

<!-- <decision-matrix> -->

EnvironmentTeamUpdatesRecommended MethodCopilot Uses It Through
Any (simplest)Any-Plugin (Option 1, no clone needed)The plugin
Local (no container)Solo-Method 1: Peer ClonePlugin from source
Local (no container)TeamControlledMethod 6: Submodule.github/copilot/settings.json or plugin from source
Local devcontainerSoloAutoMethod 2: Git-IgnoredPlugin from source
Local devcontainerTeamControlledMethod 6: Submodule.github/copilot/settings.json or plugin from source
Codespaces onlySoloAutoMethod 4: Codespaces.github/copilot/settings.json
Codespaces onlyTeamControlledMethod 6: Submodule.github/copilot/settings.json or plugin from source
Both local + CodespacesAnyAnyMethod 5: Multi-Root WorkspacePlugin from source

<!-- </decision-matrix> -->

Folders declared in .github/copilot/settings.json must sit inside the project's checkout. Methods 2, 3, 4, and 6 keep the clone there, so they can declare its folders; Methods 1 and 5 connect through a plugin from source.

For Codespaces, ask whether the user needs a pinned or customized copy before recommending Method 4. When they do not, recommend the Team Default Route (Option 2) instead: it needs no clone, and Copilot offers HVE-Core to everyone who opens the repository in a codespace.

Method Selection Logic

After gathering answers:

  1. Match answers to decision matrix

  2. Present recommendation with rationale

  3. Offer alternative if user prefers different approach

<!-- <recommendation-template> -->

## 📋 Your Recommended Setup

Based on your answers:
* **Environment**: [answer]
* **Team**: [answer]
* **Updates**: [answer]

### ✅ Recommended: Method [N] - [Name]

**Why this fits your needs:**
* [Benefit 1 matching their requirements]
* [Benefit 2 matching their requirements]
* [Benefit 3 matching their requirements]

**How Copilot uses it:** [Plugin from source, folders declared in .github/copilot/settings.json, or copy source for native adoption]

Would you like to proceed with this method, or see alternatives?

<!-- </recommendation-template> -->

Phase 4: Installation Methods

Each clone method, and both ways to connect a clone to Copilot, are documented end to end in references/installation-methods.md. Follow the method resolved by the decision matrix there. For native adoption, clone the source and leave it unconnected. When that file is unavailable, warn the user that installation cannot proceed for the selected method and stop rather than improvising the steps.

Phase 5: Validation (Validator Persona)

After installation completes, switch to the Validator persona and verify the clone.

[!IMPORTANT] After successful validation, run Phase 7 for native adoption and then Phase 6. For the clone route, proceed to Phase 6.

Validation Workflow

Run validation based on the selected method. Set the base path variable before running:

MethodBase Path
1../hve-core
2, 3, 4.hve-core
5Check workspace file
6lib/hve-core

For a clone the user already had, use its path as the base path with method 1, which checks only the agents, instructions, and skills folders.

PowerShell: Run scripts/validate-installation.ps1 with the method and basePath variables set.

Bash: Run scripts/validate-installation.sh with the method number and base path as arguments.

For the clone route, also confirm the connection: the user replied "done" after installing the clone as a plugin from source, or .github/copilot/settings.json declares the clone's three folders.

Success Report

Upon successful validation, display:

<!-- <success-report> -->

✅ Core Installation Complete!

Method [N]: [Name] installed successfully.

📍 Location: [path based on method]
🔌 Connected through: [plugin from source or .github/copilot/settings.json]
📖 Documentation: https://github.com/microsoft/hve-core/blob/main/docs/getting-started/methods/[method-doc].md

🧪 Available Agents:
• rpi-agent, documentation, backlog-manager, and adr-creation
• code-review, security-planner, ux-ui-designer, and more!

📋 Configuring optional settings...

<!-- </success-report> -->

For native adoption, skip this report. Display "✅ HVE-Core source ready at [path]" and proceed to Phase 7.

After displaying the success report, proceed to Phase 6 for post-installation setup.

Phase 6: Post-Installation Setup

Read references/post-installation-setup.md and perform every step it specifies before continuing. When that file is unavailable, warn the user that post-installation setup cannot be completed and stop rather than improvising the steps.

Phase 7: Component Installation and Upgrade

Read references/component-installation.md and follow its component installation and upgrade procedures exactly, including every confirmation gate it defines. Phase 7 runs only for native adoption, including upgrade mode when .hve-tracking.json exists.

For Methods 3 and 5, and for a clone the user already had, verify the pre-existing HVE-Core clone's configured upstream source before collision detection or copy, using the warning and confirmation behavior in that reference. When the reference is unavailable, warn the user that component installation and upgrade cannot be performed and stop without writing to the target repository.

Error Recovery

Provide targeted guidance when steps fail:

<!-- <error-recovery> -->

ErrorTroubleshooting
Not in git repoRun from within a git workspace; verify git --version
Clone failedCheck network to github.com; verify git credentials and write permissions
Validation failedRepository may be incomplete; delete HVE-Core directory and re-run installer
Settings update failedVerify .github/copilot/settings.json is valid JSON and check write permissions
Declared folders not loadingTrust the workspace folder; declared folders load only in a trusted folder and must be literal paths inside the checkout
Agents listed twiceMore than one route is installed; keep one route and remove the others
Agents or skills missingConfirm the chat uses the Copilot harness, run Developer: Reload Window, then start a new chat session

<!-- </error-recovery> -->

Rollback

To remove a failed or unwanted installation:

Route or MethodCleanup
PluginManage hve-core on the Plugins page of the Agent Customizations editor
Team defaultRemove the hve-core entries from extraKnownMarketplaces and enabledPlugins in .github/copilot/settings.json
Native adoptionDelete .hve-tracking.json and any copied .github/agents/, .github/prompts/, .github/instructions/, or .github/skills/ content you no longer need
ExtensionVS Code → Extensions → HVE Core → Uninstall
1 (Peer Clone)rm -rf ../hve-core
2 (Git-Ignored)rm -rf .hve-core
3-4 (Mounted/Codespaces)Remove the mount or postCreateCommand from devcontainer.json and rebuild the container; for Method 4, also delete .hve-core
5 (Multi-Root)Delete .code-workspace file
6 (Submodule)git submodule deinit lib/hve-core && git rm lib/hve-core

For a clone, also undo its connection: manage a plugin installed from source on the Plugins page, or remove the clone's folders from agentDirectories, skillDirectories, and instructionDirectories in .github/copilot/settings.json. When an earlier installer version added HVE-Core entries to the chat.*Locations settings, remove them as described in Earlier Location Settings Cleanup. Then run Developer: Reload Window.

Authorization Guardrails

Never modify files without explicit user authorization. Always explain changes before making them. Respect denial at any checkpoint.

Checkpoints requiring authorization:

  1. Initial Consent (Phase 1), before starting detection

  2. File Change Authorization (Checkpoint 3), before writing .github/copilot/settings.json, devcontainer.json, or a .code-workspace file, and before removing earlier location settings

Checkpoint 3: File Change Authorization

Before each of those changes, present the following:

⚙️ File Update

I will now update [file] for HVE-Core.

Changes to be made:
• [Each key, path, or entry to add or remove]

⚠️ Authorization Required: Do you authorize these changes? (yes/no)

If the user declines, respond "No changes were made to [file]." Then skip the change and explain how the route is affected, or stop when the route cannot work without it.

Output Format Requirements

Progress Reporting

Use these exact emojis for consistency:

In-progress indicators (always end with ellipsis ...):

  • "📂 Detecting environment..."

  • "🔍 Asking configuration questions..."

  • "📋 Recommending installation method..."

  • "📥 Installing HVE-Core..."

  • "🔍 Validating installation..."

  • "⚙️ Updating settings..."

  • "🛡️ Configuring gitignore..."

  • "📡 Configuring MCP servers..."

Completion indicators:

  • "✅ [Success message]"

  • "❌ [Error message]"

  • "⏭️ [Skipped message]"

Success Criteria

The installation succeeds when the user has one install route in place, every file change was authorized, any clone passed validation, the user ran Developer: Reload Window, and the agent and skill checks for that route passed in Copilot Chat.

It fails when detection fails, a clone or submodule fails, validation finds missing directories, a settings or copy step fails, or the agent and skill checks still fail after a reload.

Files

SECURITY.md


title: HVE Core Installer Skill Security Model description: STRIDE threat model for the hve-core-installer skill organized by assets, adversaries, and trust buckets (source clone and plugin manifest, target repository writes, tracking manifest and eject, caller process and local tools) with in-code mitigations, verified platform coverage, and acknowledged enterprise readiness gaps author: microsoft/hve-core ms.date: 2026-10-31 ms.topic: reference estimated_reading_time: 11 keywords:

  • security

  • STRIDE

  • installer

  • symlink

  • threat model


<!-- markdownlint-disable-file -->

HVE Core Installer Skill Security Model

This document records the STRIDE threat model for the hve-core-installer skill. The skill ships 16 scripts as 8 behaviorally equivalent PowerShell and Bash pairs under scripts/: component-copy, collision-detection, detect-environment, eject, file-status-check, upgrade-detection, validate-extension, and validate-installation. The model is organized by trust bucket: Source clone and plugin manifest (B1), Target repository writes (B2), Tracking manifest and eject (B3), and Caller process and local tools (B4). Each bucket enumerates all six STRIDE categories with the in-code mitigations that address them. Assets and adversaries are enumerated first. Acknowledged enterprise readiness gaps are listed at the end.

The skill guides an operator through installing HVE Core into their own repository. For clone-based methods, the scripts copy selected agents, prompts, instructions, and skills from a local HVE Core clone into the target repository, then record what was installed in .hve-tracking.json. The scripts handle no credentials, open no listener, and make no network requests. They run with the caller's privileges against local files and invoke only jq (Bash), git rev-parse (environment detection), and, for extension validation, the VS Code CLI.

See also: repo-wide STRIDE model. This skill participates in the repository-wide threat model at docs/security/security-model.md and is registered in its Skill Security Models section.

Executive Summary

The installer's highest-risk behavior is writing files into a user's repository from a source clone that may be a fork or a substituted local checkout. Component copy validates every requested path against the source plugin.json membership before the first write.

Links are refused on both sides of a copy:

  • on the source side, anywhere between the source root and a component;

  • on the target side, anywhere between the target root and a destination;

  • at the tracking manifest itself.

Target containment is re-verified immediately before each write, which narrows but does not eliminate the check-to-write race. The upstream-origin check is advisory. The operator remains responsible for trusting the content of the source they install from. Residual risk concentrates in that content trust, the check-to-write race, and platforms where containment has not been exercised by execution.

Security Posture Overview
DimensionValue
Runtime surfaceLocal PowerShell and Bash twins; file copy into a target repository; jq, git rev-parse, and VS Code CLI subprocesses
Trust bucketsB1 source clone and plugin manifest, B2 target repository writes, B3 tracking manifest and eject, B4 caller process and local tools
CredentialsNone handled or persisted
Network egressNone from the scripts
Open residual gaps7 (Spoofing-Med: source content is trusted after an advisory origin check)
Platform Verification

Containment claims in this model were verified by execution on these platforms:

PlatformEvidenceResult
Windows 11, PowerShell 7.6.6tests/component-copy.Tests.ps1 and tests/eject.Tests.ps1 run nativelySymlink, directory junction, check-to-write, source-link, and manifest-link cases pass. The junction case runs and passes rather than skipping
Linux (Ubuntu under WSL), PowerShell 7.5 with Bash and jqThe full installer Pester suite, including PowerShell and Bash parity cases. The same suite runs in CI on ubuntu-latestAll containment and parity cases pass; the Windows-only junction case skips

Git for Windows ships with core.symlinks=false. With that default, a cloned repository materializes committed symlinks as plain text files containing the link target, so a symlink delivered through a cloned fork does not reach the installer as a link. This was observed by cloning a repository containing a symlink entry with Git for Windows 2.55. Real links appear only when symlinks are enabled (core.symlinks=true) and the account can create them. Per the Git for Windows documentation, that means an Administrator, Developer Mode, or an explicit privilege grant. This lowers the likelihood of link-based threats on a default Windows install. On Linux and macOS, cloned symlinks materialize by default, and the refusals in B1 and B2 apply.

macOS was not exercised (G-TAM-2). Bash under Git for Windows was not exercised (G-TAM-3).

Contents

  • System Description

  • Trust Boundaries

  • Assets

  • Adversaries

  • Bucket B1: Source clone and plugin manifest

  • Bucket B2: Target repository writes

  • Bucket B3: Tracking manifest and eject

  • Bucket B4: Caller process and local tools

  • Enterprise Readiness Gaps

  • References

System Description

Components
  1. scripts/component-copy.ps1 and scripts/component-copy.sh: resolve requested components against the source plugin.json, validate every path, refuse links on the source and target sides, copy files, and write .hve-tracking.json.

  2. scripts/collision-detection.ps1 and scripts/collision-detection.sh: run component copy in report-only mode, so the pre-write check resolves components exactly as the copy does. Nothing is written.

  3. scripts/eject.ps1 and scripts/eject.sh: mark a tracked component ejected in .hve-tracking.json, so future upgrades skip it. The files stay on disk.

  4. scripts/file-status-check.ps1 and scripts/file-status-check.sh: compare each tracked file's current SHA-256 hash with the recorded hash, and report managed, modified, ejected, or missing. Read-only.

  5. scripts/upgrade-detection.ps1 and scripts/upgrade-detection.sh: compare the recorded version with the source package.json version, and report the recorded selection. Read-only.

  6. scripts/detect-environment.ps1 and scripts/detect-environment.sh: report whether the session is local, a dev container, or Codespaces. Read-only.

  7. scripts/validate-installation.ps1 and scripts/validate-installation.sh: check that the expected .github directories and method-specific configuration exist. Read-only.

  8. scripts/validate-extension.ps1 and scripts/validate-extension.sh: query the VS Code CLI for the installed HVE Core extension. Read-only.

Data Flow
flowchart TD
    accTitle: HVE Core Installer Data Flow
    accDescr: The installer reads a local HVE Core source clone and its plugin manifest, copies validated components into a target repository, writes a tracking manifest there, and queries local tools, all inside the operator workstation trust zone.
    subgraph SRC["Source clone (operator-chosen; may be a fork)"]
        PLUGIN["plugin.json + package.json"]
        FILES["Component source files"]
    end
    subgraph HOST["Operator Workstation (trust zone)"]
        COPY["component-copy<br/>(PowerShell / Bash)"]
        EJECT["eject"]
        READERS["file-status-check / upgrade-detection<br/>detect-environment / validate-*"]
        TOOLS["jq / VS Code CLI"]
    end
    subgraph TGT["Target repository"]
        OUT[".github/ components"]
        MAN[".hve-tracking.json"]
    end
    PLUGIN -->|"membership (read)"| COPY
    FILES -->|"read; links refused"| COPY
    COPY -->|"write; links refused, re-verified per write"| OUT
    COPY -->|"write; link refused"| MAN
    EJECT -->|"temp file + replace; link refused"| MAN
    MAN -->|"read"| READERS
    COPY -->|"fixed arguments"| TOOLS
    READERS -->|"fixed arguments"| TOOLS

Trust Boundaries

Boundary Diagram
┌──────────────────────────────────────┐
│ TRUST BOUNDARY: Source clone         │
│  ┌────────────────────────────────┐  │
│  │ plugin.json, package.json,     │  │
│  │ component source files         │  │
│  └────────────────────────────────┘  │
└──────────────────┬───────────────────┘
                   │ read (membership check, source links refused)
┌──────────────────▼───────────────────────────────────────┐
│ TRUST BOUNDARY: Operator Workstation                     │
│  ┌───────────────┐   ┌──────────┐   ┌──────────────────┐ │
│  │ installer     │   │ jq       │   │ VS Code CLI      │ │
│  │ scripts       │   │          │   │ (allow-listed)   │ │
│  └───────────────┘   └──────────┘   └──────────────────┘ │
└──────────────────┬───────────────────────────────────────┘
                   │ write (target links refused, re-verified per write)
┌──────────────────▼───────────────────┐
│ TRUST BOUNDARY: Target repository    │
│  ┌────────────────────────────────┐  │
│  │ .github/ components            │  │
│  │ .hve-tracking.json             │  │
│  └────────────────────────────────┘  │
└──────────────────────────────────────┘
Boundary Descriptions
BoundaryAssets ProtectedControls Enforced
Source cloneIntegrity of what is installedAdvisory upstream-origin check; plugin.json membership; .github/ manifest-path prefix; source-side link refusal; exclusions
Operator WorkstationCaller process, local toolsArray arguments (no shell); jq --arg data binding; VS Code CLI name allow-list with fixed arguments
Target repositoryFiles outside the target root; tracking manifestPath validation; target ancestor link refusal re-verified per write; manifest link refusal; schema gate before any write

Assets

IdAssetLifetimeNotes
A1Files outside the target rootPersistentMust never be written by the installer
A2Files outside the source clonePersistentMust never be read into the target repository
A3Installed components in the targetPersistedAgents, prompts, instructions, and skills later loaded by Copilot in the user's repository
A4.hve-tracking.jsonPersistedRecords source, version, selection, and per-file SHA-256 hash and status
A5Source clone contentOperator-managedChosen by the operator; may be upstream, a fork, or a local development checkout
A6jq, git, and VS Code CLI binariesExternal, PATH-resolvedUnpinned host dependencies (G-SUP-1)

Adversaries

IdAdversaryIn-scope mitigations
ADV-aAuthor of a malicious fork or substituted source cloneAdvisory origin check with explicit confirmation; membership in the source plugin.json; source-side link refusal. Content of declared components is trusted (G-SPF-1)
ADV-bAuthor of a target repository containing planted linksTarget ancestor link refusal re-verified immediately before each write; manifest link refusal; refusal before any write
ADV-cLocal process racing the check and the writePer-write re-verification narrows the window; the check and the write are not atomic (G-TAM-1)
ADV-dCaller or agent supplying adversarial component pathsRejects control characters, backslashes, absolute paths, drive letters, empty segments, . and .., unknown fields, non-members, and duplicate targets
ADV-eAnyone who can edit files in the target repositorySHA-256 status detects local modification of tracked files, but the manifest is not integrity-protected (G-TAM-4)

Bucket B1: Source clone and plugin manifest

Spoofing
  • For the mounted and multi-root methods, and for a clone the user already had, installation guidance runs git -C <HveCoreBasePath> remote get-url origin before any write. When origin is missing or does not match an expected github.com/microsoft/hve-core HTTPS, SCP-like SSH, or ssh:// form, it warns and requires an explicit yes to continue. This is an advisory trust signal, not proof of repository integrity. Intentional forks and local development clones are allowed after confirmation (G-SPF-1).

Tampering
  • Only components declared in the source plugin.json can be installed. Every plugin.json path must start with .github/, and every requested component must match a declared member after package-path projection.

  • A component is refused before any write when its source path, or any ancestor between the source root and the component, is a link. Assert-SourceWithoutLink in PowerShell checks the ReparsePoint attribute, which also covers Windows junctions; assert_source_without_link in Bash tests -L. Inside a skill directory, file links are omitted and directory links are not traversed.

  • Local environment, cache, and test paths are never copied: tests, .venv, .hypothesis, node_modules, __pycache__, .ruff_cache, .pytest_cache, .git, .env and its variants, .DS_Store, Thumbs.db, and *.pyc.

  • The content of declared components is copied as-is. The installer does not verify signatures or compare content with upstream (G-SPF-1).

Repudiation
  • Not applicable. This is a local, operator-driven installer with no audit requirement. The tracking manifest records the source identifier, version, selection, and install timestamp for the operator's own reference.

Information Disclosure
  • Source-side link refusal prevents a link in the source clone from pulling files outside the clone (for example, from the operator's home directory) into the target repository, where they could later be committed.

  • No credentials are read and no network requests are made.

Denial of Service
  • A malformed plugin.json, a manifest that declares no installable components, or a missing source file fails preflight with an error before any write.

Elevation of Privilege
  • The scripts run with the caller's privileges; there is no privilege transition. Installed components are Copilot customization files that take effect only when the user's tools load them.

Risk Rating
ThreatLikelihoodImpactResidual RiskStatus
Malicious content from a fork installed after confirmationLowHighMedAccepted (G-SPF-1)
Source link pulls outside files into the target repositoryLowHighLowMitigated (source link refusal)
Undeclared or excluded path installedLowMedLowMitigated

Bucket B2: Target repository writes

Spoofing
  • Not applicable. The target is the operator-supplied directory; the installer asserts no identity over it.

Tampering
  • Containment is decided by real filesystem state, not by the shape of a joined string. The full destination must lie under the separator-terminated target root. Every existing ancestor from the target root to the destination is inspected, and the component is refused when any of them is a link: Assert-WithinTargetRoot checks ReparsePoint, covering symlinks and Windows junctions; assert_within_target_root tests -L.

  • The Bash implementation deliberately walks ancestors instead of resolving the path with realpath -m, which is a GNU coreutils extension and is not dependable on macOS. The leaf does not exist yet on a first install.

  • Containment runs in preflight, then again immediately before each file is written. The re-check narrows the window in which a link planted between the two checks could redirect a write. It does not make the check and the write atomic (G-TAM-1).

  • The PowerShell and Bash implementations are kept behaviorally equivalent. Parity tests assert the same accept and refuse verdicts for clean, symlinked-destination, linked-source, and linked-manifest cases.

Repudiation
  • Not applicable. Local operator action; per-component copy results are printed to the caller.

Information Disclosure
  • Not applicable. The installer writes only files taken from the source clone into the target repository, and reports target-relative paths.

Denial of Service
  • Collision detection reports existing components before any write. Installation guidance requires explicit confirmation and a per-collision choice to overwrite or keep. Ejected files are never overwritten.

Elevation of Privilege
  • A write outside the target root, for example into a user profile or a global configuration location, is refused by the containment check above. The caller's privileges bound what an escaped write could reach.

Risk Rating
ThreatLikelihoodImpactResidual RiskStatus
Planted destination link redirects a write outside targetLowHighLowMitigated (ancestor link refusal)
Link planted between the check and the writeLowHighLowPartially Mitigated (G-TAM-1)
Containment divergence between PowerShell and BashLowHighLowMitigated (parity tests)

Bucket B3: Tracking manifest and eject

Spoofing
  • Not applicable. The manifest records a source string and version for operator reference; nothing authenticates against them.

Tampering
  • component-copy and eject refuse a .hve-tracking.json that is a link, before reading or writing it and before any component copy. The PowerShell scripts inspect the link itself rather than relying on Test-Path, and the Bash scripts test -L, so a dangling link is refused as well. The manifest write therefore cannot be redirected outside the target root.

  • An existing manifest must be schema version 2. Any other version fails before the target is touched, with clean-reinstall guidance.

  • eject writes the updated manifest to a new, randomly named temporary file in the same directory (a GUID name in PowerShell, mktemp in Bash), replaces the manifest with it, and removes the temporary file if the write fails. A link planted at a predictable temporary name therefore cannot redirect the write. component-copy rewrites the manifest in place at the end of a run (G-DOS-1).

  • Each tracked file carries a SHA-256 hash and a managed or ejected status. file-status-check reports modified when a file's hash differs. This detects local modification of tracked files. It is not integrity protection: anyone who can edit the files can edit the manifest, which is neither signed nor otherwise protected (G-TAM-4).

Repudiation
  • Not applicable. The manifest records installation and ejection timestamps as operator information, not as tamper-evident audit records.

Information Disclosure
  • file-status-check hashes files at the paths recorded in the manifest and reports only a status per path. It does not print file content.

Denial of Service
  • A truncated or malformed manifest fails parsing before any write. Recovery is to delete the manifest and reinstall, which discards recorded ejections (G-DOS-1).

Elevation of Privilege
  • Not applicable. Ejection changes only the manifest status of the named component's files.

Risk Rating
ThreatLikelihoodImpactResidual RiskStatus
Linked manifest redirects the manifest writeLowMedLowMitigated (manifest link refusal)
Manifest edited to hide local modificationLowLowLowAccepted (G-TAM-4)
Interrupted copy leaves an unreadable manifestLowLowLowAccepted (G-DOS-1)

Bucket B4: Caller process and local tools

Spoofing
  • jq, git, and the VS Code CLI (code or code-insiders) are resolved by name from PATH. The installer trusts the operator's environment for binary identity (G-SUP-1).

Tampering
  • The VS Code CLI name is restricted to code or code-insiders: [ValidateSet] in PowerShell, with the same allow-list in Bash, checked before execution. It is invoked only with the fixed --list-extensions and --show-versions arguments.

  • The Bash scripts pass manifest paths and values to jq through --arg and --argjson, not by building the jq program from input. Every script is invoked with discrete arguments, not a composed shell string.

Repudiation
  • Not applicable. Local, interactive tooling.

Information Disclosure
  • detect-environment reports only environment type flags (CODESPACES, REMOTE_CONTAINERS, /.dockerenv, devcontainer and workspace file presence, and whether the repository is named hve-core). It prints no environment values or credentials.

Denial of Service
  • Not applicable. The read-only scripts perform bounded local checks.

Elevation of Privilege
  • Subprocesses run with the caller's privileges and no shell. There is no privilege transition.

Risk Rating
ThreatLikelihoodImpactResidual RiskStatus
Arbitrary command via the VS Code CLI nameLowHighLowMitigated (allow-list)
PATH-resolved tool substitutionLowHighLowAccepted (operator environment)

Enterprise Readiness Gaps

The following are known limitations recorded so operators can make informed deployment decisions. Severity ratings are the project's own assessment and are not equivalent to a CVSS score.

IdGapSeverityStatus
G-SPF-1The upstream-origin check is advisory. A fork or substituted local clone is accepted after explicit confirmation, and the content of its declared components is installed without signature or content verification.Spoofing-MedAccepted; install from a trusted source and review components before committing them
G-TAM-1Target containment is re-verified immediately before each write, which narrows but does not eliminate the check-to-write race. A local process able to swap a directory for a link in that window could still redirect a write.Tampering-LowAccepted; the window requires concurrent local write access to the target
G-TAM-2Containment has not been exercised on macOS. The Bash implementation avoids the GNU-only realpath -m and uses a POSIX-portable ancestor -L walk, so no known GNU-specific dependency exists. That is a design argument, not verification.Tampering-LowOpen; verify by running the installer Pester suite on macOS
G-TAM-3Windows containment, including the directory-junction case, was verified on a developer machine only. CI runs on ubuntu-24.04, where the junction case skips permanently. Bash under Git for Windows was not exercised.Tampering-LowOpen; add a Windows CI job for the installer Pester suite
G-TAM-4.hve-tracking.json is not integrity-protected. SHA-256 status detects local modification of tracked files, but anyone who can edit those files can also edit the manifest.Tampering-LowAccepted; the manifest is operator bookkeeping, not a security control
G-DOS-1component-copy rewrites .hve-tracking.json in place. An interrupted run can leave a manifest that later runs reject, and recovery by reinstall discards recorded ejections. eject uses a temporary file and replace.DoS-LowAccepted
G-SUP-1jq, git, and the VS Code CLI are external, unpinned dependencies resolved from PATH.SupplyChain-LowAccepted (operator keeps local tools trusted)

For an active issue tracker entry covering these gaps, see the hve-core issues list.

References

🤖 Crafted with precision by ✨Copilot following brilliant human instruction, then carefully refined by our team of discerning human reviewers.

Requirements and compatibility

Written for: GitHub Copilot

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an MCP server, Needs Python

The author says: Requires VS Code or VS Code Insiders. Clone-based methods require git on PATH and network access. The Bash component scripts require jq.

Security

What our scanner noticed· Low risk

  • Scripts that your agent may run

This skill includes scripts that your agent may run. Read them before you use it.

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
Microsoft
Publisher
Microsoft (Official)
Source
microsoft/hve-core · .github/skills/installer/hve-core-installer · commit f425e94
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Microsoft or Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download hve-core-installer.zip