Developers work across many surfaces like the CLI, IDE, and GitHub. The terminal is often where they turn to move fast, automate tasks, or work directly with systems and scripts.

Tools like the GitHub Copilot CLI already make this easier. You can generate commands, debug issues, and move quicker without leaving the terminal.

However, like any environment, the CLI can still accumulate friction: re-running the same commands, re-explaining context, or translating logs for your team into something they can act on. These small steps add up, especially when every team’s stack and standards are a little different.

But what if your terminal didn’t just run commands, it understood your stack, your tools, and your team’s standards?

That’s where custom agents come in. Instead of starting from scratch each time, you can encode your team’s context into reusable workflows that go beyond one-off prompts.

With custom agents in the CLI, you can turn repeated tasks and patterns into consistent, reviewable workflows that fit naturally alongside your other tools, further tailoring GitHub Copilot CLI with expertise for specific development tasks.

What are custom agents?

A custom agent is a Copilot agent that can be defined using a Markdown file. Instead of relying on generic behavior, you describe how the agent should operate, what tools it can use, what standards it should follow, and what outputs it should produce. The result: its behavior is consistent wherever it runs.

Each coding agent you create can act as a specialized agent tailored for a specific task. For example, a generic coding agent might suggest how to clean up your code. But a custom agent can apply your formatting rules, tooling, accessibility standards, review requirements, and safety requirements every time it runs.

Custom agents are defined using agent profiles, or files that live directly in your repository. Written in Markdown, these agent profiles let you specify:

• The agent’s role and area of expertise
• Which tools it can access
• Guardrails that keep outputs safe and consistent

The snippet below shows the beginning of an agent profile that acts as an expert assistant for web accessibility:

 --- 

description: 'Expert assistant for web accessibility (WCAG 2.1/2.2), inclusive UX, and a11y testing'  
name: 'Accessibility Expert'  
model: GPT-4.1  
tools: ['changes', 'codebase', 'edit/editFiles', 'extensions', 'web/fetch', 'findTestFiles', 'githubRepo', 'new', 'openSimpleBrowser', 'problems', 'runCommands', 'runTasks', 'runTests', 'search', 'searchResults', 'terminalLastCommand', 'terminalSelection', 'testFailure', 'usages', 'vscodeAPI']

# Accessibility Expert  

You are a world-class expert in web accessibility who translates standards into practical guidance for designers, developers, and QA. You ensure products are inclusive, usable, and aligned with WCAG 2.1/2.2 across A/AA/AAA. 

# Your Expertise 

**Standards & Policy**: WCAG 2.1/2.2 conformance, A/AA/AAA mapping, privacy/security aspects, regional policies 

Because the agent profile lives in your repository, your team can review it, version it, and share it so the same expectations follow the work from the CLI to the IDE and all the way into pull requests on GitHub.

How custom agents work in GitHub Copilot CLI

GitHub Copilot CLI is well suited for agent-driven work because it already runs scripts, calls APIs, and works directly with your repositories. Defining agents here lets you further tailor Copilot CLI by encoding execution-heavy workflows once, then invoking it from the terminal. The agent will execute your workflow the same way every time.

To add a new custom agent for GitHub Copilot CLI, you’ll need to:

1. Invoke the agent from Copilot CLI. From the terminal, run the Copilot CLI and use the /agentslash command. Select the custom agent you want to use.
2. Create an agent profile in the .``github``/agents directory of your target repository. The agent profile is a Markdown file with YAML frontmatter that defines the agent’s role, scope, capabilities, and guardrails, so it behaves consistently in your workflows. The agent profile file ends with .agent.md – for example, accessibility.agent.md.

Because the agent profile is a file in your repository, it can be reviewed, updated, and shared.

Common workflows you can automate with custom agents

The best place to start with custom agents is with tasks your team already repeats, many of which often begin in the terminal and continue in the IDE and on GitHub.

Here are a few practical scenarios:

Security audit agent

Run your team’s standard security checks across your repositories, summarize findings by severity, and output a pull request-ready checklist with owners and next steps.

# .github/agents/security-audit.md 

--- 
name: Security audit 

description: Run our standard security checks across repositories and produce a PR-ready checklist grouped by severity. 

tools: 

# Keep this list aligned with what your team actually runs in CI. 

- gh 
- git 
- semgrep 
- trivy 
- gitleaks 
- jq 

--- 
## Instructions 
You are the **Security audit** agent for this organization.

### Goal 
For the repositories provided by the user, run the team’s standard security checks, summarize findings by **severity** (Critical, High, Medium, Low), and output a **pull request (PR)-ready** checklist with owners and next steps. 

### Operating rules 

- Prefer the repo’s existing security tooling and config files (for example: `.semgrep.yml`, `.trivyignore`, `.gitleaks.toml`) when present. 
- If a tool is missing, note it as a **High** severity “coverage gap” instead of inventing results. 
- Don’t paste secrets or full vulnerable payloads into output. Redact tokens and credentials. 
- Use inclusive language (use allowlist/denylist). 
- When referencing dates, use the format “March 23, 2026”. 

### Standard checks to run (per repository) 

1. Secret scanning locally: 
- `gitleaks detect --redact --no-git --source .` (or use the repository’s preferred invocation) 

2. Container scanning (if a container image or Dockerfile exists): 
- `trivy fs .` 

3. SAST (if semgrep config exists): 
- `semgrep scan --config .semgrep.yml` 

4. Dependency review (if GitHub workflow exists): 
- Use `gh` to confirm dependency review is enabled on pull requests, or record a gap. 

### Ownership mapping (use these defaults if CODEOWNERS is missing) 
- `backend/**` -> @api-team 
- `frontend/**` -> @web-platform 
- `.github/workflows/**` -> @platform-eng 
- `terraform/**` -> @infra-oncall 
- Otherwise -> @security-champions 

### Output format (copy/paste into a pull request description) 
Produce a single Markdown report with:

- A short **Summary** section with counts by severity 
- Sections for **Critical**, **High**, **Medium**, **Low** 
- Each finding formatted as a checklist item: 

Example item format: 

- [ ] **[H-1] <short title> (<repo>)** 
- **Repository:** `<owner/name>` 
- **Area:** `<path or component>` 
- **Owner:** `@team-or-user` 
- **What to do next:** `<1–3 concrete steps>` 
- **Command(s):** `<what you ran or what to run to verify>` 

### Final step 
At the end, add a “Next steps” section with: 

- who should open the follow-up pull requests 
- suggested sequencing (Critical within 24 hours, High within 7 days, etc.) 

Infrastructure as code compliance agent

Review plans and manifests against your organization’s guardrails and policies. Highlight risky changes, and generate a concise, approval-ready summary.

# .github/agents/iac-compliance.md 

--- 
name: IaC compliance 

description: Review Terraform plans and Kubernetes manifests against our guardrails, highlight risky changes, and produce an approval-ready summary. 

tools: 

- gh 
- terraform 
- conftest 
- opa 
- kubeconform 
- jq 

--- 
## Instructions 

You are the **IaC compliance** agent for this organization.  

### Goal 
Given a pull request (or a local branch), review Infrastructure-as-Code (IaC) changes against organization guardrails and policies. Highlight risky changes and produce a concise, approval-ready summary that a human can use to approve (or request changes) quickly. 

### What to review 

- Terraform:
- `*.tf`, `*.tfvars`, `*.tf.json` 
- `terraform plan` output (when available) 
- Kubernetes: 
- `*.yml`, `*.yaml` manifests (including Helm-rendered output if provided) 

### Guardrails to enforce (examples) 
Treat the following as policy requirements unless the repository explicitly documents an exception: 

- No publicly accessible resources unless explicitly approved (internet-facing load balancers, `0.0.0.0/0` ingress, public S3 buckets) 
- No wildcard permissions in IAM policies (avoid `Action: "*"`, `Resource: "*"`) 
- Encryption required at rest for managed storage services 
- Require version pinning for Terraform providers and modules 
- Kubernetes manifests must: 
- Set resource requests and limits 
- Avoid privileged containers and `hostNetwork: true` 
- Avoid `latest` image tags 
- Use non-root users where possible  

### How to run checks (prefer what the repository already uses) 

1. **Terraform plan (if Terraform changes exist)** 

- `terraform fmt -check` 
- `terraform init -backend=false` 
- `terraform validate` 
- `terraform plan -out tfplan` 
- `terraform show -json tfplan > tfplan.json` 

2. **Policy evaluation** 

- If `policy/` exists, treat it as the source of truth for OPA policies. 
- Run: 
- `conftest test tfplan.json -p policy/` 
- `conftest test k8s-rendered.yaml -p policy/` (if manifests exist) 

3. **Manifest validation** 

- `kubeconform -strict -summary <file-or-dir>` 

### Risk scoring 
Classify each notable finding into: 

- **High risk**: likely security exposure or broad blast radius (public ingress, wildcard IAM, deletion of critical resources) 
- **Medium risk**: potential operational impact (autoscaling changes, node selectors removed, timeouts reduced) 
- **Low risk**: style, minor drift, missing metadata 

### Output format (approval-ready) 
Return a single Markdown section that a reviewer can paste into a pull request comment: 

```markdown 

## IaC compliance summary 

**Scope:** Terraform and Kubernetes changes in this pull request  
**Overall risk:** <Low|Medium|High> 
**Policy result:** <Pass|Fail|Pass with notes> 

### High-risk findings 

- [ ] <finding> — **Owner:** @team — **Path:** `<path>` — **What to change:** <1 sentence> 

### Medium-risk findings 

- [ ] <finding> — **Owner:** @team — **Path:** `<path>` — **What to change:** <1 sentence> 

### Low-risk findings 

- [ ] <finding> — **Owner:** @team — **Path:** `<path>` — **What to change:** <1 sentence> 

### Evidence (commands run) 

- `terraform plan ...` 
- `conftest test ...` 
- `kubeconform ...` 

### Recommendation 

<Approve / Request changes / Block, with 1–3 bullets explaining why> 

``` 
### Notes 

- Be explicit about what changed and why it matters (developer-to-developer tone). 
- If you can’t run a check (missing tooling, no plan output, etc.), call it out under **Evidence** as a gap. 
- Don’t include secrets or full credentials in the output; redact them. 

Release docs agent

Gather merged pull requests since the previous release, categorize them, and draft release notes in your team’s style. Update the repo’s CHANGELOG.md and include a short release checklist that includes tests, migrations, and rollout/rollback notes.

# .github/agents/release-docs.md 

--- 
name: Release docs 

description: Draft release notes from merged PRs since the previous release, update CHANGELOG.md, and output a short release checklist (tests, migrations, rollout/rollback). 

tools: 

- gh 
- git 

--- 
## Instructions 

You are the **Release docs** agent for this repository.

### Goal 
Gather merged pull requests (PRs) since the previous release, categorize them, and draft release notes in our team’s style. Update `CHANGELOG.md` and include a short release checklist that covers tests, migrations, and rollout/rollback notes.  

### Inputs to request if missing 

- The previous release tag (for example: `v1.12.3`) 
- The new release version (for example: `v1.13.0`) 
- The target branch (default: `main`) 

### How to gather changes 

1. Identify the compare range: 
- Prefer `git` tags. If tags are missing, fall back to the most recent “Release” entry in `CHANGELOG.md`. 

2. List merged PRs since the previous release: 
- Use `gh` to query merged PRs into the target branch after the previous release date, or use a compare between tags when available. 

3. Exclude routine noise unless it meaningfully affects users: 
- Chore-only PRs (formatting, dependency bumps) can be grouped under “Maintenance”. 

### Categorization (use these headings) 

- Added 
- Changed
- Fixed 
- Security 
- Performance 
- Maintenance

### Style rules 

- Write for developers. Be direct and practical. 
- Use sentence case for headings. 
- Don’t anthropomorphize the agent. 
- Avoid “we” unless it’s necessary; prefer “you” where it’s actionable. 
- Don’t invent impact or claims. If a PR title is unclear, use the PR body or ask for clarification.

### Output requirements 

1. Produce a `CHANGELOG.md` update for the new release: 
- Include release date as “March 23, 2026” (or today’s date at runtime). 
- Include bullet points with PR numbers and short descriptions. 

2. Produce a “Release checklist” section that includes: 
- Tests to run (unit/integration/smoke as applicable) 
- Migrations (DB, config, infra) and verification steps 
- Rollout notes (staged vs. all-at-once) 
- Rollback notes (how to revert and what to watch) 

### File update instructions 

- If `CHANGELOG.md` exists, append a new section at the top. 
- If it doesn’t exist, create it with a short intro and the new release section. 
- Only modify `CHANGELOG.md` unless the user explicitly asks to edit other files. 

### Final response format 
Return: 

1. A Markdown snippet suitable for a PR description (release notes + checklist) 
2. The updated `CHANGELOG.md` content to commit 

Incident response agent

Given a service name and time window, gather “first look” data such as recent deploys, error rates, top endpoints, and relevant logs. Produce an incident report using your team’s template and suggest next steps.

# .github/agents/incident-response.md  

--- 
name: Incident response 

description: Gather first-look incident data (deploys, error rates, top endpoints, logs) for a service and time window, then draft an incident report and next steps. 

tools: 

- gh 
- git 
- jq 
- curl 

--- 
## Instructions 

You are the **Incident response** agent.  

### Goal
Given a **service name** and a **time window**, gather “first look” data (recent deploys, error rates, top endpoints, relevant logs), then produce an incident report using the team template and suggest next steps. 

### Inputs (ask if missing) 

- `service`: the service identifier (for example: `payments-api`) 
- `start_time` and `end_time` (include time zone, for example: `March 23, 2026 10:00 am PT` to `March 23, 2026 11:00 am PT`)
- `environment`: `prod` by default unless specified 
- `incident_commander`: the on-call or IC username/team 

### Data sources 
Prefer repository- and organization-standard sources first: 

- Deploy history: GitHub deployments / Actions workflows / release tags 
- Metrics endpoints (if documented), otherwise note the gap 
- Logs endpoints (if documented), otherwise note the gap  

If this repository includes runbooks or on-call docs, follow them.  

### What to gather (first look) 

1. **Recent deploys** 
- Identify deploys/releases to the service in the time window ± 2 hours 
- Include commit SHA, PR number, author, and deploy time if available 

2. **Error rates and latency** 
- Summarize changes over the window (baseline vs peak)
- If you can’t access metrics, state what you tried and what’s missing 

3. **Top endpoints / hottest paths** 
- List endpoints with highest error counts and/or latency regression 

4. **Relevant logs** 
- Provide a small set of representative log lines (redacted)
- Focus on new error signatures, timeouts, dependency failures, and auth issues 
- Do not include secrets or customer PII 

### Output: incident report template
Produce a single Markdown report: 

```markdown 

## Incident report: <service> — <short summary> 

**Status:** <Investigating|Mitigated|Resolved>  
**Severity:** <SEV-1|SEV-2|SEV-3>  
**Environment:** <prod|staging|...>  
**Time window:** <start> to <end>  
**Incident commander:** <@user-or-team>  
**Contributors:** <@user-or-team list> 

### Customer impact 
- <Who was affected and how, in 1–3 bullets> 

### Timeline (first look) 
- <time> — <event> 
- <time> — <event> 

### What changed (deploys in window) 
- <deploy time> — <artifact/version> — <commit> — <PR> — <author> 

### Metrics snapshot 
- **Error rate:** <baseline> → <peak> → <current> 
- **Latency (p95):** <baseline> → <peak> → <current> 
- **Traffic:** <baseline> → <peak> → <current> 

### Top failing endpoints 

| Endpoint | Error type | Error count | Notes | 

|---|---|---:|---| 

| `/v1/...` | `5xx` | 0 | <note> |  

### Logs (redacted) 
- `<timestamp>` `<service>` `<level>` `<message>` 
- `<timestamp>` `<service>` `<level>` `<message>` 

### Suspected cause (hypothesis) 
- <1–2 bullets. Clearly label as hypothesis.> 

### Next steps 

**Immediate (0–30 min)** 
- [ ] <action> — **Owner:** <@team> 

**Short term (today)** 
- [ ] <action> — **Owner:** <@team> 

**Follow-up (this week)** 
- [ ] <action> — **Owner:** <@team> 

```  

### Notes 

- Be explicit about uncertainty. If data is missing, write “Unknown (data unavailable)” and list what’s needed. 
- Use inclusive language (allowlist/denylist). 
- Use short, scannable bullets. Avoid hype and anthropomorphizing. 
- Redact secrets and personal data. 

How to choose between off-the-shelf agents vs. your own custom agents

After working with our partners like JFrog, Dynatrace, Octopus Deploy, arm, and others, we offer a number of off-the-shelf agents to help you get started quickly in areas like observability, infrastructure as code, and security.

These agents come with specific workflows and tool-specific knowledge baked in, making them a fast way to see immediate value without defining an agent from scratch (plus, you can always mod them to fit your exact needs). Teams often treat partner agents as a starting point to then create their own custom agent.

But you can also create your own custom agents with your own Markdown files that are more specific to your rules, tools, and conventions.

Use off-the-shelf agents when you want to:

• Try a working agent with minimal setup: No need to design prompts, outputs, or create guardrails from scratch.
• Lean on tool-specific expertise: You’re using a partner product and want an agent that already knows the commands and best practices.
• Standardize around a partner’s recommended practices: You want consistency with how a tool is intended to be used.
• Cover repeatable tasks across repos: For example, baseline security checks, common reviews, or other patterns that apply to multiple services.

Use custom agents when you want to:

• Define how your team gets work done: Your team has conventions like naming, review standards, and security checks, and you want the agent to follow them every time.
• Integrate with your exact stack and internal tooling: Useful if you rely on things like internal APIs or nonstandard tooling that a partner agent wouldn’t know about.
• Reduce glue work in your workflow: You can have an agent that runs the same sequence across incidents, releases, or audits.
• Version and evolve your workflow like code: You can improve the agent over time, review changes, and share it across your team as a maintained asset.

There’s a growing ecosystem of partner agents that your team can try immediately. Check out our Awesome Copilot list of custom agents.

How to get started with custom agents

First, you’ll need to install GitHub Copilot CLI.

Once you’re ready to go, start with a workflow you already repeat, then make it consistent. Choose a task that happens every week and turn it into an agent that runs the same checks, uses the same tools, and produces the same reviewable output.

If you’re new to agents, try a partner agent first to test the workflows and get a feel for the new workflow. Browse partner-built agents and try one in the CLI.

You can also create a small custom agent that you can continue to iterate on. For example:

• Take a pull request title plus labels, and generate a correctly formatted CHANGELOG.md entry.
• Turn a bug report into a structured issue comment with reproduction steps, environment information, severity, and suggested next steps.

Custom agents help standardize your workflows by taking the knowledge from scattered notes and one-use prompts and turning them into reusable, structured workflows you (and your team) can rely on.

This becomes especially valuable for teams, where the same task can be approached differently depending on who’s running it. With custom agents, these workflows become shared, repeatable, and easier to review.

They also let fast, execution-heavy tasks start in the CLI, carry context into the IDE, and land on GitHub as reviewable, shippable work. Rather than losing context between steps, agents help maintain continuity across your toolchain.

Once you encode the workflows that matter to your team, Copilot CLI becomes less about asking for help and more about reliably supporting how your team actually works day to day.

Learn more

• Creating and configuring agent profiles
• Using GitHub Copilot CLI
• List of partner custom agents for GitHub Copilot

The post From one-off prompts to workflows: How to use custom agents in GitHub Copilot CLI appeared first on The GitHub Blog.

One of the most surprising and remarkable discoveries in recent scientific history has been CRISPR. Short for Clustered Regularly Interspaced Short Palindromic Repeats, CRISPR is a form of immune system that evolved in bacteria more than a billion years ago to defend against persistent viral threats. Under attack, bacteria can snip a small fragment of a virus’s DNA, store it in the CRISPR region…

Source

Wealth tax criticized by billionaires and Gavin Newsom would levy a one-time 5% tax on residents worth over $1bn

A controversial proposal in California to impose a wealth tax on billionaires has gained enough signatures to qualify for the ballot in November, state officials announced on Wednesday.

The news is set to intensify an already heated debate around the tax, which has pitted tech moguls and the state’s governor, Gavin Newsom, against the labor unions backing the measure.

In city after city, the Trump administration’s immigration crackdown has been met by protests and rallies from members of the local community opposed to the White House’s deportation policies. Federal agents from the Customs and Border Protection and Immigration and Customs Enforcement have repeatedly attempted to break up and drive back these crowds through the use of airborne irritants like tear gas and pepper spray, which can cause an array of immediate reactions — from eye pain to shortness of breath to nausea and vomiting — intended to temporarily disable their targets.

DHS has defended its use of these weapons on crowds and said that it “does NOT target children,” but after reviewing news accounts, lawsuits and officer-worn body camera footage, as well as verifying incidents by interviewing more than 40 victims or witnesses, ProPublica recently identified more than six dozen instances in which children had been harmed by tear gas and pepper spray.

Here are five things you should know about how these airborne weapons have been used during Trump’s immigration crackdown and how their use has particularly harmed children.

Dozens of children have been harmed by tear gas deployed by immigration agents.

So-called less lethal weapons like tear gas and pepper spray were developed to inflict severe pain and debilitate adult combatants and rioters, but ProPublica identified 79 children across the country since 2025 who have been harmed by these chemicals after they were deployed by federal immigration officers. Our tally is nearly four times the number cited in a recent congressional report, yet it is likely still a vast undercount.

The Department of Homeland Security has defended its agents’ use of the chemicals and claimed the blame lies with “agitators” in the crowds and parents who put their children in harm’s way. Many children harmed by tear gas and pepper spray were in their cars, at home or walking to school when they came into contact with the airborne weapons.

Tear gas and pepper spray are especially toxic to children.

There is no one such thing as “tear gas.” It’s a catch-all term for various chemical irritants that exist as a fine powder and trigger nerve endings to feel as if they’re on fire. The chemicals sear your lungs and throat, inflaming your airways until it feels like you’re breathing through a straw, while snot and tears stream down your face. They can cause vomiting, rashes and coughs that last for weeks. Pepper spray is made from compounds found in hot peppers and causes similar effects.

Because children breathe more rapidly and can pull in more contaminated air than adults relative to their body weight, these weapons are particularly dangerous to the young. Children are also more vulnerable because they have narrower airways and they are closer to the ground, where tear gas tends to pool after being deployed. The Trump administration’s use of tear gas has been so extraordinary that no one yet knows what long-term harm may result from children who’ve come into contact with these chemicals — some of them multiple times.

Courts have found that agents’ use of tear gas is excessive, but their power is limited.

In November 2025, a federal judge in Illinois ruled that ICE and CBP officers had deployed these chemicals “without justification, often without warning” against people who didn’t pose a physical threat. This constituted an illegal use of excessive force, said the judge, ordering the agencies to stop. But her injunction covered only the areas mentioned in the complaint. Agents were unfettered to continue using the weapons elsewhere.

After federal agents in Portland, Oregon, responded to a Jan. 31 rally by firing various less-lethals into the crowd — including Triple Chaser grenades that each separated into three tear gas canisters; dozens of pepper ball projectiles filled with chemical munitions; and “rubber ball grenades” that released stinging pellets, bright lights, and loud sounds — a judge there issued a temporary restraining order that forbade federal agents from using chemical munitions unless targeted at someone who posed “an imminent threat of physical harm.”

However, appellate courts have subsequently vacated the Illinois judge’s ruling and multiple rulings from judges in Portland seeking to enjoin the use of these weapons.

Once deployed, these weapons are difficult to contain.

Though the Trump administration has defended agents’ training and said ICE officers are taught to use “the minimum amount of force necessary to resolve dangerous situations,” not only can tear gas canisters launched into a crowd bounce and roll unpredictably, but the toxic chemicals can travel through the air, sometimes for blocks. In Minneapolis, ProPublica found that tear gas had traveled at least a quarter mile before seeping into a McDonald’s.

Derrick Nash and his family live a block and a half east of an ICE facility in Broadview, Illinois. Even from that distance, they felt the effects inside their homes when officers tear-gassed protesters. Each time the tear gas seeped in, the kids — ages 6 to 17 — coughed, and their throats often burned. The eldest, a high school senior with asthma, would hide out in his second-floor bedroom. One evening, his face turned red as he coughed uncontrollably and sucked on his inhaler without relief.

“He was wigging out, saying, ‘I can’t breathe,’” Nash recalled. The family considered calling an ambulance, but the street was closed.

No national standard for use of tear gas exists.

Law enforcement policies governing the use of tear gas and pepper spray differ widely by location, and no federal standard exists. The DHS policy on force says officers must use tactics that “minimize the risk of unintended injury” and should be guided by “respect for human life.” The CBP’s policy says officers “should not use” pepper spray or “less-lethal” chemical munitions against “small children.” ICE’s policy says “the presence of other officers, subjects, or bystanders” are a factor in determining whether an officers’ use of force is reasonable.

Read More

Kids Are Being Harmed by Tear Gas, Pepper Spray Under Trump. There Could Be Long-Term Consequences.

At 17, He Was Tear-Gassed at Selma. At 78, He’s Watching Kids Tear-Gassed During Trump’s Deportation Campaign.

U.S. Lawmakers Demand Reforms to Immigration Officers’ Use of Tear Gas and Pepper Spray

Compare that with tear gas policies in two cities that have experienced Trump’s immigration crackdown firsthand. In Portland, police officers who consider using tear gas must take into account their proximity to homes. Meanwhile, Minneapolis forbids officers from using chemical munitions for crowd control unless authorized by the police chief — even when officers fear they will be physically harmed.

Requiring all law enforcement agencies to adopt uniform policies and training methods would go a long way, experts told ProPublica. At the same time, they acknowledge that this would likely require Congress to pass a bill mandating that federal law enforcement entities adopt stricter practices and incentivize local police departments to do the same.

Bills that seek to strengthen use-of-force training on such a wide scale and legislation that targets DHS and its use of these weapons have thus far failed to even make it to a vote in Congress. Following ProPublica’s investigation, U.S. lawmakers have begun demanding reforms to immigration officers’ use of these weapons.

The post What You Need to Know About How Tear Gas Harms Kids appeared first on ProPublica.

Former presidents, heads of state and celebrities converged on a lakefront park in Chicago’s South Side to dedicate the Obama Presidential Center

• Sign up for the Breaking News US email

He calls the situation a “win-win” for the US.

Vance is here, and he starts by claiming that Trump’s peace deal with Iran “is already bearing real fruits for the American people”, with 12.5m barrels going through the strait of Hormuz last night and gas prices dropping below $4 today for the first time since the conflict began.

Donald Trump is claiming his Iran peace plan is a victory for Washington, despite the 14-point agreement revealing significant concessions to Tehran. Under the deal, Iran will reopen the strait of Hormuz in exchange for sanctions relief and the release of frozen assets, while talks will continue over the fate of Iran’s nuclear programme. Nosheen Iqbal speaks to the Guardian diplomatic editor, Patrick Wintour

Welcome back to GitHub Copilot CLI for Beginners! In this series (available in video and blog format), we’ll give you everything you need to get started using GitHub Copilot CLI. So far in this series, we’ve covered how to get started and when to use interactive and non-interactive modes. In this edition, we’ll learn what slash commands are, why they matter, and how to use slash commands to control GitHub Copilot efficiently. You can complete tasks like switching models, checking token usage, and resuming past sessions right from your terminal.

Let’s dive in!

Understanding slash commands in GitHub Copilot CLI

When working in Copilot CLI, one of the most powerful concepts to learn early on is slash commands. Slash commands are built-in controls that you can access directly from the command line. Acting as your control surface within Copilot CLI, slash commands allow you to:

• Guide Copilot’s behavior
• Inspect changes
• Manage context
• Move efficiently across sessions and projects
• Keep permissions tidy

Slash commands can be thought of as your command center for interacting with Copilot CLI. To look at all of the options available, just type / in the command line for a scrollable list of all currently supported slash commands.

Let’s take a look at some of the most popular ones.

Choosing the right model

Different models are optimized for different kinds of work. If you want to switch models, type /model into the command line. This will display a list of available models, along with key details like:

• Capabilities: Some are better for quick, lightweight tasks like refactoring, while others more efficiently handle deeper reasoning such as feature planning.
• Availability: The list may vary depending on your plan or organization’s settings.
• Cost: Numbers shown on the right of each model indicate cost multiplier, helping you choose the right balance between performance and usage in relation to your plan.

Choosing the right model can significantly impact both speed and results.

Managing context and token usage

Copilot CLI operates within a context window, which determines how much information it can “remember” during a session. If you want to check your current usage, type /context to learn how many tokens you have left, along with system usage and available buffer.

If you find that you’re running low on space, you can free up space by typing /compact in the command line. This summarizes your current conversation so you can continue without having to start a new session. Copilot CLI will do this automatically when you approach the limit, but you can also do this manually if you want to transition to a new task or clean up context mid-session.

If you’d rather start fresh and completely reset your environment, you can use /clear to clear the session entirely.

Working across sessions

If you want to resume a previous session, you can type /resume. This will bring up a list of previous sessions you’ve had, including both local and remote sessions. Entering a previous session will show you your session history, and you can pick up right where you left off.

Inspecting changes

As you work with Copilot to make changes to your project, it’s important to keep track of what’s changed. If you want to see what the changes are, run /diff to see recent updates. This gives you a clear view of what modifications were made during your session, so you can validate changes before moving forward.

Navigating projects and directories

If you want to work across repositories or directories, you don’t have to exit Copilot. You can type /cwd to change your working directory to another repository. This allows you to scope Copilot’s work to a specific part of your project and helps you stay efficient while multitasking across codebases.

Managing tool permissions

In the past, you might have granted Copilot CLI permission to perform actions like editing files. Say you’re switching to a repository you want to be more careful in and want to reset those permissions: you can do so by running /reset-allowed-tools.

Take this with you

Using these slash commands gives you even better control over Copilot CLI—and the more familiar you become with them, the more deliberate your workflow becomes.

Whether you’re switching models, managing context, or navigating across projects, using slash commands in CLI gives you the tools you need to stay in control. And if you haven’t already: open up your terminal, type /, and explore! There are many more slash commands to discover.

Happy coding!

More resources to explore:

• GitHub Copilot CLI for Beginners video series
• GitHub Copilot CLI for Beginners: Getting started with GitHub Copilot CLI
• GitHub Copilot CLI for Beginners: Interactive v. non-interactive mode
• GitHub Copilot CLI 101: How to use GitHub Copilot from the command line
• Best practices for GitHub Copilot CLI

The post GitHub Copilot CLI for Beginners: Overview of common slash commands appeared first on The GitHub Blog.

In agentic systems, more delegation isn’t always better. Imagine asking Copilot CLI to make a simple change. Instead of handling it directly, it spins up a helper agent that searches the repository, waits on a result, and stalls. Work that should have taken one step now takes three. While some tasks genuinely benefit from a specialist subagent—like exploring an unfamiliar repository, checking an independent area of the code, or running a long command while the main agent keeps moving—delegation isn’t free. Every handoff adds coordination overhead, tool calls, and wait time. If an agent delegates too eagerly, the “help” can become friction.  

We recently released an improvement to our agentic harness called smarter subagent delegation. This makes Copilot CLI more selective by helping the main agent:  

• Stay focused when it can move faster on its own.
• Delegate when a specialist creates real leverage.
• Parallelize work when tasks are truly independent.

Smarter subagent delegation has now rolled out to 100% of Copilot CLI production traffic. If you want to get started today, simply update GitHub Copilot CLI by running the /update command in your terminal to version 1.0.42 or later. 

In a production A/B test, this improvement reduced tool failures per session by 23%, including a 27% reduction in search tool failures and an 18% reduction in edit tool failures. It also improved total user wait time by 5% at P95 and 3% at P75, with no quality regression. Here, P95 captures wait time near the slowest 5% of sessions, while P75 reflects wait time toward the slower end of typical sessions. This means fewer unnecessary handoffs, fewer repeated searches, fewer failure-prone tool paths, and less waiting during long-running coding tasks. 

In this post, we’ll walk through how we identified unnecessary delegation in Copilot CLI, what we changed to make delegation more selective, and how we validated those changes through offline evaluation and production A/B testing. We’ll also show why those changes led to fewer failures and less waiting—and what that looks like for developers using Copilot CLI day to day. 

The problem: Delegation is powerful, but not free

Subagents are one of the most important capabilities in an agentic CLI. They let Copilot break down complex work, run investigations in parallel, and keep the main agent focused on coordinating the final answer. For large codebases and multi-step engineering tasks, that can be the difference between a slow linear workflow and an efficient parallel one. 

But delegation introduces its own failure modes: 

• Unnecessary handoffs for simple tasks that the main agent could complete faster on its own. 
• Overuse of exploration subagents when the handoff already contains enough context.
• Repeated or overlapping searches across the main agent and subagents. 
• Sequential delegation, where the main agent waits for a subagent instead of treating delegation as an opportunity for parallel work. 
• Failure-prone subagent paths, including stale file paths, moved files, incorrect relative paths, and workspace mismatches.  

Our goal: help developers use subagents when they create leverage, avoid them when they add overhead, and parallelize work when the task genuinely benefits from independent execution. 

From problem signals to shipped improvement

The way we identified the problem became the way we solved it. Instead of treating agent trajectory analysis, product changes, evaluation, and rollout as separate activities, we used them as one feedback loop: observe the agent behavior, isolate the orchestration bottleneck, make a targeted change, validate it offline, measure it online, and ship only once the end-to-end workflow improved. 

1. Analyze: Let LLMs identify the delegation bottleneck

Instead of manually reviewing agent sessions, we used LLMs to analyze full trajectories and identify where orchestration was helping versus where it was adding overhead. That analysis surfaced a consistent pattern: subagents were sometimes being invoked for tasks that were already narrow, obvious, or fully described in the handoff. 

In those cases, the subagent could spend time re-searching the repository even though the main agent already had enough context to act directly. That clarified the improvement target: keep simple discovery-and-edit tasks in the main agent, and reserve subagents for work that is broader, cross-cutting, or naturally parallelizable. 

2. Change: Refine the orchestration policy

After identifying the bottleneck, we used LLMs to help translate that diagnosis into a more selective orchestration policy.

Copilot CLI should handle focused work directly: find a file, read it, make a targeted change, and verify it. Delegation is more useful when the work requires independent context, broad exploration, or parallel execution.

In practice, that means starting with the narrowest effective path, escalating when complexity or uncertainty creates value, and stepping back down when the task becomes focused again. Subagents should be treated as a parallelism tool, not a pause button. When Copilot launches a subagent, the main agent should continue making progress on independent work rather than simply waiting for the result.

When a subagent is used, the handoff should also be specific: what the user asked, what is already known, what the subagent owns, and what kind of result the main agent needs back. 

3. Validate: Test offline, confirm online, then ship

Before broad rollout, we validated the change with automatically generated regression cases and existing benchmarks. This helped confirm that the new delegation guidance reduced avoidable overhead without breaking cases where subagents genuinely add value. 

Finally, we moved through staff and public A/B testing, then analyzed production metrics across reliability, responsiveness, subagent workload, and quality. The gains did not come primarily from making individual LLM calls faster. Instead, it reduced orchestration overhead by avoiding unnecessary subagent paths and lowering subagent workload per user. 

That end-to-end process let us move from problem signal to shipped improvement while keeping the user experience stable: fewer avoidable handoffs, fewer failure-prone tool paths, and no quality regression. 

Outcomes

After rolling smarter subagent delegation to production traffic, we saw measurable percentage improvements across reliability and responsiveness (Table 1): 

These results show that better orchestration can improve the developer experience even when the visible feature surface doesn’t change. By teaching Copilot CLI when to delegate, when not to delegate, and how to parallelize the right work, we reduced friction in the agent loop itself. 

That is the power of GitHub Copilot as a system: the experience gets better not because developers are given more switches to manage, but because Copilot becomes better at allocating models, tools, and subagents behind the scenes. 

How this benefits developers today

For developers using Copilot CLI, this should feel like a smoother day-to-day experience. Straightforward tasks are more likely to be handled directly, complex tasks still get specialist help when it adds value, and long-running sessions keep moving with less unnecessary waiting. In practice, Copilot CLI becomes more efficient and less noisy without asking developers to work differently. 

The change is intentionally behind the scenes. Your workflow stays the same, but Copilot CLI is better at coordinating the work: fewer unnecessary handoffs, less repeated search work, fewer failed tool paths, and faster progress on long-running or multi-step tasks. 

What’s next

This work is one step toward our larger goal of improving how Copilot CLI chooses the right model, agent, and tools across your workflow. While having more agents and models available expands what Copilot can do, the value to developers depends on how well Copilot applies them across the work they are already doing, like reading files, running commands, and moving from an issue toward a pull request. 

As tasks become more complex, the quality of that orchestration matters more. The best system is not the one that delegates the most, but the one that knows when to act directly, when to delegate, and how to keep work moving without adding friction. 

The next step is making Copilot CLI more adaptive across models, agents, skills, and tools, so developers don’t have to decide whether a task needs a larger model, a specialist subagent, or a procedural skill. Copilot should make that decision based on the task, repository context, policy, and expected outcome. 

We will continue improving how Copilot CLI plans work, coordinates subagents, and measures end-to-end outcomes. That includes better visibility into main-agent and subagent behavior, deeper analysis of failure reasons, and stronger proxy metrics for orchestration quality. The goal is simple: less waiting, fewer avoidable failures, and more useful progress from every agent session. 

Get started today and share feedback

Update GitHub Copilot CLI by running the /update command in your terminal to version 1.0.42 or later.  

Already tried it? We’d love to hear what you think. Share feedback with the /feedback command in a CLI session or open an issue in our public repository. 

Acknowledgements

Smarter subagent delegation was made possible by collaboration across Code|AI, Copilot CLI, experimentation, human evaluation, and product teams. Thanks to everyone who helped identify the problem, design the process, validate the outcome, and ship the improvement to production. 

The post How we made GitHub Copilot CLI more selective about delegation appeared first on The GitHub Blog.

Ever watched GitHub Copilot CLI extract a JAR file to a temporary directory, grep through .class files, and piece together an API signature from raw bytecode? The agent is resourceful, but without a language server, that’s the best it can do.

The Language Server Protocol (LSP) is the standard that powers go to definition, find references, and type resolution in editors like VS Code. It works just as well in the terminal. The LSP Setup skill automates the installation and configuration of LSP servers for Copilot CLI, so the agent gets precise, structured answers about your code instead of relying on text search heuristics.

In this post, you’ll learn how the skill works under the hood, see the configuration format it generates, and get set up for any of the 14 languages it supports today.

The problem: heuristic code understanding

Without an LSP server, the agent in GitHub Copilot CLI reverse-engineers API information through text search and binary extraction. For a Java project, that might look like:

# Find the dependency JAR 
find ~/.m2/repository -name "*httpclient*.jar" 
 
# Extract it to a temp directory 
mkdir /tmp/httpclient && cd /tmp/httpclient 
jar xf ~/.m2/repository/org/apache/httpcomponents/httpclient/4.5.14/httpclient-4.5.14.jar 
 
# Search extracted class files for a method 
grep -r "execute" --include="*.class" .

For Python, the agent might cat files inside site-packages. For TypeScript, it walks node_modules. These text-based approaches work for simple cases, but they’re doing pattern-matching over raw text rather than true semantic analysis, so they miss generics, overloads, and transitive types, and can’t see compiled bytecode at all. That’s exactly the gap a language server close.

An LSP server solves this structurally. When the agent sends a textDocument/definition request for a symbol, the language server returns the exact source location, fully resolved type, and signature.

How the LSP Setup skill works

When triggered, the skill executes a seven-step workflow:

1. Language selection

The agent uses ask_user with a set of choices to determine which language the user needs LSP support for. This drives all subsequent steps.

2. Operating system detection

The agent runs uname -s (or checks $env:OS / %OS% on Windows) to determine the target platform. Install commands vary by operating system. For example, brew install jdtls on macOS versus downloading from eclipse.org on Linux.

3. LSP server lookup

The skill includes a reference file (references/lsp-servers.md) with curated data for 14 languages: install commands per operating system, binary names, and ready-to-use config snippets. The agent reads this file and selects the matching entry.

4. Configuration scope

The agent asks whether the config should be:

• User-level: ~/.copilot/lsp-config.json—applies to all repositories
• Repository-level: lsp.json at the repository root or .github/lsp.json—scoped to a single project

Repository-level configuration takes precedence when both exist.

5. Installation

The agent runs the appropriate install command. For example:

# TypeScript on any OS 
npm install -g typescript typescript-language-server 
 
# Java on macOS 
brew install jdtls 
 
# Rust on any OS 
rustup component add rust-analyzer

6. Configuration

The agent writes or merges an entry into the chosen config file. The format uses a lspServers object where each key is a server identifier:

{ 
  "lspServers": { 
    "java": { 
      "command": "jdtls", 
      "args": [], 
      "fileExtensions": { 
        ".java": "java" 
      } 
    } 
  } 
} 

Key rules the skill enforces:

• command must be on $PATH or an absolute path
• args typically includes "--stdio" for standard I/O transport (some servers like jdtls handle this internally)
• fileExtensions maps each extension (with leading dot) to a language identifier
• Existing entries in the config file are preserved — the agent merges, never overwrites

7. Verification

The agent runs which <binary> (or where.exe on Windows) to confirm the server is accessible, then validates the config file is well-formed JSON.

Supported languages

The skill comes with a set of predefined language servers for several programming languages. If the coding agent faces one that it is not mapped out already, it will search for an appropriate server and walk you through manual configuration.

What changes after setup

Once an LSP server is configured, the CLI agent can:

• Resolve types across dependencies — no more grepping through JAR files or node_modules
• Jump to definitions in third-party libraries, even when source isn’t checked into the repository
• Find all references to a symbol across the project
• Read hover documentation for any function, class, or type

This means the agent spends less time on tool calls and produces more accurate code on the first pass. For you, that’s less time waiting while the agent decompiles a JAR file or greps through node_modules to answer a question your IDE already knows, and fewer wrong turns built on a misread signature. The agent reasons about your code with the same structured understanding you get from go-to-definition in your editor, so you can hand it bigger, gnarlier tasks and trust the result.

Get started

1. Download the skill: visit the Awesome Copilot LSP Setup skill page and click the Download button to get a ZIP file.
2. Extract the ZIP to ~/.copilot/skills/ by running:

unzip lsp-setup.zip -d ~/.copilot/skills/

3. Restart GitHub Copilot CLI: if Copilot CLI is already running, type /exit first. Then relaunch copilot so it picks up the new skill.
4. Ask the agent to set up a language server: for example, “set up LSP for Java” or “enable code intelligence for Python”.
5. Verify: after the skill installs and configures the LSP server, restart Copilot CLI one more time (/exit, then relaunch), run /lsp to check the server status, and try go-to-definition on a symbol from one of your dependencies.

The skill is part of the Awesome Copilot project. It’s open source, so contributions and feedback are welcome!

The post Give GitHub Copilot CLI real code intelligence with language servers appeared first on The GitHub Blog.

Love or hate Amazon, its 23-26 June Prime Day event is a good time to snag discounts on tech, fashion and more, including much-loved brands such as Anyday and Caraway

• Sign up for the Filter US newsletter, your weekly guide to buying fewer, better things

You don’t have the wait until after Turkey Day: early summer is actually one of the best times of the year to snag a deal. Amazon is kicking off its annual summer sale on 23 June, and just as Christmas songs start playing in stores two months early, the company and many other retailers are slashing prices in advance.

We’ve handpicked 31 of the best deals based on products the Filter has tested and loved in the past, including discounts on some of our favorite brands such as Field Company, Anyday and Caraway. If you want to shop at Amazon, we’ve handpicked products that are actually worth your money, and very few require a Prime subscription. If you prefer other retailers, we have oodles of those too.

Best tech deal:
AirPods Pro 3

Best home deal:
Levoit Tower Fan