Add Copilot package-resolution hook to the VS Code plugin by omerzi · Pull Request #42 · jfrog/vscode-plugin

omerzi · 2026-07-27T12:39:33Z

Overview

Adds the Copilot SessionStart package-resolution hook to the VS Code plugin and vendors the hardened shared capability from jfrog-agent-hooks.

Details

Registers one package-resolution SessionStart command using copilot-session-start.mjs with a 15-second host timeout.
Vendors the released upstream module set from jfrog-agent-hooks/v0.9.0.
Adds a repeatable module sync script and CI integrity manifest/check so vendored files cannot drift silently.
Validates unconfigured advisory and configured routing paths with a fake JFrog CLI.
Adds user and administrator package-resolution guides, including VS Code plugin/hook settings and governance rules.
Keeps the plugin package-resolution-only at SessionStart; Agent Guard is delivered through its existing skill flow.

Flow

flowchart LR
  A[Copilot starts a chat] --> B[VS Code SessionStart hook]
  B --> C[Vendored Copilot adapter]
  C --> D[Shared hardened capability]
  D --> E[Verified Artifactory routing context]

Validation

node scripts/validate-package-resolution-hook.mjs
node .github/scripts/check-vendored-modules.mjs
Missing-jf advisory and configured routing fixtures
Local VS Code smoke test with real Copilot payload and routed npm install
Vendor pin uses released tag jfrog-agent-hooks/v0.9.0

Dependency

The shared hardening is released in agent-hooks PR #84 as jfrog-agent-hooks/v0.9.0.

sverdlov93

🤖 Review comment by Cursor AI

Deep review of this draft assembly PR (depends on jfrog-agent-hooks#48). CI validate job is green. ${CLAUDE_PLUGIN_ROOT} wiring is correct for a Claude-format plugin.

Findings (inline below)

🟠 Validation only proves pending/NOT READY, never routing
🟠 CI does not verify vendor pin integrity
🟠 Pin is an unmerged agent-hooks commit (0a6e194 on open #48)
🟡 Pin file without sibling sync-modules.mjs regenerator
🟡 Workflow path filter omits the pin file
🟡 README prerequisites incomplete vs upstream smoke (chat.plugins.enabled)
🟡 PR description stale (still cites pin b680ef… / version 1.0.10; tree is 0a6e194 / 1.0.11)

🔵 Vendored cursor-/claude-session-start.mjs are unused at runtime — intentional wholesale modules/ sync, same as sibling plugins.

Merge order: land agent-hooks#48 → re-pin to merged SHA/tag → strengthen validation → un-draft. Do not merge this while the pin is off master.

Known carry-over (same as Claude/Cursor, not unique here): timeout: 7 + cold sequential verify → BUG-02 fail-open class.

sverdlov93 · 2026-08-02T18:49:01Z

🤖 Review comment by Cursor AI

@omerzi — naming decision requested on the upstream PR (same topic): please choose keep vscode host / copilot harness dual naming vs copilot-only surface naming.

Full write-up: https://github.jfrog.info/JFROG/jfrog-agent-hooks/pull/48 (latest comment to @OmerZ).

Short version: Claude-in-VS Code is still claude_code; this path’s agent is Copilot Chat, not “VS Code.” PR/README “VS Code support” is easy to misread. Want your call before we treat the dual naming as settled.

sverdlov93 · 2026-08-02T18:52:20Z

🤖 Review comment by Cursor AI

@omerzi — added the Claude/Cursor comparison on upstream:

https://github.jfrog.info/JFROG/jfrog-agent-hooks/pull/48#issuecomment-829544 (and the follow-up just posted)

Claude/Cursor keep agent ≈ adapter file ≈ harness id. This PR alone splits vscode (file/plugin) vs copilot (runtime). Omer’s call whether Copilot stays the exception or aligns.

- Register the dedicated VS Code SessionStart adapter. - Validate hook wiring and document the Node 20 requirement.

Keep VS Code SessionStart validation scoped to package resolution after Agent Guard moved to skill-based delivery, and refresh vendored modules from the rebased upstream branch.

Refresh the vendored package hook so VS Code uses the same positive Copilot discriminator as the upstream implementation.

Re-pin plugin/modules to agent-hooks 847774b and bump the plugin version so the package-resolution hook ships with the latest upstream fixes.

Picks up the upstream fix for harness detection, which previously handed any SessionStart payload it did not recognize to Claude. A VS Code payload whose source was not exactly "new" was labelled foreign and the adapter dropped the routing policy without injecting it.

Validation only ever exercised the unconfigured advisory, so a break in the routing branch — the one carrying the Artifactory URLs this plugin exists to inject — would have passed CI. Adds a configured fixture with a stand-in jf, and stops the checks inheriting a kill switch or redirected JFrog home from whoever runs them. Restores .github/scripts/sync-modules.mjs from the sibling plugins so the vendor pin has a regenerator beside it instead of being documentation, and aligns the pin file with their repo spelling and dest_prefix.

Mirrors the upstream jfrog-agent-hooks rename so the harness id (copilot), log context ([copilot]), and adapter filename match — the same convention already used for claude-session-start.mjs and cursor-session-start.mjs. Bumps the plugin to 1.0.13 and re-pins the vendor source to the upstream commit that ships the rename.

omerzi · 2026-08-03T12:00:12Z

Went with option 2 on the naming thread — the vendored adapter is now modules/copilot-session-start.mjs, matching upstream's claude-session-start.mjs / cursor-session-start.mjs convention. This repo's name stays vscode-plugin (marketplace/install-location branding). See b56aa03.

…oks#48 landed

sankerr

🤖 Review comment by Cursor AI

Senior review of #42 (head b3fc5e8) for teammate handoff, including sync-job + docs parity vs cursor/claude.

Prior round

Routing validation, path filter, README prerequisites, sync-modules.mjs, and re-pin to merged master SHA are addressed. Still open: pin↔tree integrity in CI; timeout: 7 cold-start (BUG-02) as shared carry-over.

Sync Plugins (`jfrog-agent-hooks`)

vscode-plugin is in .github/plugins.json / sync-plugins.yml. This PR supplies the downstream assembly the job needs. Do not run Sync Plugins from tag jfrog-agent-hooks/v0.9.0 after merge — that tag lacks copilot-session-start.mjs and would wipe the adapter. Cut a hooks release that includes 17df9b6, then re-pin to the tag.

Docs parity

No docs/ user/admin guides, no preview notice + guide links (cursor/claude both have them). README still links to missing CONTRIBUTING/SECURITY/LICENSE (pre-existing).

Findings (inline)

🟠 Missing APR user/admin docs vs sibling plugins
🟠 Pin is post-v0.9.0; sync of that tag would remove the Copilot adapter
🟡 PR description stale (Agent Guard flow, old pin/version, overstated test plan)
🟡 Test plan claims pin integrity; CI does not verify it

⚠️ AI review supplements human review — always get a human reviewer too.

Give the Copilot hook enough bounded time for a cold repository verification and assert the hook budget in the plugin validator.

Re-vendor the merged package-resolution capability, add integrity validation, and document the Copilot setup and governance flow.

omerzi · 2026-08-09T07:06:21Z

Updated in commit e66cb32: re-vendored the merged agent-hooks hardening revision, added vendored-module integrity validation and workflow self-triggering, added user/admin APR guides, and refreshed the PR description. Local checks pass: module integrity and full hook validator. The only remaining thread is the release-tag pin; the current pin is the merged upstream SHA 4ed33ee until the next agent-hooks release tag is cut.

Use the released upstream module tag and refresh integrity metadata for the final plugin synchronization.

omerzi · 2026-08-09T10:58:07Z

Released upstream tag is now applied: . Re-vendored modules, regenerated integrity metadata, validated the plugin, pushed commit e8449d1, and resolved the final release-pin thread. CI is running on the new head.

omerzi · 2026-08-09T10:58:11Z

Correction: released upstream tag jfrog-agent-hooks/v0.9.0 is now applied. Re-vendored modules, regenerated integrity metadata, validated the plugin, pushed commit e8449d1, and resolved the final release-pin thread. CI is running on the new head.

Exercise repository verification and the per-session resolution invariant in plugin validation, and run the pinned upstream package-resolution suite in CI.

Remove the cross-host upstream clone from public plugin CI; upstream module behavior remains covered by the agent-hooks repository checks.

omerzi · 2026-08-09T12:06:59Z

CI root cause was the new upstream-test step: jfrog-agent-hooks is hosted on the internal github.jfrog.info host, so public GitHub Actions cannot clone it with the public repository token. Removed that cross-host step in eca3db4. The downstream validator retains verifyRepos=true, local Artifactory verification, and the one-request-per-session assertion; upstream behavior remains tested in the agent-hooks repository CI.

Exercise eager setup eligibility, setup receipts, and package-manager conflict detection directly against the modules shipped in the VS Code plugin.

omerzi requested a review from a team as a code owner July 27, 2026 12:39

omerzi marked this pull request as draft July 27, 2026 12:41

omerzi force-pushed the feature/JFSK-19-vscode-hooks branch from 551ca00 to ee6b7c1 Compare July 29, 2026 10:42

sverdlov93 reviewed Aug 2, 2026

View reviewed changes

Comment thread scripts/validate-package-resolution-hook.mjs Outdated

Comment thread .github/scripts/sync-modules-vendor.json Outdated

Comment thread .github/workflows/validate-package-resolution-hook.yml

Comment thread README.md Outdated

Comment thread plugin/hooks/hooks.json Outdated

omerzi added 10 commits August 3, 2026 11:02

JFSK-19 - Add package resolution hook assembly

5d9c909

- Register the dedicated VS Code SessionStart adapter. - Validate hook wiring and document the Node 20 requirement.

JFSK-19 - Document VS Code hooks setting

09a3141

JFSK-19 - Vendor and validate VS Code hooks

c677ec2

JFSK-19 - Keep plugin validation focused

7ac4a73

JFSK-19 - Align package hook with Agent Guard skill

eafdc9b

Keep VS Code SessionStart validation scoped to package resolution after Agent Guard moved to skill-based delivery, and refresh vendored modules from the rebased upstream branch.

JFSK-19 - Sync harness detection review fix

2bd079e

Refresh the vendored package hook so VS Code uses the same positive Copilot discriminator as the upstream implementation.

JFSK-19 - Refresh vendored modules after upstream rebase

7b8a514

Re-pin plugin/modules to agent-hooks 847774b and bump the plugin version so the package-resolution hook ships with the latest upstream fixes.

JFSK-19 - Bump plugin version above the skills sync on main

95dc527

omerzi force-pushed the feature/JFSK-19-vscode-hooks branch from 4c0933b to 95dc527 Compare August 3, 2026 08:02

omerzi changed the title ~~Add package resolution to the VS Code plugin~~ Add Copilot package-resolution hook to the VS Code plugin Aug 3, 2026

omerzi added 2 commits August 3, 2026 15:07

JFSK-19 - Re-pin vendor source after upstream rebase

a34693c

JFSK-19 - Re-pin vendor source to merged master SHA now that agent-ho…

b3fc5e8

…oks#48 landed

omerzi marked this pull request as ready for review August 5, 2026 09:05

sankerr reviewed Aug 5, 2026

View reviewed changes

Comment thread README.md

sankerr reviewed Aug 5, 2026

View reviewed changes

Comment thread plugin/hooks/hooks.json

sankerr reviewed Aug 5, 2026

View reviewed changes

Comment thread .github/scripts/sync-modules-vendor.json Outdated

sankerr reviewed Aug 5, 2026

View reviewed changes

Comment thread scripts/validate-package-resolution-hook.mjs

YoniMelki reviewed Aug 6, 2026

View reviewed changes

YoniMelki requested changes Aug 6, 2026

View reviewed changes

omerzi added 2 commits August 6, 2026 10:51

JFSK-19 - Allow verified repository resolution time

a8141e8

Give the Copilot hook enough bounded time for a cold repository verification and assert the hook budget in the plugin validator.

JFSK-19 - Prepare VS Code plugin for hardened hook release

e66cb32

Re-vendor the merged package-resolution capability, add integrity validation, and document the Copilot setup and governance flow.

JFSK-19 - Pin VS Code plugin to agent-hooks v0.9.0

e8449d1

Use the released upstream module tag and refresh integrity metadata for the final plugin synchronization.

omerzi added 2 commits August 9, 2026 15:04

JFSK-19 - Cover verified package-resolution paths

17d08c3

Exercise repository verification and the per-session resolution invariant in plugin validation, and run the pinned upstream package-resolution suite in CI.

JFSK-19 - Keep plugin CI independent of upstream host

eca3db4

Remove the cross-host upstream clone from public plugin CI; upstream module behavior remains covered by the agent-hooks repository checks.

JFSK-19 - Cover vendored setup support modules

d357336

Exercise eager setup eligibility, setup receipts, and package-manager conflict detection directly against the modules shipped in the VS Code plugin.

YoniMelki approved these changes Aug 10, 2026

View reviewed changes

omerzi merged commit 90f6bc9 into main Aug 10, 2026
2 checks passed

omerzi deleted the feature/JFSK-19-vscode-hooks branch August 10, 2026 07:05

Uh oh!

Conversation

omerzi commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overview

Details

Flow

Validation

Dependency

Uh oh!

sverdlov93 left a comment

Choose a reason for hiding this comment

Findings (inline below)

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sverdlov93 commented Aug 2, 2026

Uh oh!

sverdlov93 commented Aug 2, 2026

Uh oh!

omerzi commented Aug 3, 2026

Uh oh!

sankerr left a comment

Choose a reason for hiding this comment

Prior round

Sync Plugins (jfrog-agent-hooks)

Docs parity

Findings (inline)

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

omerzi commented Aug 9, 2026

Uh oh!

omerzi commented Aug 9, 2026

Uh oh!

omerzi commented Aug 9, 2026

Uh oh!

omerzi commented Aug 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

omerzi commented Jul 27, 2026 •

edited

Loading

Sync Plugins (`jfrog-agent-hooks`)