@codyswann/lisa 2.119.1 → 2.121.1

package/scripts/generate-codex-plugin-artifacts.mjs

@@ -3,18 +3,29 @@
  * Generate Codex plugin artifacts from the built Claude plugin directories.
  *
  * Claude remains Lisa's production path; this script derives the .codex-plugin
- * metadata (skills + MCP pointers) every time plugins are rebuilt.
- *
- * NOTE ON HOOKS: this script does NOT emit Codex hooks. Codex (codex-cli
- * 0.125.0) does not execute plugin-bundled hooks — its plugin manifest parser
- * only honors `skills`, `mcpServers`, `apps`, and interface fields, and a
- * runtime test confirmed a bundled `hooks/hooks.json` never fires. Lisa's
- * Codex hooks are instead installed into the project's `.codex/hooks.json`
- * by `src/codex/hooks-installer.ts` (run during `lisa` apply). Hooks with no
- * Codex equivalent are intentionally not ported: `enforce-team-first.sh`
- * (Claude-team-specific), `inject-flow-context.sh` and any SubagentStart hook
- * (Codex has no SubagentStart event), and the SessionEnd `entire` hook (Codex
- * has no SessionEnd event).
+ * metadata (skills + MCP pointers + hooks) every time plugins are rebuilt.
+ *
+ * HOOKS: as of Codex 0.125.0 (verified via codex features list showing
+ * codex_hooks as `stable`), the plugin manifest accepts a `hooks` field
+ * pointing at a sibling `hooks.json`. `emitCodexHooks` below derives the
+ * Codex-shape hooks block from the Claude manifest by applying the Wave 1
+ * per-agent ship-list audit
+ * (wiki/architecture/lisa-hook-per-agent-ship-list.md):
+ *   - Drop every `entire hooks claude-code *` command (Claude-only analytics).
+ *   - Drop every reference to `enforce-team-first.sh` (Claude-team-specific).
+ *   - Drop `inject-flow-context.sh` ONLY when targeting an agent without
+ *     SubagentStart (Codex 0.125.0 has SubagentStart, so we ship it).
+ *   - Rewrite ${CLAUDE_PLUGIN_ROOT}/hooks/<n>.sh to ./hooks/<n>.sh so the
+ *     hooks.json sibling can resolve the script path relative to itself.
+ *   - Copy the surviving scripts into .codex-plugin/hooks/.
+ *
+ * SessionEnd is documented as unsupported by Codex; the `entire hooks
+ * claude-code session-end` hook is stripped per the Claude-only rule above
+ * regardless of event support.
+ *
+ * src/codex/hooks-installer.ts remains as the documented fallback for users
+ * who install Lisa via `lisa apply` without enabling the marketplace plugin —
+ * src/codex/lisa-plugin-detection.ts is the helper that gates that fallback.
  */
 import fs from "node:fs";
 import path from "node:path";
@@ -441,10 +452,64 @@ function main() {
   const pluginName = claudeManifest.name;
 
   pruneInternalCodexSkills(pluginDir);
+  emitCodexHooks(pluginDir, claudeManifest);
   writeCodexManifest(pluginDir, claudeManifest, pluginName, versionArg);
   writeSkillAgents(pluginDir);
 }
 
+/**
+ * Per Wave 1 audit + Codex 0.125.0 supporting plugin-bundled hooks: derive
+ * a Codex-shaped hooks.json from the Claude manifest's hooks block and copy
+ * the surviving scripts into .codex-plugin/hooks/.
+ *
+ * No-op when the input has no hooks block or every entry is stripped.
+ *
+ * @param {string} pluginDir Built Claude plugin directory.
+ * @param {object} claudeManifest Parsed contents of .claude-plugin/plugin.json.
+ */
+function emitCodexHooks(pluginDir, claudeManifest) {
+  // Codex auto-discovers a plugin's hooks at <plugin-root>/hooks/hooks.json and
+  // resolves the manifest hooks pointer + ${PLUGIN_ROOT} relative to the plugin
+  // root (developers.openai.com/codex/plugins/build). The hook scripts already
+  // ship at <plugin-root>/hooks/ (copied from plugins/src by the Claude build),
+  // so the Codex hooks.json lives alongside them and no script copy is needed.
+  const hooksDir = path.join(pluginDir, "hooks");
+  const hooksJsonPath = path.join(hooksDir, "hooks.json");
+  // Clean up the pre-2.121 layout (hooks.json + copied scripts under
+  // .codex-plugin/) so a rebuilt plugin never ships both.
+  const legacyCodexPluginDir = path.join(pluginDir, ".codex-plugin");
+  fs.rmSync(path.join(legacyCodexPluginDir, "hooks.json"), { force: true });
+  fs.rmSync(path.join(legacyCodexPluginDir, "hooks"), {
+    force: true,
+    recursive: true,
+  });
+  const filtered = filterCodexHooks(claudeManifest.hooks);
+  if (filtered === null) {
+    // Nothing survived the filter. Remove any stale hooks.json so
+    // componentPointers() doesn't keep advertising removed hooks.
+    fs.rmSync(hooksJsonPath, { force: true });
+    return;
+  }
+  fs.mkdirSync(hooksDir, { recursive: true });
+  fs.writeFileSync(
+    hooksJsonPath,
+    `${JSON.stringify(buildCodexHooksDocument(filtered), null, 2)}\n`
+  );
+}
+
+/**
+ * Wrap a filtered events block in the document shape Codex's hooks.json parser
+ * expects: events nested under a top-level "hooks" key (see the HooksFile
+ * contract in src/codex/hooks-merger.ts). Writing the events block at the root
+ * would not be recognized as hooks.
+ *
+ * @param {object} filtered Codex-shaped events block from filterCodexHooks.
+ * @returns {{ hooks: object }} The hooks.json document root.
+ */
+export function buildCodexHooksDocument(filtered) {
+  return { hooks: filtered };
+}
+
 function writeCodexManifest(pluginDir, claudeManifest, pluginName, version) {
   const metadata = metadataFor(pluginName, claudeManifest);
   const manifest = {
@@ -484,9 +549,82 @@ function componentPointers(pluginDir) {
     ...(fs.existsSync(path.join(pluginDir, ".mcp.json"))
       ? { mcpServers: "./.mcp.json" }
       : {}),
+    ...(fs.existsSync(path.join(pluginDir, "hooks", "hooks.json"))
+      ? { hooks: "./hooks/hooks.json" }
+      : {}),
   };
 }
 
+/**
+ * Per the Wave 1 hook audit, derive Codex-shaped hooks.json from the
+ * Claude plugin.json hooks block:
+ *   - Drop every `entire hooks claude-code *` command (Claude-only).
+ *   - Drop every reference to `enforce-team-first.sh` (Claude-team-specific).
+ *   - Rewrite ${CLAUDE_PLUGIN_ROOT}/hooks/<script>.sh to
+ *     ${PLUGIN_ROOT}/hooks/<script>.sh (Codex exposes the installed plugin
+ *     root to hook commands as ${PLUGIN_ROOT}).
+ *   - Drop matchers that produce no surviving handlers.
+ *
+ * When the resulting block is empty, no hooks.json is written and the
+ * manifest pointer omits the hooks field.
+ *
+ * @param {object} hooksBlock The hooks field from the Claude plugin manifest.
+ * @returns {object | null} A Codex-shape hooks block or null when empty.
+ */
+export function filterCodexHooks(hooksBlock) {
+  if (!hooksBlock || typeof hooksBlock !== "object") return null;
+  const codexStrip = new Set(["enforce-team-first.sh"]);
+  const isEntire = cmd =>
+    typeof cmd === "string" &&
+    /command -v entire >\/dev\/null 2>&1 && entire hooks claude-code /.test(
+      cmd
+    );
+  const scriptName = cmd => {
+    if (typeof cmd !== "string") return null;
+    const m = /\$\{CLAUDE_PLUGIN_ROOT\}\/hooks\/([^/\s]+\.sh)/.exec(cmd);
+    return m ? m[1] : null;
+  };
+  const out = {};
+  for (const [event, entries] of Object.entries(hooksBlock)) {
+    if (!Array.isArray(entries)) continue;
+    const keptEntries = [];
+    for (const entry of entries) {
+      const handlers = entry?.hooks;
+      if (!Array.isArray(handlers)) continue;
+      const keptHandlers = handlers.flatMap(h => {
+        if (!h || typeof h.command !== "string") return [];
+        if (isEntire(h.command)) return [];
+        const script = scriptName(h.command);
+        if (script !== null) {
+          if (codexStrip.has(script)) return [];
+          return [
+            {
+              ...h,
+              // Codex exposes the installed plugin root as ${PLUGIN_ROOT} to hook
+              // commands (developers.openai.com/codex/plugins/build). A bare
+              // ./hooks/ path would resolve against the session cwd, not the
+              // plugin, so rewrite to the plugin-root env var.
+              command: h.command.replaceAll(
+                "${CLAUDE_PLUGIN_ROOT}/hooks/",
+                "${PLUGIN_ROOT}/hooks/"
+              ),
+            },
+          ];
+        }
+        // Unknown command shape — ship verbatim.
+        return [h];
+      });
+      if (keptHandlers.length > 0) {
+        keptEntries.push({ ...entry, hooks: keptHandlers });
+      }
+    }
+    if (keptEntries.length > 0) {
+      out[event] = keptEntries;
+    }
+  }
+  return Object.keys(out).length > 0 ? out : null;
+}
+
 function metadataFor(pluginName, claudeManifest) {
   const map = {
     lisa: {

package/scripts/generate-copilot-plugin-artifacts.mjs

@@ -0,0 +1,235 @@
+#!/usr/bin/env node
+/**
+ * Generate the GitHub Copilot variant of a Lisa plugin from the built Claude
+ * artifact.
+ *
+ * Copilot reads `.claude-plugin/plugin.json` as a documented fallback (per its
+ * manifest lookup order: plugin.json → .plugin/ → .github/plugin/ →
+ * .claude-plugin/). The Copilot variant keeps the `.claude-plugin/` manifest
+ * but rewrites hook event names to Copilot's camelCase convention
+ * (`preToolUse`, `agentStop`, etc.) and strips hooks that don't have a Copilot
+ * equivalent (SubagentStart entries — Copilot lacks the event).
+ *
+ * Per the Wave 1 audit, Copilot ships:
+ *   block-no-verify.sh, inject-rules.sh (conservative default — conditional on
+ *   the rules-auto-load probe), notify-ntfy.sh, install-pkgs.sh, setup-jira-cli.sh.
+ *
+ * Per the Wave 2 pattern-b-fan-out-spec.md, this generator runs four pre-flight
+ * probes when `copilot` is on PATH and caches the results. When `copilot` is
+ * not on PATH (CI builds, contributors without Copilot), the cached values are
+ * used; absent cache values fall through to conservative defaults.
+ *
+ * Usage: node scripts/generate-copilot-plugin-artifacts.mjs <source-plugin-dir> <out-dir> <version>
+ *
+ * @module scripts/generate-copilot-plugin-artifacts
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import {
+  filterHooksForAgent,
+  filterScriptsForAgent,
+} from "./lib/per-agent-hook-filter.mjs";
+
+const REPO_ROOT = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  ".."
+);
+const POLICY_PATH = path.join(
+  REPO_ROOT,
+  "scripts",
+  "internal-copilot-skill-policy.json"
+);
+const PROBE_CACHE_PATH = path.join(
+  REPO_ROOT,
+  "scripts",
+  "internal-copilot-runtime-probe.json"
+);
+
+/**
+ * @returns {{ denylist?: string[] }}
+ */
+function readPolicy() {
+  if (!fs.existsSync(POLICY_PATH)) return {};
+  try {
+    return JSON.parse(fs.readFileSync(POLICY_PATH, "utf8"));
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Read cached Copilot runtime probe results.
+ *
+ * Fields documented in pattern-b-fan-out-spec.md §Pre-flight probes:
+ *   - pluginRootEnvVar: e.g. "COPILOT_PLUGIN_ROOT" or null (use absolute paths)
+ *   - rulesAutoLoads: boolean — Copilot reads plugin's rules/ natively
+ *   - agentPathOverrideAccepted: boolean — manifest agents:"agents/" accepts non-.agent.md
+ *   - cliVersion: string for invalidation
+ *
+ * @returns {{ pluginRootEnvVar?: string|null, rulesAutoLoads?: boolean, agentPathOverrideAccepted?: boolean, cliVersion?: string }}
+ */
+function readProbeCache() {
+  if (!fs.existsSync(PROBE_CACHE_PATH)) return {};
+  try {
+    return JSON.parse(fs.readFileSync(PROBE_CACHE_PATH, "utf8"));
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Recursive directory copy with optional path-level filter.
+ *
+ * @param {string} src
+ * @param {string} dst
+ * @param {(relPath: string, stat: fs.Stats) => boolean} keep
+ */
+function copyDir(src, dst, keep = () => true) {
+  if (!fs.existsSync(src)) return;
+  fs.mkdirSync(dst, { recursive: true });
+  const walk = (current, rel) => {
+    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+      const srcPath = path.join(current, entry.name);
+      const relPath = path.join(rel, entry.name);
+      const dstPath = path.join(dst, relPath);
+      const stat = fs.statSync(srcPath);
+      if (!keep(relPath, stat)) continue;
+      if (entry.isDirectory()) {
+        fs.mkdirSync(dstPath, { recursive: true });
+        walk(srcPath, relPath);
+      } else if (entry.isFile()) {
+        fs.copyFileSync(srcPath, dstPath);
+      }
+    }
+  };
+  walk(src, "");
+}
+
+/**
+ * Generate the Copilot variant.
+ *
+ * @param {string} srcDir Built Claude plugin directory (input).
+ * @param {string} outDir Copilot variant output directory.
+ * @param {string} version Version string for the manifest.
+ */
+export function generateCopilotVariant(srcDir, outDir, version) {
+  if (!fs.existsSync(path.join(srcDir, ".claude-plugin", "plugin.json"))) {
+    return;
+  }
+
+  const policy = readPolicy();
+  const denylist = new Set(policy.denylist ?? []);
+  const probe = readProbeCache();
+
+  // Conservative defaults for any probe value not in cache:
+  //   - rulesAutoLoads: false (ship inject-rules.sh, accept potential double-load
+  //     until empirically refuted by the probe — same as the Wave 1 audit's default)
+  //   - pluginRootEnvVar: null (use ${CLAUDE_PLUGIN_ROOT} in command strings; Copilot
+  //     may or may not honor it. Wave 3 verify-by-run resolves this.)
+  //   - agentPathOverrideAccepted: false (rename agents/*.md to *.agent.md in the variant
+  //     to be safe; if the override works, this is harmless extra renaming)
+  const copilotRulesAutoLoads = probe.rulesAutoLoads === true;
+  const renameAgentsToAgentMd = probe.agentPathOverrideAccepted !== true;
+
+  fs.rmSync(outDir, { recursive: true, force: true });
+  fs.mkdirSync(outDir, { recursive: true });
+
+  // 1. Copy source minus .codex-plugin/ and apply skill denylist.
+  copyDir(srcDir, outDir, relPath => {
+    if (relPath.startsWith(".codex-plugin/") || relPath === ".codex-plugin")
+      return false;
+    // Drop the Codex hooks manifest the base build emits at hooks/hooks.json —
+    // Copilot reads its (camelCase) hooks from .claude-plugin/plugin.json, not
+    // this Codex-shaped (PascalCase, ${PLUGIN_ROOT}) file. Keeping it would ship
+    // a spurious, wrong-shaped hooks manifest in the Copilot variant.
+    if (relPath === path.join("hooks", "hooks.json")) return false;
+    // Drop Codex-specific per-skill openai.yaml artifacts — Copilot does not use them.
+    if (/^skills\/[^/]+\/agents\/openai\.ya?ml$/.test(relPath)) return false;
+    const skillsPrefix = path.join("skills") + path.sep;
+    if (relPath.startsWith(skillsPrefix)) {
+      const skillName = relPath.slice(skillsPrefix.length).split(path.sep)[0];
+      if (denylist.has(skillName)) return false;
+    }
+    return true;
+  });
+
+  // 1a. Remove any now-empty `skills/<n>/agents/` directories left by the openai.yaml strip.
+  const skillsDirForCleanup = path.join(outDir, "skills");
+  if (fs.existsSync(skillsDirForCleanup)) {
+    for (const skillName of fs.readdirSync(skillsDirForCleanup)) {
+      const agentsDir = path.join(skillsDirForCleanup, skillName, "agents");
+      if (fs.existsSync(agentsDir) && fs.readdirSync(agentsDir).length === 0) {
+        fs.rmdirSync(agentsDir);
+      }
+    }
+  }
+
+  // 2. Rename agents/<n>.md to agents/<n>.agent.md (per Copilot's default convention).
+  //    This is the safe-default path; if the manifest agents-path override probe
+  //    returns positive, this rename is unnecessary but harmless.
+  if (renameAgentsToAgentMd) {
+    const agentsDir = path.join(outDir, "agents");
+    if (fs.existsSync(agentsDir)) {
+      for (const entry of fs.readdirSync(agentsDir, { withFileTypes: true })) {
+        if (
+          entry.isFile() &&
+          entry.name.endsWith(".md") &&
+          !entry.name.endsWith(".agent.md")
+        ) {
+          const oldPath = path.join(agentsDir, entry.name);
+          const newName = entry.name.replace(/\.md$/, ".agent.md");
+          const newPath = path.join(agentsDir, newName);
+          fs.renameSync(oldPath, newPath);
+        }
+      }
+    }
+  }
+
+  // 3. Read + filter the manifest, translate event names to Copilot camelCase.
+  const manifestPath = path.join(outDir, ".claude-plugin", "plugin.json");
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+  manifest.version = version;
+  const filteredHooks = filterHooksForAgent(manifest.hooks ?? {}, "copilot", {
+    copilotRulesAutoLoads,
+  });
+  if (filteredHooks) {
+    manifest.hooks = filteredHooks;
+  } else {
+    delete manifest.hooks;
+  }
+  fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + "\n");
+
+  // 4. Filter the hooks/ directory.
+  const hooksDir = path.join(outDir, "hooks");
+  if (fs.existsSync(hooksDir)) {
+    const all = fs
+      .readdirSync(hooksDir, { withFileTypes: true })
+      .filter(e => e.isFile() && e.name.endsWith(".sh"))
+      .map(e => e.name);
+    // Copilot ships everything Cursor ships, plus inject-rules.sh when
+    // copilotRulesAutoLoads is false. The filter helper handles this.
+    const keep = new Set(filterScriptsForAgent(all, "copilot"));
+    // If the rules-auto-load probe is positive, ALSO strip inject-rules.sh.
+    if (copilotRulesAutoLoads) keep.delete("inject-rules.sh");
+    for (const name of all) {
+      if (!keep.has(name)) fs.rmSync(path.join(hooksDir, name));
+    }
+    if (fs.readdirSync(hooksDir).length === 0) {
+      fs.rmdirSync(hooksDir);
+    }
+  }
+}
+
+// CLI entrypoint.
+if (import.meta.url === `file://${process.argv[1]}`) {
+  const [srcDir, outDir, version] = process.argv.slice(2);
+  if (!srcDir || !outDir || !version) {
+    console.error(
+      "Usage: generate-copilot-plugin-artifacts.mjs <src> <out> <version>"
+    );
+    process.exit(1);
+  }
+  generateCopilotVariant(srcDir, outDir, version);
+  console.log(`Generated Copilot variant at ${outDir} (v${version})`);
+}

package/scripts/generate-cursor-plugin-artifacts.mjs

@@ -0,0 +1,177 @@
+#!/usr/bin/env node
+/**
+ * Generate the Cursor variant of a Lisa plugin from the built Claude artifact.
+ *
+ * Cursor reads `.claude-plugin/plugin.json` natively via its dual-namespace
+ * loader (also accepts `.cursor-plugin/plugin.json`). The Cursor variant
+ * therefore keeps the `.claude-plugin/` manifest but filters the hooks block
+ * to drop `inject-rules.sh` (Cursor auto-loads `rules/` from plugins natively,
+ * so shipping the polyfill would double-inject), `enforce-team-first.sh`
+ * (Claude-team-specific), and the `entire hooks claude-code *` analytics calls
+ * (Claude-only).
+ *
+ * The variant's `hooks/` directory mirrors the surviving script ship-list.
+ *
+ * Usage: node scripts/generate-cursor-plugin-artifacts.mjs <source-plugin-dir> <out-dir> <version>
+ *
+ * Where:
+ *   source-plugin-dir: path to the built Claude plugin (e.g. plugins/lisa/)
+ *   out-dir: path to write the Cursor variant (e.g. plugins/lisa-cursor/)
+ *   version: version string injected into the manifest
+ *
+ * @module scripts/generate-cursor-plugin-artifacts
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import {
+  filterHooksForAgent,
+  filterScriptsForAgent,
+} from "./lib/per-agent-hook-filter.mjs";
+
+const REPO_ROOT = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  ".."
+);
+const POLICY_PATH = path.join(
+  REPO_ROOT,
+  "scripts",
+  "internal-cursor-skill-policy.json"
+);
+
+/**
+ * Read the per-agent skill policy file. Missing-policy is treated as
+ * "ship all skills" (no denylist).
+ *
+ * @returns {{ denylist?: string[] }}
+ */
+function readPolicy() {
+  if (!fs.existsSync(POLICY_PATH)) return {};
+  try {
+    return JSON.parse(fs.readFileSync(POLICY_PATH, "utf8"));
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Recursive directory copy with optional path-level filter.
+ *
+ * @param {string} src
+ * @param {string} dst
+ * @param {(relPath: string, stat: fs.Stats) => boolean} keep
+ */
+function copyDir(src, dst, keep = () => true) {
+  if (!fs.existsSync(src)) return;
+  fs.mkdirSync(dst, { recursive: true });
+  const walk = (current, rel) => {
+    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+      const srcPath = path.join(current, entry.name);
+      const relPath = path.join(rel, entry.name);
+      const dstPath = path.join(dst, relPath);
+      const stat = fs.statSync(srcPath);
+      if (!keep(relPath, stat)) continue;
+      if (entry.isDirectory()) {
+        fs.mkdirSync(dstPath, { recursive: true });
+        walk(srcPath, relPath);
+      } else if (entry.isFile()) {
+        fs.copyFileSync(srcPath, dstPath);
+      }
+    }
+  };
+  walk(src, "");
+}
+
+/**
+ * Generate the Cursor variant.
+ *
+ * @param {string} srcDir Built Claude plugin directory (input).
+ * @param {string} outDir Cursor variant output directory.
+ * @param {string} version Version string for the manifest.
+ */
+export function generateCursorVariant(srcDir, outDir, version) {
+  if (!fs.existsSync(path.join(srcDir, ".claude-plugin", "plugin.json"))) {
+    return; // base plugin has no manifest; nothing to do
+  }
+
+  const policy = readPolicy();
+  const denylist = new Set(policy.denylist ?? []);
+
+  fs.rmSync(outDir, { recursive: true, force: true });
+  fs.mkdirSync(outDir, { recursive: true });
+
+  // 1. Copy the source plugin, applying the skill denylist filter.
+  copyDir(srcDir, outDir, relPath => {
+    // Drop the `.codex-plugin/` directory — Cursor does not consume it.
+    if (relPath.startsWith(".codex-plugin/") || relPath === ".codex-plugin")
+      return false;
+    // Drop the Codex hooks manifest the base build emits at hooks/hooks.json —
+    // Cursor reads its (filtered) hooks from .claude-plugin/plugin.json, not this
+    // Codex-shaped file. The surviving .sh scripts in hooks/ are kept below.
+    if (relPath === path.join("hooks", "hooks.json")) return false;
+    // Drop Codex-specific per-skill openai.yaml artifacts — Cursor does not use them.
+    // These live at skills/<n>/agents/openai.yaml and are generated by the Codex
+    // artifact builder; the per-agent variants ship only the SKILL.md.
+    if (/^skills\/[^/]+\/agents\/openai\.ya?ml$/.test(relPath)) return false;
+    // Apply the per-agent skill denylist (skills/<name>/).
+    const skillsPrefix = path.join("skills") + path.sep;
+    if (relPath.startsWith(skillsPrefix)) {
+      const skillName = relPath.slice(skillsPrefix.length).split(path.sep)[0];
+      if (denylist.has(skillName)) return false;
+    }
+    return true;
+  });
+
+  // 1a. Remove any now-empty `skills/<n>/agents/` directories left by the openai.yaml strip.
+  const skillsDir = path.join(outDir, "skills");
+  if (fs.existsSync(skillsDir)) {
+    for (const skillName of fs.readdirSync(skillsDir)) {
+      const agentsDir = path.join(skillsDir, skillName, "agents");
+      if (fs.existsSync(agentsDir) && fs.readdirSync(agentsDir).length === 0) {
+        fs.rmdirSync(agentsDir);
+      }
+    }
+  }
+
+  // 2. Read + filter the manifest.
+  const manifestPath = path.join(outDir, ".claude-plugin", "plugin.json");
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+  manifest.version = version;
+  const filteredHooks = filterHooksForAgent(manifest.hooks ?? {}, "cursor");
+  if (filteredHooks) {
+    manifest.hooks = filteredHooks;
+  } else {
+    delete manifest.hooks;
+  }
+  fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + "\n");
+
+  // 3. Filter the hooks/ directory to match the script ship-list.
+  const hooksDir = path.join(outDir, "hooks");
+  if (fs.existsSync(hooksDir)) {
+    const all = fs
+      .readdirSync(hooksDir, { withFileTypes: true })
+      .filter(e => e.isFile() && e.name.endsWith(".sh"))
+      .map(e => e.name);
+    const keep = new Set(filterScriptsForAgent(all, "cursor"));
+    for (const name of all) {
+      if (!keep.has(name)) fs.rmSync(path.join(hooksDir, name));
+    }
+    // Remove empty hooks dir.
+    if (fs.readdirSync(hooksDir).length === 0) {
+      fs.rmdirSync(hooksDir);
+    }
+  }
+}
+
+// CLI entrypoint.
+if (import.meta.url === `file://${process.argv[1]}`) {
+  const [srcDir, outDir, version] = process.argv.slice(2);
+  if (!srcDir || !outDir || !version) {
+    console.error(
+      "Usage: generate-cursor-plugin-artifacts.mjs <src> <out> <version>"
+    );
+    process.exit(1);
+  }
+  generateCursorVariant(srcDir, outDir, version);
+  console.log(`Generated Cursor variant at ${outDir} (v${version})`);
+}

package/scripts/internal-agy-skill-policy.json

@@ -0,0 +1,3 @@
+{
+  "denylist": []
+}

package/scripts/internal-copilot-runtime-probe.json

@@ -0,0 +1,13 @@
+{
+  "_comment": "Cached Copilot runtime probe results consumed by scripts/generate-copilot-plugin-artifacts.mjs. Populated 2026-05-28 by empirical probes against GitHub Copilot CLI 1.0.55 (see _evidence). Missing/null values fall through to conservative generator defaults.",
+  "cliVersion": "1.0.55",
+  "pluginRootEnvVar": null,
+  "rulesAutoLoads": false,
+  "agentPathOverrideAccepted": false,
+  "_evidence": {
+    "cliVersion": "[VERIFIED-BY-RUN] `copilot --version` => 'GitHub Copilot CLI 1.0.55.'",
+    "rulesAutoLoads": "[VERIFIED-BY-RUN] A plugin's bundled rules/ directory is NOT auto-loaded. Probe: `copilot --plugin-dir <pkg> -p 'plugin codeword?'` with a sentinel rule in <pkg>/rules/sentinel.md and no .github/copilot-instructions.md returned 'UNKNOWN'. (Copilot DOES auto-load .github/copilot-instructions.md — a separate project file — but that template only points at the plugin, so inject-rules.sh must still ship. Hence false: do NOT strip inject-rules.sh.)",
+    "agentPathOverrideAccepted": "[PARTIAL] With an explicit manifest 'agents: ./agents/' pointer, `copilot --plugin-dir <pkg> --agent <ns>:<name>` loaded a non-.agent.md file (agents/probeagent.md) and it responded. However that is session-only --plugin-dir loading; the marketplace-install auto-discovery path is unverified and .agent.md loads in every observed context. Kept false so the generator retains the universally-safe rename to <name>.agent.md.",
+    "pluginRootEnvVar": "[VERIFIED-DOC] GitHub Copilot CLI plugin reference documents ${COPILOT_PLUGIN_DATA} is also exposed as ${CLAUDE_PLUGIN_DATA}; Copilot aliases the CLAUDE_* plugin env vars, so the ${CLAUDE_PLUGIN_ROOT} form the generator emits in hook commands is supported. null => generator keeps ${CLAUDE_PLUGIN_ROOT}. Direct hook-fire env capture was not achievable via --plugin-dir in -p mode (hook did not fire; firing likely requires a real `copilot plugin install` and/or interactive trust — unverified)."
+  }
+}

package/scripts/internal-copilot-skill-policy.json

@@ -0,0 +1,3 @@
+{
+  "denylist": []
+}

package/scripts/internal-cursor-skill-policy.json

@@ -0,0 +1,3 @@
+{
+  "denylist": []
+}