create-agdf 0.13.7 → 0.14.1

package/lib/installers/local-marketplace.js

@@ -398,6 +398,7 @@ export function prepareLocalMarketplace({
         codexInstallVersion,
         sourceDigest,
         digest: pluginDigest,
+        runtimeDigest: runtimeManifest.digest,
         existingClassification,
         changed: false,
         commit() {},
@@ -420,6 +421,7 @@ export function prepareLocalMarketplace({
       codexInstallVersion,
       sourceDigest,
       digest: pluginDigest,
+      runtimeDigest: runtimeManifest.digest,
       existingClassification,
       changed: true,
       commit() {

package/lib/installers/opencode.js

@@ -6,6 +6,7 @@ import process from "node:process";
 import { generatedRoot, pluginDefinition } from "../cli/runtime-context.js";
 import { evaluateOpenCodeRepositoryActivation } from "./opencode-activation.js";
 import { resolveLocalValidator } from "../runtime/local-validator.js";
+import { digestDirectory } from "../runtime/plugin-provenance.js";
 import { validateLocalOpenCodePackageSource } from "./local-development.js";
 
 const contractModules = ["gate-transition.md", "interaction.md", "modes.md", "quality.md", "context-graph.md", "control-scaffold.md", "closeout.md"];
@@ -17,6 +18,7 @@ const globalOpenCodeRuntimeContractOwnershipMarker = "<!-- AGDF-GLOBAL-RUNTIME-C
 const globalOpenCodeValidatorOwnershipMarker = "// AGDF-GLOBAL-LOCAL-VALIDATOR";
 const globalOpenCodeAgentOwnershipMarker = `<!-- AGDF-GLOBAL-AGENT: ${pluginDefinition.opencode.evaluatorAgentName} -->`;
 const globalOpenCodeValidatorPackageOwner = "create-agdf";
+export const openCodePluginEntrypoint = `./node_modules/${pluginDefinition.opencode.npmPackage}/opencode-plugin.js`;
 const testNpmCliPath = process.env.NODE_ENV === "test" ? process.env.AGDF_TEST_NPM_CLI_PATH || "" : "";
 const npmCommand = testNpmCliPath ? process.execPath : process.platform === "win32" ? process.execPath : "npm";
 const npmPrefixArgs = testNpmCliPath ? [testNpmCliPath] : process.platform === "win32" ? [join(dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js")] : [];
@@ -67,10 +69,14 @@ export function installOpenCodeGlobalPlugin(configDir, dependencies = {}) {
     throw openCodeLifecycleError("configuration", `Refusing to update OpenCode config with non-array plugin field: ${configPath}`, { configPath });
   }
 
-  const plugins = [...(config.plugin ?? [])];
-  const alreadyInstalled = plugins.includes(pluginDefinition.opencode.npmPackage);
+  const plugins = (config.plugin ?? []).map((entry) => (
+    entry === pluginDefinition.opencode.npmPackage || entry.startsWith(`${pluginDefinition.opencode.npmPackage}@`)
+      ? openCodePluginEntrypoint
+      : entry
+  ));
+  const alreadyInstalled = plugins.includes(openCodePluginEntrypoint);
   if (!alreadyInstalled) {
-    plugins.push(pluginDefinition.opencode.npmPackage);
+    plugins.push(openCodePluginEntrypoint);
   }
 
   const nextConfig = {
@@ -128,6 +134,10 @@ export function installOpenCodeGlobalPlugin(configDir, dependencies = {}) {
     throw openCodeLifecycleError("configuration", `Failed to write OpenCode config ${configPath}: ${error.message}`, { configPath });
   }
   const installedPackage = resolveOpenCodePackage(configDir);
+  if (!installedPackage.loadable || !installedPackage.package_root) {
+    throw openCodeLifecycleError("verification", "Installed OpenCode AGDF package is not loadable after installation.", { configDir });
+  }
+  const installedPackageDigest = digestDirectory(installedPackage.package_root);
   const sdkAlignment = alignOpenCodePluginSdk(configDir);
 
   return {
@@ -135,6 +145,7 @@ export function installOpenCodeGlobalPlugin(configDir, dependencies = {}) {
     added: !alreadyInstalled,
     transition: openCodePackageTransition(previousPackage, installedPackage),
     sdk_alignment: sdkAlignment,
+    installed_package: { root: installedPackage.package_root, digest: installedPackageDigest },
     package_source: localPackageSource
       ? { kind: "local_checkout", path: localPackageSource.tarball, digest: localPackageSource.digest, version: localPackageSource.version }
       : { kind: "registry", path: "", digest: "", version: pluginDefinition.version },
@@ -736,7 +747,8 @@ export function evaluateOpenCodeStatus(targetDir, configDir = defaultOpenCodeCon
   const configPath = join(configDir, "opencode.json");
   const configState = readOpenCodeConfig(configPath);
   const plugins = Array.isArray(configState.config.plugin) ? configState.config.plugin : [];
-  const globalConfigured = plugins.includes(pluginDefinition.opencode.npmPackage);
+  const globalConfigured = plugins.includes(openCodePluginEntrypoint);
+  const legacyPluginConfigured = plugins.some((entry) => entry === pluginDefinition.opencode.npmPackage || entry.startsWith(`${pluginDefinition.opencode.npmPackage}@`));
   const packageState = resolveOpenCodePackage(configDir);
   const packageVersionStatus = openCodePackageVersionStatus(packageState);
   const globalNativeSurface = evaluateGlobalOpenCodeSurface(configDir);
@@ -754,7 +766,9 @@ export function evaluateOpenCodeStatus(targetDir, configDir = defaultOpenCodeCon
   const findings = [];
   if (!configState.exists) findings.push("OpenCode global config not found.");
   if (configState.parseError) findings.push(`OpenCode global config is not valid JSON: ${configState.parseError}`);
-  if (!globalConfigured) findings.push(`OpenCode global config does not include ${pluginDefinition.opencode.npmPackage}.`);
+  if (!globalConfigured) findings.push(legacyPluginConfigured
+    ? `OpenCode global config still uses the host-managed npm cache entry for ${pluginDefinition.opencode.npmPackage}; rerun installation to bind the verified local package entrypoint.`
+    : `OpenCode global config does not include ${openCodePluginEntrypoint}.`);
   if (!packageState.loadable) findings.push(`${pluginDefinition.opencode.npmPackage} is not loadable from the OpenCode config directory.`);
   if (packageVersionStatus === "outdated") findings.push(`${pluginDefinition.opencode.npmPackage} version ${packageState.installed_version} is outdated; expected ${pluginDefinition.version}.`);
   if (packageVersionStatus === "unknown" && packageState.loadable) findings.push(`${pluginDefinition.opencode.npmPackage} is loadable but its installed version is unknown.`);
@@ -783,6 +797,8 @@ export function evaluateOpenCodeStatus(targetDir, configDir = defaultOpenCodeCon
       exists: configState.exists,
       parse_error: configState.parseError,
       plugin_configured: globalConfigured,
+      plugin_entrypoint: openCodePluginEntrypoint,
+      legacy_plugin_configured: legacyPluginConfigured,
     },
     package: {
       name: pluginDefinition.opencode.npmPackage,

package/lib/installers/plugin-installers.js

@@ -1,7 +1,13 @@
 import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import process from "node:process";
 import { pluginDefinition } from "../cli/runtime-context.js";
+import { digestNormalizedPluginSource } from "../runtime/plugin-provenance.js";
 import { CODEX_REGISTRATION_REVISION, classifyMarketplaceList, inspectLocalMarketplaceProjection, isCodexLocalInstallVersion, prepareLocalMarketplace } from "./local-marketplace.js";
 
+export const COPILOT_CLI_NPM_PACKAGE = "@github/copilot@1.0.80";
+
 export function installCodexGlobalPlugin({ exec = execFileSync, prepare = prepareLocalMarketplace, dataRoot } = {}) {
   const expectedVersion = pluginDefinition.version;
   const nativeOutput = [];
@@ -30,6 +36,10 @@ export function installCodexGlobalPlugin({ exec = execFileSync, prepare = prepar
         ...(transaction.existingClassification === "owned_pre_provenance_rebuild" ? ["marketplace_recovery:owned_pre_provenance_rebuild", "loaded_session:restart_required"] : []),
         ...(expectedInstallVersion === expectedVersion ? [] : [`canonical_version:${expectedVersion}`, `local_install_version:${expectedInstallVersion}`]),
       ],
+      pluginRoot: transaction.pluginRoot ?? null,
+      digest: transaction.digest ?? null,
+      runtimeDigest: transaction.runtimeDigest ?? null,
+      sourceDigest: transaction.sourceDigest ?? null,
       nativeOutput: nativeOutput.filter(Boolean).map(String),
     };
   } catch (error) {
@@ -77,6 +87,10 @@ export function installClaudeGlobalPlugin({ exec = execFileSync, prepare = prepa
         ...(transaction.existingClassification === "owned_pre_provenance_rebuild" ? ["marketplace_recovery:owned_pre_provenance_rebuild", "loaded_session:restart_required"] : []),
         ...(installedVersion ? [] : ["host_did_not_expose_version"]),
       ],
+      pluginRoot: transaction.pluginRoot ?? null,
+      digest: transaction.digest ?? null,
+      runtimeDigest: transaction.runtimeDigest ?? null,
+      sourceDigest: transaction.sourceDigest ?? null,
       nativeOutput: nativeOutput.filter(Boolean).map(String),
     };
   } catch (error) {
@@ -85,6 +99,142 @@ export function installClaudeGlobalPlugin({ exec = execFileSync, prepare = prepa
   }
 }
 
+export function installCopilotGlobalPlugin({ exec = execFileSync, packagedCopilotExec = execFileSync, prepare = prepareLocalMarketplace, dataRoot, pluginRoot } = {}) {
+  const expectedVersion = pluginDefinition.version;
+  const transaction = pluginRoot ? null : prepare({ expectedVersion, ...(dataRoot ? { dataRoot } : {}) });
+  const effectivePluginRoot = pluginRoot ?? transaction?.pluginRoot;
+  if (!effectivePluginRoot) throw lifecycleAdapterError("package", "AGDF Copilot plugin root is required.");
+  let runtimeManifest;
+  try {
+    runtimeManifest = JSON.parse(readFileSync(join(effectivePluginRoot, "runtime", "runtime-manifest.json"), "utf8"));
+  } catch (error) {
+    transaction?.rollback();
+    throw lifecycleAdapterError("package", `AGDF Copilot runtime manifest is unavailable: ${error.message}`);
+  }
+  const sourceDigest = transaction?.sourceDigest || digestNormalizedPluginSource(effectivePluginRoot, expectedVersion);
+  let before = "";
+  let activeExec = exec;
+  const bootstrapEvidence = [];
+  try {
+    before = activeExec("copilot", ["plugin", "list"], captureOptions());
+  } catch (error) {
+    if (error?.code !== "ENOENT") {
+      transaction?.rollback();
+      throw lifecycleAdapterError("verification", commandErrorText(error), { executable: "copilot", args: ["plugin", "list"] });
+    }
+    const invocation = copilotNpmInvocation();
+    activeExec = (_executable, args, options) => packagedCopilotExec(invocation.executable, [...invocation.args, ...args], options);
+    try {
+      before = activeExec("copilot", ["plugin", "list"], captureOptions());
+      bootstrapEvidence.push("copilot_cli_not_found", `copilot_cli_npm_package:${COPILOT_CLI_NPM_PACKAGE}`);
+    } catch (bootstrapError) {
+      transaction?.commit();
+      return {
+        surface: "copilot", operation: "install", expectedVersion, installedVersion: null,
+        verificationStatus: "unavailable", manualHandoff: true,
+        evidence: ["copilot_cli_not_found", `copilot_cli_npm_bootstrap_failed:${commandErrorText(bootstrapError)}`, "durable_local_plugin_stage", `local_plugin_root:${effectivePluginRoot}`, `source_digest:${sourceDigest}`],
+        pluginRoot: effectivePluginRoot, runtimeDigest: runtimeManifest.digest, sourceDigest, nativeOutput: [],
+      };
+    }
+  }
+  const directInstalled = pluginListHasPlugin(before, "agdf");
+  const marketplaceInstalled = pluginListHasPlugin(before, "agdf@agdf");
+  let marketplaceAdded = false;
+  let directRemoved = false;
+  try {
+    const nativeOutput = [];
+    const marketplaceOutput = runPluginPhase(activeExec, "copilot", ["plugin", "marketplace", "list"], "marketplace", captureOptions());
+    const marketplace = classifyCopilotMarketplaceList(marketplaceOutput, transaction?.root ?? resolve(effectivePluginRoot, "..", ".."));
+    if (marketplace.state === "conflict") {
+      throw lifecycleAdapterError("marketplace", `Refusing to replace non-AGDF Copilot marketplace registration agdf (${marketplace.source || "unknown source"}).`);
+    }
+    if (marketplace.state === "absent") {
+      nativeOutput.push(runPluginPhase(activeExec, "copilot", ["plugin", "marketplace", "add", transaction?.root ?? resolve(effectivePluginRoot, "..", "..")], "marketplace", captureOptions()));
+      marketplaceAdded = true;
+    }
+    if (directInstalled) {
+      nativeOutput.push(runPluginPhase(activeExec, "copilot", ["plugin", "uninstall", "agdf"], "plugin_operation", captureOptions()));
+      directRemoved = true;
+    }
+    nativeOutput.push(runPluginPhase(activeExec, "copilot", ["plugin", "install", "agdf@agdf"], "plugin_operation", captureOptions()));
+    const after = runPluginPhase(activeExec, "copilot", ["plugin", "list"], "verification", captureOptions());
+    const installed = pluginListHasPlugin(after, "agdf@agdf");
+    const installedVersion = installed ? pluginVersionFromList(after, "agdf@agdf") : "";
+    if (!installed) throw lifecycleAdapterError("verification", "AGDF was not present in copilot plugin list after installation.");
+    if (installedVersion && installedVersion !== expectedVersion) {
+      throw lifecycleAdapterError("version", versionMismatchMessage("GitHub Copilot", "agdf", expectedVersion, installedVersion, "npx --yes @agdf/cli@latest copilot"));
+    }
+    transaction?.commit();
+    return {
+      surface: "copilot", operation: directInstalled || marketplaceInstalled ? "update" : "install", expectedVersion,
+      installedVersion: installedVersion || null, verificationStatus: installedVersion ? "healthy" : "degraded",
+      manualHandoff: false,
+      evidence: [...bootstrapEvidence, "durable_local_plugin_stage", "copilot plugin marketplace list", ...(marketplaceAdded ? ["copilot plugin marketplace add"] : ["marketplace:owned_local_current"]), ...(directRemoved ? ["direct_install_migrated"] : []), "copilot plugin install agdf@agdf", "copilot plugin list", `local_plugin_root:${effectivePluginRoot}`, `source_digest:${sourceDigest}`, ...(installedVersion ? [] : ["host_did_not_expose_version"])],
+      pluginRoot: effectivePluginRoot, runtimeDigest: runtimeManifest.digest, sourceDigest, nativeOutput: nativeOutput.filter(Boolean).map(String),
+    };
+  } catch (error) {
+    transaction?.rollback();
+    if (directRemoved) {
+      try {
+        activeExec("copilot", ["plugin", "install", effectivePluginRoot], captureOptions());
+      } catch (recoveryError) {
+        error.evidence = { ...(error.evidence ?? {}), direct_install_recovery: commandErrorText(recoveryError) };
+      }
+    }
+    if (marketplaceAdded) {
+      try {
+        activeExec("copilot", ["plugin", "marketplace", "remove", "agdf"], captureOptions());
+      } catch (recoveryError) {
+        error.evidence = { ...(error.evidence ?? {}), marketplace_recovery: commandErrorText(recoveryError) };
+      }
+    }
+    throw error;
+  }
+}
+
+export function classifyCopilotMarketplaceList(output, expectedRoot) {
+  const line = String(output || "").split(/\r?\n/).find((entry) => /^\s*[◆•]?\s*agdf\s+\(/.test(entry));
+  if (!line) return { state: "absent", source: "" };
+  const local = line.match(/\(Local:\s*(.+)\)\s*$/);
+  if (!local) return { state: "conflict", source: line.trim() };
+  return resolve(local[1]) === resolve(expectedRoot)
+    ? { state: "owned_local_current", source: local[1] }
+    : { state: "conflict", source: local[1] };
+}
+
+export function copilotNpmInvocation({ env = process.env, platform = process.platform, execPath = process.execPath } = {}) {
+  const args = ["exec", "--yes", `--package=${COPILOT_CLI_NPM_PACKAGE}`, "--", "copilot"];
+  if (env.npm_execpath) return { executable: execPath, args: [env.npm_execpath, ...args] };
+  return { executable: platform === "win32" ? "npm.cmd" : "npm", args };
+}
+
+export function setCopilotPluginEnabled({ enabled, exec = execFileSync } = {}) {
+  if (typeof enabled !== "boolean") throw lifecycleAdapterError("plugin_operation", "Copilot plugin enabled state must be boolean.");
+  const operation = enabled ? "enable" : "disable";
+  try {
+    const nativeOutput = runPluginPhase(exec, "copilot", ["plugin", operation, "agdf"], "plugin_operation", captureOptions());
+    const listOutput = runPluginPhase(exec, "copilot", ["plugin", "list"], "verification", captureOptions());
+    if (!pluginListHasPlugin(listOutput, "agdf") && !pluginListHasPlugin(listOutput, "agdf@agdf")) {
+      throw lifecycleAdapterError("verification", "AGDF was not present in copilot plugin list after the state change.");
+    }
+    return {
+      surface: "copilot",
+      requestedState: enabled ? "enabled" : "disabled",
+      status: "command_accepted_host_state_unverified",
+      evidence: [`copilot plugin ${operation} agdf`, "copilot plugin list", "fresh_session_required"],
+      nativeOutput: String(nativeOutput || ""),
+    };
+  } catch (error) {
+    if (/\bmanaged\b/i.test(commandErrorText(error))) {
+      return {
+        surface: "copilot", requestedState: enabled ? "enabled" : "disabled", status: "managed",
+        evidence: ["managed_policy_precedence", commandErrorText(error)], nativeOutput: "",
+      };
+    }
+    throw error;
+  }
+}
+
 function migrateMarketplace({ surface, exec, output, root, nativeOutput, migration, refreshOwnedLocal = false }) {
   const classification = classifyMarketplaceList(surface, output, root);
   Object.assign(migration, classification);
@@ -168,10 +318,10 @@ function captureOptions() {
 }
 
 export function inspectPluginSurface(surface, exec = execFileSync, options = {}) {
-  const executable = surface === "claude" ? "claude" : "codex";
-  const pluginId = "agdf@agdf";
+  const executable = surface === "claude" ? "claude" : surface === "copilot" ? "copilot" : "codex";
   try {
     const output = exec(executable, ["plugin", "list"], { encoding: "utf8", stdio: "pipe" });
+    const pluginId = surface === "copilot" && !pluginListHasPlugin(output, "agdf@agdf") ? "agdf" : "agdf@agdf";
     const installed = pluginListHasPlugin(output, pluginId);
     const version = installed ? pluginVersionFromList(output, pluginId) : "";
     let localDevelopmentVersion = false;
@@ -219,12 +369,13 @@ function commandErrorText(error) {
 }
 
 export function pluginListHasPlugin(output, pluginId) {
+  const escapedPluginId = pluginId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   return output
     .split(/\r?\n/)
-    .some((line) => line.includes(pluginId));
+    .some((line) => new RegExp(`(^|\\s)${escapedPluginId}(\\s|$)`).test(line));
 }
 
-const VERSION_PATTERN = "(\\d+\\.\\d+\\.\\d+(?:[-+][0-9A-Za-z.-]+)?)";
+const VERSION_PATTERN = "v?(\\d+\\.\\d+\\.\\d+(?:[-+][0-9A-Za-z.-]+)?)";
 
 export function pluginVersionFromList(output, pluginId) {
   const escapedPluginId = pluginId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");

package/lib/lifecycle/operations.js

@@ -85,6 +85,9 @@ export function planGlobalUninstall(surface, { configDir } = {}) {
   if (surface === "claude") {
     return nativeUninstallPlan(surface, "claude", ["plugin", "uninstall", "agdf@agdf", "--scope", "user"]);
   }
+  if (surface === "copilot") {
+    return nativeUninstallPlan(surface, "copilot", ["plugin", "uninstall", "agdf"]);
+  }
   if (surface === "opencode") {
     if (!configDir) throw new Error("OpenCode uninstall requires its explicit config directory.");
     const configPath = join(configDir, "opencode.json");

package/lib/lifecycle/presentation.js

@@ -9,6 +9,9 @@ const surfaceLabels = Object.freeze({
 function titleFor(report) {
   if (report.result === "failed") return "AGDF installation failed";
   if (report.result === "partial") return "AGDF installation partially completed";
+  if (report.result === "preview") return report.operation === "uninstall"
+    ? "AGDF uninstall preview"
+    : "AGDF installation cancelled";
   if (report.operation === "repository_setup") return "AGDF repository setup complete";
   return "AGDF installation complete";
 }
@@ -28,18 +31,55 @@ export function lifecycleCardLines(report) {
     `Installation: ${report.installation.status}`,
     `Activation: ${report.activation.status}`,
     `Repository delivery: ${report.delivery.status}`,
+    `Automatic runtime checks: requested=${report.runtime_checks.requested}; effective=${report.runtime_checks.effective}; reason=${report.runtime_checks.reason}`,
     `Verification: ${report.verification.status}`,
     `Restart required: ${report.restart.required ? "yes" : "no"}${report.restart.reason !== "none" ? ` (${report.restart.reason})` : ""}`,
     `Next action: ${report.next_action.text}`,
   ];
 }
 
-export function printLifecycleResult(report, { json = false, io = console } = {}) {
+function friendlyRuntimeCheckState(report) {
+  if (report.runtime_checks.requested === "cancelled") return "Cancelled";
+  if (report.runtime_checks.effective === "enabled") return "On";
+  if (report.runtime_checks.effective === "manual") return "Manual";
+  if (report.runtime_checks.effective === "decision_required") return `Waiting for ${surfaceLabels[report.surface]} permission`;
+  if (report.runtime_checks.effective === "renewal_required") return "Needs your review";
+  if (["degraded", "failed", "unavailable"].includes(report.runtime_checks.effective)) return "Not available; use manual checks";
+  return report.runtime_checks.requested === "enabled" ? "Requested; verification pending" : "Not configured";
+}
+
+function compactVersionLine(report) {
+  if (report.version.transition === "updated" && report.version.previous && report.version.installed) {
+    return `Updated: ${report.version.previous} -> ${report.version.installed} (${report.version.status})`;
+  }
+  if (report.version.installed) return `Version: ${report.version.installed} (${report.version.status})`;
+  if (report.version.expected) return `Version: not verified (expected ${report.version.expected})`;
+  return "Version: not verified";
+}
+
+export function compactLifecycleCardLines(report) {
+  if (report.result === "preview") return [
+    titleFor(report),
+    "No changes were made.",
+    `Next: ${report.next_action.text}`,
+  ];
+  return [
+    report.result === "success"
+      ? `AGDF ${report.operation === "update" ? "updated" : "installed"} for ${surfaceLabels[report.surface]}`
+      : titleFor(report),
+    compactVersionLine(report),
+    `Installation: ${report.installation.status === "healthy" ? "Ready" : report.installation.status}`,
+    `Automatic checks: ${friendlyRuntimeCheckState(report)}`,
+    `Next: ${report.next_action.text}`,
+  ];
+}
+
+export function printLifecycleResult(report, { json = false, compact = false, io = console } = {}) {
   if (json) {
     io.log(JSON.stringify(report, null, 2));
     return;
   }
-  for (const line of lifecycleCardLines(report)) io.log(line);
+  for (const line of compact ? compactLifecycleCardLines(report) : lifecycleCardLines(report)) io.log(line);
   if (report.failure) io.log(`Failure phase: ${report.failure.phase}: ${report.failure.message}`);
   if (report.retained.length) {
     io.log("Retained:");
@@ -56,5 +96,6 @@ export function printGeneralStatus(report, { json = false, io = console } = {})
   io.log(`Installation: ${report.installation.status}${report.installation.version ? ` (${report.installation.version})` : ""}`);
   io.log(`Repository: ${report.repository.status}`);
   io.log(`Delivery: ${report.delivery.status}${report.delivery.current_gate ? ` (${report.delivery.current_gate})` : ""}`);
+  io.log(`Automatic runtime checks: requested=${report.runtime_checks.requested}; effective=${report.runtime_checks.effective}; reason=${report.runtime_checks.reason}`);
   io.log(`Next action: ${report.next_action.text}`);
 }

package/lib/lifecycle/result.js

@@ -5,6 +5,7 @@ const SURFACES = new Set(["codex", "claude", "copilot", "opencode", "generic"]);
 const GLOBAL_INSTALL_RESTART_ACTIONS = Object.freeze({
   codex: "Restart Codex.",
   claude: "Restart Claude Code.",
+  copilot: "Restart GitHub Copilot.",
   opencode: "Restart OpenCode.",
 });
 
@@ -39,6 +40,15 @@ export function createLifecycleResult(input = {}) {
     delivery: {
       status: text(input.delivery?.status) || "not_evaluated",
     },
+    runtime_checks: {
+      requested: text(input.runtime_checks?.requested) || "unknown",
+      effective: text(input.runtime_checks?.effective) || "unknown",
+      reason: text(input.runtime_checks?.reason) || "not_evaluated",
+      capability_identity: text(input.runtime_checks?.capability_identity) || null,
+      verification: text(input.runtime_checks?.verification) || "not_evaluated",
+      mutation: text(input.runtime_checks?.mutation) || "none",
+      rollback: text(input.runtime_checks?.rollback) || "none",
+    },
     restart: {
       required: Boolean(input.restart?.required),
       reason: text(input.restart?.reason) || "none",

package/lib/lifecycle/status.js

@@ -6,6 +6,7 @@ import { evaluateGateCheck } from "../control-evaluation/gate-check.js";
 import { evaluateOpenCodeStatus } from "../installers/opencode.js";
 import { inspectPluginSurface } from "../installers/plugin-installers.js";
 import { inspectGeneratedRepositoryMarketplace } from "../runtime/plugin-provenance.js";
+import { runtimeCheckStatus } from "../runtime-check-consent/service.js";
 
 function deliveryStatus(targetDir, selection, dependencies) {
   const controlDir = join(targetDir, ".agdf", "control");
@@ -62,7 +63,7 @@ function inspectInstallation(surface, targetDir, options, deps, exec) {
       evidence: [report.global_config.path],
     };
   }
-  if (["codex", "claude"].includes(surface)) return deps.inspectPluginSurface(surface, exec);
+  if (["codex", "claude", "copilot"].includes(surface)) return deps.inspectPluginSurface(surface, exec);
   return { status: "unknown", surface, version: null, evidence: [`unsupported_status_probe:${surface}`] };
 }
 
@@ -78,7 +79,7 @@ export function evaluateGeneralStatus(targetDir, options = {}, dependencies = {}
   if (surface) {
     installation = inspectInstallation(surface, targetDir, options, deps, dependencies.exec);
   } else {
-    const probes = ["codex", "claude", "opencode"].map((candidate) => inspectInstallation(candidate, targetDir, options, deps, dependencies.exec));
+    const probes = ["codex", "claude", "copilot", "opencode"].map((candidate) => inspectInstallation(candidate, targetDir, options, deps, dependencies.exec));
     const observed = probes.filter((probe) => ["healthy", "degraded"].includes(probe.status));
     if (observed.length === 1) {
       installation = observed[0];
@@ -95,6 +96,9 @@ export function evaluateGeneralStatus(targetDir, options = {}, dependencies = {}
   }
   const repository = repositoryStatus(targetDir, surface);
   const delivery = deliveryStatus(targetDir, { runId: options.runId }, deps);
+  const runtimeChecks = ["codex", "claude", "copilot", "opencode"].includes(surface)
+    ? runtimeCheckStatus(options.dataRoot, surface)
+    : { requested: "unknown", effective: "unavailable", reason: "unsupported_host_capability" };
   const nextText = surface === "multiple"
     ? "Multiple AGDF host surfaces were detected; rerun status with an explicit --surface."
     : surface === "generic"
@@ -112,5 +116,5 @@ export function evaluateGeneralStatus(targetDir, options = {}, dependencies = {}
     : delivery.status === "not_configured"
     ? "Start a new task; status created no run and requires no approval. Initialize durable control only when the repository needs it."
     : "Continue with the reported delivery next step.";
-  return { schema_version: 1, installation, repository, delivery, next_action: { kind: "action", text: nextText } };
+  return { schema_version: 1, installation, repository, delivery, runtime_checks: runtimeChecks, next_action: { kind: "action", text: nextText } };
 }

package/lib/public-plugin/manifest.js

@@ -39,14 +39,12 @@ export function createCodexPluginManifest(definition, { publicCandidate = false
       websiteURL: distribution.urls.website,
       privacyPolicyURL: distribution.urls.privacy,
       termsOfServiceURL: distribution.urls.terms,
-      supportURL: distribution.urls.support,
       composerIcon: definition.codex.composerIcon,
       logo: definition.codex.logo,
       defaultPrompt: pluginInterface.defaultPrompt,
       brandColor: definition.brandColor,
     },
   };
-  if (!publicCandidate) manifest.hooks = `./${definition.codex.hooks}`;
   return manifest;
 }
 
@@ -70,3 +68,37 @@ export function createClaudePluginManifest(definition) {
 export function renderClaudePluginManifest(definition) {
   return `${JSON.stringify(createClaudePluginManifest(definition), null, 2)}\n`;
 }
+
+function requireCopilotPath(value, field) {
+  if (typeof value !== "string" || !value || value.startsWith("/") || value.includes("..") || value.includes("\\")) {
+    throw new Error(`AGDF_COPILOT_PLUGIN_CONTRACT_INVALID: ${field} must be a relative POSIX path`);
+  }
+  return value;
+}
+
+export function createCopilotPluginManifest(definition) {
+  if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(definition.id ?? "") || definition.id.length > 64) {
+    throw new Error("AGDF_COPILOT_PLUGIN_CONTRACT_INVALID: kebab-case name is required");
+  }
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(definition.version ?? "")) {
+    throw new Error("AGDF_COPILOT_PLUGIN_CONTRACT_INVALID: semantic version is required");
+  }
+  const copilot = definition.copilot ?? {};
+  return {
+    name: definition.id,
+    version: definition.version,
+    description: definition.description,
+    author: definition.author,
+    homepage: definition.homepage,
+    repository: definition.repository,
+    license: definition.license,
+    keywords: definition.keywords,
+    category: definition.category,
+    skills: requireCopilotPath(copilot.skills, "skills"),
+    hooks: requireCopilotPath(copilot.hooks, "hooks"),
+  };
+}
+
+export function renderCopilotPluginManifest(definition) {
+  return `${JSON.stringify(createCopilotPluginManifest(definition), null, 2)}\n`;
+}

package/lib/public-plugin/validator.js

@@ -80,7 +80,7 @@ export function validateCandidate(root) {
   if (unicodeLength(manifest.interface?.developerName) > LISTING_LIMITS.developerName) throw new Error("AGDF_PUBLIC_PLUGIN_LISTING_LIMIT_EXCEEDED: developerName");
   const prompts = manifest.interface?.defaultPrompt ?? [];
   if (prompts.length !== LISTING_LIMITS.promptCount || prompts.some((prompt) => unicodeLength(prompt) > LISTING_LIMITS.promptLength)) throw new Error("AGDF_PUBLIC_PLUGIN_LISTING_LIMIT_EXCEEDED: defaultPrompt");
-  for (const field of ["websiteURL", "privacyPolicyURL", "termsOfServiceURL", "supportURL"]) {
+  for (const field of ["websiteURL", "privacyPolicyURL", "termsOfServiceURL"]) {
     let url;
     try { url = new URL(manifest.interface?.[field]); } catch { throw new Error(`AGDF_PUBLIC_PLUGIN_CONTRACT_INVALID: ${field}`); }
     if (url.protocol !== "https:") throw new Error(`AGDF_PUBLIC_PLUGIN_CONTRACT_INVALID: ${field} must use HTTPS`);

package/lib/release/version-coherence.js

@@ -32,6 +32,7 @@ const VERSION_SURFACES = [
   jsonVersion("create-agdf/generated/plugins/agdf/meta/agdf-plugin.definition.json"),
   jsonVersion("create-agdf/generated/plugins/agdf/.codex-plugin/plugin.json"),
   jsonVersion("create-agdf/generated/plugins/agdf/.claude-plugin/plugin.json"),
+  jsonVersion("create-agdf/generated/plugins/agdf/plugin.json"),
   jsonVersion("create-agdf/generated/plugins/agdf/runtime/runtime-manifest.json"),
   jsonVersion("create-agdf/generated/plugins/agdf/runtime/create-agdf/package.json"),
   jsonVersion("create-agdf/generated/submissions/openai/agdf/meta/agdf-plugin.definition.json"),

package/lib/runtime-check-consent/adapters.js

@@ -0,0 +1,42 @@
+function fixedCommand(command) {
+  if (typeof command !== "string" || !command.trim() || /[\n\r;&|*?]/.test(command)) {
+    throw new Error("AGDF_RUNTIME_CHECK_COMMAND_NOT_EXACT");
+  }
+  return command.trim();
+}
+
+export function codexRuntimeCheckEvidence({ capabilityIdentity, observedIdentity, hookEnabled, reviewRequired = false }) {
+  if (hookEnabled && observedIdentity === capabilityIdentity) return { status: "enabled", capability_identity: capabilityIdentity, reason: "none" };
+  if (observedIdentity && observedIdentity !== capabilityIdentity) return { status: "renewal_required", reason: "capability_identity_changed" };
+  return { status: "decision_required", reason: reviewRequired ? "host_review_required" : "host_permission_unverified" };
+}
+
+export function claudePermissionRule({ platform, command }) {
+  const exact = fixedCommand(command);
+  return platform === "win32" ? `PowerShell(${exact})` : `Bash(${exact})`;
+}
+
+export function applyClaudeExactRule(settings, { rule, deny = [], ask = [] }) {
+  if (!settings || typeof settings !== "object" || Array.isArray(settings)) throw new Error("AGDF_CLAUDE_SETTINGS_INVALID");
+  if ([...deny, ...ask].includes(rule)) return { status: "degraded", reason: "host_permission_conflict", settings };
+  const next = structuredClone(settings);
+  next.permissions ??= {};
+  if (Array.isArray(next.permissions.allow) && next.permissions.allow.some((entry) => entry.includes("*") || entry !== entry.trim())) {
+    throw new Error("AGDF_CLAUDE_BROAD_OR_MALFORMED_RULE");
+  }
+  next.permissions.allow = [...new Set([...(next.permissions.allow ?? []), rule])];
+  return { status: "configured", reason: "none", settings: next };
+}
+
+export function revokeClaudeExactRule(settings, rule) {
+  const next = structuredClone(settings);
+  if (Array.isArray(next.permissions?.allow)) next.permissions.allow = next.permissions.allow.filter((entry) => entry !== rule);
+  return next;
+}
+
+export function openCodeRuntimeCheckEvidence({ capabilityIdentity, observedIdentity, packageLoadable, hookObserved }) {
+  if (!packageLoadable) return { status: "unavailable", reason: "unsupported_host_capability" };
+  if (observedIdentity !== capabilityIdentity) return { status: "renewal_required", reason: "installed_identity_mismatch" };
+  if (!hookObserved) return { status: "degraded", reason: "host_permission_unverified" };
+  return { status: "enabled", capability_identity: capabilityIdentity, reason: "none" };
+}

package/lib/runtime-check-consent/claude-settings.js

@@ -0,0 +1,71 @@
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import process from "node:process";
+import { renameSyncWithRetry } from "../fs-swap.js";
+import { applyClaudeExactRule, revokeClaudeExactRule } from "./adapters.js";
+
+export function defaultClaudeSettingsPath({ env = process.env, home = homedir() } = {}) {
+  return join(resolve(env.CLAUDE_CONFIG_DIR || join(home, ".claude")), "settings.json");
+}
+
+export function readClaudeSettings(path = defaultClaudeSettingsPath()) {
+  if (!existsSync(path)) return { exists: false, settings: {} };
+  const stats = lstatSync(path);
+  if (!stats.isFile() || stats.isSymbolicLink()) throw new Error("AGDF_CLAUDE_SETTINGS_UNOWNED_PATH");
+  try {
+    const settings = JSON.parse(readFileSync(path, "utf8"));
+    if (!settings || typeof settings !== "object" || Array.isArray(settings)) throw new Error("not an object");
+    return { exists: true, settings };
+  } catch (error) {
+    throw new Error(`AGDF_CLAUDE_SETTINGS_INVALID: ${error.message}`);
+  }
+}
+
+function atomicSettingsWrite(path, settings) {
+  mkdirSync(dirname(path), { recursive: true });
+  const temp = `${path}.agdf-tmp-${process.pid}`;
+  const backup = `${path}.agdf-backup-${process.pid}`;
+  const hadPrevious = existsSync(path);
+  const mode = hadPrevious ? lstatSync(path).mode & 0o777 : 0o600;
+  writeFileSync(temp, `${JSON.stringify(settings, null, 2)}\n`, { encoding: "utf8", flag: "wx", mode });
+  if (process.platform !== "win32") chmodSync(temp, mode);
+  try {
+    if (hadPrevious && process.platform === "win32") renameSyncWithRetry(path, backup);
+    renameSyncWithRetry(temp, path);
+    if (hadPrevious && process.platform === "win32") rmSync(backup, { force: true });
+  } catch (error) {
+    try { rmSync(temp, { force: true }); } catch {}
+    if (hadPrevious && process.platform === "win32" && existsSync(backup) && !existsSync(path)) renameSyncWithRetry(backup, path);
+    throw error;
+  }
+}
+
+export function configureClaudeExactRuntimeRule({ path = defaultClaudeSettingsPath(), rule }) {
+  const before = readClaudeSettings(path);
+  const permissions = before.settings.permissions ?? {};
+  const applied = applyClaudeExactRule(before.settings, {
+    rule,
+    deny: Array.isArray(permissions.deny) ? permissions.deny : [],
+    ask: Array.isArray(permissions.ask) ? permissions.ask : [],
+  });
+  if (applied.status !== "configured") return { ...applied, path, rollback() {} };
+  atomicSettingsWrite(path, applied.settings);
+  return {
+    status: "configured",
+    reason: "host_permission_unverified",
+    path,
+    rollback() {
+      if (before.exists) atomicSettingsWrite(path, before.settings);
+      else rmSync(path, { force: true });
+    },
+  };
+}
+
+export function revokeClaudeRuntimeRule({ path = defaultClaudeSettingsPath(), rule }) {
+  const before = readClaudeSettings(path);
+  if (!before.exists) return { status: "manual", reason: "configuration_missing", path };
+  const next = revokeClaudeExactRule(before.settings, rule);
+  atomicSettingsWrite(path, next);
+  return { status: "manual", reason: "consent_not_provided", path };
+}