Add pinned Agent Plugins support

[Copilot]

Adds plugins frontmatter for installing Agent Plugins through supported agentic engines. Plugin refs are resolved to immutable commit SHAs during compilation and installed after engine setup.

Changes

• Frontmatter

  • Accepts owner/repository[/path]@ref entries.
  • Rejects missing, malformed, duplicate, or unresolvable refs.

• Engine integration

  • Adds an engine capability for Agent Plugins.
  • Enables installation for Copilot CLI.
  • Rejects plugins on unsupported engines.

• Installation

  • Checks out each plugin at its resolved SHA.
  • Invokes copilot plugin install with the local plugin path after engine installation.

Example

engine: copilot

plugins:
  - octo-org/agent-plugin@v1
  - octo-org/agent-plugins/plugins/example@main

---

pr-sous-chef run https://github.com/github/gh-aw/actions/runs/32416237836> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 36.4 AIC · ⌖ 10.6 AIC · ⊞ 9.3K · ◷

_{Comment /souschef to run again}

---

PR Sous Chef branch refresh requested from run https://github.com/github/gh-aw/actions/runs/32422171255> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 12.8 AIC · ⌖ 10.5 AIC · ⊞ 9.3K · ◷

_{Comment /souschef to run again}

[pelikhan]

@copilot

• compiler should show error when plugin are used and the agentic engine does not support them
• must support merging from shared agentic workflow, apply semver for plugin overlap

[github-actions]

Hey @Copilot 👋 — thanks for working on Agent Plugins support! This PR looks well-structured and ready for review:

✅ What's Working:

• Focused feature: adds a new plugins frontmatter capability with clear scope
• Test coverage: includes plugins_test.go with validation logic
• Clear description: documents the feature, changes, and provides a usage example
• Well-organized: test file, implementation, schema updates, and documentation all included
• No new external dependencies added

📋 Process Note:
As mentioned in CONTRIBUTING.md, this project uses agentic development by the core team. Since this PR was created by the Copilot agent (indicating core team involvement), this looks aligned with the process.

⚠️ Minor Observation:
The PR is currently in draft status. Once it's ready for full review (mark as ready for review), maintainers can assess and potentially merge.

Generated by ✅ Contribution Check · auto · 48.6 AIC · ⌖ 6.87 AIC · ⊞ 9.2K · ◷

[Copilot]

@copilot

• compiler should show error when plugin are used and the agentic engine does not support them
• must support merging from shared agentic workflow, apply semver for plugin overlap

Addressed in 06ea3da (error-text follow-up ce63cf0): imported plugins now merge by plugin path, select the highest compatible semver, reject incompatible/conflicting refs, and pass through compiler engine-capability validation. Added end-to-end coverage for supported and unsupported engines.

[pelikhan]

@copilot

• add claude support https://code.claude.com/docs/en/plugins-reference
• update definition based agentic engine support so that cursor and kiro can also support plugins.

[pelikhan]

@copilot mark feature as experimental

[Copilot]

@copilot

• add claude support https://code.claude.com/docs/en/plugins-reference
• update definition based agentic engine support so that cursor and kiro can also support plugins.

Added in 8b8f1c4:

• Claude: plugins is now supported. Each plugin is checked out at its pinned SHA and loaded with claude --plugin-dir ./<path>, the documented non-interactive way to load a local plugin directory (no marketplace registration needed).
• Definition-based engines: engine definitions can declare a behaviors.plugins block (directory, command-name, install-args), which enables the engine's Agent Plugins capability. Plugins are checked out and then either staged into the engine's plugin folder or installed with the engine CLI. Directories may be workspace-relative or ~/-relative and are validated at definition load time.
• Cursor now stages plugins in ~/.cursor/plugins/local, and Kiro in .kiro/powers (both auto-discovered by those CLIs; neither exposes a non-interactive plugin install command).

Compiler validation still errors for engines without plugin support (now codex, gemini, pi), and the engine feature table plus frontmatter reference were updated.

[Copilot]

@copilot mark feature as experimental

Marked as experimental in 28f9c02: compiling a workflow with plugins: now emits Using experimental feature: plugins, and the schema descriptions (plugins and engine.behaviors.plugins) plus the frontmatter/engines docs flag the feature as experimental.

[github-actions]

🔍 PR Triage

Category: feature · Risk: high · Priority: medium · Score: 48/100
Breakdown: impact 28 · urgency 10 · quality 10

Recommended action: defer

Large new feature (897+/4-, 25 files) adding pinned Agent Plugins support. Still draft. Defer until author marks ready for review with CI green.

Generated by 🔧 PR Triage Agent · auto · 50 AIC · ⌖ 5.31 AIC · ⊞ 8.3K · ◷

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel skipped because pre-fetch PR data was unavailable: unable to fetch test file diff

🧪 Test quality analysis by Test Quality Sentinel

[gh-aw-bot]

@copilot Several unresolved review threads already have follow-up replies from the PR author, but they remain open and are slowing maintainer triage.

Please:

• revisit the unresolved threads on pkg/workflow/plugin_installation.go, pkg/workflow/plugins_frontmatter.go, pkg/workflow/workflow_data.go, pkg/workflow/workflow_builder.go, and pkg/workflow/engine_definition.go
• resolve each thread where the latest branch updates addressed the comment, or leave a focused follow-up if more changes are still needed
• refresh the branch if GitHub offers an update path
• run the pr-finisher skill and leave a concise maintainer handoff with validation status and any remaining human actions

Generated by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/32414851914

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 17.5 AIC · ⌖ 8.23 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

[pelikhan]

@copilot add support for plugis in codex https://github.com/openai/codex

[Copilot]

@copilot Several unresolved review threads already have follow-up replies from the PR author, but they remain open and are slowing maintainer triage.

Please:...

Status update: all 12 review threads on plugin_installation.go, plugins_frontmatter.go, workflow_data.go, workflow_builder.go, and engine_definition.go already have substantive fix replies from prior commits (staging collisions, path traversal, uppercase-SHA validation, manifest Plugins field, engine co-location, merge/semver tests). I don't have a thread-resolve action available in this session, so a maintainer will need to mark them resolved in the GitHub UI.

Also merged main into this branch (4119411) to clear the dirty/behind mergeable state, resolving the two generated lock-file conflicts (smoke-cursor.lock.yml, smoke-kiro.lock.yml) by taking main's regenerated content, then re-ran make recompile (286/286 workflows compiled). Local make fmt, make lint, and the plugin-focused go test ./pkg/workflow/... suite all pass.

Investigated the "Ponytail Reviewer" failure (run 32406420875): it's a sandbox infra flake (Cloud Hypervisor guest connectivity probe failed), not related to this PR's code — no code fix applies.

Remaining human actions: resolve the review threads in the GitHub UI, re-trigger CI (agent pushes don't trigger workflow runs), and review the ADR draft (docs/adr/54288-add-pinned-agent-plugins-support.md).

[gh-aw-bot]

@copilot This PR still has unresolved review threads where follow-up replies are already on the branch.

Please prioritize:

• revisiting the unresolved review threads on pkg/workflow/plugin_installation.go, pkg/workflow/plugins_frontmatter.go, pkg/workflow/workflow_data.go, pkg/workflow/workflow_builder.go, and pkg/workflow/engine_definition.go
• resolving each thread where the latest branch updates addressed the comment, or leaving a focused follow-up where more work is still needed
• reviewing the ADR draft committed on this branch before merge
• running the pr-finisher skill and leaving a concise maintainer handoff with validation status and any remaining human actions

Generated by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/32416237836

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 36.4 AIC · ⌖ 10.6 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot add support for plugis in codex https://github.com/openai/codex

Added in 69984bd: Codex CLI plugins only install through a marketplace (no --plugin-dir-style flag), so each checked-out plugin now gets a synthetic single-plugin .agents/plugins/marketplace.json written inside its checkout, its name is read at runtime from plugin.json via jq, and codex plugin marketplace add + codex plugin add register/install it. Docs and the engine feature table are updated, and the plugin-support tests now use Gemini as the remaining unsupported-engine example.

done

[Copilot]

@copilot This PR still has unresolved review threads where follow-up replies are already on the branch.

Please prioritize:...

Finish pass completed in 8855858c4f: the ADR now reflects experimental/public-only scope and Copilot, Claude, Codex, and behavior-defined engine support. All 12 review threads already have substantive fix replies and the fixes are present on the branch; this session has no review-thread resolve mutation, so a maintainer must mark them resolved in the UI. Local make fmt, make lint, make agent-report-progress, make test, and make recompile pass; final review, CodeQL assessment, and secret scan are clean. The earlier Ponytail failure was an infra/sandbox failure on 903a0b2, not a product test failure. Remaining human actions: resolve the threads, review/accept the ADR, and re-trigger CI on the current head.

[gh-aw-bot]

@copilot This PR still has unresolved review threads where follow-up replies already exist, and maintainers still need a tighter handoff.

Please prioritize:

• revisiting the unresolved review threads on pkg/workflow/plugin_installation.go, pkg/workflow/plugins_frontmatter.go, pkg/workflow/workflow_data.go, pkg/workflow/workflow_builder.go, and pkg/workflow/engine_definition.go
• resolving each thread where the latest branch updates addressed the comment, or leaving a focused follow-up where more work is still needed
• reviewing the ADR draft committed on this branch before merge
• running the pr-finisher skill and leaving a concise maintainer handoff with validation status and any remaining human actions

Failed checks still visible on this PR:

• Ponytail Reviewer — https://github.com/github/gh-aw/actions/runs/32406420875

GitHub may also offer a branch refresh path; if available, take it as part of the finish pass.

Generated by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/32422171255

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 12.8 AIC · ⌖ 10.5 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot This PR still has unresolved review threads where follow-up replies already exist, and maintainers still need a tighter handoff.

Please prioritize:...

Finish pass complete on 8855858: reviewed the ADR (it accurately records experimental/public-only scope and Copilot, Claude, Codex, plus behavior-defined engine support), confirmed the branch contains the current base commit, and rechecked all 12 threads—the existing substantive replies match fixes present on the branch. This session has no review-thread resolve mutation, so a maintainer must mark those threads resolved in the UI. Validation: make fmt, make lint, make test-unit BASE_REF=0844723, and make recompile pass. make test hit an unrelated completion-test shared-pipe concurrency flake; the entire failing test group passes in isolation. Ponytail run 32406420875 is an old-head infrastructure failure: its artifact reports Cloud Hypervisor guest connectivity probe failed with exit code 4 before review execution. Remaining human actions: resolve the 12 threads, approve the ADR, and re-trigger CI on the current head.