Host support: Copilot editor/VS Code — Agent Plugins namespace, hooks, skills, instructions, and MCP #706

Scope / evidence

P2 feature expansion. Research date 2026-09-06; baseline 5fc8de37c9695b816d55bdcf18a6bcb1dfee69f5. Read Microsoft/GitHub primary documentation; no editor installation or native test performed.

Correction to Ponytail-only research: current VS Code Copilot supports installable agent plugins, not merely .github/copilot-instructions.md. This issue targets the VS Code agent harness first. Other Copilot editor integrations require their own verified capability profiles; do not claim JetBrains/Visual Studio parity from VS Code documentation. Standalone Copilot CLI is #698.

Primary specifications and setup guides

• Agent plugins: formats, schema, namespaces, install and local paths
• Agent Plugins manifest schema
• Agent Plugins standard
• VS Code hooks guide and compatibility differences
• Exact hook input/output reference
• Agent Skills
• MCP setup, scopes, remote hosts and trust
• Agent customization concepts
• Copilot CLI native format reference, for comparison only

Pin the tested VS Code and Copilot/agent-harness versions. Hook functionality is currently labelled Preview; enterprise policy can disable it.

Native package contract

Agent Plugins mode uses root plugin.json with the canonical $schema, standard skills/ and mcp.json, and a client-owned com.github.copilot/ namespace for agents, commands, rules and hooks. Existing native Copilot, Claude and legacy OpenPlugin formats have different discovery rules. Avoid adding unsupported top-level fields to the portable manifest.

Proposed output:

composite-root/
  plugin.json
  skills/review/SKILL.md
  mcp.json
  com.github.copilot/
    agents/reviewer.agent.md
    commands/review.md
    hooks/hooks.json
  hooks/vscode-before.mjs
  mcp/example.mjs

{
  "$schema":"https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name":"example-plugin",
  "version":"1.0.0",
  "description":"Project review capabilities"
}

Use existing portable output when it already satisfies the native contract. Shared namespace contents can benefit #698, but callback behavior still needs host-specific tests. An agent plugin is not a VSIX extension; do not create an editor extension just to distribute skills/MCP/hooks.

Installation, development and scope

Run Chat: Install Plugin From Source, or browse @agentPlugins in Extensions and review marketplace trust. Local development uses the documented setting:

{
  "chat.plugins.enabled": true,
  "chat.pluginLocations": {
    "/absolute/composite-root": true
  }
}

Marketplaces use chat.plugins.marketplaces; enabled/disabled state can differ by workspace. VS Code can discover plugins already installed by Copilot CLI, so installing a second copy may duplicate behavior. Implement receipt-owned registration and native inventory checks rather than rewriting the entire settings file. Preserve disabled state and operator consent; package updates from external sources have explicit native approval behavior.

MCP is a separate configuration layer

A plugin's portable mcp.json is not the same schema/location as workspace .vscode/mcp.json. The latter uses servers, for example:

{"servers":{"example":{"type":"stdio","command":"node","args":["/absolute/plugin/mcp/example.mjs"]}}}

Prefer plugin-bundled registration to duplicate standalone entries. Native user-profile, workspace, remote and Agent Host sessions resolve execution locations differently. Some interactive input-variable configurations cannot be forwarded to Agent Host. Select native root/data anchors and secret input mechanisms deliberately, preserve remote OS paths, and never infer that a local host process runs beside a remote workspace.

Hook codec differences that must not be hidden

VS Code reads several compatible hook formats, but its current guide states that Claude matcher expressions are parsed and ignored. Tool names and tool-input property naming also differ. Preserve a canonical filter inside the generated wrapper when the native matcher cannot enforce it, or reject the requested mapping; never accidentally broaden an action-sensitive hook to every tool.

Use the exact per-event output reference: stopping the session is different from denying one tool; systemMessage is user-facing and is not arbitrary context injection. OS overrides follow the extension host platform. Native plugin hooks combine with other registered hooks, so returning allow must not erase an unrelated deny.

Illustrative namespaced hook config:

{"hooks":{"PreToolUse":[{"type":"command","command":"node ${PLUGIN_ROOT}/hooks/vscode-before.mjs","timeout":15}]}}

The supported placeholder/quoting form must be validated for each OS and runtime profile. Do not copy a hook command that embeds the build checkout or defaults to approval bypass.

Acceptance

• Pin schema and VS Code/harness versions; identify unsupported editor profiles and preview gates.
• Portable content-only package loads without MCP/Flight/state processes.
• Namespaced components are discovered once; foreign client namespaces are ignored; root/Claude/legacy manifest combinations have tested precedence.
• Local and CLI-installed plugin discovery does not duplicate registration.
• Generated tool succeeds after actual install/relocation with correct schema, result, cancellation, environment and writable-data scope.
• Test native matcher incompatibility, tool-name/property mapping, per-tool deny versus session stop and combined-hook behavior.
• Remote extension host paths and OS overrides work or yield explicit unsupported diagnostics.
• Native trust/enterprise policy/disabled state remain unchanged; update/remove preserves unrelated settings and data.
• Optional MCP App output is verified separately from plain tools; no blanket claim from server startup.
• Extend Composite conformance: test cross-host auto-discovery and precedence, not only file collisions #651/Small-plugin acceptance: skills and plain hooks without an unnecessary MCP/RSC runtime or empty Workbench #652 composite and small-plugin acceptance; record successful real editor invocation separately from parser tests.

Reuse canonical manifests, operation graphs, launch records, codecs and receipts. No custom VSIX, new agent orchestration, provider/account management, universal permission grant, or global removal of AB4106.