VS Code support, and the Claude install that was already running there

[DurthVadr]

The submission checks read plugin.json, .plugin/plugin.json or .github/plugin/plugin.json, and this repository carried only the Claude and Codex manifests. This adds the Agent Plugins v1 manifest at the plugin root — where github/awesome-copilot resolves it from the listing's source.path — with hooks in com.github.copilot/hooks/hooks.json.

What VS Code actually grants

Measured against VS Code 1.137.0 with Copilot Chat 0.65.0, not read out of its documentation:

Event	Tried	Result
UserPromptSubmit	continue: false	Stops it. "A hook prevented chat from continuing", with the reason, and no answer.
PreToolUse	permissionDecision: "deny"	Denies it. The command never ran and no PostToolUse followed.
PostToolUse	decision: "block"	Nothing. The model quoted the secret out of the blocked terminal output.
PostToolUse	continue: false	Nothing. The model answered from the result anyway.

Also: a read_file result reaches hooks as tool_response: "", so a file read is covered by its path before the read; a terminal result arrives in full.

So Adapter carries power — rewrite, refuse or report-only — and _decide caps the action at what the client grants. A mask becomes a refusal where only refusal exists; a refusal becomes a report where the model already holds the data. The session record says found rather than blocked, because reporting a block the model read through is worse than reporting the finding plainly.

The fault this uncovered

VS Code reads ~/.claude/settings.json by default, so shim install claude has been registering shim in two clients at once — and in VS Code it spoke Claude's protocol, whose decision: "block" VS Code ignores. Anyone running user-prompt = "enforce" who used VS Code had prompts sent that shim reported as blocked. They are now told apart by what each always sends (permission_mode against timestamp) and answered in their own protocol. The environment is no help here: the VS Code capture carried CLAUDE_CODE_* variables inherited from the terminal that started it.

A hook asked for a client this build does not know now inspects nothing and says so on stderr, instead of answering with another client's refusal — an older package meeting this newer plugin would otherwise have blocked every VS Code prompt with a message naming Codex.

Copilot CLI and the Copilot app read the same hook file, where shim install copilot is the route, so the command stands down on COPILOT_CLI.

Verified live

• VS Code 1.137.0, shipped plugin through hooks/run-shim and the committed archive: prompt answered shim: found EMAIL (1) in your prompt. Not modified.; cat secrets.env answered shim: found DB_URI (1), EMAIL (1), SECRET (1) in run_in_terminal. Not modified. and the model described the file without quoting a value; Stop rendered the session summary, overhead 168 ms median.
• Claude Code 2.1.273: a Read of a synthetic .env reached the model as <SECRET_1> and <EMAIL_1>, and it said a masking layer had replaced them.
• Copilot CLI 1.0.85: plugin loaded, hook stood down, no shim line.
• Claude Code and Codex 0.151.0: plugin detection unchanged by the new root manifest.

Codex had no live prompt on this build; the evidence record says so.

Captures are fixtures under tests/fixtures/probe/vscode/. 2,032 tests pass, gate green at 1.0.1.

🤖 Generated with Claude Code