feat(plugin): add read-only Agent Plugins 1.0 pilot

[Gregory Joseph (gnjoseph)]

Problem

The public repository does not yet provide an Agent Plugins 1.0 package for clients that discover portable MCP components. The pilot also needs release-safe version stamping and a portable Windows launch context.

Scope

• Add spec-compliant root plugin.json and mcp.json manifests.
• Launch local stdio only through exact @microsoft/spe-mcp@0.2.0-alpha.1 with start --read-only --data-dir ${PLUGIN_DATA}.
• Set manifest cwd to ${PLUGIN_DATA}. Agent Plugins clients create and expand this directory before launch, preventing npm from resolving the plugin source root as its own package on Windows.
• Keep package, lockfile, plugin, MCP pin, and registry manifest versions synchronized during release stamping and prepack checks.
• Validate offline against vendored authoritative Agent Plugins 1.0 schemas with source attribution, checksums, and license.
• Add schema, packaging, exact-command protocol, release-stamping, and documentation contract tests.
• Document the tested pre-merge PR checkout/local chat.pluginLocations flow; plain repository URL installation remains future-only until merge to main.

Security boundaries

• Read-only is enforced at launch; the exact manifest-command protocol test verifies every advertised tool has readOnlyHint: true and container_delete is absent.
• No skills, remote transport, OAuth, hooks, agents, or server behavior changes.
• Token/state data and subprocess cwd use client-managed ${PLUGIN_DATA}.
• The npm package is pinned exactly—no range or floating dist-tag.
• No audit suppression or forced dependency downgrade.

Validation

• Agent Plugin and release-version tests: 13/13 passed.
• Full CI: typecheck/build passed; 57 test files passed, 7 tests skipped.
• Lint passed.
• GitHub audit passed with 0 vulnerabilities at the configured threshold.
• Node 22, 24, and 26 checks passed.
• Package dry-run includes plugin.json, mcp.json, and docs/AGENT-PLUGIN.md.
• Pipeline, code-review, E2E, and OSS gates passed.

Release note

Included under CHANGELOG.md Unreleased because this adds a user-visible installation surface. Rollback is additive: revert the manifests and associated package/docs/test changes; standalone server behavior is unchanged.

[Gregory Joseph (gnjoseph)]

CI blocker fixes pushed in 2a75f1a557c9396bc8b11d0336c7a33250baaebc (AB#3193463, AB#3193487).

• Safe lockfile refresh removes all 5 high findings; CI-equivalent npm audit --audit-level=high passes. Three moderate Hono findings remain because the configured dependency chain has no non-breaking audit fix; no suppression or force downgrade was added.
• Added deterministic Ajv validation against authoritative Agent Plugins 1.0 schemas vendored from upstream commit bd383552095128f6effe895b9257cfd580a6d179, with Apache-2.0 attribution. Schemas remain test-only and are excluded from the npm package.
• Added npm version synchronization and prepack drift checks across package.json, both package-lock root versions, plugin.json, and the exact @microsoft/spe-mcp@<version> MCP pin.

Validation: targeted 24/24; npm run ci 758 passed / 7 skipped; lint passed; clean npm ci passed; audit high gate passed; npm pack --dry-run passed with required plugin files and schemas excluded.

[Gregory Joseph (gnjoseph)]

Resolved the branch-install documentation blocker in a1bc406ac48620cfa760303e0d964e6c5bd32031 (AB#3193463).

• The active pilot flow now clones the canonical repository, explicitly fetches/checks out pull/82/head, verifies plugin.json and mcp.json, and registers the absolute checkout path with supported VS Code chat.pluginLocations.
• The plain GitHub repository URL under Chat: Install Plugin From Source is now clearly labeled as a future instruction that must not be used until the manifests reach default branch main.
• Added a documentation contract test preventing the pre-main source-install claim from regressing.

Evidence: tested the documented clone/fetch/switch flow from a fresh temporary clone at commit 2a75f1a with both manifests present; targeted test 8/8; lint passed; full CI 57 files, 759 passed, 7 skipped.