fix: improve canvas-entry gate logic and add plugin-contributed extension detection

plugin/skills/microsoft-foundry/foundry-agent/create/create-hosted.md

@@ -50,7 +50,9 @@ Two pre-flight checks — run each script and act on its `[OK]` / `[WARN]` / `[A
 ```
 
 - **No `[ACTION]`** (only `[OK]`/`[WARN]`) — the gate doesn't apply (not in the Copilot app, or the canvas isn't installed). Continue to 1b.
-- **`[ACTION]`** — the gate applies. If the user message's `<canvas-context>` already lists **`canvas="agent-builder"`**, the user has already driven the canvas — continue to 1b using their prompt/config (loop guard, independent of prompt wording). Otherwise `open_canvas` (`canvasId: "agent-builder"`), then state this non-question reminder in the normal response: **You can create the agent in the open canvas: sign in, select a subscription + Foundry project, then Send.** Then **stop — do not run 1b or scaffold**.
+- **`[ACTION]`** — the gate applies. Check `<canvas-context>`:
+  - **`canvas="agent-builder"` present** — canvas is already open; do **not** call `open_canvas`. If the user's prompt includes project/subscription details, continue to 1b. Otherwise remind and **stop**: **The Foundry Agent Canvas is already open — sign in, select a subscription + Foundry project, then Send.**
+  - **`canvas="agent-builder"` absent** — call `open_canvas` (`canvasId: "agent-builder"`), remind and **stop**: **You can create the agent in the open canvas: sign in, select a subscription + Foundry project, then Send.**
 
 **1b — Tooling & auth.** Run the bundled verification script before any other create/deploy command:
 

plugin/skills/microsoft-foundry/foundry-agent/create/quick-start-hosted.md

@@ -37,7 +37,9 @@ Two pre-flight checks — run each script and act on its `[OK]` / `[WARN]` / `[A
 ```
 
 - **No `[ACTION]`** (only `[OK]`/`[WARN]`) — the gate doesn't apply (not in the Copilot app, or the canvas isn't installed). Continue to 1b.
-- **`[ACTION]`** — the gate applies. If the user message's `<canvas-context>` already lists **`canvas="agent-builder"`**, the user has already driven the canvas — continue to 1b using their prompt/config (loop guard, independent of prompt wording). Otherwise `open_canvas` (`canvasId: "agent-builder"`), then state this non-question reminder in the normal response: **You can create the agent in the open canvas: sign in, select a subscription + Foundry project, then Send.** Then **stop — do not run 1b or scaffold**.
+- **`[ACTION]`** — the gate applies. Check `<canvas-context>`:
+  - **`canvas="agent-builder"` present** — canvas is already open; do **not** call `open_canvas`. If the user's prompt includes project/subscription details, continue to 1b. Otherwise remind and **stop**: **The Foundry Agent Canvas is already open — sign in, select a subscription + Foundry project, then Send.**
+  - **`canvas="agent-builder"` absent** — call `open_canvas` (`canvasId: "agent-builder"`), remind and **stop**: **You can create the agent in the open canvas: sign in, select a subscription + Foundry project, then Send.**
 
 **1b — Tooling & auth.** Run the bundled script:
 

plugin/skills/microsoft-foundry/foundry-agent/create/scripts/check-canvas-entry.ps1

@@ -7,7 +7,8 @@
     GitHub Copilot app, from two deterministic facts:
       * copilot_app      - is AI_AGENT=github_copilot_app_agent?
       * canvas_installed - is the Foundry Agent Canvas (foundry-agent-canvas)
-                           installed in the project, user, or session location?
+                           installed in the project, user, session, or
+                           plugin-contributed location?
 
     Output lines are prefixed with [OK], [WARN], or [ACTION].
     Exit code is 0 when the gate does not apply (not in the app, or the canvas is
@@ -30,7 +31,7 @@ if ($env:AI_AGENT -ne "github_copilot_app_agent") {
 
 Write-Output "[OK] GitHub Copilot app detected (AI_AGENT=github_copilot_app_agent)."
 
-# Candidate install locations: project (repo), user, session.
+# Candidate install locations: project (repo), user, session, and plugin-contributed.
 $dirs = @()
 try { $root = (& git rev-parse --show-toplevel 2>$null); if ($root) { $dirs += (Join-Path $root ".github/extensions/$ext") } } catch {}
 $dirs += (Join-Path (Get-Location) ".github/extensions/$ext")
@@ -39,12 +40,23 @@ if ($homeDir) { $dirs += (Join-Path $homeDir ".copilot/extensions/$ext") }
 if ($homeDir -and $env:COPILOT_AGENT_SESSION_ID) {
     $dirs += (Join-Path $homeDir ".copilot/session-state/$($env:COPILOT_AGENT_SESSION_ID)/extensions/$ext")
 }
-
+# Plugin-contributed extensions live under ~/.copilot/installed-plugins/<repo>/<plugin>/...
+# The layout varies (some nest the extension under an extensions/ subfolder, others place it
+# directly), but the leaf directory holding extension.mjs is always named after the extension.
 $installedAt = $null
 foreach ($d in $dirs) {
     if (Test-Path (Join-Path $d "extension.mjs")) { $installedAt = $d; break }
 }
 
+if (-not $installedAt -and $homeDir) {
+    $pluginRoot = Join-Path $homeDir ".copilot/installed-plugins"
+    if (Test-Path $pluginRoot) {
+        $installedAt = Get-ChildItem -Path $pluginRoot -Recurse -Depth 4 -Directory -Filter $ext -ErrorAction SilentlyContinue |
+            Where-Object { Test-Path (Join-Path $_.FullName "extension.mjs") -PathType Leaf } |
+            Select-Object -First 1 -ExpandProperty FullName
+    }
+}
+
 if (-not $installedAt) {
     Write-Output "[WARN] Foundry Agent Canvas is not installed -- canvas-first gate does not apply; continue with the normal create workflow."
     exit 0

plugin/skills/microsoft-foundry/foundry-agent/create/scripts/check-canvas-entry.sh

@@ -7,7 +7,8 @@
 # GitHub Copilot app, from two deterministic facts:
 #   * copilot_app      - is AI_AGENT=github_copilot_app_agent?
 #   * canvas_installed - is the Foundry Agent Canvas (foundry-agent-canvas)
-#                        installed in the project, user, or session location?
+#                        installed in the project, user, session, or
+#                        plugin-contributed location?
 #
 # Output: summary lines, each prefixed with [OK], [WARN], or [ACTION].
 # Exit code: 0 when the gate does not apply (not in the app, or the canvas is not
@@ -27,7 +28,7 @@ fi
 
 echo "[OK] GitHub Copilot app detected (AI_AGENT=github_copilot_app_agent)."
 
-# Candidate install locations: project (repo), user, session.
+# Candidate install locations: project (repo), user, session, and plugin-contributed.
 dirs=()
 root="$(git rev-parse --show-toplevel 2>/dev/null || true)"
 [ -n "$root" ] && dirs+=("$root/.github/extensions/$ext")
@@ -42,6 +43,15 @@ for d in "${dirs[@]}"; do
   if [ -f "$d/extension.mjs" ]; then installed_at="$d"; break; fi
 done
 
+# Plugin-contributed extensions live under ~/.copilot/installed-plugins/<repo>/<plugin>/...
+# The layout varies (some nest the extension under an extensions/ subfolder, others place it
+# directly), but the leaf directory holding extension.mjs is always named after the extension.
+plugin_root="$home_dir/.copilot/installed-plugins"
+if [ -z "$installed_at" ] && [ -n "$home_dir" ] && [ -d "$plugin_root" ]; then
+  mjs="$(find "$plugin_root" -maxdepth 6 -type f -name extension.mjs -path "*/$ext/extension.mjs" -print -quit 2>/dev/null)"
+  [ -n "$mjs" ] && installed_at="$(dirname "$mjs")"
+fi
+
 if [ -z "$installed_at" ]; then
   echo "[WARN] Foundry Agent Canvas is not installed -- canvas-first gate does not apply; continue with the normal create workflow."
   exit 0