chore: update dependencies, fix agent resolution & skill discovery

[ChrisRomp]

Changes

Dependency Updates

0.2.2
4.7.0
4.1.4

Fix: Plugin Agent Resolution

The SDK couldn't find plugin-sourced agents (e.g., "anvil" from ~/.copilot/installed-plugins/) because we only passed the agent name, not the definition content. Now customAgents is built from all discovered agent definitions (plugin, user, workspace) and passed to createSession/resumeSession, so the SDK can resolve them.

Fix: Remove Duplicative Skill Discovery

The SDK's enableConfigDiscovery already discovers workspace-level skills (.github/skills/, .agents/skills/). Our manual discovery was passing the same directories, causing redundant loading. Split into:

• user-level + plugin sources only (for SDK sessions)discoverExtraSkillDirectories()
• full discovery including workspace (for/skills display)discoverAllSkillDirectories()
• Added enableConfigDiscovery: true to inter-agent ephemeral sessions (was missing)

Testing

• 683 tests pass
• Type-check clean
• Verified plugin agent (anvil) resolves correctly after bridge restart

[Copilot]

Pull request overview

Updates Copilot Bridge session creation to properly resolve plugin/user-defined agents via the SDK, and removes redundant skill directory discovery by relying on SDK config discovery where appropriate.

Changes:

• Bump dependencies: @github/copilot-sdk → 0.2.2, @slack/bolt → 4.7.0, vitest → 4.1.4.
• Refactor skill discovery into “all sources” (for /skills display) vs “extra only” (for SDK sessions) and enable SDK config discovery on more session types.
• Build and pass customAgents into SDK session creation/resume; add agent-not-found fallback behavior.

Show a summary per file

File	Description
src/core/session-manager.ts	Splits skill discovery paths, enables SDK config discovery, passes customAgents, and adds agent selection/session fallback logic.
src/core/bridge.ts	Threads enableConfigDiscovery through to SDK createSession/resumeSession calls.
package.json	Updates key runtime/dev dependencies.
package-lock.json	Lockfile refresh for updated dependency graph.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (1)

src/core/session-manager.ts:1714

• Same case-sensitivity issue as in switchAgent: msg.includes('not found') is case-sensitive while the agent check is lowercased. Consider normalizing the message once and applying both checks consistently so the agent-pref fallback reliably triggers across SDK error variants.

      const msg = String(err?.message ?? err);

      // Agent not found — clear the pref and retry without the agent
      if (prefs.agent && msg.includes('not found') && msg.toLowerCase().includes('agent')) {
        log.warn(`Agent "${prefs.agent}" not found for channel ${channelId}, falling back to default`);
        prefs.agent = null;

• Files reviewed: 3/4 changed files
• Comments generated: 3

[ChrisRomp]

Re: session config duplication in fallback valid concern about config drift. Deferring for now since the fallback path is rarely hit (only when a stored agent pref becomes invalid) and refactoring the session builder is a larger change.