Sync Agent Kit generated artifacts (4ae1af87af09)

[endor-matt]

Source

Generated from endorlabs/endor-labs-agent-kit@4ae1af87af0921190453373af514de093cf389fb after Agent Kit CI validation.

Validation

• endor-agent-kit validate and authoring-check for every source recipe
• python -m pytest -q
• endor-agent-kit publish ... --include-plugins
• endor-agent-kit check-guardrails --catalog-root .
• endor-agent-kit verify-provenance --catalog-root .
• Claude official root and self-contained Cursor marketplace boundary validation, conventional component checks, JSON checks, Cursor SDK compile check, Gemini no-zip check, and byte-for-byte generated-surface diffs

Provenance

• Manifest SHA256: f0d27685bbf1f6093d2103f97422cf5f3cae3061eae4fc75d26c34b1579a69e0
• Provenance bundle SHA256: 5c4634f42021459655c6ac0160c5ba3e0a5eea0f14b55512b455c6f905df5a7f
• Attestable artifact name: github.com/endorlabs/ai-plugins/agent-kit-catalog-provenance@sha256:5c4634f42021459655c6ac0160c5ba3e0a5eea0f14b55512b455c6f905df5a7f
• Endor Labs signing: enabled only when ENDOR_ARTIFACT_SIGNING_ENABLED=true and ENDOR_NAMESPACE repository variables are configured

Maintainer Checks

• Source Agent Kit PR was merged by a maintainer.
• Generated distribution changes only mirror approved Agent Kit source.
• New or changed agents include source recipe, instructions, eval coverage, and architecture diagram in Agent Kit.
• No direct behavior edits were made in ai-plugins.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 29cc6df397

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Keep Endor MCP behind setup approval

This registers .mcp.json as a plugin-level MCP server as soon as the Codex plugin is installed, but the same package still documents that installers must not add plugin-wide MCP and that MCP setup is opt-in/approval-gated. In Codex installs that honor mcpServers, endorctl ai-tools mcp-server becomes available before the setup skill has checked readiness or obtained approval, so this manifest entry should be removed or the setup flow should explicitly gate MCP registration.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Emit the manifest advisory for PostToolUse

The generated hook graphs register this script for PostToolUse on edit tools, but this branch causes every matching manifest or lockfile edit to output only {} instead of the advisory text built below. As a result, edits to package.json, lockfiles, etc. never surface the dependency-review guidance, unlike the sibling dependency-install hook which does emit additionalContext for PostToolUse.

Useful? React with 👍 / 👎.