v1.2.0

Added

• Agency plugin manifests — agency.json (governance manifest), .mcp.json (standalone MCP config), and hooks/hooks.json (PostToolUse hook declaration) enable installation via agency plugin install. The PostToolUse hook classifies tool calls using lib/heuristics.mjs and returns classification data to the host. Phase 1: classification only; session persistence is deferred to Phase 2.
• hooks/post-tool-use.mjs — Agency PostToolUse hook script. Reads JSON from stdin, classifies file edits / PR creation / git actions, writes JSON response to stdout. Stateless subprocess — each invocation is independent.

Changed

• Extracted lib/heuristics.mjs — tool classification sets, extraction helpers (extractPrInfo, detectShellGitAction), brag keyword detection (isBragRequest), and composite classifyToolUse() are now importable from any entry point. extension.mjs imports from this module instead of defining them inline.
• Extracted lib/operations.mjs — shared saveBragEntry, reviewBragEntries, and generateWorkLog with { ok: true/false } discriminated returns. Both extension.mjs and mcp-server.mjs delegate to these instead of duplicating validate→create→persist→backup logic.
• Moved atomicWriteText to lib/storage.mjs alongside atomicWriteJSON. Previously duplicated in both extension.mjs and mcp-server.mjs.
• isBragRequest no longer false-triggers on "bragging" / "braggart" — the \b word boundary already prevented matching; the redundant exclude regex that caused false negatives on mixed prompts was removed.
• Whitespace-only summaries are now consistently rejected across both Copilot CLI and MCP surfaces. Previously the MCP surface accepted " " through Zod's .min(1).

Fixed

• git config fallback null guard — extension.mjs now applies the same ?? { enabled: false, push: false } guard as mcp-server.mjs, preventing a potential NPE when config.git is undefined.
• Empty session summaries in work-log — formatSessionRow now falls back to taskDescription (captured from the user's first prompt) when summary is absent. Previously sessions without a host-provided finalMessage rendered as blank rows in the session activity log.