Malformed plugin.json "commands" field crashes every prompt with cryptic "TypeError: a.replace is not a function"

[tldrr]

Describe the bug

When an installed plugin's .claude-plugin/plugin.json declares commands as an array of objects (instead of the spec-required array of path strings), Copilot CLI crashes on every prompt with a minified, undebuggable error:

Execution failed: TypeError: a.replace is not a function

Surfaced to the user as Skills: error loading — TypeError: a.replace is not a function. The CLI is unusable until the offending plugin is uninstalled or its manifest is hand-patched. Users have no way to know which plugin or field is responsible.

Debug log shows the error originates during tool initialization:

[DEBUG] Failed to initialize tools for validation: TypeError: a.replace is not a function
[DEBUG] Failed to initialize tools for validation: TypeError: a.replace is not a function
[DEBUG] session.error event received: errorType=query, message=Execution failed: TypeError: a.replace is not a function

No plugin name, no field name, no file path, no stack trace.

Affected version

1.0.44

Steps to reproduce the behavior

1. Install a plugin whose plugin.json declares commands as objects (e.g. kucherenko/gangsta v1.1.0 — see plugin.json: "commands" must be an array of path strings — current object form crashes Copilot CLI with "a.replace is not a function" kucherenko/gangsta#42):

   copilot plugin marketplace add kucherenko/gangsta
   copilot plugin install gangsta@gangsta-marketplace

   Manifest contains:

   "commands": [
     { "name": "heist", "path": "commands/heist.md" }
   ]

2. Run any prompt:

   copilot -p "hello" --allow-all-tools

3. Observe Execution failed: TypeError: a.replace is not a function and exit code 1.

Expected behavior

Two things, in priority order:

1. Don't crash the whole session because of one malformed plugin field. Skip the bad commands entry, log a warning, and continue loading the rest of the plugin (skills, agents, hooks).
2. Produce an actionable error. Something like:

   [warn] gangsta: invalid plugin.json: "commands" must be an array of strings
            (path strings), got array of objects. Field ignored.
   

   At minimum: the plugin name, the file path, and the offending field.

This is consistent with the policy already adopted in #951 / #1631 (silently or gracefully tolerating unknown / spec-divergent fields rather than blowing up the whole session).

Additional context

• Reproduced on Linux, Node v24.15.0, Copilot CLI 1.0.44.
• Bisected: removing the commands field from the plugin's .claude-plugin/plugin.json (or rewriting it as ["commands/heist.md", ...] per the Claude Code plugin manifest spec) fully resolves the crash.
• Upstream plugin issue: plugin.json: "commands" must be an array of path strings — current object form crashes Copilot CLI with "a.replace is not a function" kucherenko/gangsta#42
• Likely culprit: the schema validator iterates commands and calls .replace(...) on each entry assuming string; a type guard and a clearer error message would prevent the crash.