From 91324fa56047c0a1f1d8e5b2934946d44aaaf6a3 Mon Sep 17 00:00:00 2001
From: Jason Irish <jirish@dynamicagency.com>
Date: Tue, 25 Aug 2026 14:15:46 -0500
Subject: [PATCH 1/2] feat(#47): validate Codex/agents manifests in CI, close
 hooks investigation

.codex-plugin/plugin.json and .agents/plugins/marketplace.json shipped with
zero CI coverage since PR #46 - extend the existing jq manifest validation
(local-ci custom check + GHA) to cover both, plus a version-agreement check
between .claude-plugin/plugin.json and .codex-plugin/plugin.json (independently
hand-maintained, nothing else keeps them in sync).

Issue #47 (Codex automatic-capture hooks) investigated empirically via a live
throwaway probe hook under real `codex exec` - findings posted to the issue.
Decision: not wiring hooks. Discovery is solved (explicit "hooks" key in
plugin.json, not convention) and double-registration is ruled out for the
recommended pattern, but hooks require a persisted-trust grant with no
verified non-interactive path - `codex exec` silently no-ops without
--dangerously-bypass-hook-trust, which the CLI itself scopes to "automation
that already vets hook sources," not a shipped plugin default. Wiring it now
would look automatic while silently not firing for most real usage.

No hooks.json changes; keeping the skills-only framing with evidence instead
of an inconclusive prior attempt.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013cG9PVNGundwPjNB4Yz5AS
---
 .github/workflows/ci.yml | 10 ++++++++++
 .local-ci.json           |  6 +++++-
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 64e84af..aae9d32 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,6 +19,16 @@ jobs:
           jq -e '.hooks | keys' hooks/hooks.json >/dev/null
           jq -e '.name and .version' .claude-plugin/plugin.json >/dev/null
           jq -e '.plugins' .claude-plugin/marketplace.json >/dev/null
+          jq -e '.name and .version' .codex-plugin/plugin.json >/dev/null
+          jq -e '.plugins' .agents/plugins/marketplace.json >/dev/null
+      - name: Check plugin version agreement
+        run: |
+          c=$(jq -r .version .claude-plugin/plugin.json)
+          x=$(jq -r .version .codex-plugin/plugin.json)
+          if [ "$c" != "$x" ]; then
+            echo "version drift: .claude-plugin/plugin.json=$c .codex-plugin/plugin.json=$x" >&2
+            exit 1
+          fi
       - name: Run hook tests
         run: sh tests/run.sh
 
diff --git a/.local-ci.json b/.local-ci.json
index 49937bb..30c28cd 100644
--- a/.local-ci.json
+++ b/.local-ci.json
@@ -2,7 +2,11 @@
   "checks": [
     {
       "label": "manifest validation",
-      "run": "jq -e '.hooks | keys' hooks/hooks.json >/dev/null && jq -e '.name and .version' .claude-plugin/plugin.json >/dev/null && jq -e '.plugins' .claude-plugin/marketplace.json >/dev/null"
+      "run": "jq -e '.hooks | keys' hooks/hooks.json >/dev/null && jq -e '.name and .version' .claude-plugin/plugin.json >/dev/null && jq -e '.plugins' .claude-plugin/marketplace.json >/dev/null && jq -e '.name and .version' .codex-plugin/plugin.json >/dev/null && jq -e '.plugins' .agents/plugins/marketplace.json >/dev/null"
+    },
+    {
+      "label": "plugin version agreement",
+      "run": "c=$(jq -r .version .claude-plugin/plugin.json); x=$(jq -r .version .codex-plugin/plugin.json); [ \"$c\" = \"$x\" ] || { echo \"version drift: .claude-plugin/plugin.json=$c .codex-plugin/plugin.json=$x\" >&2; exit 1; }"
     },
     {
       "label": "hook tests",

From 97783698381bdd32ca0d576b4bac79c5bd309333 Mon Sep 17 00:00:00 2001
From: Jason Irish <jirish@dynamicagency.com>
Date: Tue, 25 Aug 2026 14:19:35 -0500
Subject: [PATCH 2/2] fix: strict-equivalent local-ci version-agreement check
 to CI

/review-pr on PR #48 found the local-ci form and the GHA form diverged when
both plugin.json files are missing: bash -c without -e let the failed jq
command substitutions silently produce empty strings that compared equal
(false pass), while GHA's default `bash -e` aborted correctly. Prefixing
with `set -e;` restores exit-on-failure semantics, matching GHA - verified
both the normal-pass and now-fails-fast-on-missing-file cases.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013cG9PVNGundwPjNB4Yz5AS
---
 .local-ci.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.local-ci.json b/.local-ci.json
index 30c28cd..732b273 100644
--- a/.local-ci.json
+++ b/.local-ci.json
@@ -6,7 +6,7 @@
     },
     {
       "label": "plugin version agreement",
-      "run": "c=$(jq -r .version .claude-plugin/plugin.json); x=$(jq -r .version .codex-plugin/plugin.json); [ \"$c\" = \"$x\" ] || { echo \"version drift: .claude-plugin/plugin.json=$c .codex-plugin/plugin.json=$x\" >&2; exit 1; }"
+      "run": "set -e; c=$(jq -r .version .claude-plugin/plugin.json); x=$(jq -r .version .codex-plugin/plugin.json); [ \"$c\" = \"$x\" ] || { echo \"version drift: .claude-plugin/plugin.json=$c .codex-plugin/plugin.json=$x\" >&2; exit 1; }"
     },
     {
       "label": "hook tests",