[Jordan Harband (ljharb)]

Ship an OpenAI Codex plugin so Codex users install every Socket skill in one step and sign in to the hosted Socket MCP server with their Socket account instead of pasting one organization's API token.

• scripts/repo/generate-codex-plugin.mts writes skills/.codex-plugin/plugin.json, skills/.codex-plugin/mcp.json, and .agents/plugins/marketplace.json from .claude-plugin/plugin.json. The plugin root is skills/, so a Codex install copies only skill content. Output matches the repo formatter byte for byte.
• mcp.json points at https://mcp.socket.dev/ with its advertised scopes and no bearer setting, so Codex runs OAuth (dynamic client registration + PKCE).
• Register the generator in publish.mts and classify .agents as a shipped root entry. The Codex path helpers live in scripts/repo/paths.mts, and the generator uses the repo's own scripts/repo/util/main.mts entry point, like the Cursor generator.
• .gitignore keeps ignoring .agents/ except .agents/plugins/marketplace.json.
• Skill-dir test helpers skip dot dirs; manifest consistency covers the Codex manifest and marketplace.
• socket-connect: Codex sign-in row and tool-name example.
• README Codex section: marketplace add, install, MCP login, CLI auth, and migration from single-skill plugins.

Testing

• Rebased onto main after feat(auth): connect to Socket through browser sign-in #25, feat(cursor): ship socket's hosted oauth mcp server in the cursor plugin #26 and build: drop the fleet pack and own the repo tooling #28 landed. Main dropped the vendored fleet tooling, so this PR now uses the repo-owned paths module and entry point.
• pnpm run check passes, and all repo tests pass locally: 57 files, 1264 tests. pnpm run generate:check reports the generated files are up to date.
• Not tested in Codex itself.

---

Note

Medium Risk
Introduces Codex install/auth wiring (OAuth MCP config and ON_INSTALL policy) that affects how users connect to Socket, though changes are generated manifests and docs with strong generator guardrails and tests.

Overview
Adds first-class OpenAI Codex support via a repo-root marketplace (.agents/plugins/marketplace.json) and a bundled socket-skills plugin whose root is skills/, so one install ships every skill plus hosted MCP access.

A new generate-codex-plugin.mts generator (wired into publish.mts) derives skills/.codex-plugin/plugin.json, skills/.codex-plugin/mcp.json, and the marketplace from .claude-plugin/plugin.json, discovers top-level skill dirs, and formats JSON to match the repo checker. The MCP artifact points at https://mcp.socket.dev/ with scoped OAuth (no bearer env), and the generator is constrained to only write under skills/.codex-plugin/ and .agents/plugins/ so it never touches the fleet root .mcp.json.

Repo hygiene updates track .agents as a shipped surface, gitignore everything under .agents except the marketplace manifest, and extend structural tests (dot-dir skill exclusion, Codex version sync, marketplace ↔ manifest name checks). README Codex docs now cover marketplace add, plugin install, codex mcp login socket, CLI token auth for non-interactive runs, and removing legacy per-skill Codex plugins to avoid duplicate skills.

^{Reviewed by Cursor Bugbot for commit a9c8471. Configure here.}