chore: import upstream snapshot with attribution

2026-07-13 11:55:55 +08:00
commit d48cda4081
3322 changed files with 668744 additions and 0 deletions
@@ -0,0 +1,83 @@
+# .codex-plugin — Codex Native Plugin for ECC
+
+This directory contains the **Codex plugin manifest** for ECC.
+
+## Structure
+
+```
+.codex-plugin/
+└── plugin.json   — Codex plugin manifest (name, version, skills ref, MCP ref)
+.mcp.json         — MCP server configurations at plugin root (NOT inside .codex-plugin/)
+```
+
+## What This Provides
+
+- **249 skills** from `./skills/` — reusable Codex workflows for TDD, security,
+  code review, architecture, and more
+- **6 MCP servers** — GitHub, Context7, Exa, Memory, Playwright, Sequential Thinking
+
+## Installation
+
+Codex plugin support is marketplace-backed. The repo exposes a repo-scoped
+marketplace at `.agents/plugins/marketplace.json`; Codex can add and track that
+marketplace source from the CLI:
+
+```bash
+# Add the public repo marketplace
+codex plugin marketplace add affaan-m/ECC
+
+# Or add a local checkout while developing
+codex plugin marketplace add /absolute/path/to/ECC
+```
+
+The marketplace entry points at `plugins/ecc/` — Codex does not discover
+plugins whose local marketplace `source.path` is the marketplace root (`./`),
+so the entry must target a concrete plugin subdirectory (see
+[#2128](https://github.com/affaan-m/ECC/issues/2128)). That thin plugin folder
+references the root `skills/` and `.mcp.json` so content stays single-sourced.
+After adding or updating the marketplace, restart Codex and install or enable
+`ecc` from the plugin directory.
+
+After install, `codex plugin list` is only a registration check. From an ECC
+checkout, run the cache check to verify that the installed manifest can resolve
+its referenced skills, MCP config, and assets:
+
+```bash
+node scripts/codex/check-plugin-cache.js
+```
+
+> **Plugin mode is currently fragile on Codex.** Marketplace discovery and
+> install work with this layout, but runtime skill loading from local/repo
+> marketplaces is unreliable upstream
+> ([openai/codex#26037](https://github.com/openai/codex/issues/26037)) — Codex
+> copies only the plugin folder into its install cache, so parent-referenced
+> content may not be exposed in a fresh session. The safer, fully supported
+> path today is the manual sync flow:
+> `npm install && bash scripts/sync-ecc-to-codex.sh`.
+
+Official Plugin Directory publishing is coming soon. For official OpenAI
+plugin-directory review, package this repo under the `openai/plugins`
+repository shape: `plugins/ecc/.codex-plugin/plugin.json`,
+`plugins/ecc/skills/`, and the supporting README/assets. Until that listing is
+accepted, treat the public repo marketplace as the supported Codex distribution
+path and keep release copy framed as repo-marketplace/manual installation.
+
+The installed plugin registers under the short slug `ecc` so tool and command names
+stay below provider length limits.
+
+## MCP Servers Included
+
+| Server | Purpose |
+|---|---|
+| `chrome-devtools` | Interactive browser debugging via Chrome DevTools (CDP sessions, performance traces, console/network inspection) |
+
+The former defaults (`github`, `context7`, `exa`, `memory`, `playwright`, `sequential-thinking`) were retired in the June 2026 connector audit — their jobs are covered by skills wrapping CLIs/REST APIs or by harness-native features. They remain available as opt-in entries in `mcp-configs/mcp-servers.json`. See `docs/MCP-CONNECTOR-POLICY.md` for the policy and the per-connector rationale.
+
+## Notes
+
+- The `skills/` directory at the repo root is the source of truth for the Codex
+  plugin package; do not duplicate skill content inside `.codex-plugin/`.
+- ECC is moving to a skills-first workflow surface. Legacy `commands/` remain for
+  compatibility on harnesses that still expect slash-entry shims.
+- MCP server credentials are inherited from the launching environment (env vars)
+- This manifest does **not** override `~/.codex/config.toml` settings
@@ -0,0 +1,36 @@
+{
+  "name": "ecc",
+  "version": "2.0.0",
+  "description": "Harness-native ECC workflows for Codex: shared skills, production-ready MCP configs, and selective-install-aligned conventions for TDD, security scanning, code review, and autonomous development.",
+  "author": {
+    "name": "Affaan Mustafa",
+    "email": "me@affaanmustafa.com",
+    "url": "https://x.com/affaanmustafa"
+  },
+  "homepage": "https://ecc.tools",
+  "repository": "https://github.com/affaan-m/ECC",
+  "license": "MIT",
+  "keywords": ["codex", "agents", "skills", "tdd", "code-review", "security", "workflow", "automation"],
+  "skills": "./skills/",
+  "mcpServers": "./.mcp.json",
+  "interface": {
+    "displayName": "ECC",
+    "shortDescription": "249 ECC skills plus MCP configs for TDD, security, code review, and autonomous development.",
+    "longDescription": "ECC is a harness-native operator system for Codex and adjacent agent harnesses. It packages reusable skills, MCP configs, TDD workflows, security scanning, code review, architecture decisions, operator workflows, and release gates in one installable plugin.",
+    "developerName": "Affaan Mustafa",
+    "category": "Coding",
+    "capabilities": ["Interactive", "Read", "Write"],
+    "websiteURL": "https://ecc.tools",
+    "privacyPolicyURL": "https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement",
+    "termsOfServiceURL": "https://docs.github.com/en/site-policy/github-terms/github-terms-of-service",
+    "brandColor": "#E07856",
+    "composerIcon": "./assets/ecc-icon.svg",
+    "logo": "./assets/hero.png",
+    "screenshots": [],
+    "defaultPrompt": [
+      "Use the tdd-workflow skill to write tests before implementation.",
+      "Use the security-review skill to scan for OWASP Top 10 vulnerabilities.",
+      "Use the verification-loop skill to verify correctness before shipping changes."
+    ]
+  }
+}