chore: import upstream snapshot with attribution

plugins/README.md

@@ -0,0 +1,85 @@
+# Plugins and Marketplaces
+
+Plugins extend Claude Code with new tools and capabilities. This guide covers installation only - see the [full article](https://x.com/affaanmustafa/status/2012378465664745795) for when and why to use them.
+
+---
+
+## Marketplaces
+
+Marketplaces are repositories of installable plugins.
+
+### Adding a Marketplace
+
+```bash
+# Add official Anthropic marketplace
+claude plugin marketplace add https://github.com/anthropics/claude-plugins-official
+
+# Add community marketplaces (mgrep by @mixedbread-ai)
+claude plugin marketplace add https://github.com/mixedbread-ai/mgrep
+```
+
+### Recommended Marketplaces
+
+| Marketplace | Source |
+|-------------|--------|
+| claude-plugins-official | `anthropics/claude-plugins-official` |
+| claude-code-plugins | `anthropics/claude-code` |
+| Mixedbread-Grep (@mixedbread-ai) | `mixedbread-ai/mgrep` |
+
+---
+
+## Installing Plugins
+
+```bash
+# Open plugins browser
+/plugins
+
+# Or install directly
+claude plugin install typescript-lsp@claude-plugins-official
+```
+
+### Recommended Plugins
+
+**Development:**
+- `typescript-lsp` - TypeScript intelligence
+- `pyright-lsp` - Python type checking
+- `hookify` - Create hooks conversationally
+- `code-simplifier` - Refactor code
+
+**Code Quality:**
+- `code-review` - Code review
+- `pr-review-toolkit` - PR automation
+- `security-guidance` - Security checks
+
+**Search:**
+- `mgrep` - Enhanced search (better than ripgrep)
+- `context7` - Live documentation lookup
+
+**Workflow:**
+- `commit-commands` - Git workflow
+- `frontend-patterns` - UI patterns
+- `feature-dev` - Feature development
+
+---
+
+## Quick Setup
+
+```bash
+# Add marketplaces
+claude plugin marketplace add https://github.com/anthropics/claude-plugins-official
+claude plugin marketplace add https://github.com/mixedbread-ai/mgrep
+
+# Open /plugins and install what you need
+```
+
+---
+
+## Plugin Files Location
+
+```
+~/.claude/plugins/
+|-- cache/                    # Downloaded plugins
+|-- installed_plugins.json    # Installed list
+|-- known_marketplaces.json   # Added marketplaces
+|-- marketplaces/             # Marketplace data
+```

plugins/ecc/.codex-plugin/plugin.json

@@ -0,0 +1,36 @@
+{
+  "name": "ecc",
+  "version": "2.0.0",
+  "description": "Harness-native ECC workflows for Codex: shared skills, production-ready MCP configs, and selective-install-aligned conventions for TDD, security scanning, code review, and autonomous development.",
+  "author": {
+    "name": "Affaan Mustafa",
+    "email": "me@affaanmustafa.com",
+    "url": "https://x.com/affaanmustafa"
+  },
+  "homepage": "https://ecc.tools",
+  "repository": "https://github.com/affaan-m/ECC",
+  "license": "MIT",
+  "keywords": ["codex", "agents", "skills", "tdd", "code-review", "security", "workflow", "automation"],
+  "skills": "../../skills/",
+  "mcpServers": "../../.mcp.json",
+  "interface": {
+    "displayName": "ECC",
+    "shortDescription": "249 ECC skills plus MCP configs for TDD, security, code review, and autonomous development.",
+    "longDescription": "ECC is a harness-native operator system for Codex and adjacent agent harnesses. It packages reusable skills, MCP configs, TDD workflows, security scanning, code review, architecture decisions, operator workflows, and release gates in one installable plugin.",
+    "developerName": "Affaan Mustafa",
+    "category": "Coding",
+    "capabilities": ["Interactive", "Read", "Write"],
+    "websiteURL": "https://ecc.tools",
+    "privacyPolicyURL": "https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement",
+    "termsOfServiceURL": "https://docs.github.com/en/site-policy/github-terms/github-terms-of-service",
+    "brandColor": "#E07856",
+    "composerIcon": "../../assets/ecc-icon.svg",
+    "logo": "../../assets/hero.png",
+    "screenshots": [],
+    "defaultPrompt": [
+      "Use the tdd-workflow skill to write tests before implementation.",
+      "Use the security-review skill to scan for OWASP Top 10 vulnerabilities.",
+      "Use the verification-loop skill to verify correctness before shipping changes."
+    ]
+  }
+}

plugins/ecc/README.md

@@ -0,0 +1,52 @@
+# plugins/ecc — Codex Repo-Marketplace Plugin Target
+
+This directory is the plugin folder that `.agents/plugins/marketplace.json`
+points at. Codex does not discover plugins whose local marketplace
+`source.path` is the marketplace root itself (`./`), so the marketplace entry
+must target a concrete plugin subdirectory — verified against Codex CLI
+0.137.0 and the official plugin docs (`$REPO_ROOT/plugins/<name>`).
+
+## Single source of truth
+
+Per the repo's no-duplication policy, no skill or MCP content is vendored
+here. `.codex-plugin/plugin.json` references the canonical root content with
+parent-relative paths:
+
+| Manifest field | Resolves to |
+|---|---|
+| `skills` | `skills/` at the repo root |
+| `mcpServers` | `.mcp.json` at the repo root |
+| `interface.composerIcon` / `interface.logo` | `assets/` at the repo root |
+
+The canonical Codex plugin manifest for the repo-root bundle (used by the
+official `openai/plugins` directory shape and other harness tooling) remains
+at `.codex-plugin/plugin.json`. Keep `name` and `version` in both manifests in
+sync — `tests/plugin-manifest.test.js` enforces this and `scripts/release.sh`
+bumps both.
+
+## Current Codex plugin-mode status
+
+With this layout, `codex plugin marketplace add affaan-m/ECC` discovers and
+installs `ecc@ecc`. Runtime skill loading from repo marketplaces is still
+unreliable upstream — Codex copies only the plugin folder into its install
+cache, and local/personal marketplace plugins are not always exposed at
+runtime (see [openai/codex#26037](https://github.com/openai/codex/issues/26037)
+and [affaan-m/ECC#2128](https://github.com/affaan-m/ECC/issues/2128)).
+
+After install, `codex plugin list` is not enough to prove the runtime can load
+the referenced skills and assets. From an ECC checkout, run:
+
+```bash
+node scripts/codex/check-plugin-cache.js
+```
+
+The check inspects the installed cache under `CODEX_HOME` (or `~/.codex`) and
+fails if `.codex-plugin/plugin.json` points at files that were not copied into
+that cache entry.
+
+Until the upstream discovery issues settle, the supported Codex path is the
+manual sync flow documented in the README:
+
+```bash
+npm install && bash scripts/sync-ecc-to-codex.sh
+```