Remove the Codex marketplace from shared devtools

README.md

@@ -198,7 +198,9 @@ Raw SDK output is private and is not included in results or hook output. Progres
 
 The Codex plugin (`mainsequence` in the `mainsequence` marketplace, npm package `@dev-mainsequence/codex-plugin`) is built, verified and released from [mainsequence-codex-plugin](https://github.com/mainsequence-sdk/mainsequence-codex-plugin). It vendors the exact pinned devtools package into its artifact, so an installed plugin needs neither this checkout nor an npm download at execution time. Its hook runs the `/ms` slash-menu commands before inference, and its `mainsequence-mcp` skill exposes the MCP client above in conversation.
 
-The marketplace file `.agents/plugins/marketplace.json` stays in this repository because people added it with `codex plugin marketplace add mainsequence-sdk/mainsequence-devtools`. It points at the published plugin package. Devtools 0.2.8 was the last package that carried the plugin itself, under the former name `mainsequence-devtools`; the plugin repository's README explains the migration.
+The Codex marketplace is maintained in the Codex plugin repository. This shared library
+repository does not host a plugin catalog. Follow the [Codex installation and source
+migration instructions](https://github.com/mainsequence-sdk/mainsequence-codex-plugin#install).
 
 ## Reusable API
 
@@ -222,7 +224,7 @@ npm run release:check
 node scripts/verify-sdk-interop.cjs /path/to/mainsequence-sdk /path/to/command-center-sdk
 ```
 
-`release:check` type-checks, builds, runs the tests, checks release metadata and the Codex marketplace file, packs the npm archive into `artifacts/` and verifies it from an isolated consumer. The Codex host checks moved to the plugin repository with the plugin.
+`release:check` type-checks, builds, runs the tests, checks release metadata and the absence of host/plugin catalogs, packs the npm archive into `artifacts/` and verifies it from an isolated consumer. The Codex host checks moved to the plugin repository with the plugin.
 
 Tests use a loopback fixture backend, synthetic in-memory store entries, stand-ins for native store programs, installed-CLI fixtures, and temporary Git repositories. They never log in to a real backend or read/write the user's credentials. Loopback networking must be permitted to run the browser tests. The parser, tokenizer and terminal runner have their own suite in `tests/arguments.test.cjs`, since host runners depend on them.
 

docs/adr/0003-codex-plugin-extraction.md

@@ -2,6 +2,7 @@
 
 - **Status:** Accepted; implemented by devtools 0.3.0 and Codex plugin 0.3.0.
 - **Date:** 2026-10-21
+- **Amended:** 2026-10-24: the owner requires the Codex marketplace to live in the Codex repository; remove this repository’s catalog without retaining a compatibility entry.
 - **Scope:** Ownership and release of the Codex host integration.
 
 ## Context
@@ -50,11 +51,14 @@ package `files` list and `.gitignore` carried plugin-only paths.
    The owner also decided to remove the old marketplace entry rather than keep it pinned
    at 0.2.8. Users install the new entry, review and trust its hook, and remove the old
    plugin; the Codex repository's README carries that migration note.
-4. The marketplace file `.agents/plugins/marketplace.json` stays in this repository,
-   because people added the marketplace by this repository's URL. Its single entry becomes
-   `mainsequence` with `source.package` `@dev-mainsequence/codex-plugin` once that package
-   is published; until then it keeps pointing at devtools 0.2.8, the last package that
-   carries the plugin, and `scripts/check-release.cjs` refuses any newer devtools pin.
+4. **Marketplace ownership amended 2026-10-24.** The marketplace file
+   `.agents/plugins/marketplace.json` belongs to `mainsequence-codex-plugin`, alongside
+   its installation documentation and catalog validation. Remove the catalog here;
+   do not retain a compatibility marketplace in shared devtools. New installs add
+   `mainsequence-sdk/mainsequence-codex-plugin`. Existing users replace the configured
+   `mainsequence` marketplace source, keeping the same plugin ID and published npm
+   archive. The Codex README owns those migration instructions. This supersedes the
+   original decision to keep the catalog here for existing repository URLs.
 5. Versions keep advancing from what people have installed: devtools 0.3.0 and Codex
    plugin 0.3.0.
 
@@ -64,20 +68,20 @@ package `files` list and `.gitignore` carried plugin-only paths.
   is on npm, after which they may adopt it independently.
 - A devtools release no longer changes anything in Codex. A Codex release pins a
   published devtools version; a change that needs both lands as a devtools release
-  first, then a plugin release, then the marketplace change here.
+  first, then a plugin release, then the marketplace change in the Codex repository.
 - `docs/adr/0002` and `docs/conversational-mcp.md` moved with the plugin; stubs here point
   at their new location. The MCP client itself (the `mcp-*` actions) remains shared code.
 - Codex's `ms-devtools` bin and the shared package's bin have the same name. Installing
   both globally is unsupported; the plugin's copy is meant for Codex, the shared one for
   terminals.
 
-## Publish order
+## Publish order (catalog location amended 2026-10-24)
 
 1. Tag `v0.3.0` here; the release workflow publishes `@dev-mainsequence/devtools@0.3.0`
    with provenance.
 2. Confirm the Codex repository's lockfile integrity matches the registry archive, then
    tag `v0.3.0` there; its release workflow publishes `@dev-mainsequence/codex-plugin@0.3.0`.
-3. Merge the marketplace change here so `codex plugin marketplace upgrade` offers
+3. Merge the marketplace change in the Codex repository so `codex plugin marketplace upgrade` offers
    `mainsequence@mainsequence` from the published package.
 
 ## Verification

docs/integration-roadmap.md

@@ -7,7 +7,7 @@ public API, pins a compatible version, and owns its host-specific implementation
 | --- | --- | --- |
 | VS Code | [ms-vscode-extension](https://github.com/mainsequence-sdk/ms-vscode-extension) already owns the extension and pins devtools; inspected version 0.1.47 uses 0.2.1. | No repository move or pin update in this migration. Adoption of new shared operations is separate work. |
 | Claude Desktop | [mainsequence-claude-desktop](https://github.com/mainsequence-sdk/mainsequence-claude-desktop) owns all Claude UI, lifecycle, account switching, worker transport, tests, docs, marketplace and releases. | Depends on the released devtools package; no sibling checkout or private imports. |
-| Codex | Extracted on 2026-10-21: [mainsequence-codex-plugin](https://github.com/mainsequence-sdk/mainsequence-codex-plugin) owns the hook adapter, presentation, manifests, skills, host checks, tests, docs and releases of the `mainsequence` plugin ([ADR 0003](adr/0003-codex-plugin-extraction.md)). | Depends on the released devtools package; no sibling checkout or private imports. The Codex marketplace file stays in this repository because people added it by this repository's URL. |
+| Codex | Extracted on 2026-10-21: [mainsequence-codex-plugin](https://github.com/mainsequence-sdk/mainsequence-codex-plugin) owns the hook adapter, presentation, manifests, skills, host checks, tests, docs, marketplace and releases of the `mainsequence` plugin ([ADR 0003](adr/0003-codex-plugin-extraction.md)). | Depends on the released devtools package; no sibling checkout or private imports. The Codex marketplace moved into its host repository on 2026-10-24; this shared repository has no plugin catalog. |
 | OpenCode | Existing implementation remains in the development checkout. | Deferred: extract server/TUI/RPC integration, manifests, host tests and releases into an independent repository. Preserve plugin identity and configuration. |
 
 The Codex extraction is implemented by devtools 0.3.0; the plugin is renamed from

docs/phase-2-release.md

@@ -42,14 +42,14 @@ Review and trust the current hook definition in Codex (`/hooks` in the CLI). Sta
 
 After installation, run `node scripts/verify-codex-host.cjs` for an opt-in host integration check. It creates ephemeral Codex sessions, disables the MainSequence MCP server for those sessions, and directs inference to a local counted HTTP fixture. It verifies native `ms` skill registration and exercises help, failures, and valid SDK sync commands that refresh dependency files in temporary repositories without changing their Git state or contacting the backend. Handled commands make zero model requests, including while sync is running; ordinary prompts pass through to the offline fixture. The default check uses no live MainSequence authentication. Optionally set `MAINSEQUENCE_CODEX_SYNC_PROJECT=/absolute/project/path` to check, with the read-only `status` command, that a real project's installed SDK offers the dependency-only sync; this changes nothing in that project. No check contacts a real model endpoint.
 
-## Install the published release
-
-```sh
-codex plugin marketplace add mainsequence-sdk/mainsequence-devtools
-codex plugin add mainsequence-devtools@mainsequence
-```
-
-The committed `.agents/plugins/marketplace.json` points to the exact npm version. Codex installs the npm archive without running lifecycle scripts; the archive already includes its compiled runner and plugin files. Users need Node 22+, plus the target project's SDK and action-specific tools for project operations. Login/status can run before either SDK exists.
+## Install the published Codex release
+
+Current installation instructions and the public marketplace are maintained in
+[mainsequence-codex-plugin](https://github.com/mainsequence-sdk/mainsequence-codex-plugin#install).
+The former Codex marketplace in this shared repository was removed on 2026-10-24.
+Use the Codex repository’s instructions to replace an existing marketplace source.
+The historical 0.2.x package details elsewhere in this document are not current
+installation instructions.
 
 See [Codex plugin packaging and npm sources](https://developers.openai.com/plugins/build/plugins) and [plugin commands](https://learn.chatgpt.com/docs/developer-commands).
 

scripts/check-release.cjs

@@ -1,7 +1,6 @@
 const assert = require('node:assert/strict');
 const fs = require('node:fs');
 const pkg = require('../package.json');
-const marketplace = JSON.parse(fs.readFileSync('.agents/plugins/marketplace.json', 'utf8'));
 assert.equal(pkg.private, undefined);
 assert.equal(pkg.publishConfig.access, 'public');
 assert.equal(pkg.exports['.'].default, './dist/index.js');
@@ -12,30 +11,10 @@ assert.equal(fs.existsSync('dist/index.js'), true);
 assert.equal(fs.existsSync('dist/runner.js'), true);
 assert.equal(fs.existsSync('dist/shared/mcp.js'), true);
 // Host adapters are released from their own repositories (ADR 0003).
-for (const removed of ['src/hosts', 'dist/hosts', 'manifests', '.codex-plugin', 'hooks', 'skills', 'assets', 'build-info.json', 'plugin.json']) {
+for (const removed of ['src/hosts', 'dist/hosts', 'manifests', '.codex-plugin', 'hooks', 'skills', 'assets', 'build-info.json', 'plugin.json', '.agents/plugins/marketplace.json']) {
   assert.equal(fs.existsSync(removed), false, `${removed} belongs to a host repository, not to the shared package`);
 }
-// The Codex marketplace stays in this repository because people added it by this
-// repository's URL. Its entries point at published npm packages. The plugin itself is
-// released from mainsequence-sdk/mainsequence-codex-plugin; devtools 0.2.8 is the last
-// package that carried it, so an entry may still pin that version until the new package
-// is published, but never a newer devtools version.
-const compare = (a, b) => a.map((n, i) => n - b[i]).find(d => d !== 0) ?? 0;
-assert.equal(marketplace.name, 'mainsequence');
-assert.ok(Array.isArray(marketplace.plugins) && marketplace.plugins.length > 0, 'The marketplace must list a plugin');
-for (const plugin of marketplace.plugins) {
-  assert.equal(plugin.source.source, 'npm');
-  assert.match(plugin.source.version, /^\d+\.\d+\.\d+$/);
-  const version = plugin.source.version.split('.').map(Number);
-  if (plugin.source.package === pkg.name) {
-    assert.equal(plugin.name, 'mainsequence-devtools');
-    assert.ok(compare(version, [0, 2, 8]) <= 0, 'devtools 0.2.8 is the last package that contains the Codex plugin');
-  } else {
-    assert.equal(plugin.source.package, '@dev-mainsequence/codex-plugin');
-    assert.equal(plugin.name, 'mainsequence');
-  }
-}
 if (process.env.GITHUB_REF_TYPE === 'tag') assert.equal(process.env.GITHUB_REF_NAME, `v${pkg.version}`);
-console.log(`Release metadata agrees: ${pkg.name}@${pkg.version}; the Codex marketplace lists ${marketplace.plugins.map(plugin => `${plugin.name} from ${plugin.source.package}@${plugin.source.version}`).join(', ')}.`);
+console.log(`Release metadata agrees: ${pkg.name}@${pkg.version}; shared library and terminal CLI only.`);
 // The pack step that follows writes into artifacts/; npm pack does not create it.
 fs.mkdirSync('artifacts', { recursive: true });

tests/shared-boundary.test.cjs

@@ -10,7 +10,7 @@ test('shared APIs have no dependency on any host integration', () => {
     assert.doesNotMatch(text, /from\s+['"][^'"]*(?:claude|codex|\/hosts\/)/i, file);
   }
   // Claude Desktop and the Codex plugin are released from their own repositories (ADR 0003).
-  for (const removed of ['src/hosts', 'src/claudeRunner.ts', 'manifests', 'dist/hosts', 'dist/claudeRunner.js', 'claude', 'artifacts/codex', '.codex-plugin', 'hooks', 'skills']) {
+  for (const removed of ['src/hosts', 'src/claudeRunner.ts', 'manifests', 'dist/hosts', 'dist/claudeRunner.js', 'claude', 'artifacts/codex', '.codex-plugin', 'hooks', 'skills', '.agents/plugins/marketplace.json']) {
     assert.equal(fs.existsSync(path.join(root, removed)), false, removed);
   }
   const runner = fs.readFileSync(path.join(root, 'src/runner.ts'), 'utf8');