feat: add Codex plugin support

.github/workflows/publish.yml

@@ -18,8 +18,28 @@ permissions:
   contents: read
 
 jobs:
+  validate:
+    name: Validate all targets
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v5
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Install
+        run: npm ci
+
+      - name: Build and validate
+        run: npm test
+
   publish:
     name: ${{ matrix.target }} → ${{ matrix.repo }}
+    needs: validate
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -29,6 +49,8 @@ jobs:
             repo: claude-plugins
           - target: cursor
             repo: cursor-plugins
+          - target: codex
+            repo: codex-plugins
     concurrency:
       group: pluginpack-sync-${{ matrix.target }}
       cancel-in-progress: true

README.md

@@ -4,20 +4,21 @@ The source-of-truth repository for Glean's official plugins for AI coding
 assistants. One portable library of skills, agents, rules, commands, and hooks
 is authored here once, and [`pluginpack`](https://github.com/gleanwork/pluginpack)
 compiles it into the native plugin layout each host expects — today **Claude
-Code** and **Cursor**. The same skills ship to every target; only each host's
-manifest layer differs, and pluginpack generates that.
+Code**, **Cursor**, and **Codex**. Most skills share one base source; target
+overrides handle the few host-specific setup and capability differences.
 
 ## Layout
 
 | Path | What it is |
 |------|------------|
-| `skills/` | The portable skill library — one `SKILL.md` (plus optional `references/`) per capability, in the open Agent Skills format. Host-agnostic; **the source of truth.** |
-| `sources/shared/` | Components shared by every target (subagents). |
+| `skills/` | The portable skill library — one `SKILL.md` (plus optional `references/`) per capability, with host-specific files only under `targets/<host>/`. **The source of truth.** |
+| `sources/shared/` | Components shared by targets that support them (subagents). |
 | `sources/claude/` | Claude-only components (slash-commands, hooks). |
+| `sources/codex/` | Codex-only plugin documentation and static files. |
 | `sources/cursor/` | Cursor-only components (rules, commands, assets). |
 | `sources/dev-docs/` | Source for the separate `glean-dev-docs` plugin. |
 | `pluginpack.config.ts` | Build config — which sources compose into which plugin, per target. |
-| `plugins/`, `glean/`, `glean-dev-docs/`, `.claude-plugin/`, `.cursor-plugin/` | **Generated** output. Don't edit by hand — it's rebuilt from source. |
+| `plugins/`, `glean/`, `glean-dev-docs/`, `.agents/`, `.codex-plugin/`, `.claude-plugin/`, `.cursor-plugin/` | **Generated** output. Don't edit by hand — it's rebuilt from source. |
 
 ## Plugins produced
 
@@ -38,11 +39,13 @@ components, and emits each host's native format:
   skills, commands, and hooks.
 - **Cursor** — a marketplace + `plugin.json` referencing skills, agents, rules,
   and commands.
+- **Codex** — a marketplace + `.codex-plugin/plugin.json` for each plugin,
+  with bundled skills and install-surface metadata.
 
 Skills use the open Agent Skills format — `SKILL.md` with `name`/`description`
 frontmatter and optional `references/` loaded on demand — which Claude Code,
-Cursor, Gemini CLI, and Copilot all support. Write a skill once; it ships
-everywhere, and per-host quirks are neutralized at build time.
+Codex, Cursor, Gemini CLI, and Copilot all support. Base skills ship everywhere;
+target overrides handle the few host-specific differences.
 
 > The plugins don't bundle a Glean MCP server — users connect one themselves
 > (your host's Glean MCP setup guides that). The skills then use whatever Glean MCP
@@ -56,7 +59,7 @@ Requires Node >= 24. Install once with `npm install`.
 |---------|--------------|
 | `npm run build` | Compile all targets into the generated plugin output. |
 | `npm run validate` | Validate each target's generated output. |
-| `npm test` | Diff a fresh build against the committed output (staleness gate). |
+| `npm test` | Build every target, then validate each generated output. |
 | `npm run prune` | Remove stale generated files. |
 | `npm run clean` | Remove all generated output. |
 
@@ -65,7 +68,8 @@ Requires Node >= 24. Install once with `npm install`.
 1. Edit or create `skills/<name>/SKILL.md` (add `references/*.md` for deep,
    load-on-demand detail).
 2. `npm run build` to regenerate the plugins.
-3. `npm test` to confirm the output is well-formed and in sync.
+3. `npm test` to confirm every target builds and validates cleanly.
 
-Because every target compiles from the same `skills/` source, a change lands in
-all of them at once.
+Base skill changes reach every target that includes them. When one host needs
+different instructions, add a full replacement at
+`skills/<name>/targets/<host>/SKILL.md`; other targets keep the base file.

package.json

@@ -13,13 +13,13 @@
     "build": "pluginpack build",
     "clean": "pluginpack clean",
     "prune": "pluginpack prune",
-    "validate": "pluginpack validate --target claude --dir dist/claude && pluginpack validate --target cursor --dir dist/cursor",
+    "validate": "pluginpack validate --target claude --dir dist/claude && pluginpack validate --target cursor --dir dist/cursor && pluginpack validate --target codex --dir dist/codex",
     "test": "npm run build && npm run validate",
     "prebuild": "node scripts/sync-changelog.mjs",
     "release": "release-it"
   },
   "devDependencies": {
-    "@gleanwork/pluginpack": "^0.6.0",
+    "@gleanwork/pluginpack": "^0.7.0",
     "@release-it/conventional-changelog": "^11.0.1",
     "release-it": "^20.2.0"
   },

pluginpack.config.ts

@@ -83,5 +83,81 @@ export default defineConfig({
         },
       },
     },
+    codex: {
+      outDir: "dist/codex",
+      rootFiles: {
+        "README.md": "roots/codex/README.md",
+        LICENSE: "LICENSE",
+      },
+      manifest: {
+        name: "glean-codex-plugins",
+        interface: { displayName: "Glean for Codex" },
+      },
+      plugins: {
+        glean: {
+          from: ["glean-lib", "codex", "codex-assets"],
+          components: ["skills", "assets"],
+          description:
+            "Official Glean plugin — search documents, Slack, and email; explore code across repos; find experts and stakeholders; prep for meetings and onboarding.",
+          manifest: {
+            interface: {
+              displayName: "Glean",
+              shortDescription: "Enterprise knowledge in Codex",
+              longDescription:
+                "Search enterprise documents, Slack, email, code, and people; prepare for meetings; and synthesize trusted company knowledge in Codex.",
+              developerName: "Glean",
+              category: "Productivity",
+              capabilities: ["Read", "Search"],
+              defaultPrompt: [
+                "Search Glean for the latest project decision.",
+                "Find an expert on this codebase.",
+                "Prepare me for my next meeting.",
+              ],
+              composerIcon: "./assets/avatar.png",
+              logo: "./assets/avatar.png",
+            },
+          },
+          entry: {
+            policy: {
+              installation: "AVAILABLE",
+              authentication: "ON_INSTALL",
+            },
+            category: "Productivity",
+          },
+        },
+        "glean-dev-docs": {
+          from: ["dev-docs", "codex-assets"],
+          components: ["skills", "assets"],
+          description:
+            "Search the public Glean developer documentation — APIs, SDKs, MCP, and integration guides for building with Glean.",
+          manifest: {
+            homepage: "https://developers.glean.com/",
+            interface: {
+              displayName: "Glean Developer Docs",
+              shortDescription: "Build with Glean in Codex",
+              longDescription:
+                "Search public Glean API, SDK, MCP, authentication, and integration documentation while you build in Codex.",
+              developerName: "Glean",
+              category: "Productivity",
+              capabilities: ["Read", "Search"],
+              defaultPrompt: [
+                "How do I authenticate with the Glean API?",
+                "Find the Glean Indexing API documentation.",
+                "Show me a Glean SDK example.",
+              ],
+              composerIcon: "./assets/avatar.png",
+              logo: "./assets/avatar.png",
+            },
+          },
+          entry: {
+            policy: {
+              installation: "AVAILABLE",
+              authentication: "ON_INSTALL",
+            },
+            category: "Productivity",
+          },
+        },
+      },
+    },
   },
 });

roots/codex/README.md

@@ -0,0 +1,51 @@
+# Glean Plugins for Codex
+
+> **Generated repository.** Built from
+> [gleanwork/agent-plugins](https://github.com/gleanwork/agent-plugins) via
+> [pluginpack](https://github.com/gleanwork/pluginpack). Don't hand-edit managed
+> files here — changes are made in `agent-plugins` and synced through generated
+> pull requests.
+
+Official Glean plugins for [Codex](https://developers.openai.com/codex) —
+enterprise knowledge, search, people, code, meetings, and Glean developer docs.
+
+## Install
+
+```bash
+codex plugin marketplace add gleanwork/codex-plugins
+codex plugin add glean@glean-codex-plugins
+codex plugin add glean-dev-docs@glean-codex-plugins
+```
+
+Before starting Codex, connect the MCP server used by the plugin you installed:
+
+- **Glean enterprise knowledge:** get your server URL and name from the
+  [Glean MCP configurator](https://app.glean.com/settings/install?mcpConfigure=true),
+  then run `codex mcp add glean --url <server-url>/mcp/<server-name>` followed by
+  `codex mcp login glean`.
+- **Glean developer docs:** run
+  `codex mcp add glean-dev-docs --url https://developers.glean.com/mcp`.
+
+Then start a new Codex task so the bundled skills and MCP tools are available.
+
+## Plugins
+
+| Plugin | Description |
+|--------|-------------|
+| **[glean](plugins/glean)** | Enterprise knowledge — search docs/Slack/email, cross-repo code exploration, people & experts, meetings, onboarding, and productivity. |
+| **[glean-dev-docs](plugins/glean-dev-docs)** | Search Glean's public developer documentation — APIs, SDKs, MCP, and integration guides. |
+
+## Requirements
+
+- [Codex](https://developers.openai.com/codex) with plugin support
+- A Glean account with MCP access (for the `glean` plugin)
+
+## Support
+
+- [Glean MCP Documentation](https://docs.glean.com/mcp)
+- [Glean Support](https://help.glean.com)
+- [GitHub Issues](https://github.com/gleanwork/codex-plugins/issues)
+
+## License
+
+MIT License — see [LICENSE](LICENSE) for details.

scripts/sync-changelog.mjs

@@ -9,7 +9,12 @@ import { dirname, join } from "node:path";
 
 const root = join(dirname(fileURLToPath(import.meta.url)), "..");
 const source = join(root, "CHANGELOG.md");
-const buckets = ["sources/claude", "sources/cursor", "sources/dev-docs"];
+const buckets = [
+  "sources/claude",
+  "sources/codex",
+  "sources/cursor",
+  "sources/dev-docs",
+];
 
 for (const bucket of buckets) {
   copyFileSync(source, join(root, bucket, "CHANGELOG.md"));

skills/connect-glean/SKILL.md

@@ -5,11 +5,10 @@ description: Help the user connect a Glean MCP server so the Glean skills have t
 
 # Connect Glean
 
-The Glean plugin ships skills and agents but **does not bundle an MCP server** —
-the skills call whatever Glean MCP tools the host exposes. If no Glean MCP server
-is connected, the skills have nothing to call. This skill connects one, or
-verifies and troubleshoots an existing connection. Follow the section for the
-user's host.
+The Glean plugin ships skills but **does not bundle an MCP server** — the skills
+call whatever Glean MCP tools the host exposes. If no Glean MCP server is
+connected, the skills have nothing to call. This skill connects one, or verifies
+and troubleshoots an existing connection. Follow the section for the user's host.
 
 ## When this applies
 
@@ -31,8 +30,8 @@ Gather these once, then apply them in the host-specific step:
    `glean-code`).
 
 The MCP endpoint is always `<server-url>/mcp/<server-name>`. It is a **remote
-HTTP** server, and the host prompts for **OAuth on first tool use** — there is no
-API key to paste. **Restart the host** after configuring.
+HTTP** server and uses OAuth — there is no API key to paste. Follow the
+host-specific authentication and reload steps below.
 
 ## Claude Code
 
@@ -45,6 +44,18 @@ claude mcp add <friendly-name> <server-url>/mcp/<server-name> --transport http -
 Verify with `claude mcp list` (look for a `glean.com/mcp` URL). Restart Claude
 Code; authenticate on first use.
 
+## Codex
+
+Run:
+
+```bash
+codex mcp add <friendly-name> --url <server-url>/mcp/<server-name>
+codex mcp login <friendly-name>
+```
+
+Complete the browser OAuth flow, then verify with `codex mcp list` (look for a
+`glean.com/mcp` URL). Start a new Codex task so the MCP tools are available.
+
 ## Cursor
 
 Add an entry to `~/.cursor/mcp.json`:
@@ -70,14 +81,17 @@ config lives and the exact field names.
 
 ## Checking status / troubleshooting "no Glean tools"
 
-If the Glean skills run but report missing tools, the host has no Glean MCP server
-connected for the current session:
+If the Glean skills run but report missing tools, the host has no usable Glean
+MCP server in the current session or task:
 
-1. Confirm a server is configured (Claude Code: `claude mcp list`; other hosts:
-   check the MCP config above for a `glean.com/mcp` URL).
-2. If none, run the host setup above.
-3. If configured but tools are still missing: restart the host, then trigger
-   OAuth by running any Glean tool once.
+1. Confirm a server is configured: use `claude mcp list` in Claude Code,
+   `codex mcp list` in Codex, or inspect the host's MCP config for a
+   `glean.com/mcp` URL.
+2. If none is configured, run the host setup above.
+3. If Codex is configured but not authenticated, run
+   `codex mcp login <friendly-name>`, then start a new task.
+4. In other hosts, restart the host and trigger OAuth by running any Glean tool
+   once.
 
 ## Glean developer docs server (separate, optional)
 
@@ -86,6 +100,9 @@ name, or auth needed:
 
 - **Claude Code:**
   `claude mcp add glean-dev-docs https://developers.glean.com/mcp --transport http --scope user`
+- **Codex:**
+  `codex mcp add glean-dev-docs --url https://developers.glean.com/mcp`, then
+  start a new task.
 - **Other hosts:** register `https://developers.glean.com/mcp` as a remote HTTP
   MCP server (no OAuth required).