Add Claude Code and Codex plugins backed by one hook table

.agents/plugins/marketplace.json

@@ -0,0 +1,20 @@
+{
+  "name": "crosshead",
+  "interface": {
+    "displayName": "Crosshead"
+  },
+  "plugins": [
+    {
+      "name": "crosshead",
+      "source": {
+        "source": "local",
+        "path": "./plugins/codex"
+      },
+      "policy": {
+        "installation": "AVAILABLE",
+        "authentication": "ON_INSTALL"
+      },
+      "category": "Productivity"
+    }
+  ]
+}

.claude-plugin/marketplace.json

@@ -0,0 +1,18 @@
+{
+  "name": "crosshead",
+  "owner": {
+    "name": "FriendMachine",
+    "url": "https://crosshead.sh"
+  },
+  "metadata": {
+    "description": "Crosshead plugins for Claude Code. Codex reads .agents/plugins/marketplace.json."
+  },
+  "plugins": [
+    {
+      "name": "crosshead",
+      "source": "./plugins/claude-code",
+      "description": "Persistent memory across coding agents. Hooks connect this host to the locally installed Crosshead runtime, shared with Claude Code, Codex, Hermes, OpenCode and Pi.",
+      "version": "1.0.1"
+    }
+  ]
+}

.github/workflows/ci.yml

@@ -33,6 +33,7 @@ jobs:
       - run: npm run typecheck
       - run: npm run check:boundary
       - run: npm run build
+      - run: npm run plugins:check
       - run: npm test
 
   release-build:

.github/workflows/native-hosts.yml

@@ -7,6 +7,10 @@ on:
       - 'src/runtime/**'
       - 'tests/runtime/native-host-plugins.test.ts'
       - 'scripts/*native-host*'
+      - 'scripts/*host-plugins*'
+      - 'plugins/**'
+      - '.claude-plugin/**'
+      - '.agents/**'
       - 'package-lock.json'
       - '.github/workflows/native-hosts.yml'
 
@@ -40,3 +44,58 @@ jobs:
           include-hidden-files: true
           if-no-files-found: ignore
           retention-days: 14
+
+  host-plugins:
+    name: Claude Code and Codex plugins
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run release:build
+      - run: npm run plugins:check
+      - run: bash scripts/test-host-plugins.sh
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        if: always()
+        with:
+          name: host-plugin-results
+          path: .native-host-test-logs/host-plugins/
+          include-hidden-files: true
+          if-no-files-found: ignore
+          retention-days: 14
+
+  host-plugins-macos:
+    name: Claude Code and Codex plugins (macOS)
+    runs-on: macos-latest
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run release:build
+      - run: npm run plugins:check
+      - name: Install pinned host CLIs
+        run: npm install --global --no-audit --no-fund @anthropic-ai/claude-code@2.1.319 @openai/codex@0.167.0
+      - name: Exercise installed plugins
+        env:
+          CROSSHEAD_SMOKE_ROOT: ${{ runner.temp }}/crosshead-plugin-smoke
+        run: node scripts/smoke-host-plugins.mjs
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        if: always()
+        with:
+          name: host-plugin-macos-results
+          path: ${{ runner.temp }}/crosshead-plugin-smoke/
+          include-hidden-files: true
+          if-no-files-found: ignore
+          retention-days: 7

README.md

@@ -13,11 +13,41 @@ are covered by [TRADEMARKS.md](TRADEMARKS.md).
 
 ## Install
 
+### Claude Code and Codex: plugin
+
+```bash
+claude plugin marketplace add FriendMachine/crosshead
+claude plugin install crosshead@crosshead
+# Codex:
+codex plugin marketplace add FriendMachine/crosshead
+codex plugin add crosshead@crosshead
+```
+
+Then start a session and run `/crosshead:setup` in Claude Code, or type
+`$crosshead:setup` in Codex. Only you can start setup; the model does not run
+it on its own. Until setup has run, each session starts with one line saying
+Crosshead isn't set up; nothing else happens and the session is never blocked.
+Setup asks for your consent, runs the installer below, and connects the host
+with `crosshead quickstart --adapter claude-code|codex --hook-mode plugin`.
+Codex runs plugin hooks only after you trust them in `/hooks`. The plugin
+launcher needs a POSIX shell; Windows is not supported.
+
+The plugins are thin. They contain the lifecycle hooks, the setup skill and a
+small launcher that runs the installed runtime's hook entrypoints. They do not
+bundle, download or update the runtime, so one runtime, daemon and identity
+stays shared by every host. See [host plugins](docs/HOST-PLUGINS.md).
+
+### Other hosts and scripts: installer
+
 ```bash
 curl -fsSL https://crosshead.sh/install | bash
 crosshead quickstart --api-base https://crosshead.sh --adapter claude-code --workspace-root .
 ```
 
+`--adapter` also takes `codex`, `pi`, `omp`, `hermes` and `opencode`. Without
+the plugin, `crosshead install claude-code|codex` registers the hooks in
+`.claude/settings.json` or `$CODEX_HOME/hooks.json` itself.
+
 The installer downloads one release tarball, checks its SHA-256 against the
 installer script, installs three npm dependencies (`@noble/curves`,
 `nostr-tools`, `tar`) with install scripts disabled, and writes the wrappers
@@ -41,7 +71,8 @@ same bytes (see [Releases](#releases)).
   in the runtime's local secret store under `~/.crosshead/config/secrets/`. It
   signs authentication challenges, handoff capsules and trust receipts. Logs
   redact key material and session tokens.
-- The adapters register Claude Code and Codex hooks. On session start and each
+- The Crosshead plugin (or, without it, the adapter installer) registers
+  Claude Code and Codex hooks. On session start and each
   turn, the hook asks the local daemon for context. After a turn, the daemon
   records where the work stands as hot memory and writes it to the hosted
   service. Promotion to warm memory and archiving to cold memory follow your
@@ -61,8 +92,10 @@ same bytes (see [Releases](#releases)).
 - `crosshead status`, `crosshead doctor` and `crosshead logs` show what the
   runtime is doing. Local state lives in `~/.crosshead/state/`.
 
-`crosshead uninstall` removes the runtime; `crosshead uninstall claude-code`
-and `crosshead uninstall codex` remove the hooks.
+`crosshead uninstall` removes the runtime. Uninstall the plugin
+(`claude plugin uninstall crosshead@crosshead`, `codex plugin remove
+crosshead@crosshead`) to remove its hooks; `crosshead uninstall claude-code`
+and `crosshead uninstall codex` remove installer-written hooks and adapter files.
 
 ## Hermes and OpenCode
 
@@ -85,6 +118,7 @@ uninstall commands, supported versions, and Docker tests.
 | Path | Contents |
 | --- | --- |
 | `src/runtime/` | CLI, daemon, host adapters, hooks, hosted API client |
+| `plugins/`, `.claude-plugin/`, `.agents/plugins/` | Claude Code and Codex plugins and their marketplace, generated by `npm run plugins:generate` |
 | `src/protocol/` | Wire contract shared with the hosted service. It depends only on Node built-ins and is published as `@crosshead/protocol`. |
 | `schemas/` | Published JSON schemas for protocol records |
 | `tests/` | Unit tests. Client/server contract tests run in the hosted repository against the exact release artifact. |
@@ -103,6 +137,7 @@ npm ci
 npm run typecheck
 npm run check:boundary
 npm run build        # tests spawn the compiled daemon and hooks
+npm run plugins:check
 npm test
 ```
 

docs/ARCHITECTURE.md

@@ -27,6 +27,12 @@ Rules, enforced by `npm run check:boundary` and `scripts/verify-release.mjs`:
 Code that only the hosted service needs, such as recall heuristics, does not
 belong here. Code both sides need lives here; the hosted service imports it.
 
+The Claude Code and Codex plugins (`plugins/`, `.claude-plugin/`,
+`.agents/plugins/`) are generated from `src/runtime/host-hook-spec.ts` and are
+installed from this repository by the hosts, not from the release tarball. They
+only run the installed runtime's hook entrypoints; see
+[HOST-PLUGINS.md](HOST-PLUGINS.md).
+
 ## Operator extensions
 
 FriendMachine's local operator runs a superset build from the hosted