cc-research 1.2.0: independent Codex plugin (multi-agent fan-out, Stop-hook audit)

A new independent Codex CLI plugin (plugin-codex/) joins the Claude Code plugin + SDK in this monorepo. It ports the cc-research research loop to OpenAI's Codex with the same evidence/audit substrate, while keeping its own copy of everything — no shared core, synced by hand. The Claude plugin and SDK are unchanged and remain at 1.1.2; the Codex plugin is versioned independently at 1.2.0.

Codex plugin (plugin-codex/)

• Same method, same substrate. runs/<id>/ with meta.json, plan.md, per-strand sources-<slug>.jsonl / claims-<slug>.jsonl, and report.md; [#id] citations; A/B/C/D tiering; citation styles; the Frame step; load-bearing-claim verification; version-isn't-maturity; the recency + security/CVE pass; quantitative-maturity capture; the verified field; the outlook strand; caveat discipline; recommendation-not-on-one-weak-source.
• Multi-agent fan-out, preserved. The orchestrator spawns one researcher subagent per strand in parallel (Codex agents.max_threads, default 6). Codex has no Task tool, so the fan-out is requested in plain language and the roles live in the skill (a Codex plugin can't bundle subagents); optional typed roles ship in .codex/agents/*.toml.
• Two audit layers. A bundled Stop hook (scripts/audit.py, fail-open) and a mandatory in-skill self-audit, so an uncited or missing report is caught even when plugin_hooks is off or the directory isn't trusted. On Codex the hook exits 2 with a reason and the run continues to fix it.
• Codex-native plumbing: the update_plan progress tracker, web_search (run with --search for live results), the agents/openai.yaml invocation sidecar, and a Codex marketplace at .agents/plugins/marketplace.json.

Install (Codex)

codex plugin marketplace add richer-richard/cc-research
codex plugin add cc-research-codex     # or enable from the `codex /plugins` browser on older builds

Then enable hooks in ~/.codex/config.toml, in a trusted directory:

[features]
hooks = true
plugin_hooks = true

See AGENTS.md and the root README.md for details and the Codex-specific notes.

Unchanged

The Claude Code plugin (plugin/), its marketplace, and the Agent SDK (sdk/) are untouched and remain at 1.1.2. The Claude-side version lockstep is independent of the Codex plugin.

cc-research 1.1.3: double the researcher turn backstop (maxTurns 8 → 16)

Raises the researcher turn backstop so a normal deep strand isn't cut off mid-work before it writes its evidence files.

Changed

• maxTurns for researcher and local-researcher raised from 8 to 16. The hard turn cap is a runaway backstop, but at 8 it sat below the soft "≤ 8 tool calls" budget — a turn batches several tool calls, so 8 turns is fewer than 8 calls' worth of room — and could stop a researcher before it persisted its sources-*.jsonl / claims-*.jsonl. Doubling it to 16 gives clearance so the backstop only catches a genuine runaway; the soft ≤ 8 tool-call budget stays the everyday governor, and the orchestrator's maxTurns: 60 is unchanged. The Agent SDK inherits this automatically through the shared agent definitions.

Unchanged

• The ≤ 8 tool-call soft budget, ≤ 5 web researchers/wave, ≤ 2 waves, ≤ 3 local researchers, and the [#id] / per-strand / tier substrate. The independent Codex plugin (plugin-codex/, 1.2.0) is unaffected — its spawned researchers are soft-budgeted only, with no hard turn cap to raise.

Update: plugin users run /plugin marketplace update; SDK users pipx install --force "git+https://github.com/richer-richard/cc-research.git#subdirectory=sdk".

cc-research 1.1.2: dual-name task tracker, security pass, quantified maturity

Synthesis-quality pass plus a tracker tool-name fix. No redesign — the [#id] citation sigil, the per-strand evidence substrate, the budget rails, and all v1.1.x machinery are unchanged. Built-in tools + Claude models only; no new dependencies.

Fixed

• Live task tracker no longer silently no-ops in team-mode sessions. It now names both real tool families — TaskCreate/TaskUpdate (+ TaskList/TaskGet) for team-enabled sessions and TodoWrite for single-agent / headless-SDK sessions — and is described tool-agnostically so the orchestrator uses whichever its session exposes. (Verified against claude 2.1.148: both are live, mode-gated tools; TodoWrite stays correct for the SDK and vanilla sessions, so it was kept rather than removed.)

Synthesis quality

• Production-readiness security pass — for "should I adopt / build on X" questions, the recency self-check searches per-entity CVEs / advisories / breaking incidents (~12 mo) and persists findings as scored, citable evidence.
• Maturity quantified from the registry — weekly downloads (+ at most one usage figure) recorded as scored evidence, so the report states numbers rather than adjectives.
• Caveat discipline — non-extractable or single-sourced figures are flagged in-line; a headline number that carries weight is cross-checked against ≥ 2 independent sources.
• Recommendations can't rest on one weak source — a recommendation's primary quantitative justification may not rest on a single C/D-tier source.

Added

• verified source field (optional, nullable) — records the exact live-fetched value + date, e.g. npm dist-tags latest=19.2.6 @2026-05-22. Existing rows stay valid; the Stop-hook audit is unaffected and stays fail-open.

Install / update: plugin users run /plugin marketplace update. SDK: pipx install --force "git+https://github.com/richer-richard/cc-research.git@v1.1.2#subdirectory=sdk".

cc-research 1.1.1

Synthesis quality

• Per-entity load-bearing-claim verification — before synthesis, the orchestrator re-confirms each main entity's single most decision-relevant claim (current architecture / conflict-resolution model / maturity / status) against the actual current text of that entity's highest-tier primary / first-party source — never a competitor's description or a researcher's paraphrase — and persists any correction as normal per-strand evidence. The synthesizer enforces the same rule and lowers confidence when only a secondary/competitor source backs such a claim.
• Version strings are not maturity — a bare semver no longer reads as stability/GA; the release channel / dist-tag (alpha/beta/rc/stable) and the project's own roadmap/status language outrank it, and any discrepancy is stated explicitly.
• Recency widened from figures to architecture — the recency self-check now also catches an entity with a rewrite, major-version transition, acquisition, or license change (one targeted "what changed in the last ~12 months" search) and feeds the finding back before synthesis.

Fixed

• The SDK install is now self-contained. The wheel bundles the shared plugin/ core (agents + research-method skill) at cc_research/_core/plugin/, so pipx install / pip install of the SDK works from any directory; previously only an editable install (pip install -e) could locate the core. coreloader prefers the packaged copy and still falls back to the repo layout for development.
• The synthesizer no longer silently misses late strands. It now has Glob and discovers every sources-*.jsonl / claims-*.jsonl itself (the orchestrator's strand list is a hint), matching what the Stop-hook audit already globs — wave-2, outlook, and load-bearing-claim correction strands can no longer be dropped.
• The Stop-hook audit is session-scoped (still fail-open). A run whose evidence files are all older than a staleness window is treated as abandoned, so an earlier unfinished run can't block an unrelated later turn; and a plan-only run resumed past planning (sources present) is now correctly audited for a report.
• --budget 0 is honored as a real $0 cap and labeled correctly in the banner (was shown as "unlimited").
• SDK resume restores the run's stored budget / max_turns / max_waves from meta.json instead of reverting to defaults; an explicit flag overrides and is persisted.

Docs / tests

• Clarified that ≤ 8 tool calls per researcher is a self-imposed budget while maxTurns: 8 is a turn-cap backstop (it caps agentic turns, not tool calls). Corrected the SDK install ordering in the READMEs. Added unit tests for auth credential resolution + env scrubbing, frontmatter parsing, and the citation audit.

Unchanged

• The in-body [#<id>] citation sigil and what the Stop-hook audit checks, the per-strand file set / plan.md / meta.json / report.md substrate, the budget rails, the aim-wide / independence rules, and the v1.1 citation-style / TodoWrite / Frame / outlook / recency machinery.

cc-research 1.1.0: citation styles, TodoWrite progress, quality upgrades

Three capabilities over the 1.0.0 multi-agent research loop, preserving the durable substrate (per-strand .jsonl evidence, [#id] citations, the Stop-hook audit, the budget rails). Both front-ends stay in sync through the shared plugin/ core.

Citation styles

Pick inline (default), mla, apa, or chicago for the report's reference section. The plugin asks once at Scope via AskUserQuestion (recorded in meta.json as citation_style); the SDK takes --citation-style. The in-body [#id] sigil and the Stop-hook audit are unchanged; only the reference heading/format changes (## Sources / ## Works Cited / ## References / ## Bibliography), with the quality-tier annotation kept for inline. Source rows gain author plus optional container/site_name.

TodoWrite live progress

The orchestrator keeps a TodoWrite list (one todo per phase plus one per strand), flipped as researchers return and rebuilt from disk on resume, alongside the existing prose narration.

Quality upgrades

A Frame step (one orienting search to a shared framing fact passed to every researcher), up to 2 flagged adjacent in-source facts per researcher, forward-looking synthesis via an outlook strand, and a recency self-check before synthesis.

Upgrade

• Plugin: run /plugin marketplace update, then it resolves to 1.1.0.
• SDK: pipx install --force "git+https://github.com/richer-richard/cc-research.git#subdirectory=sdk".

See CHANGELOG.md for the full entry.

cc-research 1.0.0

cc-research 1.0.0 — first release.

Multi-agent deep research on Claude models, with two front-ends that share one source of truth: an interactive Claude Code plugin and a headless Agent SDK CLI.

Install — plugin (in Claude Code)

/plugin marketplace add richer-richard/cc-research
/plugin install cc-research@cc-research
/cc-research:research <your question>

Install — SDK CLI (on your PATH)

pipx install "git+https://github.com/richer-richard/cc-research.git#subdirectory=sdk"
# or grab the attached wheel:  pip install cc_research-1.0.0-py3-none-any.whl
cc-research login
cc-research "<your question>"

Highlights

• Orchestrator → parallel researcher subagents (aim wide, one per independent strand) → triangulate → synthesize → cite → report.
• Built-in tools only (WebSearch, WebFetch, Read, Grep, Glob, Write, Task); Claude models only; no MCP.
• Per-strand evidence persisted to disk (sources-<strand>.jsonl / claims-<strand>.jsonl); runs are resumable; a Stop-hook audit blocks unbacked [#id] citations.
• Auth: OAuth subscription (monthly Agent SDK credit) by default, Anthropic API key as fallback.
• No default budget cap — runs are uncapped; set --budget for an optional hard cap.

See CHANGELOG.md for the full list. Attached: the SDK wheel and sdist.