v2.4.0

Added

• Codex plugin format — the same directory now installs in Claude Code, Cursor, and Codex. New .codex-plugin/plugin.json (spec) declares the seven shared skills, the destructive-DB hook, and an interface block (display name, category, brand color, default prompts) for directory presentation. The hook is reused verbatim — no Codex variant: Codex's hook system mirrors Claude Code's (same PreToolUse event, matcher: "Bash", tool_input.command payload, exit-2 + stderr blocking) and it reads CLAUDE_PLUGIN_ROOT for compatibility, so .codex-plugin/plugin.json points straight at hooks/hooks.json.
• codex/skills/builder/ — the builder spine for Codex. Codex plugin manifests have no agents and no rules field, so neither agents/builder.md (Claude, forced default via settings.json) nor rules/agentlink.mdc (Cursor, alwaysApply) can port. This entry-point skill carries the same spine — engage-AgentLink routing, plan-first, the architecture decision matrix, the decision protocol, core rules, and the prod guardrail — and delegates the how to the shared skills. It is the peer of those two files: change one, consider the other two.
  • It lives in a Codex-only root so it stays invisible to Claude Code (which auto-discovers ./skills/ only) and Cursor (whose manifest points at skills) — the seven domain skills stay shared and single-source, with no duplication.
  • ⚠️ .codex-plugin/plugin.json declares "skills": ["./skills/", "./codex/skills/"]. The manifest array replaces the default ./skills root rather than adding to it (plugin_skill_roots()), so ./skills/ must stay listed — drop it and the domain skills silently stop loading. (Array support: openai/codex#28790, stable since rust-v0.143.0; the published docs still describe skills as a single string.)
• .agents/plugins/marketplace.json — the Codex repo marketplace, making the plugin installable. Codex reads a repo's marketplace from .agents/plugins/marketplace.json (not .codex-plugin/, which holds only the plugin manifest), and its plugin entries take a source object ({"source":"local","path":"./"}) rather than Claude's plain string. Install is codex plugin marketplace add tomaspozo/agentlink (accepts a local path, owner/repo[@ref], or an HTTPS/SSH Git URL) followed by codex plugin add agentlink@tomaspozo — note plugin add, not plugin install.
  • ⚠️ .agents/ was gitignored (it's where companion skills install locally), so .gitignore now re-includes that one file explicitly — level by level, since git won't descend into an excluded directory. Without the negation the marketplace never ships and the documented install fails. Keep it in sync if the file ever moves.
• cli skill: references/resend.md documents the new OAuth key-provisioning path. First-time interactive resend setup now leads with "Connect with Resend" — a browser OAuth flow that mints a sending_access key and pushes it, no dashboard/copy-paste — with paste as the fallback. The note makes clear this only affects the interactive prompt: --api-key, --non-interactive, and saved defaults are unchanged, so agent-driven/scripted setup still passes the key explicitly. Matches the CLI's resend setup OAuth feature.
• frontend skill: the canonical list + detail routing pattern is documented and demonstrated. references/routing.md gained a "List + detail pages" section and SKILL.md a matching rule: for independent /x (list) and /x/$id (detail) pages, use an index route (x/index.tsx + x/$id.tsx) — never a flat x.tsx + x.$id.tsx, which makes the generator treat x.tsx as a parent layout and nest the detail inside it, so /x/$id changes the URL but keeps rendering the list (the detail only mounts in an <Outlet/> the full-page list doesn't have). Points at the scaffold's new _auth/settings/members/ (list index.tsx + detail $membershipId.tsx) as the reference to copy.
• frontend skill: references/data_fetching.md gained "Reloading on a Workspace Switch". Explains why query keys must NOT carry the active workspace id (reloading on switch is centralized in WorkspaceProvider, which resets workspace-scoped queries), with a user-scoped vs workspace-scoped table and the rule that a user-level query (profile, oauth-grants, account settings, active sessions, billing…) must be added to KEEP_ON_WORKSPACE_SWITCH so it isn't needlessly refetched on every switch. A matching note landed in SKILL.md's workspace-switching section and the Query Key Structure rules; flags the two anti-patterns (filter-less invalidateQueries(), threading activeId into keys).

Changed

• rules/agentlink.mdc slimmed to routing + non-negotiables (114 → 58 lines, ~6.7k → ~3.1k chars). The rule is alwaysApply: true, so it rides in the system prompt of every Cursor request — length there is paid on all traffic and dilutes the rules. It now does the one job only it can do (route a generic agent into AgentLink and state the hard stops: api-only exposure, .rpc() never .from(), RLS everywhere, never reset the DB, forward-only migrations, prod needs approval) and delegates the detail to the skills Cursor already loads. Dropped from the rule and verified as covered: the function-prefix table and schema layout (database), the withSupabase options (edge-functions), scaffold-map and prerequisites (cli), and the blank-project kickoff (cli/references/workflows.md). Dropping the withSupabase block also removes a copy of a contract that churns between releases — the edge-functions skill is the single source of truth for it.
• release.sh bumps all three manifests. .codex-plugin/plugin.json joins .claude-plugin and .cursor-plugin in the version bump and the release commit, so the Codex manifest can't silently drift out of lockstep.
• frontend skill: canonical members references now point at members/index.tsx. SKILL.md's route tree, references/auth_ui.md's route-guard recipe, and references/routing.md's convention table updated for the CLI scaffold's members list+detail split.