fix(codex): register marketplace plugin lifecycle hooks

[AlexCawl]

Installing Caveman from the Codex marketplace exposes its skills but does not register activation hooks. Move the Codex manifest and its existing icons to the marketplace root and declare inline SessionStart and UserPromptSubmit hooks using the existing handlers and readable Node commands.

Codex stores mode changes per chat in PLUGIN_DATA. Startup/clear apply the configured default; resume/compact preserve the selected style or explicit off. Native $skill and Markdown skill references use the shared parser. Invalid session ids fail open, and Codex skips Claude statusline setup, model overrides, and usage scripts.

Remove the repository-local hook configuration to prevent duplicate activation. Keep the standalone Codex loader and installer introduced in main. The Claude plugin manifest, launch commands, Windows behavior, standalone installer, and OpenCode behavior are unchanged. No dependencies or version bump are added.

Fixes #1242.

Validation:

• 133 focused tests passed on Node 18, including Codex lifecycle, standalone installation, Claude SDK/subagents, and existing hook path tests.
• 35 Python activation tests, 44 Python mode-tracking tests, and all 16 standalone JavaScript suites passed.
• python3 tests/verify_repo.py and git diff --check passed.
• Full npm test: 575 passed, 17 skipped, one existing macOS/Homebrew failure in standalone hooks keep a stable PATH node symlink, also reproduced on unmodified upstream main (2e08b91).
• Native marketplace upgrade installed the rebased branch. Codex discovers exactly one SessionStart and one UserPromptSubmit plugin handler in both a consumer project and Caveman, with no warnings or errors; installed files match the checkout.
• Windows execution is left to the existing CI. Hook trust remains a user action in Codex.

[JuliusBrussee]

Reviewed, not adopted — the diagnosis is correct and the mechanism is the right instinct, but three consequences need @JuliusBrussee's call. Thanks for tracing this to the manifest rather than just reporting a symptom.

Verified in your favour: the hooks genuinely cannot resolve where the manifest sits today — plugins/caveman/src/ does not exist, so a hooks block added in place would point at an unshipped path. Moving the plugin root is the only way ${PLUGIN_ROOT}/src/hooks/... resolves.

What stopped me adopting it:

1. It changes what ships to Codex. The current root serves plugins/caveman/skills/ (6 skills); the repo root serves skills/ (24). Every Codex marketplace user would get all 24, whose description fields then compete for activation. That is a product decision.
2. It deletes .codex/config.toml and .codex/hooks.json but keeps .codex/codex-sessionstart.js, which CLAUDE.md documents at length as this checkout's repo-local hook and as the payload the user-level always-on path (Add optional always-on mode for Codex #573) copies. After the PR that script remains with nothing registering it in-repo.
3. The rename moves files under plugins/caveman/**, the CI-synced plugin distribution, which this routine does not edit.

Also unverifiable from here: whether Codex accepts a plugin-declared hooks block at all, and whether it still needs [features] hooks = true once .codex/config.toml is gone. If you have a Codex install, that is the one observation that would settle the design — worth pasting.

None of this is a correctness objection to your patch; it is three decisions above a triage routine's pay grade.

---

Generated by Claude Code