$npx -y skills add Borda/AI-Rig --skill syncDry-run-first Codex Rig installation drift and update workflow. Use to inspect the active plugin cache, refresh its GitHub marketplace, or reinstall the current plugin while coordinating separately managed agent shims.
| 1 | # Sync |
| 2 | |
| 3 | Inspect and refresh the public-GitHub Codex Rig plugin through supported Codex CLI operations. Never copy files into |
| 4 | an installed cache, edit Codex configuration by hand, or treat cached package directories as mutable source trees. |
| 5 | |
| 6 | Sync never mutates external agent files. Before plugin removal, run `agent-shims remove` while the manager is still |
| 7 | available. After refresh or reinstall, run `agent-shims doctor` to report prior shim residue; new installation and |
| 8 | relinking remain platform-blocked. Report unknown or modified `codex-rig-*.toml` files without removing, adopting, or |
| 9 | repairing them. |
| 10 | |
| 11 | ## Input Schema |
| 12 | |
| 13 | ```json |
| 14 | { |
| 15 | "mode": "check|refresh", |
| 16 | "marketplace": "borda-ai-rig", |
| 17 | "plugin": "codex-rig@borda-ai-rig", |
| 18 | "ref": "optional Git ref; omitted follows the remote default branch", |
| 19 | "done_when": "active selection and package identity are recorded; an approved refresh is reinstalled and rechecked" |
| 20 | } |
| 21 | ``` |
| 22 | |
| 23 | Only the frozen marketplace and plugin identifiers are accepted. `check` is the default and is read-only. `refresh` |
| 24 | requires explicit user approval because it fetches marketplace state and changes the local plugin cache. |
| 25 | |
| 26 | ## Workflow |
| 27 | |
| 28 | ### 01: Create the result directory |
| 29 | |
| 30 | Create `.reports/codex/sync/<timestamp>/` in the consuming project. Record the Codex CLI version, resolved executable, |
| 31 | `CODEX_HOME` presence without secret values, operating system, and requested mode. |
| 32 | |
| 33 | ### 02: Inspect current state without mutation |
| 34 | |
| 35 | Run the authoritative help for the available CLI, then collect: |
| 36 | |
| 37 | ```bash |
| 38 | codex plugin marketplace list --json |
| 39 | codex plugin list --marketplace borda-ai-rig --json |
| 40 | ``` |
| 41 | |
| 42 | If a documented `--json` option is absent, capture the text form and mark structured comparison unavailable. Never |
| 43 | invent a flag. Record exactly one of: `not-configured`, `not-installed`, `disabled`, `active`, `ambiguous`, or |
| 44 | `cli-unsupported`. |
| 45 | |
| 46 | For one active installation, resolve the selected cache path reported or implied by the observed CLI contract. Require |
| 47 | a regular `.codex-plugin/plugin.json` and `package-manifest.json`; reject symlinks, path escape, duplicate selections, |
| 48 | name/version disagreement, unsupported manifest schema, and package-file hash mismatch. Do not select a cache by |
| 49 | lexical or modification-time "latest" rules. |
| 50 | |
| 51 | ### 03: Report external-agent residue without touching it |
| 52 | |
| 53 | Read-only scan the user agent directory for exact `codex-rig-*.toml` names. Record names and hashes, never file bodies. |
| 54 | Classify every match `unmanaged-or-unknown` unless a compatible lifecycle manager and its ownership state are |
| 55 | available and verified. Plugin-only sync never deletes or overwrites a match. |
| 56 | |
| 57 | ### 04: Stop after dry run unless refresh was explicitly approved |
| 58 | |
| 59 | Show the installed state, marketplace source, configured ref or default-branch tracking, resolved revision when the |
| 60 | marketplace checkout exposes it, current version, package verification result, possible external-agent residue, |
| 61 | proposed commands, network/cache effects, and rollback limit. Ask for approval before `refresh`. A check-only request, |
| 62 | missing approval, ambiguous source, foreign marketplace, or unverified active package stops without mutation. |
| 63 | |
| 64 | ### 05: Refresh through the Codex CLI |
| 65 | |
| 66 | After approval, use only commands confirmed by authoritative help: |
| 67 | |
| 68 | ```bash |
| 69 | codex plugin marketplace add Borda/AI-Rig |
| 70 | # Optional reproducible release pin: |
| 71 | # codex plugin marketplace add Borda/AI-Rig --ref codex-rig-v0.3.0 |
| 72 | codex plugin marketplace upgrade borda-ai-rig |
| 73 | codex plugin add codex-rig@borda-ai-rig |
| 74 | ``` |
| 75 | |
| 76 | Omitting `--ref` follows the remote default branch. An explicit ref pins it. Do not silently change an existing |
| 77 | marketplace between pinned and unpinned modes: report the mismatch and require legacy shim cleanup before deliberate |
| 78 | marketplace removal and re-addition. Do not use `git clone`, edit marketplace configuration, delete old cache |
| 79 | directories, or force an update. A failed refresh must preserve and report the prior installation state; never claim |
| 80 | rollback unless the CLI evidence proves it. |
| 81 | |
| 82 | ### 06: Recheck exact active identity |
| 83 | |
| 84 | Repeat the read-only inspection and package validation. Pass only when exactly one enabled selection is reported and |
| 85 | its manifest plus all recorded payload hashes agree. Record requested/configured ref, resolved revision when |
| 86 | available, old/new version, and package-manifest hashes. Same version with different package bytes is a cache-identity |
| 87 | failure. |
| 88 | |
| 89 | ### 07: Write the validated artifact |
| 90 | |
| 91 | Follow `../../shared/helper-cli-contract.md`. Write `SYNC_METADATA`, gate logs, `state-before.json`, |
| 92 | `proposed-actions.json`, and, for refresh, `state-after.json`. Promote only the candidate accepted by the shared |
| 93 | validator. |
| 94 | |
| 95 | ## Fail-Fast Rules |
| 96 | |
| 97 | 1. Unknown marketplace/plugin identifier => fail before comman |