feat: refkit agent plugin for Claude Code and Codex

[MyPrototypeWhat]

What ships

refkit as one agent plugin, installable in Claude Code and Codex from this repository's own marketplace:

claude plugin marketplace add refkitjs/refkit
claude plugin install refkit@refkit

• plugins/refkit/
  • Claude manifest and Codex manifest.
  • One shared .mcp.json that launches npx -y @refkit/mcp@0.8.2, pinned to an exact version as Anthropic's directory requires.
  • Two skills:
    • find-references: works out the intended use, chooses between annotating and filtering (intent vs gateFor), shapes the query, and presents verdicts honestly.
    • check-usage-rights: takes license facts and returns a verdict and a credit line.
  • A README that discloses what the plugin runs and contacts.
• Marketplace catalogs: .claude-plugin/marketplace.json for Claude Code and .agents/plugins/marketplace.json for Codex.
• scripts/sync-plugin-version.mjs, run by version-packages after changeset version. It keeps the plugin's pin and version equal to @refkit/mcp's version, so the Version Packages PR carries the bump.
• Tests in the mcp vitest project (plugin-manifest, sync-plugin-version):
  • Lockstep between the pin, both manifest versions and @refkit/mcp.
  • Manifest and catalog consistency.
  • No lockfile or symlinks in the plugin folder.
  • Skill front matter.
  • Every tool parameter the skills teach exists in the live tool schemas.
  • Skill and README claims are checked against the live server: which licenses need no credit, editorial-only → denied, which resource kinds exist, which key env vars are read.

The spec and plan are in docs/superpowers/. This PR changes no @refkit/mcp runtime code, so it has no changeset.

Verification

• pnpm typecheck && pnpm lint && pnpm build && pnpm test:run: 551 passed, 23 skipped.
• claude plugin validate --strict plugins/refkit and claude plugin validate . both pass.
• Local marketplace install: claude plugin details refkit shows Skills (2) and MCP servers (1). claude mcp list shows plugin:refkit:refkit: npx -y @refkit/mcp@0.8.2 - ✔ Connected.
• Headless claude -p --plugin-dir plugins/refkit:
  • "CC0 forest textures I can ship in a commercial game" triggers find-references. It calls search_references with gateFor: commercial-product on Poly Haven and ambientCG and answers with CC0 textures and links.
  • An HDRI request triggers the skill. It says no HDRIs are available and offers alternatives.
  • "Can I use lodash (MIT) in a commercial app?" triggers no skill and no refkit tool.
• Cold npx start measured at 7.6 s and warm at 2.0 s, against Codex's 10 s default startup timeout.
• Codex: untested. Nobody with a Codex account has tried it yet. Codex support follows OpenAI's documented plugin format (the same shape superpowers ships), and both READMEs say it is untested. If the Codex manifest shape turns out wrong, only a manifest edit is needed.

Follow-ups (not in this PR)

• Phase 2: submit plugins/refkit to Anthropic's directory at claude.ai/directory/manage. The submission adds icon and the other listing fields, and expects the pinned-npx reviewer hold.
• BYOK through the plugin (userConfig): deferred. The spec records what it needs: a Codex-specific MCP config, and changing ?? to || in cli.ts.
• @refkit/mcp runtime: for unknown/proprietary, build_attribution says "No attribution required" (the skill works around this). Search annotations also ignore gateContext.userJurisdiction. Both are tracked as a separate task.