grayhatdevelopers · tulayha · Aug 7, 2026 · Aug 7, 2026 · Aug 7, 2026 · Aug 7, 2026
diff --git a/.agents/plugins/marketplace.json b/.agents/plugins/marketplace.json
@@ -0,0 +1,20 @@
+{
+  "name": "vidxp",
+  "interface": {
+    "displayName": "VidXP"
+  },
+  "plugins": [
+    {
+      "name": "vidxp",
+      "source": {
+        "source": "local",
+        "path": "./plugins/vidxp"
+      },
+      "policy": {
+        "installation": "AVAILABLE",
+        "authentication": "ON_INSTALL"
+      },
+      "category": "Productivity"
+    }
+  ]
+}
diff --git a/.github/workflows/desktop.yml b/.github/workflows/desktop.yml
@@ -22,6 +22,11 @@ on:
         required: false
         default: ""
         type: string
+      plugin_marketplace_ref:
+        description: Git ref for release builds; empty keeps a local marketplace.
+        required: false
+        default: ""
+        type: string
   workflow_dispatch:
     inputs:
       checkout_ref:
@@ -44,6 +49,11 @@ on:
         required: false
         default: ""
         type: string
+      plugin_marketplace_ref:
+        description: Git ref for release builds; empty keeps a local marketplace.
+        required: false
+        default: ""
+        type: string
 permissions:
   contents: read
 
@@ -179,6 +189,7 @@ jobs:
         working-directory: desktop
         env:
           VIDXP_DESKTOP_SIGN: ${{ (runner.os == 'macOS' && inputs.sign) && '1' || '' }}
+          VIDXP_PLUGIN_MARKETPLACE_REF: ${{ inputs.plugin_marketplace_ref }}
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
           APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
           APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}

diff --git a/.github/workflows/release-candidate.yml b/.github/workflows/release-candidate.yml
@@ -114,6 +114,7 @@ jobs:
       artifact_retention_days: 30
       checkout_ref: ${{ inputs.head_sha }}
       package_artifact_name: vidxp-python-dist
+      plugin_marketplace_ref: ${{ inputs.target_branch }}
       sign: true
     secrets: inherit
 

diff --git a/Dockerfile b/Dockerfile
@@ -37,6 +37,7 @@ FROM python:3.14-slim-trixie AS runtime-base
 LABEL org.opencontainers.image.title="VidXP" \
     org.opencontainers.image.description="Video indexing and search" \
     org.opencontainers.image.source="https://github.com/grayhatdevelopers/vidxp" \
+    org.opencontainers.image.vendor="Grayhat Developers PVT Ltd" \
     org.opencontainers.image.licenses="MIT"
 
 RUN apt-get update && apt-get install -y --no-install-recommends \

diff --git a/LICENSE b/LICENSE
@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Grayhat Developers
+Copyright (c) 2026 Grayhat Developers PVT Ltd
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

diff --git a/MANIFEST.in b/MANIFEST.in
@@ -4,9 +4,7 @@ include docs/images/logo.png
 recursive-include src/vidxp/assets/upload_page *
 recursive-include src/vidxp/assets/artifact_download *
 recursive-include src/vidxp/assets/mcp_app *
-include src/vidxp/bundled_plugins/vidxp/.mcp.json
-include src/vidxp/bundled_plugins/vidxp/.codex-plugin/plugin.json
-recursive-include src/vidxp/bundled_plugins/vidxp/skills *
+recursive-include plugins/vidxp *
 include web/upload-page/package.json
 include web/upload-page/package-lock.json
 include web/upload-page/scripts/build.mjs

diff --git a/README.md b/README.md
@@ -159,20 +159,26 @@ questions about a library, and return inspectable evidence such as boards,
 frames, and clips. Clients can connect locally over stdio or to a self-hosted
 VidXP server.
 
-### ChatGPT and Codex skills
+### Codex plugin and skills
 
-VidXP includes reusable skill source folders for the two common agent workflows:
+VidXP is distributed as a Codex plugin through a Git marketplace hosted in
+this GitHub repository. It includes three reusable agent workflows:
 
-- [Ingest and index videos](skills/vidxp-ingest-video/SKILL.md)
-- [Find moments and return inspectable evidence](skills/vidxp-find-video-evidence/SKILL.md)
+- [Install Desktop or CLI and connect Codex](plugins/vidxp/skills/vidxp-install/SKILL.md)
+- [Ingest and index videos](plugins/vidxp/skills/vidxp-ingest-video/SKILL.md)
+- [Find moments and return inspectable evidence](plugins/vidxp/skills/vidxp-find-video-evidence/SKILL.md)
 
-Download a skill folder directly, or install the versioned VidXP plugin bundle
-shipped inside the Python package. The plugin keeps both skills and the local
-`vidxp-mcp` server definition together. Its MCP App resource also gives
-compatible hosts an interactive upload and evidence-review view; every workflow
-continues to work through ordinary MCP tool results when a host has no UI.
-When the MCP feature is installed, VidXP Desktop can configure another MCP
-client or install the complete local plugin directly into Codex.
+Paste this into Codex:
+
+```text
+Add https://github.com/grayhatdevelopers/vidxp as a Git plugin marketplace, install the VidXP plugin, then use its $vidxp-install skill to set up VidXP on this computer.
+```
+
+VidXP Desktop can perform the same setup from its **Set up in Codex** button.
+
+The MCP App resource gives compatible hosts an interactive upload and
+evidence-review view; every workflow continues to work through ordinary MCP
+tool results when a host has no UI.
 
 - [Python, HTTP, and MCP installation](INSTALLATION_GUIDE.md)
 - [ChatGPT and Codex plugin integration](docs/integrations/openai-plugin.md)
@@ -240,14 +246,14 @@ Contributions are welcome. Read the
 
 ## Credits
 
-Built by Grayhat Developers PVT Ltd. and maintained by the community.
+Built by [Grayhat](https://grayhat.studio/) and maintained by the community.
 Originally researched by students:
 - [Abdullah Mansoor](https://github.com/abdullahmansoor321)
 - [Muhammad Haroon](https://github.com/haroon10725)
 - [Sarah Jawaid](https://github.com/sarr266)
 - [Talha Ahmed](https://github.com/talhaahmed1234)
 
-Working with [Dr Shahab Tahzeeb](https://scholar.google.com/citations?user=cryeRB0AAAAJ&hl=en) ([NED University of Engineering and Technology](https://www.neduet.edu.pk/)) and [Saad Bazaz](https://scholar.google.com/citations?user=mrJo09oAAAAJ&hl=en) ([Grayhat](https://grayhat.studio)).
+Working with [Dr Shahab Tahzeeb](https://scholar.google.com/citations?user=cryeRB0AAAAJ&hl=en) ([NED University of Engineering and Technology](https://www.neduet.edu.pk/)) and [Saad Bazaz](https://scholar.google.com/citations?user=mrJo09oAAAAJ&hl=en) ([Grayhat](https://grayhat.studio/)).
 
 Email: info@grayhat.studio
 

diff --git a/desktop/THIRD_PARTY_NOTICES.txt b/desktop/THIRD_PARTY_NOTICES.txt
@@ -9,7 +9,7 @@ VidXP Desktop and VidXP | MIT | https://github.com/grayhatdevelopers/vidxp
 
 MIT License
 
-Copyright (c) 2026 Grayhat Developers
+Copyright (c) 2026 Grayhat Developers PVT Ltd
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

diff --git a/desktop/package.json b/desktop/package.json
@@ -17,7 +17,7 @@
     "model-catalog:check": "uv run --frozen python scripts/model-catalog.py --check",
     "tauri": "tauri",
     "sync:branding": "node scripts/sync-branding.mjs",
-    "icons": "npm run sync:branding && tauri icon ../docs/images/logo.png --output src-tauri/icons",
+    "icons": "tauri icon ../docs/images/logo.png --output src-tauri/icons && npm run sync:branding",
     "predesktop:dev": "npm run sync:branding",
     "desktop:dev": "tauri dev",
     "predesktop:build": "npm run icons",

diff --git a/desktop/scripts/sync-branding.mjs b/desktop/scripts/sync-branding.mjs
@@ -6,7 +6,15 @@ const desktopRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const source = resolve(desktopRoot, "../docs/images/logo.png");
 const publicDirectory = resolve(desktopRoot, "public");
 const favicon = resolve(publicDirectory, "icon.png");
+const pluginLogo = resolve(desktopRoot, "../plugins/vidxp/assets/logo.png");
+const artifactLogo = resolve(
+  desktopRoot,
+  "../src/vidxp/assets/artifact_download/vidxp-logo.png",
+);
+const generatedIcon = resolve(desktopRoot, "src-tauri/icons/128x128.png");
 
 mkdirSync(publicDirectory, { recursive: true });
 copyFileSync(source, favicon);
-console.log("Synced the VidXP desktop favicon from the shared icon.");
+copyFileSync(source, pluginLogo);
+copyFileSync(generatedIcon, artifactLogo);
+console.log("Synced VidXP branding from docs/images/logo.png.");
diff --git a/desktop/src-tauri/src/lib.rs b/desktop/src-tauri/src/lib.rs
@@ -51,6 +51,8 @@ const RUNTIME_PACKAGE_WHEEL_NAME: &str =
 const RUNTIME_PACKAGE_WHEEL_SHA256: &str =
     include_str!(concat!(env!("OUT_DIR"), "/runtime-package-sha256.txt"));
 const MODEL_CACHE_CATALOG_BYTES: &[u8] = include_bytes!("../../model-cache-catalog.json");
+const CODEX_PLUGIN_MARKETPLACE_SOURCE: &str = "grayhatdevelopers/vidxp";
+const CODEX_PLUGIN_MARKETPLACE_REF: Option<&str> = option_env!("VIDXP_PLUGIN_MARKETPLACE_REF");
 const PRODUCT_DATA_DIRECTORY_NAME: &str = "VidXP";
 const RUNTIME_CONSTRAINTS_FILE_NAME: &str = "runtime-constraints.txt";
 const MAX_SETUP_OUTPUT_BYTES: usize = 4 * 1024 * 1024;
@@ -3693,11 +3695,25 @@ async fn install_codex_plugin(
                 installer_path.display()
             ));
         }
-        let marketplace_root = paths.private_data.join("codex-marketplace");
         let mut command = target_command(&profile, &paths, &installer_path);
+        if let Some(marketplace_ref) =
+            CODEX_PLUGIN_MARKETPLACE_REF.filter(|value| !value.is_empty())
+        {
+            command
+                .arg("--marketplace-source")
+                .arg(CODEX_PLUGIN_MARKETPLACE_SOURCE)
+                .arg("--marketplace-ref")
+                .arg(marketplace_ref)
+                .arg("--marketplace-sparse")
+                .arg(".agents/plugins")
+                .arg("--marketplace-sparse")
+                .arg("plugins/vidxp");
+        } else {
+            command
+                .arg("--marketplace-root")
+                .arg(paths.private_data.join("codex-marketplace"));
+        }
         command
-            .arg("--marketplace-root")
-            .arg(&marketplace_root)
             .arg("--repository")
             .arg("default")
             .arg("--index-directory")

diff --git a/desktop/src-tauri/tauri.conf.json b/desktop/src-tauri/tauri.conf.json
@@ -34,6 +34,8 @@
   "bundle": {
     "active": true,
     "targets": "all",
+    "publisher": "Grayhat Developers PVT Ltd",
+    "copyright": "Copyright © 2026 Grayhat Developers PVT Ltd",
     "resources": [
       "../THIRD_PARTY_NOTICES.txt",
       "../../LICENSE"

diff --git a/docs/desktop.md b/docs/desktop.md
@@ -188,17 +188,17 @@ action, and **Quit VidXP** runs supervised shutdown for the interface and any
 Desktop-owned repository worker. The active-target panel also reports and
 controls local video processing through the existing `JobService` worker
 lifecycle, reports the app integration service, creates copyable AI-assistant
-MCP config, installs the bundled MCP-and-skills plugin directly into Codex, and
+MCP config, installs the VidXP plugin and local MCP server into Codex, and
 presents the existing doctor result as product health rather than raw output.
-Codex setup exports a target-specific copy of the plugin from the selected
-VidXP runtime into a dedicated Desktop-private `vidxp-local` marketplace. The
-copy keeps the versioned skills but replaces its generic MCP command with the
-selected runtime's absolute executable, repository, and data paths. Desktop
-then uses `codex plugin marketplace add --json` and
-`codex plugin add vidxp@vidxp-local --json`; it never edits Codex configuration
-or the user's personal marketplace by hand. Re-running setup refreshes the
-managed bundle using a deterministic plugin-version cache key. A new Codex chat
-is required before the refreshed skills and tools are available.
+Release builds add the repository's Git marketplace from `main` for beta or
+`release` for stable, then install `vidxp@vidxp`. Development and pull-request
+builds export the packaged plugin to a dedicated Desktop-private
+`vidxp-local` marketplace. Desktop uses the supported Codex CLI commands to
+register the marketplace, plugin, and selected runtime's absolute `vidxp-mcp`
+command with its repository and data paths. Re-running setup refreshes these
+registrations; a successful release setup removes the obsolete local
+marketplace. A new Codex task is required before refreshed skills and tools are
+available.
 The browser and app integration service remain loopback-only by default.
 Explicit sharing controls compose their existing `--share` modes: browser
 sharing reports its LAN URL and warns that it is unauthenticated, while API/MCP

diff --git a/docs/integrations/openai-plugin.md b/docs/integrations/openai-plugin.md
@@ -1,44 +1,61 @@
 # ChatGPT and Codex plugin integration
 
-VidXP ships one versioned plugin bundle with its Python distribution. The
-bundle combines the local MCP server definition with VidXP's canonical ingest
-and evidence-search skills, while the MCP server exposes an optional interactive
-view for hosts that implement MCP Apps.
+VidXP ships one versioned plugin from this repository. It provides the install,
+ingest, and evidence-search skills, while an installed VidXP runtime provides
+the local MCP server and its optional interactive MCP App view.
 
-The packaged bundle lives at
-`src/vidxp/bundled_plugins/vidxp/` and contains:
+The sole editable plugin source lives at `plugins/vidxp/` and contains:
 
 - `.codex-plugin/plugin.json`, the plugin manifest;
-- `.mcp.json`, which starts the installed `vidxp-mcp` command; and
-- `skills/`, a release snapshot of the canonical root `skills/` folders.
+- `assets/logo.png`, used for the plugin logo and composer icon; and
+- `skills/`, the canonical install, ingest, and evidence workflows.
 
-The root skill folders remain the authoring source. Packaging tests require the
-bundled snapshot to match their file inventory and text exactly, and Release
-Please keeps the plugin manifest version aligned with the Python package.
+The repository marketplace is declared at `.agents/plugins/marketplace.json`.
+Other product code in the repository does not affect the marketplace: Codex
+reads only that manifest and the plugin path it declares. In a repository
+checkout the marketplace is discoverable as an available local marketplace; it
+is not installed merely because the repository was opened. Packaging copies
+the canonical plugin into the Python wheel at build time, and Release Please
+keeps its manifest version aligned with the Python package.
 
 ## Install in Codex
 
+### Ask Codex to install it
+
+```text
+Add https://github.com/grayhatdevelopers/vidxp as a Git plugin marketplace, install the VidXP plugin, then use its $vidxp-install skill to set up VidXP on this computer.
+```
+
+### VidXP Desktop button
+
 With **AI assistant integration** enabled, VidXP Desktop shows two distinct
 actions:
 
-- **Set up in Codex** exports a target-specific copy of this bundle to a
-  Desktop-managed `vidxp-local` marketplace, registers that marketplace through
-  the Codex CLI, and installs the plugin. The generated `.mcp.json` pins the
-  selected installation's absolute `vidxp-mcp` command, repository, and data
-  paths, so Codex does not depend on its process `PATH`.
+- **Set up in Codex** installs the plugin and registers the selected
+  installation's absolute `vidxp-mcp` command, repository, and data paths, so
+  Codex does not depend on its process `PATH`.
 - **Copy MCP setup** retains the transport-only JSON flow for other compatible
   local MCP clients.
 
-The Codex action installs the MCP server and both skills as one unit. It uses
-the documented JSON forms of `codex plugin marketplace add` and
-`codex plugin add`, leaves personal marketplace files and `config.toml`
-untouched, and asks the user to start a new Codex chat after installation. The
-exported marketplace lives in VidXP Desktop's private application-data
-directory. Its catalog is written to the Codex marketplace contract at
-`.agents/plugins/marketplace.json`, with the plugin at `plugins/vidxp/`. The
-exporter also removes the obsolete root-level `marketplace.json` from earlier
-VidXP-managed exports. The canonical distributable bundle remains checked into
-this repository and packaged in every VidXP wheel.
+Signed beta builds register `grayhatdevelopers/vidxp` at `main`; signed stable
+builds use `release`. Both use sparse checkout for `.agents/plugins` and
+`plugins/vidxp`, so unrelated repository content is not downloaded into the
+plugin cache. Development and pull-request builds export the packaged plugin to
+the Desktop-private `vidxp-local` marketplace instead. The action uses the
+documented `codex plugin marketplace add`, `codex plugin add`, and
+`codex mcp add` commands. A successful Git install removes the obsolete managed
+`vidxp-local` registration. Start a new Codex task after setup.
+
+### Manual fallback
+
+If an agent does not have an authorized local shell, add the beta marketplace
+manually with:
+
+```text
+codex plugin marketplace add grayhatdevelopers/vidxp --ref main \
+  --sparse .agents/plugins --sparse plugins/vidxp
+codex plugin add vidxp@vidxp
+```
 
 ## Interactive MCP App
 
@@ -66,8 +83,9 @@ only exact HTTPS origins if future component assets or requests require them.
 
 ## Connect ChatGPT
 
-The bundled `.mcp.json` is for local plugin hosts. A ChatGPT connection still
-requires a publicly reachable Streamable HTTP endpoint (VidXP serves `/mcp`),
+The Git marketplace described above is for Codex's local plugin system. A
+ChatGPT connection still requires a publicly reachable Streamable HTTP endpoint
+(VidXP serves `/mcp`),
 an HTTPS deployment or secure development tunnel, and registration in ChatGPT
 Developer Mode.
 

diff --git a/...d_plugins/vidxp/.codex-plugin/plugin.json → plugins/vidxp/.codex-plugin/plugin.json b/...d_plugins/vidxp/.codex-plugin/plugin.json → plugins/vidxp/.codex-plugin/plugin.json
@@ -3,7 +3,8 @@
   "version": "0.4.0-b.3",
   "description": "Ingest, index, search, and inspect video evidence with VidXP.",
   "author": {
-    "name": "Grayhat"
+    "name": "Grayhat",
+    "url": "https://grayhat.studio/"
   },
   "homepage": "https://github.com/grayhatdevelopers/vidxp",
   "repository": "https://github.com/grayhatdevelopers/vidxp",
@@ -17,12 +18,15 @@
     "developerName": "Grayhat",
     "category": "Productivity",
     "capabilities": ["Read", "Write", "Interactive"],
-    "websiteURL": "https://github.com/grayhatdevelopers/vidxp",
+    "websiteURL": "https://grayhat.studio/",
     "defaultPrompt": [
       "Find and verify moments in my indexed videos.",
+      "Set up VidXP on this computer.",
       "Ingest and index a video with VidXP."
     ],
-    "brandColor": "#6D5EF7"
-  },
-  "mcpServers": "./.mcp.json"
+    "brandColor": "#6D5EF7",
+    "composerIcon": "./assets/logo.png",
+    "logo": "./assets/logo.png",
+    "logoDark": "./assets/logo.png"
+  }
 }
diff --git a/plugins/vidxp/assets/logo.png b/plugins/vidxp/assets/logo.png
diff --git a/skills/vidxp-find-video-evidence/SKILL.md → ...skills/vidxp-find-video-evidence/SKILL.md b/skills/vidxp-find-video-evidence/SKILL.md → ...skills/vidxp-find-video-evidence/SKILL.md
diff --git a/...xp-find-video-evidence/agents/openai.yaml → ...xp-find-video-evidence/agents/openai.yaml b/...xp-find-video-evidence/agents/openai.yaml → ...xp-find-video-evidence/agents/openai.yaml
diff --git a/skills/vidxp-ingest-video/SKILL.md → .../vidxp/skills/vidxp-ingest-video/SKILL.md b/skills/vidxp-ingest-video/SKILL.md → .../vidxp/skills/vidxp-ingest-video/SKILL.md
diff --git a/skills/vidxp-ingest-video/agents/openai.yaml → ...lls/vidxp-ingest-video/agents/openai.yaml b/skills/vidxp-ingest-video/agents/openai.yaml → ...lls/vidxp-ingest-video/agents/openai.yaml