diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 000000000..5f29f5167
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,4 @@
+# The plugin manifests are merged with the driver "fork-manifest", which the upstream sync job
+# configures: the result is upstream's file without the version fields (.github/upstream-sync/README.md).
+plugins/codex/.claude-plugin/plugin.json merge=fork-manifest
+.claude-plugin/marketplace.json merge=fork-manifest
diff --git a/.github/upstream-sync/README.md b/.github/upstream-sync/README.md
new file mode 100644
index 000000000..5ee2b52b9
--- /dev/null
+++ b/.github/upstream-sync/README.md
@@ -0,0 +1,72 @@
+# Upstream sync
+
+This fork takes the changes of its upstream, [Crazytieguy/codex-plugin-cc](https://github.com/Crazytieguy/codex-plugin-cc), automatically, but only once they are at least 7 days old. The delay is a defense against supply-chain attacks: every machine that installs the plugin updates itself from this fork's `main`, so a malicious commit pushed to upstream should have a week to be noticed and removed before it gets here. The rule is the one package managers use for a minimum release age, such as npm's `min-release-age` or uv's `exclude-newer`: take the newest version that upstream has had for at least 7 days.
+
+## What the job does
+
+The workflow `.github/workflows/upstream-sync.yml` runs `sync.sh` once a day. Each run:
+
+1. Fetches upstream's `main`, this fork's `main`, and the branch `upstream-sync-state`. That branch holds `seen.tsv`, a log of upstream's head with one row per change (the full commit hash and the time the job saw it, in UTC), and `last_checked`, the time of the last run. The first run creates the branch.
+2. Adds a row to `seen.tsv` when upstream's head differs from the last row's commit, even if that commit is in an earlier row.
+3. Picks the newest row that is at least 7 days old and whose commit has stayed in upstream's history since: it is an ancestor of every later row's commit, the last of which is upstream's current head. Commit dates play no part, since anyone can backdate them.
+4. Merges nothing if GitHub's activity log of upstream's `main` shows a force-push or a deletion of `main` after that row's time.
+5. Merges nothing, and fails, if any upstream commit to merge touches `.github/` or `.gitattributes`, file modes and symbolic links included. The job's scripts, its workflow and its merge driver live there, so upstream can never change them.
+6. Otherwise merges the commit into `main`, with a merge commit that names it and the time of its row.
+7. Pushes `upstream-sync-state`, on every run, then `main` if it merged something.
+
+## How force-pushes are handled
+
+The job looks at upstream once a day, so `seen.tsv` shows upstream's head only at those times. A commit that a force-push removes from upstream is never merged, and a commit that comes back counts only from its new row. A removal and restore between two runs leaves no trace in `seen.tsv`; GitHub's activity log shows it, and step 4 then holds back every row logged before it. When the head after such a force-push is the same commit as the last row, the job logs it again, so it counts from that run.
+
+So after any force-push of upstream's `main`, nothing is merged until a head logged after it has been on upstream for 7 days. If an upstream commit waits more than 30 days, the job fails and says why.
+
+What the rule does not cover: a bad commit that upstream reverts instead of removing still reaches this fork's `main` 7 days after it appeared on upstream, and the revert follows 7 days after it appeared. Packages behave the same way: a bad version that is replaced by a newer one, but not withdrawn, is still installed once it is old enough.
+
+The job uses `git`, `jq` and `curl` (for GitHub's activity log), and no third-party actions. It never runs upstream code: step 5 keeps upstream from changing what the job runs.
+
+## Plugin versions
+
+Claude Code updates a plugin only when its version changes. Without a `version` field it uses the git commit, so each new commit of this fork counts as an update. The fork therefore keeps `version` deleted in `plugins/codex/.claude-plugin/plugin.json` and in the plugin entries of `.claude-plugin/marketplace.json`, while upstream changes the version in most commits.
+
+`.gitattributes` gives both files the merge driver `fork-manifest` (`fork-manifest.sh`), which `sync.sh` configures: where both sides changed the file, the result is upstream's file without the version fields. After each merge, `sync.sh` also deletes version fields that only upstream changed. Any other change this fork makes to these two files is replaced by upstream's next change to them.
+
+## When the job stops running
+
+GitHub turns off scheduled workflows in a public repository after 60 days without activity. The daily push to `upstream-sync-state` may count as activity; GitHub does not say. If GitHub turns the schedule off, it sends an email, the fork stays on the last upstream commit it merged, and this turns the schedule back on:
+
+```sh
+gh workflow enable upstream-sync.yml -R TruthfulAI-research/codex-plugin-cc
+```
+
+## When the job fails
+
+GitHub emails the person who last changed the workflow's schedule. The run's log says why the run failed and names the upstream commit. Only the 30-day alert can come from a run that also merged something; every other failed run leaves `main` as it was.
+
+- **Upstream changed `.github/` or `.gitattributes`.** Read the change first: merged workflows run in this repository, and this fork's sync files should stay as they are unless you mean to change them. Then merge by hand, as below, from a machine whose token may push workflow files (Johannes's laptop).
+- **The merge conflicts.** Merge by hand, as below.
+- **Upstream removed commits that this fork merged.** Upstream may have removed them because they were bad. Check them, and revert them in `main` if needed. The job fails on every run until their rows are deleted from `seen.tsv` on the branch `upstream-sync-state`; delete them once the commits are checked.
+- **An upstream commit has waited 30 days.** The log says what held it back, usually force-pushes on upstream. Check upstream; the job merges again once a head has been on upstream for 7 days without a force-push.
+- **GitHub's activity log could not be read.** Nothing was merged; the next run tries again.
+
+To merge by hand, merge the commit that the log names, not upstream's newer head: it is the one that has been on upstream for 7 days.
+
+```sh
+git clone https://github.com/TruthfulAI-research/codex-plugin-cc.git && cd codex-plugin-cc
+git config merge.fork-manifest.driver "bash '$PWD/.github/upstream-sync/fork-manifest.sh' %B %A %P"
+git fetch https://github.com/Crazytieguy/codex-plugin-cc.git main
+git merge --no-ff --no-commit <commit named in the log>
+# Resolve any conflicts, then delete the version fields that the merge driver did not:
+for f in plugins/codex/.claude-plugin/plugin.json .claude-plugin/marketplace.json; do
+  bash .github/upstream-sync/fork-manifest.sh "$f" "$f.new" "$f" && mv "$f.new" "$f" && git add "$f"
+done
+git commit
+git push origin main
+```
+
+The next run sees that the commit is in `main` and goes on from there.
+
+## Dry runs and tests
+
+- A pull request that changes the sync files runs `test.sh` and a dry run, which merges locally and pushes nothing. The dry run merges upstream's current candidate into the current `main`, so it can fail because of an upstream conflict that has nothing to do with the pull request.
+- A dry run by hand: `gh workflow run upstream-sync.yml -R TruthfulAI-research/codex-plugin-cc -f dry_run=true`, or `SYNC_DRY_RUN=1 bash .github/upstream-sync/sync.sh` locally.
+- `bash .github/upstream-sync/test.sh` tests `sync.sh` on scratch repos (a fake upstream and a fake fork, with the clock set by `SYNC_NOW`). It needs `git` and `jq`.
diff --git a/.github/upstream-sync/fork-manifest.sh b/.github/upstream-sync/fork-manifest.sh
new file mode 100755
index 000000000..b5c08b4e8
--- /dev/null
+++ b/.github/upstream-sync/fork-manifest.sh
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Writes a plugin manifest without its version fields: usage fork-manifest.sh <source> <destination> <repo path>.
+# Git runs it as the merge driver "fork-manifest" (see .gitattributes) with upstream's file as the source,
+# so the merge result is upstream's file without the version fields. sync.sh also runs it after each merge.
+# Without a version, Claude Code updates the plugin on every new commit of the fork.
+set -euo pipefail
+
+src=$1 dest=$2 path=$3
+if [ "$src" -ef "$dest" ]; then
+  echo "fork-manifest.sh: source and destination must be different files" >&2
+  exit 1
+fi
+
+case $path in
+  plugins/codex/.claude-plugin/plugin.json)
+    has_version='has("version")'
+    strip='del(.version)'
+    ;;
+  .claude-plugin/marketplace.json)
+    has_version='any(.plugins[]?; has("version"))'
+    strip='del(.plugins[]?.version)'
+    ;;
+  *)
+    echo "fork-manifest.sh: not a plugin manifest: $path" >&2
+    exit 1
+    ;;
+esac
+
+# Exits here on invalid JSON, which makes git report a conflict.
+has=$(jq "$has_version" "$src")
+if [ "$has" = true ]; then
+  jq "$strip" "$src" > "$dest"
+else
+  # Keep the file byte for byte when there is nothing to delete.
+  cat "$src" > "$dest"
+fi
diff --git a/.github/upstream-sync/sync.sh b/.github/upstream-sync/sync.sh
new file mode 100755
index 000000000..896536b22
--- /dev/null
+++ b/.github/upstream-sync/sync.sh
@@ -0,0 +1,285 @@
+#!/usr/bin/env bash
+# Merges upstream's main into this fork's main, but only commits that upstream's main has had for at
+# least 7 days, like a package manager's minimum release age. See README.md in this folder.
+#
+# Environment (all optional):
+#   SYNC_DRY_RUN=1     do everything locally, push nothing, print what would happen
+#   SYNC_TOKEN         token for pushing to the fork over HTTPS (the job's GITHUB_TOKEN)
+#   SYNC_NOW           the current time, as 2026-10-28T17:00:00Z (tests)
+#   SYNC_API_TOKEN     token for reading GitHub's activity log of upstream (read only)
+#   SYNC_ORIGIN_URL    the fork (default: this GitHub repository)
+#   SYNC_UPSTREAM_URL  upstream (default: Crazytieguy/codex-plugin-cc)
+#   SYNC_ACTIVITY_URL  GitHub's activity log of upstream (tests use a file:// URL)
+set -euo pipefail
+export LC_ALL=C
+
+here=$(cd "$(dirname "$0")" && pwd)
+origin_url=${SYNC_ORIGIN_URL:-https://github.com/${GITHUB_REPOSITORY:-TruthfulAI-research/codex-plugin-cc}.git}
+upstream_url=${SYNC_UPSTREAM_URL:-https://github.com/Crazytieguy/codex-plugin-cc.git}
+activity_url=${SYNC_ACTIVITY_URL:-https://api.github.com/repos/Crazytieguy/codex-plugin-cc/activity}
+state_branch=upstream-sync-state
+min_age_days=7
+stall_days=30
+manifests="plugins/codex/.claude-plugin/plugin.json .claude-plugin/marketplace.json"
+tab=$(printf '\t')
+time_re='^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$'
+
+die() {
+  if [ "${GITHUB_ACTIONS:-}" = true ]; then echo "::error::$*"; else echo "error: $*" >&2; fi
+  exit 1
+}
+
+command -v jq > /dev/null || die "jq is not installed"
+
+case ${SYNC_DRY_RUN:-0} in
+  1 | true) dry_run=1 ;;
+  0 | false | '') dry_run=0 ;;
+  *) die "SYNC_DRY_RUN must be 0 or 1" ;;
+esac
+
+now=${SYNC_NOW:-$(date -u +%Y-%m-%dT%H:%M:%SZ)}
+[[ $now =~ $time_re ]] || die "SYNC_NOW must look like 2026-10-28T17:00:00Z, not $now"
+# Times in this format compare correctly as strings.
+days_before() { jq -nr --arg now "$now" --argjson days "$1" '$now | fromdateiso8601 - $days * 86400 | todate'; }
+cutoff=$(days_before "$min_age_days")
+stall_cutoff=$(days_before "$stall_days")
+
+work=$(mktemp -d "${RUNNER_TEMP:-${TMPDIR:-/tmp}}/upstream-sync.XXXXXX")
+trap 'rm -rf "$work"' EXIT
+git init -q -b sync "$work/repo"
+cd "$work/repo"
+if [ "${GITHUB_ACTIONS:-}" = true ]; then
+  git config user.name 'github-actions[bot]'
+  git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+fi
+git config merge.fork-manifest.name 'upstream manifest without version fields'
+git config merge.fork-manifest.driver "bash '$here/fork-manifest.sh' %B %A %P"
+
+if [ -n "${SYNC_TOKEN:-}" ]; then
+  auth=$(printf 'x-access-token:%s' "$SYNC_TOKEN" | base64 | tr -d '\n')
+  if [ "${GITHUB_ACTIONS:-}" = true ]; then echo "::add-mask::$auth"; fi
+  # The header goes only to the fork's URL, and through the environment, so the token is in no file.
+  export GIT_CONFIG_COUNT=1
+  export GIT_CONFIG_KEY_0="http.$origin_url.extraheader"
+  export GIT_CONFIG_VALUE_0="AUTHORIZATION: basic $auth"
+fi
+
+git remote add origin "$origin_url"
+git remote add upstream "$upstream_url"
+git fetch -q --no-tags upstream +refs/heads/main:refs/remotes/upstream/main
+git fetch -q --no-tags origin +refs/heads/main:refs/remotes/origin/main
+status=0
+git ls-remote --exit-code origin "refs/heads/$state_branch" > /dev/null || status=$?
+case $status in
+  0)
+    have_state=1
+    git fetch -q --no-tags origin "+refs/heads/$state_branch:refs/remotes/origin/$state_branch"
+    git show "refs/remotes/origin/$state_branch:seen.tsv" > "$work/seen.tsv"
+    ;;
+  2)
+    have_state=0
+    echo "The state branch $state_branch does not exist yet; this run creates it."
+    : > "$work/seen.tsv"
+    ;;
+  *) die "could not list the branches of $origin_url" ;;
+esac
+
+# seen.tsv is a log of upstream's head: a row whenever the head differs from the last row's commit,
+# even if that commit is in an earlier row. So the last row is upstream's current head.
+head=$(git rev-parse refs/remotes/upstream/main)
+last_row=$(tail -n 1 "$work/seen.tsv")
+if [ "${last_row%%"$tab"*}" = "$head" ]; then
+  echo "Upstream main is at $head, its head since ${last_row#*"$tab"}."
+else
+  printf '%s\t%s\n' "$head" "$now" >> "$work/seen.tsv"
+  echo "Upstream main is at $head, a new head as of now ($now)."
+fi
+
+if [ -s "$work/seen.tsv" ] && [ -n "$(tail -c 1 "$work/seen.tsv")" ]; then
+  die "seen.tsv on $state_branch does not end with a newline"
+fi
+if grep -Evq "^[0-9a-f]{40}${tab}[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z\$" "$work/seen.tsv"; then
+  die "seen.tsv on $state_branch has a malformed line"
+fi
+if ! awk -F "$tab" 'NR > 1 && $2 < previous { exit 1 } { previous = $2 }' "$work/seen.tsv"; then
+  die "seen.tsv on $state_branch is not in time order, or the clock is behind its last row"
+fi
+
+shas=() times=()
+while IFS="$tab" read -r sha time; do
+  shas+=("$sha")
+  times+=("$time")
+done < "$work/seen.tsv"
+
+# Commits that this fork merged and that upstream's main no longer has: upstream removed them after
+# the 7 days, which may mean that they were bad.
+removed=$(for sha in "${shas[@]}"; do
+  if git merge-base --is-ancestor "$sha" refs/remotes/origin/main 2> /dev/null &&
+    ! git merge-base --is-ancestor "$sha" refs/remotes/upstream/main 2> /dev/null; then
+    echo "$sha"
+  fi
+done | sort -u)
+
+# stayed <row>: whether the row's commit is an ancestor of every later row's commit, that is, stayed
+# in upstream's history without a break since that row. A later commit that is no longer on upstream
+# main is not fetched; it counts as a break.
+stayed() {
+  local j
+  for ((j = $1 + 1; j < ${#shas[@]}; j++)); do
+    git merge-base --is-ancestor "${shas[$1]}" "${shas[$j]}" 2> /dev/null || return 1
+  done
+}
+
+# The candidate: the newest row at least 7 days old whose commit stayed in upstream's history since.
+# A commit that left upstream's history and came back counts only from its new row. Commit dates
+# are never used: an attacker can backdate them.
+candidate='' candidate_seen=''
+for ((i = ${#shas[@]} - 1; i >= 0; i--)); do
+  if [[ ${times[$i]} > $cutoff ]]; then continue; fi
+  if stayed "$i"; then
+    candidate=${shas[$i]} candidate_seen=${times[$i]}
+    break
+  fi
+  echo "Skipping ${shas[$i]} (on upstream main at ${times[$i]}): not every later head is known to contain it."
+done
+
+# rewrites_since <time>: prints the force-pushes and deletions of upstream's main after <time> that
+# GitHub's activity log shows. A removal and restore between two runs leaves no trace in seen.tsv.
+# Fails when the log cannot be read.
+rewrites_since() {
+  local type
+  for type in force_push branch_deletion; do
+    if [ -n "${SYNC_API_TOKEN:-}" ]; then printf 'Authorization: Bearer %s\n' "$SYNC_API_TOKEN"; fi |
+      curl -fsS --max-time 60 -H @- -H 'Accept: application/vnd.github+json' -H 'X-GitHub-Api-Version: 2022-11-28' \
+        "$activity_url?ref=refs/heads/main&activity_type=$type&direction=desc&per_page=100" > "$work/activity-$type.json" ||
+      return 1
+  done
+  # The newest 100 of each type, newest first, are enough: one after <time> is all it takes.
+  jq -nr --arg since "$1" '
+    [inputs | if type == "array" then .[] else error("the activity log is not a list") end
+      | select(.ref == "refs/heads/main" and (.activity_type == "force_push" or .activity_type == "branch_deletion"))
+      | if (.timestamp | type) == "string" and (.timestamp | test("^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$")) then .
+        else error("an activity has no valid timestamp") end
+      | select(.timestamp > $since) | "\(.timestamp) \(.activity_type)"]
+    | unique[]' "$work/activity-force_push.json" "$work/activity-branch_deletion.json"
+}
+
+merged=0 failure='' outcome=''
+if [ -n "$removed" ]; then
+  echo "Upstream's main no longer has these commits, which this fork's main has merged:"
+  echo "$removed"
+  failure="upstream removed from its main commits that this fork merged ($(printf '%s' "$removed" | tr '\n' ' ')); they may be bad. Nothing was merged. See .github/upstream-sync/README.md."
+elif [ -z "$candidate" ]; then
+  outcome="no commit has been on upstream main for 7 days without a break."
+  echo "Nothing to merge: $outcome"
+elif git merge-base --is-ancestor "$candidate" refs/remotes/origin/main; then
+  outcome="the newest commit that has been on upstream main for 7 days without a break, $candidate, is already in main."
+  echo "Nothing to merge: $outcome"
+elif ! rewrites=$(rewrites_since "$candidate_seen"); then
+  failure="could not read GitHub's activity log of upstream's main; nothing was merged."
+elif [ -n "$rewrites" ]; then
+  outcome="upstream's main was force-pushed or deleted after $candidate_seen, when $candidate was logged."
+  echo "Nothing to merge: $outcome"
+  echo "$rewrites"
+  echo "A head logged after that can be merged once it has been on upstream main for 7 days."
+  # If the head is still the last row's commit, log it again, so that it counts from now.
+  latest=${rewrites##*$'\n'}
+  if [[ ${latest%% *} > ${times[${#times[@]} - 1]} ]]; then
+    printf '%s\t%s\n' "$head" "$now" >> "$work/seen.tsv"
+    echo "Logged upstream's head $head again, as of now."
+  fi
+else
+  # Upstream must never change this job (its scripts, workflow or merge driver), so commits that touch
+  # .github/ or .gitattributes, including modes and symlinks, are merged only by hand.
+  protected=$(git log --format='%h %s' --full-history "refs/remotes/origin/main..$candidate" -- .github .gitattributes)
+  if [ -n "$protected" ]; then
+    echo "These upstream commits change .github/ or .gitattributes, which the job never merges:"
+    echo "$protected"
+    failure="upstream commit $candidate changes .github/ or .gitattributes; main was not changed. Merge by hand from a machine whose token may push workflow files: see .github/upstream-sync/README.md."
+  else
+    echo "Merging $candidate (on upstream main since $candidate_seen). Upstream commits it brings:"
+    git log --oneline --no-decorate "refs/remotes/origin/main..$candidate"
+    git checkout -q --detach refs/remotes/origin/main
+    if ! git merge -q --no-ff --no-commit "$candidate"; then
+      echo "The merge conflicts in:"
+      git diff --name-only --diff-filter=U
+      failure="merging upstream commit $candidate into main conflicts; main was not changed. Merge by hand: see .github/upstream-sync/README.md."
+    elif ! git diff --cached --quiet refs/remotes/origin/main -- .github .gitattributes; then
+      # A second check on the result, in case the history check above missed a path.
+      failure="merging upstream commit $candidate would change .github/ or .gitattributes; main was not changed. Merge by hand from a machine whose token may push workflow files: see .github/upstream-sync/README.md."
+    else
+      # The merge driver runs only where both sides changed a manifest. This also deletes version
+      # fields that only upstream added or changed.
+      for path in $manifests; do
+        if [ -f "$path" ]; then
+          bash "$here/fork-manifest.sh" "$path" "$work/manifest" "$path"
+          if ! cmp -s "$work/manifest" "$path"; then
+            cp "$work/manifest" "$path"
+            git add "$path"
+            echo "Deleted the version fields in $path."
+          fi
+        fi
+      done
+      {
+        echo "Merge upstream commit ${candidate:0:12}"
+        echo
+        echo "Upstream: $upstream_url"
+        echo "Commit: $candidate"
+        echo "On upstream main since: $candidate_seen"
+        echo
+        echo "Merged by the upstream sync job, which merges an upstream commit only once it has"
+        echo "been on upstream main for 7 days (.github/upstream-sync/README.md)."
+      } > "$work/message"
+      git commit -q --no-verify -F "$work/message"
+      merged=1
+      outcome="merged $candidate."
+    fi
+  fi
+fi
+
+# A stall: upstream's main has had a commit for 30 days that main still lacks.
+synced=refs/remotes/origin/main
+if [ "$merged" = 1 ]; then synced=HEAD; fi
+stall=''
+for ((i = 0; i < ${#shas[@]}; i++)); do
+  if [[ ${times[$i]} > $stall_cutoff ]]; then break; fi
+  if git merge-base --is-ancestor "${shas[$i]}" refs/remotes/upstream/main 2> /dev/null &&
+    ! git merge-base --is-ancestor "${shas[$i]}" "$synced"; then
+    stall="the job has not been able to merge upstream commit ${shas[$i]}, logged at ${times[$i]}, for $stall_days days. This run: $outcome See .github/upstream-sync/README.md."
+    break
+  fi
+done
+
+printf '%s\n' "$now" > "$work/last_checked"
+seen_blob=$(git hash-object -w "$work/seen.tsv")
+checked_blob=$(git hash-object -w "$work/last_checked")
+tree=$(printf '100644 blob %s\tlast_checked\n100644 blob %s\tseen.tsv\n' "$checked_blob" "$seen_blob" | git mktree)
+message="Upstream sync check at $now (upstream main $head)"
+if [ "$have_state" = 1 ]; then
+  state_commit=$(git commit-tree "$tree" -p "refs/remotes/origin/$state_branch" -m "$message")
+else
+  state_commit=$(git commit-tree "$tree" -m "$message")
+fi
+
+if [ "$dry_run" = 1 ]; then
+  echo "Dry run: would push $state_branch (last_checked $now)."
+else
+  git push -q origin "$state_commit:refs/heads/$state_branch"
+  echo "Pushed $state_branch (last_checked $now)."
+fi
+
+if [ -n "$failure" ]; then
+  die "$failure"
+fi
+if [ "$merged" = 1 ]; then
+  if [ "$dry_run" = 1 ]; then
+    echo "Dry run: would push main as $(git log -1 --format='%h %s')."
+  elif git push -q origin HEAD:refs/heads/main; then
+    echo "Pushed main: $(git log -1 --format='%h %s')."
+  else
+    die "pushing main failed; main was not changed."
+  fi
+fi
+if [ -n "$stall" ]; then
+  die "$stall"
+fi
diff --git a/.github/upstream-sync/test.sh b/.github/upstream-sync/test.sh
new file mode 100755
index 000000000..45ce3660a
--- /dev/null
+++ b/.github/upstream-sync/test.sh
@@ -0,0 +1,453 @@
+#!/usr/bin/env bash
+# Tests sync.sh on scratch repos: a fake upstream and a fake fork, with SYNC_NOW as the clock.
+# Needs git and jq. Usage: bash .github/upstream-sync/test.sh
+set -euo pipefail
+export LC_ALL=C
+
+here=$(cd "$(dirname "$0")" && pwd)
+repo_root=$(cd "$here/../.." && pwd)
+root=$(mktemp -d "${TMPDIR:-/tmp}/upstream-sync-test.XXXXXX")
+trap 'rm -rf "$root"' EXIT
+
+# Keep git away from the user's and the system's config, and from the job's settings.
+export GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1
+export GIT_AUTHOR_NAME=test GIT_AUTHOR_EMAIL=test@example.com
+export GIT_COMMITTER_NAME=test GIT_COMMITTER_EMAIL=test@example.com
+unset GITHUB_ACTIONS RUNNER_TEMP SYNC_TOKEN SYNC_API_TOKEN SYNC_DRY_RUN SYNC_NOW GIT_CONFIG_COUNT
+
+up=$root/up         # upstream (a plain repo, so a force-push is a reset)
+fork=$root/fork.git # the fork's GitHub repo
+tab=$(printf '\t')
+plugin=plugins/codex/.claude-plugin/plugin.json
+marketplace=.claude-plugin/marketplace.json
+failures=0
+
+pass() { echo "ok - $1"; }
+fail() {
+  echo "FAIL - $1"
+  sed 's/^/    | /' "$root/out"
+  failures=$((failures + 1))
+}
+check() {
+  local name=$1
+  shift
+  if "$@"; then pass "$name"; else fail "$name"; fi
+}
+not() { ! "$@"; }
+
+# An upstream with a workflow of its own, and a fork whose main is upstream's first commit plus the
+# fork's own commit: versions deleted, and this repo's .gitattributes, sync files and workflow.
+# The fork's pre-receive hook refuses what GitHub refuses the job's token: a new commit on main
+# that changes .github/workflows/ compared with its first parent. (GitHub accepts a merge commit
+# whose tree has a workflow file that only its second parent lacks; checked on 2026-10-28.)
+# GitHub's activity log of upstream is the file $activity, empty unless a test fills it.
+setup() {
+  rm -rf "$up" "$fork" "$root/clone"
+  git init -q -b main "$up"
+  mkdir -p "$up/plugins/codex/.claude-plugin" "$up/.claude-plugin" "$up/.github/workflows"
+  printf '{\n  "name": "codex",\n  "version": "1.0.0",\n  "description": "d"\n}\n' > "$up/$plugin"
+  printf '{\n  "name": "m",\n  "owner": { "name": "o" },\n  "plugins": [\n    { "name": "codex", "source": "./plugins/codex" }\n  ]\n}\n' > "$up/$marketplace"
+  printf 'line 1\nline 2\n' > "$up/a.txt"
+  printf 'on: pull_request\n' > "$up/.github/workflows/ci.yml"
+  up_commit "upstream 0" > /dev/null
+  git clone -q --bare "$up" "$fork"
+  git clone -q "$fork" "$root/clone"
+  cp "$repo_root/.gitattributes" "$root/clone/.gitattributes"
+  cp -R "$here" "$root/clone/.github/upstream-sync"
+  cp "$repo_root/.github/workflows/upstream-sync.yml" "$root/clone/.github/workflows/"
+  jq 'del(.version)' "$up/$plugin" > "$root/clone/$plugin"
+  git -C "$root/clone" add -A
+  git -C "$root/clone" commit -q -m "fork: delete version, add the sync job"
+  git -C "$root/clone" push -q origin main
+  cat > "$fork/hooks/pre-receive" << 'EOF'
+#!/bin/sh
+while read -r old new ref; do
+  [ "$ref" = refs/heads/main ] || continue
+  for c in $(git rev-list "$old..$new"); do
+    if [ -n "$(git diff --name-only "$c^1" "$c" -- .github/workflows)" ]; then
+      echo "refusing to allow a GitHub App to create or update workflow without workflows permission" >&2
+      exit 1
+    fi
+  done
+done
+EOF
+  chmod +x "$fork/hooks/pre-receive"
+  main0=$(main_head)
+  activity=$root/activity.json
+  echo '[]' > "$activity"
+}
+
+up_commit() {
+  git -C "$up" add -A
+  git -C "$up" commit -q -m "$1"
+  git -C "$up" rev-parse HEAD
+}
+
+# run_sync <now> [dry run: 0 or 1]: output in $root/out, exit status in $status.
+run_sync() {
+  status=0
+  SYNC_NOW=$1 SYNC_DRY_RUN=${2:-0} SYNC_ORIGIN_URL=$fork SYNC_UPSTREAM_URL=$up SYNC_ACTIVITY_URL=file://$activity \
+    bash "$here/sync.sh" > "$root/out" 2>&1 || status=$?
+}
+
+main_head() { git -C "$fork" rev-parse main; }
+has_ref() { git -C "$fork" rev-parse -q --verify "$1" > /dev/null; }
+state_file() { git -C "$fork" show "upstream-sync-state:$1"; }
+in_main() { git -C "$fork" merge-base --is-ancestor "$1" main 2> /dev/null; }
+said() { grep -qF -- "$1" "$root/out"; }
+succeeded() { [ "$status" = 0 ]; }
+equal() { [ "$1" = "$2" ]; }
+# rewrite <time> [type]: an entry in GitHub's activity log of upstream's main (default: force_push).
+rewrite() {
+  jq --arg t "$1" --arg type "${2:-force_push}" '. + [{ref: "refs/heads/main", activity_type: $type, timestamp: $t}]' \
+    "$activity" > "$root/activity.new"
+  mv "$root/activity.new" "$activity"
+}
+
+# put_state <seen.tsv>: replaces seen.tsv on the state branch, as anyone with write access could.
+put_state() {
+  local blob tree
+  blob=$(printf '%s' "$1" | git -C "$fork" hash-object -w --stdin)
+  tree=$(printf '100644 blob %s\tseen.tsv\n' "$blob" | git -C "$fork" mktree)
+  edited_state=$(git -C "$fork" commit-tree "$tree" -p upstream-sync-state -m "edited state")
+  git -C "$fork" update-ref refs/heads/upstream-sync-state "$edited_state"
+}
+
+echo "# a missing state branch is created"
+setup
+u0=$(git -C "$up" rev-parse HEAD)
+run_sync 2026-01-01T00:00:00Z
+check "first run succeeds" succeeded
+check "state branch exists" has_ref refs/heads/upstream-sync-state
+check "seen.tsv lists upstream's head with the time" equal "$(state_file seen.tsv)" "$u0${tab}2026-01-01T00:00:00Z"
+check "last_checked is the time" equal "$(state_file last_checked)" 2026-01-01T00:00:00Z
+check "main is unchanged" equal "$(main_head)" "$main0"
+
+echo "# no merge before 7 days, a merge after"
+setup
+run_sync 2026-01-01T00:00:00Z
+printf 'line 1\nupstream line 2\n' > "$up/a.txt"
+u1=$(up_commit "upstream 1")
+run_sync 2026-01-02T00:00:00Z
+run_sync 2026-01-08T23:59:59Z
+check "a run 1 second before 7 days succeeds" succeeded
+check "it merges nothing" equal "$(main_head)" "$main0"
+check "it updates last_checked" equal "$(state_file last_checked)" 2026-01-08T23:59:59Z
+run_sync 2026-01-09T00:00:00Z
+check "a run at 7 days succeeds" succeeded
+check "main's first parent is the old main" equal "$(git -C "$fork" rev-parse main^1)" "$main0"
+check "main's second parent is the upstream commit" equal "$(git -C "$fork" rev-parse main^2)" "$u1"
+check "the merge message names the commit" grep -qF "Commit: $u1" <(git -C "$fork" log -1 --format=%B main)
+check "the merge message says since when it was on upstream main" \
+  grep -qF "On upstream main since: 2026-01-02T00:00:00Z" <(git -C "$fork" log -1 --format=%B main)
+merged=$(main_head)
+run_sync 2026-01-10T00:00:00Z
+check "a later run succeeds" succeeded
+check "it says the commit is already in main" said "is already in main"
+check "it merges nothing" equal "$(main_head)" "$merged"
+
+echo "# the newest commit seen at least 7 days ago is merged, not a newer one"
+setup
+printf 'line 1\nx\n' > "$up/a.txt"
+u1=$(up_commit "upstream 1")
+run_sync 2026-01-01T00:00:00Z
+printf 'line 1\ny\n' > "$up/a.txt"
+u2=$(up_commit "upstream 2")
+run_sync 2026-01-04T00:00:00Z
+run_sync 2026-01-08T00:00:00Z
+check "the run succeeds" succeeded
+check "the commit seen 7 days ago is in main" in_main "$u1"
+check "the commit seen 4 days ago is not" not in_main "$u2"
+
+echo "# a re-pushed commit counts only from its re-push"
+setup
+printf 'line 1\nm\n' > "$up/a.txt"
+m=$(up_commit "m")
+run_sync 2026-01-01T00:00:00Z
+git -C "$up" reset -q --hard HEAD~1
+printf 'line 1\nx\n' > "$up/a.txt"
+x=$(up_commit "x")
+run_sync 2026-01-02T00:00:00Z
+git -C "$up" reset -q --hard "$m"
+run_sync 2026-01-04T00:00:00Z
+check "seen.tsv logs the re-pushed commit again" equal "$(state_file seen.tsv | cut -f1 | tr '\n' ' ')" "$m $x $m "
+run_sync 2026-01-10T23:59:59Z
+check "a run 7 days after its first row succeeds" succeeded
+check "it skips the first row" said "Skipping $m (on upstream main at 2026-01-01T00:00:00Z)"
+check "it merges nothing" equal "$(main_head)" "$main0"
+run_sync 2026-01-11T00:00:00Z
+check "7 days after the re-push, the commit is merged" equal "$(git -C "$fork" rev-parse main^2)" "$m"
+check "the commit that replaced it for 2 days is not in main" not in_main "$x"
+
+echo "# a commit reverted within the week is still merged on day 7, as with packages"
+setup
+run_sync 2026-01-01T00:00:00Z
+printf 'line 1\nbad\n' > "$up/a.txt"
+m=$(up_commit "bad")
+run_sync 2026-01-02T00:00:00Z
+git -C "$up" revert --no-edit HEAD > /dev/null
+r=$(git -C "$up" rev-parse HEAD)
+run_sync 2026-01-03T00:00:00Z
+run_sync 2026-01-09T00:00:00Z
+check "the run on day 7 succeeds" succeeded
+check "it merges the reverted commit" equal "$(git -C "$fork" rev-parse main^2)" "$m"
+run_sync 2026-01-10T00:00:00Z
+check "the revert follows a day later" equal "$(git -C "$fork" rev-parse main^2)" "$r"
+
+echo "# an upstream version bump merges without a conflict and the version stays deleted"
+setup
+printf '{\n  "name": "codex",\n  "version": "1.0.1",\n  "description": "d2"\n}\n' > "$up/$plugin"
+jq '.plugins[0].version = "1.0.1"' "$up/$marketplace" > "$root/m.json" && mv "$root/m.json" "$up/$marketplace"
+up_commit "bump to 1.0.1" > /dev/null
+run_sync 2026-01-01T00:00:00Z
+run_sync 2026-01-08T00:00:00Z
+check "the run succeeds" succeeded
+check "main has the merge" equal "$(git -C "$fork" rev-parse main^1)" "$main0"
+check "plugin.json is upstream's without the version" \
+  equal "$(git -C "$fork" show "main:$plugin" | jq -c .)" '{"name":"codex","description":"d2"}'
+check "marketplace.json has no version" \
+  equal "$(git -C "$fork" show "main:$marketplace" | jq -c '[.plugins[] | has("version")]')" '[false]'
+
+echo "# a conflict fails the job and leaves main unchanged"
+setup
+printf 'fork line 1\nline 2\n' > "$root/clone/a.txt"
+git -C "$root/clone" commit -q -am "fork change"
+git -C "$root/clone" push -q origin main
+main0=$(main_head)
+printf 'upstream line 1\nline 2\n' > "$up/a.txt"
+up_commit "upstream change" > /dev/null
+run_sync 2026-01-01T00:00:00Z
+run_sync 2026-01-08T00:00:00Z
+check "the run fails" not succeeded
+check "it names the conflict" said "conflicts"
+check "main is unchanged" equal "$(main_head)" "$main0"
+check "the state branch is still updated" equal "$(state_file last_checked)" 2026-01-08T00:00:00Z
+
+echo "# a backdated commit does not count as old"
+setup
+printf 'line 1\nold\n' > "$up/a.txt"
+git -C "$up" add -A
+GIT_AUTHOR_DATE=2020-01-01T00:00:00Z GIT_COMMITTER_DATE=2020-01-01T00:00:00Z git -C "$up" commit -q -m "backdated"
+run_sync 2026-01-01T00:00:00Z
+run_sync 2026-01-02T00:00:00Z
+check "the run succeeds" succeeded
+check "it merges nothing" equal "$(main_head)" "$main0"
+
+echo "# a commit that a force-push removed from upstream is skipped"
+setup
+printf 'line 1\nbad\n' > "$up/a.txt"
+bad=$(up_commit "bad")
+run_sync 2026-01-01T00:00:00Z
+git -C "$up" reset -q --hard HEAD~1
+printf 'line 1\ngood\n' > "$up/a.txt"
+good=$(up_commit "good")
+run_sync 2026-01-02T00:00:00Z
+run_sync 2026-01-08T01:00:00Z
+check "the run succeeds" succeeded
+check "it skips the removed commit" said "Skipping $bad"
+check "it merges nothing" equal "$(main_head)" "$main0"
+run_sync 2026-01-09T00:00:00Z
+check "a run 7 days after the new head succeeds" succeeded
+check "the new head is in main" in_main "$good"
+check "the removed commit is not" not in_main "$bad"
+
+echo "# a dry run pushes nothing"
+setup
+printf 'line 1\nupstream line 2\n' > "$up/a.txt"
+up_commit "upstream 1" > /dev/null
+refs_before=$(git -C "$fork" for-each-ref)
+run_sync 2026-01-01T00:00:00Z 1
+check "a dry run without a state branch succeeds" succeeded
+check "it creates no state branch" equal "$(git -C "$fork" for-each-ref)" "$refs_before"
+run_sync 2026-01-01T00:00:00Z
+refs_before=$(git -C "$fork" for-each-ref)
+run_sync 2026-01-08T00:00:00Z 1
+check "a dry run with a commit to merge succeeds" succeeded
+check "it says it would push main" said "Dry run: would push main"
+check "it pushes nothing" equal "$(git -C "$fork" for-each-ref)" "$refs_before"
+
+echo "# upstream changes to .github/ or .gitattributes are never merged"
+for change in "a new workflow" "a mode change" "a symlink" "a .gitattributes"; do
+  setup
+  case $change in
+    "a new workflow") printf 'on: push\n' > "$up/.github/workflows/new.yml" ;;
+    "a mode change") chmod +x "$up/.github/workflows/ci.yml" ;;
+    "a symlink") ln -s ../a.txt "$up/.github/link" ;;
+    "a .gitattributes") printf '* text=auto\n' > "$up/.gitattributes" ;;
+  esac
+  up_commit "$change" > /dev/null
+  run_sync 2026-01-01T00:00:00Z
+  run_sync 2026-01-08T00:00:00Z
+  check "$change: the run fails" not succeeded
+  check "$change: it says to merge by hand" said "Merge by hand from a machine whose token may push workflow files"
+  check "$change: main is unchanged" equal "$(main_head)" "$main0"
+  check "$change: the state branch is still updated" equal "$(state_file last_checked)" 2026-01-08T00:00:00Z
+done
+
+echo "# upstream cannot take over the sync script, in one step or two"
+setup
+mkdir -p "$up/.github/upstream-sync"
+cp "$here/sync.sh" "$up/.github/upstream-sync/sync.sh"
+u1=$(up_commit "a copy of the fork's sync.sh")
+check "upstream's copy is the same file, mode included" \
+  equal "$(git -C "$up" ls-tree HEAD .github/upstream-sync/sync.sh)" "$(git -C "$fork" ls-tree main .github/upstream-sync/sync.sh)"
+run_sync 2026-01-01T00:00:00Z
+run_sync 2026-01-08T00:00:00Z
+check "the identical copy is not merged" not in_main "$u1"
+check "the run fails" not succeeded
+# Someone merges the copy by hand; then upstream edits the script.
+git -C "$root/clone" fetch -q "$up" main
+git -C "$root/clone" merge -q --no-ff --no-edit FETCH_HEAD
+git -C "$root/clone" push -q origin main
+main1=$(main_head)
+printf 'echo replaced\n' >> "$up/.github/upstream-sync/sync.sh"
+up_commit "edit the sync script" > /dev/null
+run_sync 2026-01-09T00:00:00Z
+run_sync 2026-01-16T00:00:00Z
+check "the edit fails the run" not succeeded
+check "it says to merge by hand" said "Merge by hand from a machine whose token may push workflow files"
+check "main and its sync.sh are unchanged" equal "$(main_head)" "$main1"
+
+echo "# GitHub's activity log: a force-push after a commit's row blocks it"
+setup
+printf 'line 1\nm\n' > "$up/a.txt"
+m=$(up_commit "m")
+run_sync 2026-01-01T00:00:00Z
+# Upstream removed and restored m between two runs: only GitHub's activity log shows it.
+rewrite 2026-01-03T10:00:00Z
+rewrite 2026-01-03T11:00:00Z
+run_sync 2026-01-08T00:00:00Z
+check "the run succeeds" succeeded
+check "it names the force-push" said "2026-01-03T11:00:00Z force_push"
+check "it merges nothing" equal "$(main_head)" "$main0"
+check "it logs the head again, as of now" \
+  equal "$(state_file seen.tsv | tr '\n' ' ')" "$m${tab}2026-01-01T00:00:00Z $m${tab}2026-01-08T00:00:00Z "
+run_sync 2026-01-14T23:59:59Z
+check "6 days later it still merges nothing" equal "$(main_head)" "$main0"
+run_sync 2026-01-15T00:00:00Z
+check "7 days after the new row, the commit is merged" equal "$(git -C "$fork" rev-parse main^2)" "$m"
+
+echo "# GitHub's activity log: a deletion of upstream's main after a commit's row blocks it"
+setup
+printf 'line 1\nm\n' > "$up/a.txt"
+up_commit "m" > /dev/null
+run_sync 2026-01-01T00:00:00Z
+rewrite 2026-01-02T00:00:00Z branch_deletion
+run_sync 2026-01-08T00:00:00Z
+check "the run succeeds" succeeded
+check "it merges nothing" equal "$(main_head)" "$main0"
+
+echo "# GitHub's activity log: a force-push before a commit's row, or a plain push, does not block it"
+setup
+rewrite 2025-12-31T00:00:00Z
+rewrite 2026-01-02T00:00:00Z push
+printf 'line 1\nm\n' > "$up/a.txt"
+m=$(up_commit "m")
+run_sync 2026-01-01T00:00:00Z
+run_sync 2026-01-08T00:00:00Z
+check "the run succeeds" succeeded
+check "the commit is merged" equal "$(git -C "$fork" rev-parse main^2)" "$m"
+
+echo "# GitHub's activity log: if it cannot be read, the job fails and merges nothing"
+for response in missing '{"message": "Not Found"}' '[{"ref": "refs/heads/main", "activity_type": "force_push"}]'; do
+  setup
+  printf 'line 1\nm\n' > "$up/a.txt"
+  up_commit "m" > /dev/null
+  run_sync 2026-01-01T00:00:00Z
+  if [ "$response" = missing ]; then rm "$activity"; else printf '%s\n' "$response" > "$activity"; fi
+  run_sync 2026-01-08T00:00:00Z
+  check "response $response: the run fails" not succeeded
+  check "response $response: it names the activity log" said "activity log"
+  check "response $response: main is unchanged" equal "$(main_head)" "$main0"
+  check "response $response: the state branch is still updated" equal "$(state_file last_checked)" 2026-01-08T00:00:00Z
+done
+
+echo "# a malformed seen.tsv fails the job and pushes nothing"
+setup
+run_sync 2026-01-01T00:00:00Z
+u0=$(git -C "$up" rev-parse HEAD)
+nl=$'\n'
+for content in "not a commit${tab}2026-01-01T00:00:00Z$nl" \
+  "$u0${tab}2026-01-03T00:00:00Z$nl$u0${tab}2026-01-01T00:00:00Z$nl" \
+  "$u0${tab}2026-01-01T00:00:00Z"; do
+  put_state "$content"
+  run_sync 2026-01-04T00:00:00Z
+  check "the run fails" not succeeded
+  check "it names the problem" said "seen.tsv on upstream-sync-state"
+  check "the state branch is unchanged" equal "$(git -C "$fork" rev-parse upstream-sync-state)" "$edited_state"
+done
+
+echo "# a clock behind the last row fails the job and pushes nothing"
+setup
+run_sync 2026-01-05T00:00:00Z
+state_before=$(git -C "$fork" rev-parse upstream-sync-state)
+printf 'line 1\nm\n' > "$up/a.txt"
+up_commit "m" > /dev/null
+run_sync 2026-01-04T00:00:00Z
+check "the run fails" not succeeded
+check "it says the clock is behind" said "the clock is behind its last row"
+check "the state branch is unchanged" equal "$(git -C "$fork" rev-parse upstream-sync-state)" "$state_before"
+
+echo "# a commit that upstream removes after the fork merged it fails the job"
+setup
+printf 'line 1\nm\n' > "$up/a.txt"
+m=$(up_commit "m")
+run_sync 2026-01-01T00:00:00Z
+run_sync 2026-01-08T00:00:00Z
+check "the commit is merged on day 7" equal "$(git -C "$fork" rev-parse main^2)" "$m"
+merged=$(main_head)
+git -C "$up" reset -q --hard HEAD~1
+printf 'line 1\nx\n' > "$up/a.txt"
+up_commit "x" > /dev/null
+run_sync 2026-01-09T00:00:00Z
+check "the next run fails" not succeeded
+check "it names the removed commit" said "upstream removed from its main commits that this fork merged ($m)"
+check "main is unchanged" equal "$(main_head)" "$merged"
+check "the state branch is still updated" equal "$(state_file last_checked)" 2026-01-09T00:00:00Z
+
+echo "# a commit that waits 30 days fails the job, saying why"
+setup
+printf 'line 1\nm\n' > "$up/a.txt"
+up_commit "m" > /dev/null
+run_sync 2026-01-01T00:00:00Z
+for day in 02 09 16 23; do
+  rewrite "2026-01-${day}T00:00:00Z"
+  run_sync "2026-01-$((10#$day + 6))T00:00:00Z"
+done
+run_sync 2026-01-30T23:59:59Z
+check "29 days and 23:59:59 after the commit was logged, the run succeeds" succeeded
+run_sync 2026-01-31T00:00:00Z
+check "after 30 days, the run fails" not succeeded
+check "it says the job could not merge for 30 days" said "has not been able to merge upstream commit"
+check "it says why" said "This run: upstream's main was force-pushed or deleted"
+check "main is unchanged" equal "$(main_head)" "$main0"
+
+echo "# merges on top of earlier sync merges, with merge commits upstream"
+setup
+printf 'line 1\nu1\n' > "$up/a.txt"
+up_commit "u1" > /dev/null
+run_sync 2026-01-01T00:00:00Z
+run_sync 2026-01-08T00:00:00Z
+first_merge=$(main_head)
+git -C "$up" checkout -q -b feature
+printf 'feature\n' > "$up/b.txt"
+up_commit "feature" > /dev/null
+git -C "$up" checkout -q main
+printf '{\n  "name": "codex",\n  "version": "1.0.2",\n  "description": "d"\n}\n' > "$up/$plugin"
+up_commit "bump to 1.0.2" > /dev/null
+git -C "$up" merge -q --no-ff --no-edit feature
+u3=$(git -C "$up" rev-parse HEAD)
+run_sync 2026-01-09T00:00:00Z
+run_sync 2026-01-16T00:00:00Z
+check "the run succeeds" succeeded
+check "main's first parent is the earlier sync merge" equal "$(git -C "$fork" rev-parse main^1)" "$first_merge"
+check "main's second parent is upstream's merge commit" equal "$(git -C "$fork" rev-parse main^2)" "$u3"
+check "plugin.json still has no version" equal "$(git -C "$fork" show "main:$plugin" | jq 'has("version")')" false
+check "the fork's sync job is unchanged" \
+  equal "$(git -C "$fork" rev-parse main:.github)" "$(git -C "$fork" rev-parse "$main0:.github")"
+
+if [ "$failures" -gt 0 ]; then
+  echo "$failures check(s) failed"
+  exit 1
+fi
+echo "All checks passed."
diff --git a/.github/workflows/upstream-sync.yml b/.github/workflows/upstream-sync.yml
new file mode 100644
index 000000000..427f73f21
--- /dev/null
+++ b/.github/workflows/upstream-sync.yml
@@ -0,0 +1,53 @@
+name: Upstream sync
+
+# Merges upstream's main (Crazytieguy/codex-plugin-cc) into this fork's main, but only commits that
+# upstream's main has had for at least 7 days. See .github/upstream-sync/README.md.
+
+on:
+  schedule:
+    - cron: "17 6 * * *"
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: Print what would happen and push nothing
+        type: boolean
+        default: false
+  pull_request:
+    paths:
+      - .github/workflows/upstream-sync.yml
+      - .github/upstream-sync/**
+      - .gitattributes
+
+permissions:
+  contents: write
+
+concurrency:
+  # One real run at a time; pull request runs are dry runs and queue on their own.
+  group: upstream-sync-${{ github.event_name == 'pull_request' && github.ref || 'main' }}
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      # Plain git instead of actions/checkout, so the job runs no third-party code.
+      - name: Fetch this commit's sync scripts
+        env:
+          REPO_URL: https://github.com/${{ github.repository }}.git
+        run: |
+          git init -q -b src "$RUNNER_TEMP/src"
+          git -C "$RUNNER_TEMP/src" fetch -q --no-tags --depth=1 "$REPO_URL" "$GITHUB_SHA"
+          git -C "$RUNNER_TEMP/src" checkout -q --detach FETCH_HEAD
+
+      - name: Test the sync scripts
+        if: github.event_name == 'pull_request'
+        run: bash "$RUNNER_TEMP/src/.github/upstream-sync/test.sh"
+
+      - name: Sync
+        env:
+          SYNC_DRY_RUN: ${{ (github.event_name == 'pull_request' || inputs.dry_run) && '1' || '0' }}
+          # Dry runs push nothing, so they get no token for pushing.
+          SYNC_TOKEN: ${{ !(github.event_name == 'pull_request' || inputs.dry_run) && github.token || '' }}
+          # Only for reading GitHub's activity log of upstream.
+          SYNC_API_TOKEN: ${{ github.token }}
+        run: bash "$RUNNER_TEMP/src/.github/upstream-sync/sync.sh"