qURL plugin for Codex

Share an app running on your machine privately, straight from Codex, with qURL: no deploy, no account, no API key, no signup. Install it as the repository README says.

What it adds

Skill	How it runs	What it does
`qurl:qurl`	Codex uses it on its own whenever you want to share, publish or open something with qURL. You can also type `$qurl:qurl`.	The qURL agent skill.
`qurl:share`	Only when you type `$qurl:share [who]`	Share the app you're working on privately: email invitations, email sign-in, review, approved passkeys or a contract. Asks who it's for.
`qurl:approve`	Only when you type `$qurl:approve [who or what] [CRID]`	Decide a waiting request: a verified email (review), a passkey's approval details, a contract entitlement from your backend, or a six-digit code. Never by name.
`qurl:access`	Only when you type `$qurl:access [change] [CRID]`	See who is invited and who has access; invite more addresses, resend, remove someone, or change the mode.

share, approve and access are Codex's equivalent of slash commands: their agents/openai.yaml sets allow_implicit_invocation: false, so the model is never offered them on its own and they add nothing to a session's context until you type them. They require qURL CLI 3.4.1 or newer, because an older CLI publishes a resource that anyone with its address can open, and their rules hold whatever the skill says.

Private access modes

Mode	Who can open it
`invite_only`	Only the email addresses you invite. Strangers can't ask.
`email_capture`	Anyone who verifies an email address; you receive each one.
`review`	People verify an email and ask; you approve each one.
`keys`	Passkeys you approve one by one.
`contract`	People your own backend entitles (a purchase, a subscription).

Email verification proves control of a mailbox, not who someone is. The modes need a qurl CLI whose qurl publish --help lists --access, and a qURL service with private access turned on. Where either is missing, Codex says so and shares nothing; it never falls back to a public share or six-digit codes.

The plugin has no MCP server. The skill already drives the qurl CLI, which needs no account; a bundled server (@layervai/qurl-mcp) would start a Node process through npx in every Codex session, shared or not, to reach the same CLI.

Keeping the bundled skill current (maintainers)

skills/qurl/SKILL.md is a copy of the skill served at https://layerv.ai/skills/qurl/SKILL.md, byte for byte. The served file is the source of truth: never edit the copy here. The Check plugins workflow compares the two every day and on every PR, and fails while they differ. To update it:

Copy the served file over the bundled one, from the repository root:

curl -fsSL https://layerv.ai/skills/qurl/SKILL.md -o plugins/qurl/skills/qurl/SKILL.md

Raise version in plugin.json in the same PR. People get the new files when they run codex plugin marketplace upgrade layerv; the version is how they, and codex plugin list, tell one copy from another. Use a patch version for a new copy of the skill or a wording change, a minor version for a new command, and a major version when a command is removed or renamed. The version lives only in plugin.json, never in the marketplace entry.
If the skill's rules changed, check that skills/share, skills/approve and skills/access still agree with them.

Run the checks the workflow runs:

python3 scripts/check_manifests.py .
python3 scripts/check_codex_install.py . -- npx -y @openai/codex@0.162.1

Raise the version for any other change to the plugin's files too.