diff --git a/.github/workflows/publish-platform.yml b/.github/workflows/publish-platform.yml
index 5f061ab6b..154e12d15 100644
--- a/.github/workflows/publish-platform.yml
+++ b/.github/workflows/publish-platform.yml
@@ -49,7 +49,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: "1.3.12"
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -75,8 +75,8 @@ jobs:
             exit 1
           fi
 
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "dist_tag=$DIST_TAG" >> $GITHUB_OUTPUT
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "dist_tag=$DIST_TAG" >> "$GITHUB_OUTPUT"
 
       - name: Check if already published
         id: check
@@ -95,26 +95,26 @@ jobs:
           echo "oh-my-openagent-${{ matrix.platform }}@${VERSION}: ${OA_STATUS}"
           
           if [ "$OC_STATUS" = "200" ]; then
-            echo "skip_opencode=true" >> $GITHUB_OUTPUT
+            echo "skip_opencode=true" >> "$GITHUB_OUTPUT"
             echo "✓ oh-my-opencode-${{ matrix.platform }}@${VERSION} already published"
           else
-            echo "skip_opencode=false" >> $GITHUB_OUTPUT
+            echo "skip_opencode=false" >> "$GITHUB_OUTPUT"
             echo "→ oh-my-opencode-${{ matrix.platform }}@${VERSION} needs publishing"
           fi
           
           if [ "$OA_STATUS" = "200" ]; then
-            echo "skip_openagent=true" >> $GITHUB_OUTPUT
+            echo "skip_openagent=true" >> "$GITHUB_OUTPUT"
             echo "✓ oh-my-openagent-${{ matrix.platform }}@${VERSION} already published"
           else
-            echo "skip_openagent=false" >> $GITHUB_OUTPUT
+            echo "skip_openagent=false" >> "$GITHUB_OUTPUT"
             echo "→ oh-my-openagent-${{ matrix.platform }}@${VERSION} needs publishing"
           fi
           
           # Skip build only if BOTH are already published
           if [ "$OC_STATUS" = "200" ] && [ "$OA_STATUS" = "200" ]; then
-            echo "skip=true" >> $GITHUB_OUTPUT
+            echo "skip=true" >> "$GITHUB_OUTPUT"
           else
-            echo "skip=false" >> $GITHUB_OUTPUT
+            echo "skip=false" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Update version in package.json
@@ -288,8 +288,8 @@ jobs:
             exit 1
           fi
 
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "dist_tag=$DIST_TAG" >> $GITHUB_OUTPUT
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "dist_tag=$DIST_TAG" >> "$GITHUB_OUTPUT"
 
       - name: Check if already published
         id: check
@@ -300,30 +300,29 @@ jobs:
           OA_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://registry.npmjs.org/oh-my-openagent-${{ matrix.platform }}/${VERSION}")
           
           if [ "$OC_STATUS" = "200" ]; then
-            echo "skip_opencode=true" >> $GITHUB_OUTPUT
+            echo "skip_opencode=true" >> "$GITHUB_OUTPUT"
             echo "✓ oh-my-opencode-${{ matrix.platform }}@${VERSION} already published"
           else
-            echo "skip_opencode=false" >> $GITHUB_OUTPUT
+            echo "skip_opencode=false" >> "$GITHUB_OUTPUT"
           fi
           
           if [ "$OA_STATUS" = "200" ]; then
-            echo "skip_openagent=true" >> $GITHUB_OUTPUT
+            echo "skip_openagent=true" >> "$GITHUB_OUTPUT"
             echo "✓ oh-my-openagent-${{ matrix.platform }}@${VERSION} already published"
           else
-            echo "skip_openagent=false" >> $GITHUB_OUTPUT
+            echo "skip_openagent=false" >> "$GITHUB_OUTPUT"
           fi
           
           # Need artifact if either package needs publishing
           if [ "$OC_STATUS" = "200" ] && [ "$OA_STATUS" = "200" ]; then
-            echo "skip_all=true" >> $GITHUB_OUTPUT
+            echo "skip_all=true" >> "$GITHUB_OUTPUT"
           else
-            echo "skip_all=false" >> $GITHUB_OUTPUT
+            echo "skip_all=false" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Download artifact
         id: download
         if: steps.check.outputs.skip_all != 'true'
-        continue-on-error: true
         uses: actions/download-artifact@v4
         with:
           name: binary-${{ matrix.platform }}
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 210205b95..e806d9440 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -22,6 +22,11 @@ on:
         required: false
         type: boolean
         default: false
+      publish_lazycodex:
+        description: "Publish lazycodex npm alias and sync Codex marketplace"
+        required: false
+        type: boolean
+        default: false
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
@@ -38,7 +43,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: "1.3.11"
+          bun-version: "1.3.12"
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -55,7 +60,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: "1.3.11"
+          bun-version: "1.3.12"
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -72,10 +77,21 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - name: Verify trusted publisher for all 24 packages
+      - name: Require LazyCodex sync token
+        if: inputs.publish_lazycodex == true
+        env:
+          LAZYCODEX_SYNC_TOKEN: ${{ secrets.LAZYCODEX_SYNC_TOKEN }}
+        run: |
+          if [ -z "$LAZYCODEX_SYNC_TOKEN" ]; then
+            echo "::error::LAZYCODEX_SYNC_TOKEN is required to push the Codex marketplace bundle to code-yeongyu/lazycodex."
+            exit 1
+          fi
+
+      - name: Verify trusted publisher for release packages
         env:
           REPO: code-yeongyu/oh-my-openagent
           WORKFLOW_FILE: publish.yml
+          PUBLISH_LAZYCODEX: ${{ inputs.publish_lazycodex }}
         run: |
           OIDC_TOKEN=$(curl -sH "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \
             "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=npm:registry.npmjs.org" \
@@ -88,6 +104,9 @@ jobs:
 
           PLATFORMS=(darwin-arm64 darwin-x64 darwin-x64-baseline linux-x64 linux-x64-baseline linux-arm64 linux-x64-musl linux-x64-musl-baseline linux-arm64-musl windows-x64 windows-x64-baseline)
           ALL_PACKAGES=(oh-my-opencode oh-my-openagent)
+          if [ "${PUBLISH_LAZYCODEX}" = "true" ]; then
+            ALL_PACKAGES+=(lazycodex)
+          fi
           for plat in "${PLATFORMS[@]}"; do
             ALL_PACKAGES+=("oh-my-opencode-${plat}")
             ALL_PACKAGES+=("oh-my-openagent-${plat}")
@@ -113,57 +132,56 @@ jobs:
           done
 
           if [ ${#FAILED[@]} -gt 0 ]; then
-            {
-              echo
-              echo "::error::Trusted publisher not configured for ${#FAILED[@]} package(s)."
-              echo "::error::Configure each below at the URL with these values:"
-              echo "::error::  Provider: GitHub Actions"
-              echo "::error::  Organization: code-yeongyu"
-              echo "::error::  Repository: ${REPO}"
-              echo "::error::  Workflow filename: ${WORKFLOW_FILE}"
-              echo
-              for pkg in "${FAILED[@]}"; do
-                echo "::error::  https://www.npmjs.com/package/${pkg}/access"
-              done
-            } >&2
-            exit 1
+            HARD_FAILED=()
+            SOFT_FAILED=()
+            for pkg in "${FAILED[@]}"; do
+              if [ "${pkg}" = "lazycodex" ]; then
+                SOFT_FAILED+=("${pkg}")
+              else
+                HARD_FAILED+=("${pkg}")
+              fi
+            done
+
+            if [ ${#HARD_FAILED[@]} -gt 0 ]; then
+              {
+                echo
+                echo "::error::Trusted publisher not configured for ${#HARD_FAILED[@]} required package(s)."
+                echo "::error::Configure each below at the URL with these values:"
+                echo "::error::  Provider: GitHub Actions"
+                echo "::error::  Organization: code-yeongyu"
+                echo "::error::  Repository: ${REPO}"
+                echo "::error::  Workflow filename: ${WORKFLOW_FILE}"
+                echo
+                for pkg in "${HARD_FAILED[@]}"; do
+                  echo "::error::  https://www.npmjs.com/package/${pkg}/access"
+                done
+              } >&2
+              exit 1
+            fi
+
+            if [ ${#SOFT_FAILED[@]} -gt 0 ]; then
+              {
+                echo
+                echo "::warning::Trusted publisher is not configured for lazycodex yet."
+                echo "::warning::First publish can require a one-time manual npm publish to claim the name."
+                echo "::warning::After claiming, configure GitHub Actions trusted publishing at:"
+                echo "::warning::  https://www.npmjs.com/package/lazycodex/access"
+                echo "::warning::  Organization: code-yeongyu"
+                echo "::warning::  Repository: ${REPO}"
+                echo "::warning::  Workflow filename: ${WORKFLOW_FILE}"
+              }
+            fi
           fi
 
           echo
           echo "All ${#ALL_PACKAGES[@]} packages have trusted publisher configured."
 
-  publish-main:
+  release-metadata:
     runs-on: ubuntu-latest
-    needs: [test, typecheck, preflight-trust]
-    if: github.repository == 'code-yeongyu/oh-my-openagent'
     outputs:
       version: ${{ steps.version.outputs.version }}
       dist_tag: ${{ steps.version.outputs.dist_tag }}
     steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          submodules: recursive
-
-      - run: git fetch --force --tags
-
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: "1.3.11"
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version: "24"
-          registry-url: "https://registry.npmjs.org"
-
-      - name: Upgrade npm for trusted publishing (>=11.5.1)
-        run: npm install -g npm@latest
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile
-        env:
-          BUN_INSTALL_ALLOW_SCRIPTS: "@ast-grep/cli @ast-grep/napi"
-
       - name: Calculate version
         id: version
         env:
@@ -187,7 +205,7 @@ jobs:
             exit 1
           fi
 
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
           if [[ "$VERSION" == *"-"* ]]; then
             DIST_TAG=$(printf '%s' "$VERSION" | cut -d'-' -f2 | cut -d'.' -f1)
@@ -195,30 +213,123 @@ jobs:
               echo "::error::Invalid dist_tag: $DIST_TAG"
               exit 1
             fi
-            echo "dist_tag=${DIST_TAG:-next}" >> $GITHUB_OUTPUT
+            echo "dist_tag=${DIST_TAG:-next}" >> "$GITHUB_OUTPUT"
           else
-            echo "dist_tag=" >> $GITHUB_OUTPUT
+            echo "dist_tag=" >> "$GITHUB_OUTPUT"
           fi
 
           echo "Version: $VERSION"
 
+  publish-main:
+    runs-on: ubuntu-latest
+    needs: [test, typecheck, preflight-trust, release-metadata, publish-platform]
+    if: >-
+      always() &&
+      github.repository == 'code-yeongyu/oh-my-openagent' &&
+      needs.test.result == 'success' &&
+      needs.typecheck.result == 'success' &&
+      needs.preflight-trust.result == 'success' &&
+      needs.release-metadata.result == 'success' &&
+      (inputs.skip_platform == true || needs.publish-platform.result == 'success')
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          submodules: recursive
+
+      - run: git fetch --force --tags
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.3.12"
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Upgrade npm for trusted publishing (>=11.5.1)
+        run: npm install -g npm@latest
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+        env:
+          BUN_INSTALL_ALLOW_SCRIPTS: "@ast-grep/cli @ast-grep/napi"
+
+      - name: Verify platform packages are published
+        env:
+          VERSION: ${{ needs.release-metadata.outputs.version }}
+        run: |
+          PLATFORMS=(darwin-arm64 darwin-x64 darwin-x64-baseline linux-x64 linux-x64-baseline linux-arm64 linux-x64-musl linux-x64-musl-baseline linux-arm64-musl windows-x64 windows-x64-baseline)
+          FAILED=()
+          for platform in "${PLATFORMS[@]}"; do
+            for family in oh-my-opencode oh-my-openagent; do
+              pkg="${family}-${platform}"
+              STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://registry.npmjs.org/${pkg}/${VERSION}")
+              if [ "$STATUS" = "200" ]; then
+                echo "OK   ${pkg}@${VERSION}"
+              else
+                echo "MISS ${pkg}@${VERSION} (HTTP ${STATUS})"
+                FAILED+=("${pkg}")
+              fi
+            done
+          done
+
+          if [ ${#FAILED[@]} -gt 0 ]; then
+            echo "::error::Missing platform package(s); refusing to publish wrappers."
+            for pkg in "${FAILED[@]}"; do
+              echo "::error::  ${pkg}@${VERSION}"
+            done
+            exit 1
+          fi
+
       - name: Check if already published
         id: check
         env:
-          VERSION: ${{ steps.version.outputs.version }}
+          VERSION: ${{ needs.release-metadata.outputs.version }}
         run: |
           STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://registry.npmjs.org/oh-my-opencode/${VERSION}")
           if [ "$STATUS" = "200" ]; then
-            echo "skip=true" >> $GITHUB_OUTPUT
+            echo "skip=true" >> "$GITHUB_OUTPUT"
             echo "✓ oh-my-opencode@${VERSION} already published"
           else
-            echo "skip=false" >> $GITHUB_OUTPUT
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Check if oh-my-openagent already published
+        id: check-openagent
+        env:
+          VERSION: ${{ needs.release-metadata.outputs.version }}
+        run: |
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://registry.npmjs.org/oh-my-openagent/${VERSION}")
+          if [ "$STATUS" = "200" ]; then
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            echo "✓ oh-my-openagent@${VERSION} already published"
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Check if lazycodex already published
+        if: inputs.publish_lazycodex == true
+        id: check-lazycodex
+        env:
+          VERSION: ${{ needs.release-metadata.outputs.version }}
+        run: |
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://registry.npmjs.org/lazycodex/${VERSION}")
+          if [ "$STATUS" = "200" ]; then
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            echo "✓ lazycodex@${VERSION} already published"
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Update version
-        if: steps.check.outputs.skip != 'true'
+        if: >-
+          steps.check.outputs.skip != 'true' ||
+          steps.check-openagent.outputs.skip != 'true' ||
+          (inputs.publish_lazycodex == true && steps.check-lazycodex.outputs.skip != 'true')
         env:
-          VERSION: ${{ steps.version.outputs.version }}
+          VERSION: ${{ needs.release-metadata.outputs.version }}
         run: |
           jq --arg v "$VERSION" '.version = $v' package.json > tmp.json && mv tmp.json package.json
 
@@ -229,13 +340,21 @@ jobs:
           done
 
           jq --arg v "$VERSION" '.optionalDependencies = (.optionalDependencies | to_entries | map(.value = $v) | from_entries)' package.json > tmp.json && mv tmp.json package.json
+          jq --arg v "$VERSION" '.version = $v' packages/omo-codex/plugin/.codex-plugin/plugin.json > tmp.json && mv tmp.json packages/omo-codex/plugin/.codex-plugin/plugin.json
+          jq --arg v "$VERSION" '.version = $v' packages/omo-codex/plugin/package.json > tmp.json && mv tmp.json packages/omo-codex/plugin/package.json
 
       - name: Build main package
-        if: steps.check.outputs.skip != 'true'
+        if: >-
+          steps.check.outputs.skip != 'true' ||
+          steps.check-openagent.outputs.skip != 'true' ||
+          (inputs.publish_lazycodex == true && steps.check-lazycodex.outputs.skip != 'true')
         run: bun run build
 
       - name: Strip token auth from .npmrc to force OIDC
-        if: steps.check.outputs.skip != 'true'
+        if: >-
+          steps.check.outputs.skip != 'true' ||
+          steps.check-openagent.outputs.skip != 'true' ||
+          (inputs.publish_lazycodex == true && steps.check-lazycodex.outputs.skip != 'true')
         run: |
           for f in .npmrc "$HOME/.npmrc"; do
             if [ -f "$f" ]; then
@@ -248,7 +367,7 @@ jobs:
       - name: Publish oh-my-opencode
         if: steps.check.outputs.skip != 'true'
         env:
-          DIST_TAG: ${{ steps.version.outputs.dist_tag }}
+          DIST_TAG: ${{ needs.release-metadata.outputs.dist_tag }}
           NPM_CONFIG_PROVENANCE: true
         run: |
           if [ -n "$DIST_TAG" ]; then
@@ -257,24 +376,11 @@ jobs:
             npm publish --access public --provenance --loglevel verbose
           fi
 
-      - name: Check if oh-my-openagent already published
-        id: check-openagent
-        env:
-          VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://registry.npmjs.org/oh-my-openagent/${VERSION}")
-          if [ "$STATUS" = "200" ]; then
-            echo "skip=true" >> $GITHUB_OUTPUT
-            echo "✓ oh-my-openagent@${VERSION} already published"
-          else
-            echo "skip=false" >> $GITHUB_OUTPUT
-          fi
-
       - name: Publish oh-my-openagent
         if: steps.check-openagent.outputs.skip != 'true'
         env:
-          VERSION: ${{ steps.version.outputs.version }}
-          DIST_TAG: ${{ steps.version.outputs.dist_tag }}
+          VERSION: ${{ needs.release-metadata.outputs.version }}
+          DIST_TAG: ${{ needs.release-metadata.outputs.dist_tag }}
           NPM_CONFIG_PROVENANCE: true
         run: |
           # Update package name, version, and optionalDependencies for oh-my-openagent
@@ -299,19 +405,64 @@ jobs:
         run: |
           git checkout -- package.json
 
+      - name: Publish lazycodex
+        if: inputs.publish_lazycodex == true && steps.check-lazycodex.outputs.skip != 'true'
+        continue-on-error: true
+        env:
+          VERSION: ${{ needs.release-metadata.outputs.version }}
+          DIST_TAG: ${{ needs.release-metadata.outputs.dist_tag }}
+          NPM_CONFIG_PROVENANCE: true
+        run: |
+          jq --arg v "$VERSION" '
+            .name = "lazycodex" |
+            .version = $v |
+            .optionalDependencies = (.optionalDependencies | to_entries | map(.value = $v) | from_entries)
+          ' package.json > tmp.json && mv tmp.json package.json
+
+          set +e
+          if [ -n "$DIST_TAG" ]; then
+            npm publish --access public --provenance --tag "$DIST_TAG" --loglevel verbose
+          else
+            npm publish --access public --provenance --loglevel verbose
+          fi
+          PUBLISH_STATUS=$?
+          set -e
+
+          if [ "$PUBLISH_STATUS" -ne 0 ]; then
+            echo "::warning::lazycodex publish failed. If this is the first publish, claim it once manually from a trusted environment (with NPM_AUTH_TOKEN) using npm publish."
+            echo "::warning::Then configure GitHub Actions trusted publishing at https://www.npmjs.com/package/lazycodex/access with org=code-yeongyu repo=oh-my-openagent workflow=publish.yml."
+            exit 0
+          fi
+
+      - name: Restore package.json after lazycodex publish attempt
+        if: always() && inputs.publish_lazycodex == true && steps.check-lazycodex.outputs.skip != 'true'
+        run: |
+          git checkout -- package.json
+
   publish-platform:
-    needs: publish-main
-    if: inputs.skip_platform != true
+    needs: [test, typecheck, preflight-trust, release-metadata]
+    if: >-
+      always() &&
+      github.repository == 'code-yeongyu/oh-my-openagent' &&
+      inputs.skip_platform != true &&
+      needs.test.result == 'success' &&
+      needs.typecheck.result == 'success' &&
+      needs.preflight-trust.result == 'success' &&
+      needs.release-metadata.result == 'success'
     uses: ./.github/workflows/publish-platform.yml
     with:
-      version: ${{ needs.publish-main.outputs.version }}
-      dist_tag: ${{ needs.publish-main.outputs.dist_tag }}
+      version: ${{ needs.release-metadata.outputs.version }}
+      dist_tag: ${{ needs.release-metadata.outputs.dist_tag }}
     secrets: inherit
 
   release:
     runs-on: ubuntu-latest
-    needs: [publish-main, publish-platform]
-    if: always() && needs.publish-main.result == 'success' && (inputs.skip_platform == true || needs.publish-platform.result == 'success')
+    needs: [release-metadata, publish-main, publish-platform]
+    if: >-
+      always() &&
+      needs.release-metadata.result == 'success' &&
+      needs.publish-main.result == 'success' &&
+      (inputs.skip_platform == true || needs.publish-platform.result == 'success')
     steps:
       - uses: actions/checkout@v4
         with:
@@ -321,7 +472,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: "1.3.12"
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -335,9 +486,36 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Apply release version to source tree
+      - name: Resolve release state
+        id: release-state
         env:
-          VERSION: ${{ needs.publish-main.outputs.version }}
+          VERSION: ${{ needs.release-metadata.outputs.version }}
+          RELEASE_REF: ${{ github.ref_name }}
+        run: |
+          if git rev-parse -q --verify "refs/tags/v${VERSION}" >/dev/null; then
+            echo "tag_exists=true" >> "$GITHUB_OUTPUT"
+            echo "release_commit_exists=true" >> "$GITHUB_OUTPUT"
+            git checkout --detach "v${VERSION}"
+            exit 0
+          fi
+
+          echo "tag_exists=false" >> "$GITHUB_OUTPUT"
+          RELEASE_SHA=""
+          if [ -n "$RELEASE_REF" ]; then
+            RELEASE_SHA=$(git rev-list --max-count=1 --grep="^release: v${VERSION}$" "origin/${RELEASE_REF}" 2>/dev/null || true)
+          fi
+
+          if [ -n "$RELEASE_SHA" ]; then
+            echo "release_commit_exists=true" >> "$GITHUB_OUTPUT"
+            git checkout --detach "$RELEASE_SHA"
+          else
+            echo "release_commit_exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Apply release version to source tree
+        if: steps.release-state.outputs.release_commit_exists != 'true'
+        env:
+          VERSION: ${{ needs.release-metadata.outputs.version }}
         run: |
           jq --arg v "$VERSION" '.version = $v' package.json > tmp.json && mv tmp.json package.json
 
@@ -348,37 +526,86 @@ jobs:
           done
 
           jq --arg v "$VERSION" '.optionalDependencies = (.optionalDependencies | to_entries | map(.value = $v) | from_entries)' package.json > tmp.json && mv tmp.json package.json
+          jq --arg v "$VERSION" '.version = $v' packages/omo-codex/plugin/.codex-plugin/plugin.json > tmp.json && mv tmp.json packages/omo-codex/plugin/.codex-plugin/plugin.json
+          jq --arg v "$VERSION" '.version = $v' packages/omo-codex/plugin/package.json > tmp.json && mv tmp.json packages/omo-codex/plugin/package.json
 
       - name: Commit version bump
+        if: steps.release-state.outputs.release_commit_exists != 'true'
         env:
-          VERSION: ${{ needs.publish-main.outputs.version }}
+          VERSION: ${{ needs.release-metadata.outputs.version }}
         run: |
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git config user.name "github-actions[bot]"
-          git add package.json packages/oh-my-opencode-*/package.json
+          git add package.json packages/oh-my-opencode-*/package.json packages/omo-codex/plugin/.codex-plugin/plugin.json packages/omo-codex/plugin/package.json
           git diff --cached --quiet || git commit -m "release: v${VERSION}"
 
       - name: Create release tag
+        if: steps.release-state.outputs.tag_exists != 'true'
         env:
-          VERSION: ${{ needs.publish-main.outputs.version }}
+          VERSION: ${{ needs.release-metadata.outputs.version }}
         run: |
-          if git rev-parse "v${VERSION}" >/dev/null 2>&1; then
-            echo "::error::Tag v${VERSION} already exists"
-            exit 1
+          if git rev-parse -q --verify "refs/tags/v${VERSION}" >/dev/null; then
+            echo "Release tag v${VERSION} already exists locally"
+          else
+            git tag "v${VERSION}"
           fi
-          git tag "v${VERSION}"
 
       - name: Push release state
+        if: steps.release-state.outputs.tag_exists != 'true'
         env:
-          VERSION: ${{ needs.publish-main.outputs.version }}
+          VERSION: ${{ needs.release-metadata.outputs.version }}
+          RELEASE_REF: ${{ github.ref_name }}
+          RELEASE_COMMIT_EXISTS: ${{ steps.release-state.outputs.release_commit_exists }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          git push origin HEAD
-          git push origin "v${VERSION}"
+          if [ "$RELEASE_COMMIT_EXISTS" != "true" ]; then
+            if [ -z "$RELEASE_REF" ]; then
+              echo "::error::Cannot push release commit because github.ref_name is empty."
+              exit 1
+            fi
+            git push origin "HEAD:${RELEASE_REF}"
+          else
+            echo "Release commit already exists on origin/${RELEASE_REF}"
+          fi
+
+          if git ls-remote --exit-code --tags origin "refs/tags/v${VERSION}" >/dev/null 2>&1; then
+            echo "Release tag v${VERSION} already exists on origin"
+          else
+            git push origin "v${VERSION}"
+          fi
+
+      - name: Checkout LazyCodex marketplace
+        if: inputs.publish_lazycodex == true
+        uses: actions/checkout@v4
+        with:
+          repository: code-yeongyu/lazycodex
+          path: lazycodex-marketplace
+          token: ${{ secrets.LAZYCODEX_SYNC_TOKEN }}
+          fetch-depth: 0
+
+      - name: Sync LazyCodex Codex marketplace
+        if: inputs.publish_lazycodex == true
+        env:
+          VERSION: ${{ needs.release-metadata.outputs.version }}
+        run: |
+          bun run --cwd packages/omo-codex/plugin build
+          bun run build:ast-grep-mcp
+          bun run build:lsp-tools-mcp
+          bun run script/sync-lazycodex-marketplace.ts "$GITHUB_WORKSPACE" "$GITHUB_WORKSPACE/lazycodex-marketplace"
+          cd "$GITHUB_WORKSPACE/lazycodex-marketplace"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git config user.name "github-actions[bot]"
+          git add .agents/plugins/marketplace.json plugins/omo
+          if git diff --cached --quiet; then
+            echo "LazyCodex marketplace already up to date"
+          else
+            git commit -m "chore: sync Codex marketplace v${VERSION}"
+            git push origin HEAD:main
+          fi
 
       - name: Create GitHub release
         env:
-          VERSION: ${{ needs.publish-main.outputs.version }}
+          VERSION: ${{ needs.release-metadata.outputs.version }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           gh release view "v${VERSION}" >/dev/null 2>&1 || \
@@ -392,7 +619,7 @@ jobs:
       - name: Merge to master
         continue-on-error: true
         env:
-          VERSION: ${{ needs.publish-main.outputs.version }}
+          VERSION: ${{ needs.release-metadata.outputs.version }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           git config user.name "github-actions[bot]"
diff --git a/.github/workflows/refresh-model-capabilities.yml b/.github/workflows/refresh-model-capabilities.yml
index 0bec53521..f654188eb 100644
--- a/.github/workflows/refresh-model-capabilities.yml
+++ b/.github/workflows/refresh-model-capabilities.yml
@@ -18,7 +18,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: "1.3.12"
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
diff --git a/.github/workflows/sisyphus-agent.yml b/.github/workflows/sisyphus-agent.yml
index 80e5af297..1aa1a71fc 100644
--- a/.github/workflows/sisyphus-agent.yml
+++ b/.github/workflows/sisyphus-agent.yml
@@ -59,7 +59,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: "1.3.12"
 
       - name: Cache Bun dependencies
         uses: actions/cache@v4
@@ -345,29 +345,31 @@ jobs:
           COMMENT_ID_VAL: ${{ github.event.comment.id }}
           REPO: ${{ github.repository }}
         run: |
-          if [[ "$EVENT_NAME" == "issue_comment" ]]; then
-            ISSUE_NUM="$ISSUE_NUMBER"
-            AUTHOR="$COMMENT_AUTHOR"
-            COMMENT_ID="$COMMENT_ID_VAL"
+          {
+            if [[ "$EVENT_NAME" == "issue_comment" ]]; then
+              ISSUE_NUM="$ISSUE_NUMBER"
+              AUTHOR="$COMMENT_AUTHOR"
+              COMMENT_ID="$COMMENT_ID_VAL"
 
-            # Check if PR or Issue and get title
-            ISSUE_DATA=$(gh api "repos/$REPO/issues/${ISSUE_NUM}")
-            TITLE=$(echo "$ISSUE_DATA" | jq -r '.title')
-            if echo "$ISSUE_DATA" | jq -e '.pull_request' > /dev/null; then
-              echo "type=pr" >> $GITHUB_OUTPUT
-              echo "number=${ISSUE_NUM}" >> $GITHUB_OUTPUT
-            else
-              echo "type=issue" >> $GITHUB_OUTPUT
-              echo "number=${ISSUE_NUM}" >> $GITHUB_OUTPUT
+              # Check if PR or Issue and get title
+              ISSUE_DATA=$(gh api "repos/$REPO/issues/${ISSUE_NUM}")
+              TITLE=$(echo "$ISSUE_DATA" | jq -r '.title')
+              if echo "$ISSUE_DATA" | jq -e '.pull_request' > /dev/null; then
+                echo "type=pr"
+                echo "number=${ISSUE_NUM}"
+              else
+                echo "type=issue"
+                echo "number=${ISSUE_NUM}"
+              fi
+              echo "title=${TITLE}"
             fi
-            echo "title=${TITLE}" >> $GITHUB_OUTPUT
-          fi
 
-          echo "comment<<EOF" >> $GITHUB_OUTPUT
-          echo "$COMMENT_BODY" >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
-          echo "author=$AUTHOR" >> $GITHUB_OUTPUT
-          echo "comment_id=$COMMENT_ID" >> $GITHUB_OUTPUT
+            echo "comment<<EOF"
+            echo "$COMMENT_BODY"
+            echo "EOF"
+            echo "author=$AUTHOR"
+            echo "comment_id=$COMMENT_ID"
+          } >> "$GITHUB_OUTPUT"
 
       # Add :eyes: reaction (as sisyphus-dev-ai)
       - name: Add eyes reaction