codex plugin add copies .git and gitignored files, including a root .env, into the plugin cache

What version of Codex CLI is running?

codex-cli 0.153.4

What platform is your computer?

macOS 26.6.2, arm64, zsh

What issue are you seeing?

codex plugin add copies the marketplace root into ~/.codex/plugins/cache/<marketplace>/<plugin>/<version>/, and the copy includes .git along with every file git ignores.

Measured on my checkout (github.com/bostonaholic/team, 90 skills and 13 agents):

• Codex cache copy: 151M, of which .git is 24M and node_modules/ is 51M
• content tracked by git: 4.5M
• Claude Code copies the same marketplace root and excludes .git; Codex keeps it

Two consequences beyond disk use:

1. The cache directory is a live git repo. Any tool that walks up from a path inside it (git itself, or anything looking for a repo root) finds a stale clone of the plugin's source instead of no repo at all.
2. .gitignore is where local secrets go by convention. My repo reserves a root .env for the API key its eval suite reads. I confirmed that file gets copied by writing a probe value to it and reinstalling:

$ cat ~/.codex/plugins/cache/team-dev/team/0.97.0+codex.20260910173558/.env
TEAM_DEV_COPY_PROBE=not-a-real-secret

plugin-creator's documented development loop (references/installing-and-updating.md) is to bump the cachebuster and reinstall after each edit, so this copy runs once per edit.

What steps can reproduce the bug?

1. Clone a plugin repo whose .gitignore covers node_modules/, and write any value to a root .env.
2. bun install (or npm install).
3. codex plugin marketplace add <path>
4. codex plugin add <plugin>@<marketplace>
5. ls -A ~/.codex/plugins/cache/<marketplace>/<plugin>/<version>/ shows .git, node_modules/, and .env in the copy.

What is the expected behavior?

Exclude .git, as Claude Code does. When the marketplace root is a local directory, also skip files git ignores, honoring global excludes and core.excludesFile.

Additional information

#40457 asks for a --plugin-dir flag, which would let development skip the copy entirely. This report is about what the copy contains, which applies to installed plugins too.

Start at the codex plugin add path and reproduce the copy using a local marketplace with .git, node_modules/, and a gitignored .env; the issue provides the expected cache location and observed contents. Review references/installing-and-updating.md for the development loop, then verify that copied plugins exclude .git and locally ignored files while installed-plugin behavior remains intact.