@bitkyc08/opencodex 2.6.7 → 2.6.8

package/src/codex-history-provider.ts

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, statSync, unlinkSync, utimesSync, writeFileSync } from "node:fs";
+import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, readSync, unlinkSync, writeSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { Database } from "bun:sqlite";
 import { CODEX_HOME } from "./codex-paths";
@@ -14,6 +14,130 @@ function historyBackupPathFor(stateDbPath: string): string {
 const HISTORY_BACKUP_PATH = historyBackupPathFor(STATE_DB_PATH);
 const RESUMABLE_SOURCES = ["cli", "vscode"] as const;
 
+/**
+ * Open the live `state_5.sqlite` the way the Codex app expects a *secondary* writer to behave:
+ * wait on the WAL/file lock instead of failing instantly, so we never race the app's own
+ * connection pool into a half-applied checkpoint. The app opens this DB with `busy_timeout=5s`
+ * (see codex-rs `state::runtime::base_sqlite_options`); we mirror that here.
+ */
+function openStateDb(stateDbPath: string): Database {
+  const db = new Database(stateDbPath);
+  try {
+    db.exec("PRAGMA busy_timeout = 5000");
+  } catch {
+    /* best-effort: an older sqlite without busy_timeout still works, just less politely */
+  }
+  return db;
+}
+
+/**
+ * Append one JSONL line to a rollout using an O_APPEND handle, exactly like the Codex app's own
+ * metadata writer (`append_rollout_item_to_path` in codex-rs `rollout/src/recorder.rs`).
+ *
+ * Why append instead of rewriting line 1:
+ * - The app caches the live session's append handle and only reopens it when the handle is gone
+ *   (codex-rs `RolloutWriterState::ensure_writer_open`). A temp+rename swap would orphan that
+ *   handle; an in-place truncate would race the app's concurrent appends and clip new turns.
+ * - The app folds metadata by replaying every `session_meta` line in file order, last-writer-wins
+ *   (codex-rs `apply_session_meta_from_item`), so a trailing `session_meta` overrides earlier ones.
+ *   Real rollouts already contain multiple `session_meta` lines for this reason.
+ * O_APPEND makes each write land at EOF atomically, so it composes safely with the app appending
+ * concurrently. We do not touch mtime: a fresh mtime is correct here (the app uses mtime as the
+ * rollout's updated_at), and forcing it backwards could hide a real edit from list ordering.
+ */
+function appendRolloutLine(path: string, line: string): void {
+  const fd = openSync(path, "a");
+  try {
+    const buf = Buffer.from(line.endsWith("\n") ? line : `${line}\n`, "utf8");
+    let offset = 0;
+    while (offset < buf.length) {
+      offset += writeSync(fd, buf, offset, buf.length - offset, null);
+    }
+    try { fsyncSync(fd); } catch { /* best-effort durability */ }
+  } finally {
+    closeSync(fd);
+  }
+}
+
+/**
+ * Patch the `model_provider` value inside the FIRST line of a rollout *in place, length-preserving*.
+ *
+ * Why this exists in addition to {@link appendRolloutLine}: Codex resolves a thread's provider via
+ * two different readers. The SQLite replay path folds every `session_meta` line last-writer-wins
+ * (covered by appending a trailing meta), but `read_session_meta_line` reads only the FIRST line
+ * and `update_thread_metadata` clones it when the app later writes git/memory-mode metadata
+ * (codex-rs `thread-store/src/local/update_thread_metadata.rs`). If the first line still says
+ * `opencodex` after a native restore, that clone re-appends `opencodex` and last-writer-wins
+ * resurrects the routed provider. So a durable restore must also fix line 1.
+ *
+ * Safety: Codex parses each rollout line as `serde_json::from_str(line.trim())`, which tolerates
+ * insignificant JSON whitespace. We therefore replace the provider value and pad the removed bytes
+ * with spaces so the line's byte length is unchanged. Equal length means we can write at offset 0
+ * with no truncate and no inode swap, so this composes safely with the app's cached append handle.
+ * Only length-preserving shrinks are handled (e.g. "opencodex" -> "openai"); callers that would
+ * grow the value fall back to append-only, which is correct for the opencodex direction.
+ *
+ * Returns true when line 1 was patched, false when it could not be done safely (missing file,
+ * non-`session_meta` first line, id mismatch, value already correct, or a length-growing change).
+ */
+function patchFirstLineProviderInPlace(path: string, expectedId: string, provider: string): boolean {
+  if (!existsSync(path)) return false;
+  const fd = openSync(path, "r+");
+  try {
+    // Read the first line by growing the probe until we hit a newline. session_meta lines embed
+    // base_instructions and can be tens of KB; a fixed cap would silently skip the in-place patch
+    // (and fall back to append-only, re-opening the first-line-clone resurrection gap), so we read
+    // until the line actually ends rather than guessing a ceiling.
+    const CHUNK = 1 << 16;
+    const MAX_FIRST_LINE = 1 << 24; // 16 MiB hard stop so a newline-less/corrupt file can't OOM us.
+    let collected = Buffer.alloc(0);
+    let nlIndex = -1;
+    let pos = 0;
+    while (nlIndex === -1) {
+      const chunk = Buffer.alloc(CHUNK);
+      const read = readSync(fd, chunk, 0, CHUNK, pos);
+      if (read === 0) break; // EOF with no newline: single-line file, skip
+      collected = Buffer.concat([collected, chunk.subarray(0, read)]);
+      nlIndex = collected.indexOf(0x0a);
+      pos += read;
+      if (collected.length > MAX_FIRST_LINE) return false;
+    }
+    if (nlIndex === -1) return false; // no newline anywhere: skip
+    const firstLine = collected.subarray(0, nlIndex).toString("utf8");
+
+    const meta = parseSessionMetaLine(firstLine);
+    if (!meta) return false;
+    if (meta.record.payload.id !== expectedId) return false;
+    if (meta.record.payload.model_provider === provider) return false;
+
+    // Locate the exact `"model_provider":"<value>"` token (allowing whitespace after the colon).
+    const match = firstLine.match(/"model_provider"\s*:\s*"([^"\\]*)"/);
+    if (!match || match.index === undefined) return false;
+    const oldToken = match[0];
+    const newCore = `"model_provider":"${provider}"`;
+    if (Buffer.byteLength(newCore, "utf8") > Buffer.byteLength(oldToken, "utf8")) return false; // grow: not length-preserving
+    const pad = " ".repeat(Buffer.byteLength(oldToken, "utf8") - Buffer.byteLength(newCore, "utf8"));
+    const newToken = `${newCore}${pad}`;
+
+    const patchedLine = firstLine.slice(0, match.index) + newToken + firstLine.slice(match.index + oldToken.length);
+    // Length must be identical so the trailing bytes (newline + rest of file) are untouched.
+    if (Buffer.byteLength(patchedLine, "utf8") !== Buffer.byteLength(firstLine, "utf8")) return false;
+    // Sanity: the patched line must still parse and carry the new provider.
+    const reparsed = parseSessionMetaLine(patchedLine);
+    if (!reparsed || reparsed.record.payload.model_provider !== provider) return false;
+
+    const out = Buffer.from(patchedLine, "utf8");
+    let offset = 0;
+    while (offset < out.length) {
+      offset += writeSync(fd, out, offset, out.length - offset, offset);
+    }
+    try { fsyncSync(fd); } catch { /* best-effort durability */ }
+    return true;
+  } finally {
+    closeSync(fd);
+  }
+}
+
 type CodexHistoryProvider = "openai" | "opencodex";
 
 export interface CodexHistorySyncResult {
@@ -92,24 +216,62 @@ function rememberOriginal(manifest: BackupManifest, row: ThreadRow): void {
   };
 }
 
-function updateSessionMeta(path: string, patch: { provider?: string; source?: string }): boolean {
-  if (!path || !existsSync(path)) return false;
-  const stat = statSync(path);
-  const raw = readFileSync(path, "utf8");
-  const newline = raw.indexOf("\n");
-  const firstLine = newline === -1 ? raw : raw.slice(0, newline);
-  const rest = newline === -1 ? "" : raw.slice(newline);
+interface ParsedSessionMeta {
+  record: { type?: unknown; timestamp?: unknown; payload: { model_provider?: unknown; source?: unknown } & Record<string, unknown> };
+}
 
+/** Parse one JSONL line into a `session_meta` record, or null if it isn't one. */
+function parseSessionMetaLine(line: string): ParsedSessionMeta | null {
   let parsed: unknown;
   try {
-    parsed = JSON.parse(firstLine);
+    parsed = JSON.parse(line);
   } catch {
-    return false;
+    return null;
   }
+  if (!parsed || typeof parsed !== "object") return null;
+  const record = parsed as ParsedSessionMeta["record"];
+  if (record.type !== "session_meta" || !record.payload || typeof record.payload !== "object") return null;
+  return { record };
+}
 
-  if (!parsed || typeof parsed !== "object") return false;
-  const record = parsed as { type?: unknown; payload?: { model_provider?: unknown; source?: unknown } };
-  if (record.type !== "session_meta" || !record.payload || typeof record.payload !== "object") return false;
+/**
+ * Find the LAST `session_meta` line in a rollout, mirroring the app's last-writer-wins fold
+ * (codex-rs `apply_session_meta_from_item`). We base our patch on the most recent metadata so we
+ * never resurrect a stale provider that a later app-written `session_meta` already changed.
+ */
+function readLatestSessionMeta(path: string): ParsedSessionMeta | null {
+  const raw = readFileSync(path, "utf8");
+  const lines = raw.split("\n");
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const line = lines[i];
+    if (!line) continue;
+    if (!line.includes("\"session_meta\"")) continue;
+    const meta = parseSessionMetaLine(line);
+    if (meta) return meta;
+  }
+  return null;
+}
+
+/**
+ * Make a thread's rollout reflect a provider/source change by APPENDING a new `session_meta` line,
+ * rather than rewriting line 1. The appended line clones the latest metadata payload (so no field
+ * is accidentally reset to empty) and applies only the requested changes. Returns false when the
+ * rollout is missing, has no parseable `session_meta`, its latest `session_meta` belongs to a
+ * different thread id, or it already matches the desired values.
+ */
+function updateSessionMeta(path: string, expectedId: string, patch: { provider?: string; source?: string }): boolean {
+  if (!path || !existsSync(path)) return false;
+
+  const latest = readLatestSessionMeta(path);
+  if (!latest) return false;
+  const record = latest.record;
+
+  // The app ignores `session_meta` lines whose payload id != the canonical thread id
+  // (codex-rs `apply_session_meta_from_item`). Forked rollouts can embed a source session's
+  // metadata, so an id-mismatched latest line means we'd be cloning the wrong thread's meta and
+  // appending a line the app would discard. Skip rather than write a no-op/misleading line.
+  const payloadId = record.payload.id;
+  if (typeof payloadId !== "string" || payloadId !== expectedId) return false;
 
   let changed = false;
   if (patch.provider !== undefined && record.payload.model_provider !== patch.provider) {
@@ -122,8 +284,19 @@ function updateSessionMeta(path: string, patch: { provider?: string; source?: st
   }
   if (!changed) return false;
 
-  atomicWriteFile(path, `${JSON.stringify(record)}${rest}`);
-  utimesSync(path, stat.atime, stat.mtime);
+  // Cover Codex's *other* provider reader: `read_session_meta_line` reads only line 1, and the
+  // app clones it when writing later git/memory-mode metadata. Appending alone leaves a stale
+  // line-1 provider that the clone would re-append, so for a length-preserving provider change we
+  // also patch line 1 in place (no inode swap, no truncate). Best-effort: when it can't be done
+  // safely (e.g. a length-growing change), the trailing append below is still correct for the
+  // SQLite replay path.
+  if (patch.provider !== undefined) {
+    try { patchFirstLineProviderInPlace(path, expectedId, patch.provider); } catch { /* best-effort line-1 patch */ }
+  }
+
+  // Refresh the line timestamp so the appended record reads as the newest metadata.
+  record.timestamp = new Date().toISOString();
+  appendRolloutLine(path, JSON.stringify(record));
   return true;
 }
 
@@ -155,7 +328,7 @@ function ejectRemainingOpencodexHistory(db: Database): { rows: number; files: nu
   let files = 0;
   for (const row of rows) {
     try {
-      if (updateSessionMeta(row.rollout_path, {
+      if (updateSessionMeta(row.rollout_path, row.id, {
         provider: "openai",
         source: row.source === "exec" ? "cli" : undefined,
       })) files++;
@@ -206,7 +379,7 @@ function syncCodexHistoryProviderUnsafe(provider: CodexHistoryProvider, stateDbP
   if (!existsSync(stateDbPath)) return { rows: 0, files: 0 };
   if (provider === "openai") return restoreCodexHistoryProvider(stateDbPath, backupPath);
 
-  const db = new Database(stateDbPath);
+  const db = openStateDb(stateDbPath);
   try {
     const placeholders = RESUMABLE_SOURCES.map(() => "?").join(",");
     const openaiRows = db
@@ -234,14 +407,14 @@ function syncCodexHistoryProviderUnsafe(provider: CodexHistoryProvider, stateDbP
     let files = 0;
     for (const row of openaiRows) {
       try {
-        if (updateSessionMeta(row.rollout_path, { provider: "opencodex" })) files++;
+        if (updateSessionMeta(row.rollout_path, row.id, { provider: "opencodex" })) files++;
       } catch {
         /* best-effort; keep DB migration moving even if one old rollout is malformed */
       }
     }
     for (const row of execRows) {
       try {
-        if (updateSessionMeta(row.rollout_path, { source: "cli" })) files++;
+        if (updateSessionMeta(row.rollout_path, row.id, { source: "cli" })) files++;
       } catch {
         /* best-effort; keep DB migration moving even if one old rollout is malformed */
       }
@@ -281,7 +454,7 @@ function restoreCodexHistoryProvider(stateDbPath: string, backupPath: string): C
   const manifest = readBackup(backupPath, stateDbPath);
   const entries = Object.values(manifest.entries);
 
-  const db = new Database(stateDbPath);
+  const db = openStateDb(stateDbPath);
   try {
     if (entries.length === 0) {
       const ejected = ejectRemainingOpencodexHistory(db);
@@ -292,7 +465,7 @@ function restoreCodexHistoryProvider(stateDbPath: string, backupPath: string): C
     for (const entry of entries) {
       const target = toNativeRestoreTarget(entry);
       try {
-        if (updateSessionMeta(entry.rolloutPath, { provider: target.modelProvider, source: target.source })) files++;
+        if (updateSessionMeta(entry.rolloutPath, entry.id, { provider: target.modelProvider, source: target.source })) files++;
       } catch {
         /* best-effort; keep DB restore moving even if one rollout disappeared */
       }
@@ -325,7 +498,7 @@ function restoreCodexHistoryProvider(stateDbPath: string, backupPath: string): C
 export function restoreLegacyOpenaiHistory(stateDbPath = STATE_DB_PATH): { rows: number; files: number } {
   try {
     if (!existsSync(stateDbPath)) return { rows: 0, files: 0 };
-    const db = new Database(stateDbPath);
+    const db = openStateDb(stateDbPath);
     try {
       return ejectRemainingOpencodexHistory(db);
     } finally {

package/src/codex-plugins-doctor.ts

@@ -0,0 +1,242 @@
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { isAbsolute, join } from "node:path";
+import { CODEX_CONFIG_PATH } from "./codex-paths";
+import { redactUserPath } from "./redact";
+
+// Mirrors codex-rs core-plugins/src/marketplace.rs MARKETPLACE_MANIFEST_RELATIVE_PATHS.
+// A marketplace root "resolves" only when one of these files exists under it.
+const MARKETPLACE_MANIFEST_RELATIVE_PATHS = [
+  ".agents/plugins/marketplace.json",
+  ".claude-plugin/marketplace.json",
+] as const;
+
+const OPENAI_BUNDLED_MARKETPLACE_NAME = "openai-bundled";
+
+// Where the Codex desktop app's bundled plugins live, relative to an install
+// root. Windows app-package paths embed the app version, so the actual install
+// root is discovered by scanning candidate bases (LOCALAPPDATA, etc.) rather
+// than hardcoded. The bundled marketplace dir is named after the marketplace.
+const BUNDLED_MARKETPLACE_LEAF = join("plugins", "bundled-marketplaces", OPENAI_BUNDLED_MARKETPLACE_NAME);
+const CODEX_APP_DIR_SEGMENTS = [join("Programs", "@openai", "codex"), join("Programs", "codex"), join("@openai", "codex"), "codex"] as const;
+
+// Plugins the issue (#43) calls out. Treated as data, not as an authoritative
+// allowlist: codex-rs only allowlists chrome/computer-use, but the diagnostic
+// just reports presence, so listing browser here is informational only.
+const COMMON_BUNDLED_PLUGINS = ["computer-use", "browser", "chrome"] as const;
+
+export type CodexPluginsDiagnostic =
+  | { applicable: false; reason: string; summary: string }
+  | {
+      applicable: true;
+      stale: boolean;
+      marketplace: {
+        name: string;
+        present: boolean;
+        sourceType: string | null;
+        source: string | null;
+        resolvesToManifest: boolean;
+        currentBundledPath: string | null;
+        pathMismatch: boolean;
+      };
+      bundledPlugins: Array<{ id: string; configured: boolean }>;
+      suggestedRepair: string | null;
+      summary: string;
+    };
+
+/** True when the table at `[marketplaces.<name>]` exists in the config text. */
+function readMarketplaceTable(configText: string, name: string): Record<string, string> | null {
+  // Split on CRLF or LF: config.toml on Windows (the platform this diagnostic
+  // targets) uses CRLF, and a leftover \r would defeat the `$`-anchored regexes.
+  const lines = configText.split(/\r?\n/);
+  const header = new RegExp(`^\\s*\\[marketplaces\\.(?:"${escapeRegExp(name)}"|${escapeRegExp(name)})\\]\\s*(?:#.*)?$`);
+  let start = -1;
+  for (let i = 0; i < lines.length; i++) {
+    if (header.test(lines[i] ?? "")) { start = i + 1; break; }
+  }
+  if (start === -1) return null;
+
+  const table: Record<string, string> = {};
+  for (let i = start; i < lines.length; i++) {
+    const line = lines[i] ?? "";
+    if (/^\s*\[/.test(line)) break; // next table starts; stop
+    const m = line.match(/^\s*([A-Za-z0-9_-]+)\s*=\s*("(?:\\.|[^"])*"|'[^']*'|[^#]+?)\s*(?:#.*)?$/);
+    if (!m) continue;
+    table[m[1]] = unquoteTomlValue(m[2].trim());
+  }
+  return table;
+}
+
+function unquoteTomlValue(raw: string): string {
+  if (raw.startsWith("\"")) {
+    try { return JSON.parse(raw) as string; } catch { return raw.slice(1, -1); }
+  }
+  if (raw.startsWith("'")) return raw.slice(1, -1);
+  return raw;
+}
+
+function escapeRegExp(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+/** A directory is a bundled-marketplace root when it holds a supported manifest. */
+function dirHasManifest(dir: string): boolean {
+  return MARKETPLACE_MANIFEST_RELATIVE_PATHS.some(rel => existsSync(join(dir, rel)));
+}
+
+/**
+ * Locate the bundled `openai-bundled` marketplace dir under the installed Codex
+ * desktop app on Windows. Windows app paths embed the app version, so we scan
+ * candidate install bases for a versioned app dir whose
+ * `plugins/bundled-marketplaces/openai-bundled` holds a manifest. Returns the
+ * newest matching dir (by mtime) or null. Filesystem access is injectable for
+ * tests so a Windows layout can be exercised on any OS.
+ */
+export function locateCurrentBundledMarketplace(
+  options: {
+    env?: NodeJS.ProcessEnv;
+    listDir?: (dir: string) => string[];
+    isManifestRoot?: (dir: string) => boolean;
+    mtimeOf?: (dir: string) => number;
+  } = {},
+): string | null {
+  const env = options.env ?? process.env;
+  const listDir = options.listDir ?? ((dir: string) => {
+    try { return readdirSync(dir); } catch { return []; }
+  });
+  const isManifestRoot = options.isManifestRoot ?? dirHasManifest;
+  const mtimeOf = options.mtimeOf ?? ((dir: string) => {
+    try { return statSync(dir).mtimeMs; } catch { return 0; }
+  });
+
+  const bases = [env.LOCALAPPDATA, env.PROGRAMFILES, env["ProgramFiles(x86)"], env.APPDATA]
+    .filter((b): b is string => typeof b === "string" && b.length > 0);
+
+  const candidates: string[] = [];
+  for (const base of bases) {
+    for (const seg of CODEX_APP_DIR_SEGMENTS) {
+      const appRoot = join(base, seg);
+      // Direct (unversioned) layout.
+      const direct = join(appRoot, BUNDLED_MARKETPLACE_LEAF);
+      if (isManifestRoot(direct)) candidates.push(direct);
+      // Versioned layout: appRoot/<version>/plugins/bundled-marketplaces/openai-bundled
+      for (const child of listDir(appRoot)) {
+        const versioned = join(appRoot, child, BUNDLED_MARKETPLACE_LEAF);
+        if (isManifestRoot(versioned)) candidates.push(versioned);
+      }
+    }
+  }
+  if (candidates.length === 0) return null;
+  candidates.sort((a, b) => mtimeOf(b) - mtimeOf(a));
+  return candidates[0] ?? null;
+}
+
+/** Normalize a path for comparison: lowercase + unify separators (Windows is case-insensitive). */
+function normalizePathForCompare(path: string): string {
+  return path.replace(/[\\/]+/g, "\\").replace(/\\+$/, "").toLowerCase();
+}
+
+/** A local marketplace `source` resolves when it holds a supported manifest. */
+function sourceResolvesToManifest(source: string): boolean {
+  if (!isAbsolute(source)) return false;
+  if (!existsSync(source)) return false;
+  return MARKETPLACE_MANIFEST_RELATIVE_PATHS.some(rel => existsSync(join(source, rel)));
+}
+
+/**
+ * Read-only diagnostic for the Codex `openai-bundled` plugin marketplace.
+ *
+ * Only meaningful on Windows, where app-package paths embed the app version and
+ * go stale after an update. On other platforms it reports "not applicable".
+ * NEVER mutates config.toml, never invokes `codex plugin marketplace add`.
+ */
+export function diagnoseCodexBundledPlugins(
+  options: {
+    platform?: NodeJS.Platform;
+    configPath?: string;
+    locateCurrent?: () => string | null;
+  } = {},
+): CodexPluginsDiagnostic {
+  const platform = options.platform ?? process.platform;
+  if (platform !== "win32") {
+    return {
+      applicable: false,
+      reason: "not_windows",
+      summary: "not applicable (bundled-marketplace staleness is Windows-specific)",
+    };
+  }
+
+  const configPath = options.configPath ?? CODEX_CONFIG_PATH;
+  let configText: string;
+  try {
+    configText = readFileSync(configPath, "utf8");
+  } catch {
+    return {
+      applicable: false,
+      reason: "config_unreadable",
+      summary: "not applicable (Codex config.toml not found or unreadable)",
+    };
+  }
+
+  const table = readMarketplaceTable(configText, OPENAI_BUNDLED_MARKETPLACE_NAME);
+  const present = table !== null;
+  const sourceType = table?.source_type ?? null;
+  const source = table?.source ?? null;
+  const isLocal = sourceType === "local" && !!source;
+  const resolvesToManifest = isLocal ? sourceResolvesToManifest(source as string) : false;
+
+  // Locate the bundled marketplace under the currently installed Codex app, so
+  // we can tell "registered path differs from the live app path" (the Windows
+  // app-update staleness signal) apart from a merely missing manifest.
+  const locateCurrent = options.locateCurrent ?? (() => locateCurrentBundledMarketplace());
+  const currentBundledPath = locateCurrent();
+  const pathMismatch = !!(
+    currentBundledPath && source && isLocal &&
+    normalizePathForCompare(currentBundledPath) !== normalizePathForCompare(source)
+  );
+
+  // Stale = a registered local bundled marketplace whose source no longer
+  // resolves to a manifest, OR whose registered path differs from the live
+  // app's bundled path (the Windows app-update signal). A missing marketplace
+  // is "not stale" but flagged separately by `present: false`.
+  const stale = present && isLocal && (!resolvesToManifest || pathMismatch);
+  // Present but not a usable local entry (wrong source_type or empty source):
+  // not "stale" in the app-update sense, but it must NOT be reported as healthy.
+  const malformed = present && !isLocal;
+
+  const bundledPlugins = COMMON_BUNDLED_PLUGINS.map(id => ({
+    id,
+    configured: new RegExp(`\\[plugins\\.(?:"${escapeRegExp(`${id}@${OPENAI_BUNDLED_MARKETPLACE_NAME}`)}")\\]`).test(configText),
+  }));
+
+  const repairTarget = currentBundledPath ?? `<current ${OPENAI_BUNDLED_MARKETPLACE_NAME} path under the installed Codex app>`;
+  const suggestedRepair = (stale || pathMismatch)
+    ? `codex plugin marketplace add ${currentBundledPath ? redactUserPath(currentBundledPath) : repairTarget}`
+    : null;
+
+  const summary = !present
+    ? `no [marketplaces.${OPENAI_BUNDLED_MARKETPLACE_NAME}] entry in Codex config`
+    : malformed
+      ? `[marketplaces.${OPENAI_BUNDLED_MARKETPLACE_NAME}] is present but not a usable local source (source_type/source missing)`
+      : !resolvesToManifest
+        ? `stale: registered ${OPENAI_BUNDLED_MARKETPLACE_NAME} source no longer resolves to a marketplace manifest`
+        : pathMismatch
+          ? `stale: registered ${OPENAI_BUNDLED_MARKETPLACE_NAME} path differs from the installed Codex app's bundled path`
+          : `ok: ${OPENAI_BUNDLED_MARKETPLACE_NAME} marketplace resolves`;
+
+  return {
+    applicable: true,
+    stale,
+    marketplace: {
+      name: OPENAI_BUNDLED_MARKETPLACE_NAME,
+      present,
+      sourceType,
+      source: source ? redactUserPath(source) : null,
+      resolvesToManifest,
+      currentBundledPath: currentBundledPath ? redactUserPath(currentBundledPath) : null,
+      pathMismatch,
+    },
+    bundledPlugins,
+    suggestedRepair,
+    summary,
+  };
+}

package/src/config.ts

@@ -99,6 +99,7 @@ const configSchema = z.object({
   providers: z.record(z.string(), providerConfigSchema),
   defaultProvider: z.string().min(1).default("openai"),
   providerContextCaps: z.record(z.string(), z.number().int().positive()).optional(),
+  contextCapValue: z.number().int().positive().optional(),
 }).passthrough().superRefine((config, ctx) => {
   for (const name of Object.keys(config.providers)) {
     if (!isValidProviderName(name)) {