@kodelyth/codex 2026.5.42 → 2026.6.1

package/src/app-server/plugin-activation.test.ts

@@ -1,336 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-import { CodexAppInventoryCache } from "./app-inventory-cache.js";
-import { CODEX_PLUGINS_MARKETPLACE_NAME, type ResolvedCodexPluginPolicy } from "./config.js";
-import {
-  ensureCodexAppsSubstrateConfig,
-  ensureCodexPluginActivation,
-  upsertTomlBoolean,
-} from "./plugin-activation.js";
-import type { v2 } from "./protocol.js";
-
-describe("Codex plugin activation", () => {
-  function expectActivationResult(
-    result: Awaited<ReturnType<typeof ensureCodexPluginActivation>>,
-    expected: { ok: boolean; reason: string; installAttempted: boolean },
-  ) {
-    expect(result.ok).toBe(expected.ok);
-    expect(result.reason).toBe(expected.reason);
-    expect(result.installAttempted).toBe(expected.installAttempted);
-  }
-
-  function expectBooleanParam(params: unknown, key: string, expected: boolean) {
-    expect((params as Record<string, unknown> | undefined)?.[key]).toBe(expected);
-  }
-
-  it("skips plugin/install when the migrated plugin is already active", async () => {
-    const calls: string[] = [];
-    const result = await ensureCodexPluginActivation({
-      identity: identity("google-calendar"),
-      request: async (method) => {
-        calls.push(method);
-        if (method === "plugin/list") {
-          return pluginList([pluginSummary("google-calendar", { installed: true, enabled: true })]);
-        }
-        throw new Error(`unexpected request ${method}`);
-      },
-    });
-
-    expectActivationResult(result, {
-      ok: true,
-      reason: "already_active",
-      installAttempted: false,
-    });
-    expect(calls).toEqual(["plugin/list"]);
-  });
-
-  it("can reinstall an already active plugin when migration explicitly applies it", async () => {
-    const calls: string[] = [];
-    const result = await ensureCodexPluginActivation({
-      identity: identity("google-calendar"),
-      installEvenIfActive: true,
-      request: async (method, params) => {
-        calls.push(method);
-        if (method === "plugin/list") {
-          return pluginList([pluginSummary("google-calendar", { installed: true, enabled: true })]);
-        }
-        if (method === "plugin/install") {
-          expect(params).toEqual({
-            marketplacePath: "/marketplaces/openai-curated",
-            pluginName: "google-calendar",
-          });
-          return { authPolicy: "ON_USE", appsNeedingAuth: [] } satisfies v2.PluginInstallResponse;
-        }
-        if (method === "skills/list") {
-          return { data: [] } satisfies v2.SkillsListResponse;
-        }
-        if (method === "hooks/list") {
-          return { data: [] } satisfies v2.HooksListResponse;
-        }
-        if (method === "config/mcpServer/reload") {
-          return {};
-        }
-        throw new Error(`unexpected request ${method}`);
-      },
-    });
-
-    expectActivationResult(result, {
-      ok: true,
-      reason: "already_active",
-      installAttempted: true,
-    });
-    expect(calls).toEqual([
-      "plugin/list",
-      "plugin/install",
-      "plugin/list",
-      "skills/list",
-      "hooks/list",
-      "config/mcpServer/reload",
-    ]);
-  });
-
-  it("installs a migration-authorized local curated plugin and refreshes runtime state", async () => {
-    const calls: Array<{ method: string; params: unknown }> = [];
-    const appCache = new CodexAppInventoryCache();
-    const result = await ensureCodexPluginActivation({
-      identity: identity("google-calendar"),
-      appCache,
-      appCacheKey: "runtime",
-      request: async (method, params) => {
-        calls.push({ method, params });
-        if (method === "plugin/list") {
-          return pluginList([
-            pluginSummary("google-calendar", { installed: false, enabled: false }),
-          ]);
-        }
-        if (method === "plugin/install") {
-          expect(params).toEqual({
-            marketplacePath: "/marketplaces/openai-curated",
-            pluginName: "google-calendar",
-          });
-          return { authPolicy: "ON_USE", appsNeedingAuth: [] } satisfies v2.PluginInstallResponse;
-        }
-        if (method === "skills/list") {
-          expectBooleanParam(params, "forceReload", true);
-          return { data: [] } satisfies v2.SkillsListResponse;
-        }
-        if (method === "hooks/list") {
-          return { data: [] } satisfies v2.HooksListResponse;
-        }
-        if (method === "config/mcpServer/reload") {
-          return {};
-        }
-        if (method === "app/list") {
-          expectBooleanParam(params, "forceRefetch", true);
-          return { data: [], nextCursor: null } satisfies v2.AppsListResponse;
-        }
-        throw new Error(`unexpected request ${method}`);
-      },
-    });
-
-    expectActivationResult(result, {
-      ok: true,
-      reason: "installed",
-      installAttempted: true,
-    });
-    expect(calls.map((call) => call.method)).toEqual([
-      "plugin/list",
-      "plugin/install",
-      "plugin/list",
-      "skills/list",
-      "hooks/list",
-      "config/mcpServer/reload",
-      "app/list",
-    ]);
-    expect(appCache.getRevision()).toBeGreaterThan(0);
-  });
-
-  it("keeps activation fail-closed when post-install app inventory refresh fails", async () => {
-    const appCache = new CodexAppInventoryCache();
-    const result = await ensureCodexPluginActivation({
-      identity: identity("google-calendar"),
-      appCache,
-      appCacheKey: "runtime",
-      request: async (method) => {
-        if (method === "plugin/list") {
-          return pluginList([
-            pluginSummary("google-calendar", { installed: false, enabled: false }),
-          ]);
-        }
-        if (method === "plugin/install") {
-          return { authPolicy: "ON_USE", appsNeedingAuth: [] } satisfies v2.PluginInstallResponse;
-        }
-        if (method === "skills/list") {
-          return { data: [] } satisfies v2.SkillsListResponse;
-        }
-        if (method === "hooks/list") {
-          return { data: [] } satisfies v2.HooksListResponse;
-        }
-        if (method === "config/mcpServer/reload") {
-          return {};
-        }
-        if (method === "app/list") {
-          throw new Error("app/list unavailable");
-        }
-        throw new Error(`unexpected request ${method}`);
-      },
-    });
-
-    expectActivationResult(result, {
-      ok: true,
-      reason: "installed",
-      installAttempted: true,
-    });
-    expect(result.diagnostics).toEqual([
-      {
-        message: "Codex app inventory refresh skipped: app/list unavailable",
-      },
-    ]);
-    expect(appCache.getRevision()).toBeGreaterThan(0);
-  });
-
-  it("reports post-install runtime refresh failures without hiding the install attempt", async () => {
-    const result = await ensureCodexPluginActivation({
-      identity: identity("google-calendar"),
-      request: async (method) => {
-        if (method === "plugin/list") {
-          return pluginList([
-            pluginSummary("google-calendar", { installed: false, enabled: false }),
-          ]);
-        }
-        if (method === "plugin/install") {
-          return { authPolicy: "ON_USE", appsNeedingAuth: [] } satisfies v2.PluginInstallResponse;
-        }
-        if (method === "skills/list") {
-          throw new Error("skills/list unavailable");
-        }
-        throw new Error(`unexpected request ${method}`);
-      },
-    });
-
-    expectActivationResult(result, {
-      ok: false,
-      reason: "refresh_failed",
-      installAttempted: true,
-    });
-    expect(result.diagnostics).toEqual([
-      {
-        message: "Codex plugin runtime refresh failed after install: skills/list unavailable",
-      },
-    ]);
-  });
-
-  it("installs from a remote curated marketplace when no local marketplace path is present", async () => {
-    const calls: Array<{ method: string; params: unknown }> = [];
-    const result = await ensureCodexPluginActivation({
-      identity: identity("google-calendar"),
-      request: async (method, params) => {
-        calls.push({ method, params });
-        if (method === "plugin/list") {
-          return {
-            ...pluginList([pluginSummary("google-calendar", { installed: false, enabled: false })]),
-            marketplaces: [
-              {
-                name: CODEX_PLUGINS_MARKETPLACE_NAME,
-                path: null,
-                interface: null,
-                plugins: [pluginSummary("google-calendar", { installed: false, enabled: false })],
-              },
-            ],
-          } satisfies v2.PluginListResponse;
-        }
-        if (method === "plugin/install") {
-          expect(params).toEqual({
-            remoteMarketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
-            pluginName: "google-calendar",
-          });
-          return { authPolicy: "ON_USE", appsNeedingAuth: [] } satisfies v2.PluginInstallResponse;
-        }
-        if (method === "skills/list") {
-          return { data: [] } satisfies v2.SkillsListResponse;
-        }
-        if (method === "hooks/list") {
-          return { data: [] } satisfies v2.HooksListResponse;
-        }
-        if (method === "config/mcpServer/reload") {
-          return {};
-        }
-        throw new Error(`unexpected request ${method}`);
-      },
-    });
-
-    expectActivationResult(result, {
-      ok: true,
-      reason: "installed",
-      installAttempted: true,
-    });
-    expect(calls.map((call) => call.method)).toEqual([
-      "plugin/list",
-      "plugin/install",
-      "plugin/list",
-      "skills/list",
-      "hooks/list",
-      "config/mcpServer/reload",
-    ]);
-  });
-
-  it("upserts native apps substrate config without clobbering other toml", async () => {
-    const existing = 'model = "gpt-5.5"\n\n[features]\nother = true\n';
-    expect(upsertTomlBoolean(existing, "features", "apps", true)).toBe(
-      'model = "gpt-5.5"\n\n[features]\nother = true\napps = true\n',
-    );
-
-    const writes: Array<{ path: string; content: string }> = [];
-    const result = await ensureCodexAppsSubstrateConfig({
-      codexHome: "/codex-home",
-      readFile: vi.fn(async () => existing),
-      mkdir: vi.fn(async () => undefined),
-      writeFile: vi.fn(async (filePath, content) => {
-        writes.push({ path: String(filePath), content: String(content) });
-      }),
-    });
-
-    expect(result).toEqual({ changed: true, configPath: "/codex-home/config.toml" });
-    expect(writes[0]?.content).toContain("[features]\nother = true\napps = true");
-    expect(writes[0]?.content).toContain("[apps._default]\nenabled = true");
-  });
-});
-
-function identity(pluginName: string): ResolvedCodexPluginPolicy {
-  return {
-    configKey: pluginName,
-    marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
-    pluginName,
-    enabled: true,
-    allowDestructiveActions: false,
-  };
-}
-
-function pluginList(plugins: v2.PluginSummary[]): v2.PluginListResponse {
-  return {
-    marketplaces: [
-      {
-        name: CODEX_PLUGINS_MARKETPLACE_NAME,
-        path: "/marketplaces/openai-curated",
-        interface: null,
-        plugins,
-      },
-    ],
-    marketplaceLoadErrors: [],
-    featuredPluginIds: [],
-  };
-}
-
-function pluginSummary(id: string, overrides: Partial<v2.PluginSummary> = {}): v2.PluginSummary {
-  return {
-    id,
-    name: id,
-    source: { type: "remote" },
-    installed: false,
-    enabled: false,
-    installPolicy: "AVAILABLE",
-    authPolicy: "ON_USE",
-    availability: "AVAILABLE",
-    interface: null,
-    ...overrides,
-  };
-}

package/src/app-server/plugin-activation.ts

@@ -1,283 +0,0 @@
-import fs from "node:fs/promises";
-import path from "node:path";
-import {
-  type CodexAppInventoryCache,
-  type CodexAppInventoryRequest,
-} from "./app-inventory-cache.js";
-import { CODEX_PLUGINS_MARKETPLACE_NAME, type ResolvedCodexPluginPolicy } from "./config.js";
-import {
-  findOpenAiCuratedPluginSummary,
-  pluginReadParams,
-  type CodexPluginMarketplaceRef,
-  type CodexPluginRuntimeRequest,
-} from "./plugin-inventory.js";
-import type { v2 } from "./protocol.js";
-
-export type CodexPluginActivationReason =
-  | "already_active"
-  | "installed"
-  | "disabled"
-  | "marketplace_missing"
-  | "plugin_missing"
-  | "auth_required"
-  | "refresh_failed";
-
-export type CodexPluginActivationDiagnostic = {
-  message: string;
-};
-
-export type CodexPluginActivationResult = {
-  identity: ResolvedCodexPluginPolicy;
-  ok: boolean;
-  reason: CodexPluginActivationReason;
-  installAttempted: boolean;
-  marketplace?: CodexPluginMarketplaceRef;
-  installResponse?: v2.PluginInstallResponse;
-  diagnostics: CodexPluginActivationDiagnostic[];
-};
-
-export type EnsureCodexPluginActivationParams = {
-  identity: ResolvedCodexPluginPolicy;
-  request: CodexPluginRuntimeRequest;
-  appCache?: CodexAppInventoryCache;
-  appCacheKey?: string;
-  installEvenIfActive?: boolean;
-};
-
-export type CodexPluginRuntimeRefreshResult = {
-  diagnostics: CodexPluginActivationDiagnostic[];
-};
-
-export async function ensureCodexPluginActivation(
-  params: EnsureCodexPluginActivationParams,
-): Promise<CodexPluginActivationResult> {
-  if (params.identity.marketplaceName !== CODEX_PLUGINS_MARKETPLACE_NAME) {
-    return activationFailure(params.identity, "marketplace_missing", {
-      message: "Only " + CODEX_PLUGINS_MARKETPLACE_NAME + " plugins can be activated.",
-    });
-  }
-
-  const listed = (await params.request("plugin/list", {
-    cwds: [],
-  } satisfies v2.PluginListParams)) as v2.PluginListResponse;
-  const resolved = findOpenAiCuratedPluginSummary(listed, params.identity.pluginName);
-  if (!resolved) {
-    const hasCuratedMarketplace = listed.marketplaces.some(
-      (marketplace) => marketplace.name === CODEX_PLUGINS_MARKETPLACE_NAME,
-    );
-    if (!hasCuratedMarketplace) {
-      return activationFailure(params.identity, "marketplace_missing", {
-        message: `Codex marketplace ${CODEX_PLUGINS_MARKETPLACE_NAME} was not found.`,
-      });
-    }
-    return activationFailure(params.identity, "plugin_missing", {
-      message: `${params.identity.pluginName} was not found in ${CODEX_PLUGINS_MARKETPLACE_NAME}.`,
-    });
-  }
-
-  if (resolved.summary.installed && resolved.summary.enabled && !params.installEvenIfActive) {
-    return {
-      identity: params.identity,
-      ok: true,
-      reason: "already_active",
-      installAttempted: false,
-      marketplace: resolved.marketplace,
-      diagnostics: [],
-    };
-  }
-
-  const installResponse = (await params.request(
-    "plugin/install",
-    pluginReadParams(
-      resolved.marketplace,
-      params.identity.pluginName,
-    ) satisfies v2.PluginInstallParams,
-  )) as v2.PluginInstallResponse;
-  const refreshDiagnostics: CodexPluginActivationDiagnostic[] = [];
-  let refreshFailed = false;
-  try {
-    const refreshResult = await refreshCodexPluginRuntimeState({
-      request: params.request,
-      appCache: params.appCache,
-      appCacheKey: params.appCacheKey,
-    });
-    refreshDiagnostics.push(...refreshResult.diagnostics);
-  } catch (error) {
-    refreshFailed = true;
-    refreshDiagnostics.push({
-      message: `Codex plugin runtime refresh failed after install: ${
-        error instanceof Error ? error.message : String(error)
-      }`,
-    });
-  }
-  const authRequired = installResponse.appsNeedingAuth.length > 0;
-  return {
-    identity: params.identity,
-    ok: !authRequired && !refreshFailed,
-    reason: refreshFailed
-      ? "refresh_failed"
-      : authRequired
-        ? "auth_required"
-        : resolved.summary.installed && resolved.summary.enabled
-          ? "already_active"
-          : "installed",
-    installAttempted: true,
-    marketplace: resolved.marketplace,
-    installResponse,
-    diagnostics: [
-      ...refreshDiagnostics,
-      ...installResponse.appsNeedingAuth.map((app) => ({
-        message: `${app.name} requires app authentication before plugin tools are exposed.`,
-      })),
-    ],
-  };
-}
-
-export async function refreshCodexPluginRuntimeState(params: {
-  request: CodexPluginRuntimeRequest;
-  appCache?: CodexAppInventoryCache;
-  appCacheKey?: string;
-}): Promise<CodexPluginRuntimeRefreshResult> {
-  const diagnostics: CodexPluginActivationDiagnostic[] = [];
-  await params.request("plugin/list", {
-    cwds: [],
-  } satisfies v2.PluginListParams);
-  await params.request("skills/list", {
-    cwds: [],
-    forceReload: true,
-  } satisfies v2.SkillsListParams);
-  try {
-    await params.request("hooks/list", {
-      cwds: [],
-    } satisfies v2.HooksListParams);
-  } catch (error) {
-    diagnostics.push({
-      message: `Codex hooks refresh skipped: ${error instanceof Error ? error.message : String(error)}`,
-    });
-  }
-  await params.request("config/mcpServer/reload", undefined);
-
-  if (params.appCache && params.appCacheKey) {
-    params.appCache.invalidate(params.appCacheKey, "Codex plugin activation changed app inventory");
-    const request: CodexAppInventoryRequest = async (method, requestParams) =>
-      (await params.request(method, requestParams)) as v2.AppsListResponse;
-    try {
-      await params.appCache.refreshNow({
-        key: params.appCacheKey,
-        request,
-        forceRefetch: true,
-      });
-    } catch (error) {
-      diagnostics.push({
-        message: `Codex app inventory refresh skipped: ${
-          error instanceof Error ? error.message : String(error)
-        }`,
-      });
-    }
-  }
-
-  return { diagnostics };
-}
-
-export async function ensureCodexAppsSubstrateConfig(params: {
-  codexHome: string;
-  readFile?: (filePath: string, encoding: "utf8") => Promise<string>;
-  writeFile?: (filePath: string, content: string, encoding: "utf8") => Promise<void>;
-  mkdir?: (dirPath: string, options: { recursive: true }) => Promise<unknown>;
-}): Promise<{ changed: boolean; configPath: string }> {
-  const readFile = params.readFile ?? ((filePath, encoding) => fs.readFile(filePath, encoding));
-  const writeFile =
-    params.writeFile ??
-    ((filePath, content, encoding) => fs.writeFile(filePath, content, encoding));
-  const mkdir = params.mkdir ?? ((dirPath, options) => fs.mkdir(dirPath, options));
-  const configPath = path.join(params.codexHome, "config.toml");
-  let current = "";
-  try {
-    current = await readFile(configPath, "utf8");
-  } catch (error) {
-    if (!isEnoent(error)) {
-      throw error;
-    }
-  }
-
-  const next = upsertTomlBoolean(
-    upsertTomlBoolean(current, "features", "apps", true),
-    "apps._default",
-    "enabled",
-    true,
-  );
-  if (next === current) {
-    return { changed: false, configPath };
-  }
-  await mkdir(path.dirname(configPath), { recursive: true });
-  await writeFile(configPath, next, "utf8");
-  return { changed: true, configPath };
-}
-
-export function upsertTomlBoolean(
-  source: string,
-  section: string,
-  key: string,
-  value: boolean,
-): string {
-  const lines = source.replace(/\r\n/g, "\n").split("\n");
-  if (lines.length > 0 && lines.at(-1) === "") {
-    lines.pop();
-  }
-  const sectionHeaderPattern = new RegExp(`^\\s*\\[${escapeRegExp(section)}\\]\\s*(?:#.*)?$`);
-  const anySectionPattern = /^\s*\[[^\]]+\]\s*(?:#.*)?$/;
-  const keyPattern = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`);
-  const desiredLine = `${key} = ${value ? "true" : "false"}`;
-  const sectionStart = lines.findIndex((line) => sectionHeaderPattern.test(line));
-  if (sectionStart === -1) {
-    const nextLines = [...lines];
-    if (nextLines.length > 0 && nextLines.at(-1)?.trim()) {
-      nextLines.push("");
-    }
-    nextLines.push(`[${section}]`, desiredLine);
-    return `${nextLines.join("\n")}\n`;
-  }
-
-  let sectionEnd = lines.length;
-  for (let index = sectionStart + 1; index < lines.length; index += 1) {
-    if (anySectionPattern.test(lines[index] ?? "")) {
-      sectionEnd = index;
-      break;
-    }
-  }
-  for (let index = sectionStart + 1; index < sectionEnd; index += 1) {
-    if (keyPattern.test(lines[index] ?? "")) {
-      if (lines[index] === desiredLine) {
-        return `${lines.join("\n")}\n`;
-      }
-      const nextLines = [...lines];
-      nextLines[index] = desiredLine;
-      return `${nextLines.join("\n")}\n`;
-    }
-  }
-  const nextLines = [...lines];
-  nextLines.splice(sectionEnd, 0, desiredLine);
-  return `${nextLines.join("\n")}\n`;
-}
-
-function activationFailure(
-  identity: ResolvedCodexPluginPolicy,
-  reason: CodexPluginActivationReason,
-  diagnostic: CodexPluginActivationDiagnostic,
-): CodexPluginActivationResult {
-  return {
-    identity,
-    ok: false,
-    reason,
-    installAttempted: false,
-    diagnostics: [diagnostic],
-  };
-}
-
-function isEnoent(error: unknown): boolean {
-  return Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
-}
-
-function escapeRegExp(value: string): string {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}

package/src/app-server/plugin-app-cache-key.ts

@@ -1,74 +0,0 @@
-import { createHash } from "node:crypto";
-import {
-  buildCodexAppInventoryCacheKey,
-  type CodexAppInventoryCacheKeyInput,
-} from "./app-inventory-cache.js";
-import { resolveCodexAppServerHomeDir } from "./auth-bridge.js";
-import type { CodexAppServerRuntimeOptions, CodexAppServerStartOptions } from "./config.js";
-
-export type CodexPluginAppCacheKeyParams = Omit<
-  CodexAppInventoryCacheKeyInput,
-  "codexHome" | "endpoint"
-> & {
-  appServer: Pick<CodexAppServerRuntimeOptions, "start">;
-  agentDir?: string;
-};
-
-export function buildCodexPluginAppCacheKey(params: CodexPluginAppCacheKeyParams): string {
-  return buildCodexAppInventoryCacheKey({
-    codexHome: resolveCodexPluginAppCacheCodexHome(params.appServer, params.agentDir),
-    endpoint: resolveCodexPluginAppCacheEndpoint(params.appServer),
-    authProfileId: params.authProfileId,
-    accountId: params.accountId,
-    envApiKeyFingerprint: params.envApiKeyFingerprint,
-    appServerVersion: params.appServerVersion,
-  });
-}
-
-export function resolveCodexPluginAppCacheEndpoint(
-  appServer: Pick<CodexAppServerRuntimeOptions, "start">,
-): string {
-  return JSON.stringify({
-    transport: appServer.start.transport,
-    command: appServer.start.command,
-    args: appServer.start.args,
-    url: appServer.start.url ?? null,
-    credentialFingerprint: fingerprintCodexPluginAppCacheCredentials(appServer.start),
-  });
-}
-
-export function resolveCodexPluginAppCacheCodexHome(
-  appServer: Pick<CodexAppServerRuntimeOptions, "start">,
-  agentDir?: string,
-): string | undefined {
-  const configuredCodexHome = appServer.start.env?.CODEX_HOME?.trim();
-  if (configuredCodexHome) {
-    return configuredCodexHome;
-  }
-  return appServer.start.transport === "stdio" && agentDir
-    ? resolveCodexAppServerHomeDir(agentDir)
-    : undefined;
-}
-
-function fingerprintCodexPluginAppCacheCredentials(
-  startOptions: CodexAppServerStartOptions,
-): string | null {
-  const authToken = startOptions.authToken ?? "";
-  const headers = Object.entries(startOptions.headers)
-    .map(([key, value]) => [key.toLowerCase(), value] as const)
-    .toSorted(([left], [right]) => left.localeCompare(right));
-  if (!authToken && headers.length === 0) {
-    return null;
-  }
-  const hash = createHash("sha256");
-  hash.update("klaw:codex:plugin-app-cache-credentials:v1");
-  hash.update("\0");
-  hash.update(authToken);
-  for (const [key, value] of headers) {
-    hash.update("\0");
-    hash.update(key);
-    hash.update("\0");
-    hash.update(value);
-  }
-  return `sha256:${hash.digest("hex")}`;
-}