@meistrari/agent-core 0.1.8 → 0.1.10

package/docs/mantle-plugin-discovery.md

@@ -0,0 +1,27 @@
+# Repo-skills profiles and native plugin discovery
+
+`CodexProvider.create({ pluginsEnabled: false, ... })` disables the native
+`features.plugins` feature on every app-server connection, including model-change
+reopening and session resume. This is independent of native shell tools and the
+adapter's repository skill-root registration. Omit the option to preserve the
+native default for other consumers; authentication does not implicitly disable it.
+
+The pinned Codex source (`25af12f7e61572b0bc18ddb1008be543b91519b0`) enables plugins
+by default. Its plugin manager starts curated repository synchronization for
+non-Codex-backend authentication. The sync code includes GitHub and a
+`https://chatgpt.com/backend-api/plugins/export/curated` archive fallback:
+
+- [Native feature default](https://github.com/openai/codex/blob/25af12f7e61572b0bc18ddb1008be543b91519b0/codex-rs/features/src/lib.rs)
+- [Startup-task guard](https://github.com/openai/codex/blob/25af12f7e61572b0bc18ddb1008be543b91519b0/codex-rs/core-plugins/src/manager.rs)
+- [Curated synchronization transports](https://github.com/openai/codex/blob/25af12f7e61572b0bc18ddb1008be543b91519b0/codex-rs/core-plugins/src/startup_sync.rs)
+
+This provides a plausible non-inference explanation for concurrent GitHub and
+ChatGPT TLS handshakes observed during an agent-api Mantle turn. SNI alone does
+not establish their HTTP routes or process ownership; do not claim attribution
+or fallback exclusion solely from this source inspection.
+
+The agent-api repo-skills profile should opt out explicitly after consuming an
+exact release with this option. Rebuild its dedicated v5 image and re-onboard
+immutable provenance, then repeat native skills, continuation, model changes and
+bounded hostname observation. No existing image or bound session was changed by
+this source edit. Other consumers, Claude and v4 retain their behavior.

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@meistrari/agent-core",
     "type": "module",
-    "version": "0.1.8",
+    "version": "0.1.10",
     "packageManager": "bun@1.3.12",
     "description": "Shared contracts and runtime modules for Tela coding-agent sandboxes: agent protocol, supervisor wire protocol, resident supervisor, worker runtime client, and Claude/Codex harness adapters.",
     "license": "UNLICENSED",

package/src/agents/codex/codex-event-mapper.ts

@@ -323,7 +323,10 @@ function toolCallCompletion(item: CodexCompletedItem): { status: AgentToolCallSt
         return { status: item.status === 'failed' ? 'failed' : 'completed', output: imageGenerationResult(item) }
     if (item.type === 'commandExecution') {
         const status = item.exitCode === undefined || item.exitCode === null || item.exitCode === 0 ? 'completed' : 'failed'
-        return { status, output: commandExecutionResult(item, status), error: 'error' in item && typeof item.error === 'string' ? { message: item.error } : undefined }
+        const error = 'error' in item && typeof item.error === 'string'
+            ? { message: item.error }
+            : status === 'failed' ? { message: `Command exited with code ${item.exitCode}.` } : undefined
+        return { status, output: commandExecutionResult(item, status), error }
     }
     if (item.type === 'dynamicToolCall')
         return { status: item.success === false ? 'failed' : 'completed', output: dynamicToolResult(item) }
@@ -401,7 +404,10 @@ function hookPromptText(item: CodexHookPromptItem): string | undefined {
 function commandExecutionResult(item: Extract<CodexCompletedItem, { type: 'commandExecution' }>, status: 'completed' | 'failed'): AgentToolResult | undefined {
     // Stdout is content, not a label: whitespace and an explicitly empty
     // successful output must survive normalization into the complete step.
-    const text = item.aggregatedOutput
+    // Native build_command_execution_end_item encodes empty captured output as
+    // null, alongside a concrete exit code. That authoritative terminal receipt
+    // differs from an incomplete item whose output and exit code are both absent.
+    const text = item.aggregatedOutput ?? (Number.isInteger(item.exitCode) ? '' : undefined)
     if (typeof text !== 'string')
         return undefined
 

package/src/agents/codex/codex-provider.ts

@@ -44,6 +44,8 @@ export interface CodexProviderConfig {
     instructions?: InstructionComposer
     /** Service-owned public model to inference model mapping. */
     resolveInferenceModel?: (model: string) => string
+    /** Native plugin/marketplace discovery. Does not disable repository skill roots. */
+    pluginsEnabled?: boolean
 }
 
 interface CodexRunHolder {
@@ -88,6 +90,7 @@ export class CodexProvider implements AgentProvider<'codex'> {
     private readonly instructions: InstructionComposer
     private readonly resolveInferenceModel: (model: string) => string
     private readonly hasInferenceModelMapping: boolean
+    private readonly pluginsEnabled: boolean | undefined
 
     private constructor(config: CodexProviderConfig) {
         this.auth = normalizeCodexAuthentication(config.auth)
@@ -98,6 +101,7 @@ export class CodexProvider implements AgentProvider<'codex'> {
         this.instructions = config.instructions ?? emptyInstructionComposer
         this.resolveInferenceModel = config.resolveInferenceModel ?? (model => model)
         this.hasInferenceModelMapping = config.resolveInferenceModel !== undefined
+        this.pluginsEnabled = config.pluginsEnabled
     }
 
     static create(config: CodexProviderConfig): CodexProvider {
@@ -386,9 +390,12 @@ export class CodexProvider implements AgentProvider<'codex'> {
             client = new CodexJsonRpcClient(this.executable, {
                 cwd,
                 environment: this.environment,
-                configOverrides: this.auth.kind === 'amazon-bedrock'
-                    ? ['cli_auth_credentials_store="ephemeral"', 'model_provider="amazon-bedrock"', `model_providers.amazon-bedrock.aws.region=${JSON.stringify(this.auth.region)}`, 'model_providers.amazon-bedrock.aws.wire_api="responses"']
-                    : undefined,
+                configOverrides: [
+                    ...(this.auth.kind === 'amazon-bedrock'
+                        ? ['cli_auth_credentials_store="ephemeral"', 'model_provider="amazon-bedrock"', `model_providers.amazon-bedrock.aws.region=${JSON.stringify(this.auth.region)}`, 'model_providers.amazon-bedrock.aws.wire_api="responses"']
+                        : []),
+                    ...(this.pluginsEnabled === undefined ? [] : [`features.plugins=${this.pluginsEnabled}`]),
+                ],
                 onMessage: (message) => {
                     messageQueue = this.enqueueMessageHandling(messageQueue, { message, holder, state, client, signal: abortController.signal })
                 },

package/src/provenance.gen.ts

@@ -1,6 +1,6 @@
 // Generated by scripts/write-provenance.ts. Do not edit by hand.
 export const generatedProvenance = {
-    version: "0.1.8",
-    sha: "ff5b7ece6b3b115d420a21046bd47b465813132b",
-    buildTime: "2026-09-10T20:15:33.140Z",
+    version: "0.1.10",
+    sha: "af84feab98a91cd1cd31661c9fa3c0a72521ccf6",
+    buildTime: "2026-09-14T15:18:33.258Z",
 } as const