@meistrari/agent-core 0.1.9 → 0.1.10

package/docs/mantle-plugin-discovery.md

@@ -0,0 +1,27 @@
+# Repo-skills profiles and native plugin discovery
+
+`CodexProvider.create({ pluginsEnabled: false, ... })` disables the native
+`features.plugins` feature on every app-server connection, including model-change
+reopening and session resume. This is independent of native shell tools and the
+adapter's repository skill-root registration. Omit the option to preserve the
+native default for other consumers; authentication does not implicitly disable it.
+
+The pinned Codex source (`25af12f7e61572b0bc18ddb1008be543b91519b0`) enables plugins
+by default. Its plugin manager starts curated repository synchronization for
+non-Codex-backend authentication. The sync code includes GitHub and a
+`https://chatgpt.com/backend-api/plugins/export/curated` archive fallback:
+
+- [Native feature default](https://github.com/openai/codex/blob/25af12f7e61572b0bc18ddb1008be543b91519b0/codex-rs/features/src/lib.rs)
+- [Startup-task guard](https://github.com/openai/codex/blob/25af12f7e61572b0bc18ddb1008be543b91519b0/codex-rs/core-plugins/src/manager.rs)
+- [Curated synchronization transports](https://github.com/openai/codex/blob/25af12f7e61572b0bc18ddb1008be543b91519b0/codex-rs/core-plugins/src/startup_sync.rs)
+
+This provides a plausible non-inference explanation for concurrent GitHub and
+ChatGPT TLS handshakes observed during an agent-api Mantle turn. SNI alone does
+not establish their HTTP routes or process ownership; do not claim attribution
+or fallback exclusion solely from this source inspection.
+
+The agent-api repo-skills profile should opt out explicitly after consuming an
+exact release with this option. Rebuild its dedicated v5 image and re-onboard
+immutable provenance, then repeat native skills, continuation, model changes and
+bounded hostname observation. No existing image or bound session was changed by
+this source edit. Other consumers, Claude and v4 retain their behavior.

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@meistrari/agent-core",
     "type": "module",
-    "version": "0.1.9",
+    "version": "0.1.10",
     "packageManager": "bun@1.3.12",
     "description": "Shared contracts and runtime modules for Tela coding-agent sandboxes: agent protocol, supervisor wire protocol, resident supervisor, worker runtime client, and Claude/Codex harness adapters.",
     "license": "UNLICENSED",

package/src/agents/codex/codex-provider.ts

@@ -44,6 +44,8 @@ export interface CodexProviderConfig {
     instructions?: InstructionComposer
     /** Service-owned public model to inference model mapping. */
     resolveInferenceModel?: (model: string) => string
+    /** Native plugin/marketplace discovery. Does not disable repository skill roots. */
+    pluginsEnabled?: boolean
 }
 
 interface CodexRunHolder {
@@ -88,6 +90,7 @@ export class CodexProvider implements AgentProvider<'codex'> {
     private readonly instructions: InstructionComposer
     private readonly resolveInferenceModel: (model: string) => string
     private readonly hasInferenceModelMapping: boolean
+    private readonly pluginsEnabled: boolean | undefined
 
     private constructor(config: CodexProviderConfig) {
         this.auth = normalizeCodexAuthentication(config.auth)
@@ -98,6 +101,7 @@ export class CodexProvider implements AgentProvider<'codex'> {
         this.instructions = config.instructions ?? emptyInstructionComposer
         this.resolveInferenceModel = config.resolveInferenceModel ?? (model => model)
         this.hasInferenceModelMapping = config.resolveInferenceModel !== undefined
+        this.pluginsEnabled = config.pluginsEnabled
     }
 
     static create(config: CodexProviderConfig): CodexProvider {
@@ -386,9 +390,12 @@ export class CodexProvider implements AgentProvider<'codex'> {
             client = new CodexJsonRpcClient(this.executable, {
                 cwd,
                 environment: this.environment,
-                configOverrides: this.auth.kind === 'amazon-bedrock'
-                    ? ['cli_auth_credentials_store="ephemeral"', 'model_provider="amazon-bedrock"', `model_providers.amazon-bedrock.aws.region=${JSON.stringify(this.auth.region)}`, 'model_providers.amazon-bedrock.aws.wire_api="responses"']
-                    : undefined,
+                configOverrides: [
+                    ...(this.auth.kind === 'amazon-bedrock'
+                        ? ['cli_auth_credentials_store="ephemeral"', 'model_provider="amazon-bedrock"', `model_providers.amazon-bedrock.aws.region=${JSON.stringify(this.auth.region)}`, 'model_providers.amazon-bedrock.aws.wire_api="responses"']
+                        : []),
+                    ...(this.pluginsEnabled === undefined ? [] : [`features.plugins=${this.pluginsEnabled}`]),
+                ],
                 onMessage: (message) => {
                     messageQueue = this.enqueueMessageHandling(messageQueue, { message, holder, state, client, signal: abortController.signal })
                 },

package/src/provenance.gen.ts

@@ -1,6 +1,6 @@
 // Generated by scripts/write-provenance.ts. Do not edit by hand.
 export const generatedProvenance = {
-    version: "0.1.9",
-    sha: "2b4aae8268cb99a570e9a2d40d6086189c1aa19a",
-    buildTime: "2026-09-11T20:10:58.896Z",
+    version: "0.1.10",
+    sha: "af84feab98a91cd1cd31661c9fa3c0a72521ccf6",
+    buildTime: "2026-09-14T15:18:33.258Z",
 } as const