[codex-core-plugins] Remote Plugin ID Persisted to File

[jameswt-oai]

This PR

Remote plugin analytics cannot rely only on the in-memory installed-plugin snapshot because that snapshot is refreshed asynchronously after startup. This PR persists the authoritative backend identity alongside each cached remote plugin bundle so later consumers can resolve it without a network request.

Behavior

• Store Codex-owned remote installation metadata in an atomic .codex-remote-plugin-install.json sidecar under the plugin cache root.

• Use a versioned, snake_case schema:

  {
    "schema_version": 1,
    "remote_plugin_id": "plugins~Plugin_..."
  }

• Write the metadata during remote bundle installation.

• Backfill it when bundle sync finds an already-current cached bundle.

• Clear it when a generic/local install replaces the cache.

• Let existing uninstall and stale-cache removal delete it with the plugin cache root.

• Reject unsupported schema versions rather than silently misreading future formats.

This PR does not change analytics serialization or event behavior.

Review surface

The implementation is limited to four codex-core-plugins files:

• store.rs: owns the versioned sidecar read/write/remove lifecycle.
• remote_bundle.rs: persists the backend ID after a remote bundle install.
• remote/remote_installed_plugin_sync.rs: backfills metadata for an already-current cached bundle.
• Tests cover the storage lifecycle and both remote write paths.

Testing / Validation

Automated

• just test -p codex-core-plugins (268 tests passed)
• just fix -p codex-core-plugins passes with one pre-existing large_enum_variant warning in manifest.rs.
• Coverage verifies the exact filename and JSON schema, identity replacement, local reinstall clearing, uninstall cleanup, remote bundle installation, unsupported schema rejection, and installed-plugin sync backfill.

Live manual validation

Validated the production app-server RPC path with an isolated temporary CODEX_HOME and the PR-built Codex binary. The app-server communicated over stdio and did not bind a port.

Test plugin: plugins~Plugin_b80dd84519148191a409cde181c9b3d6 (build-macos-apps@openai-curated-remote).

1. Confirmed plugin/read initially reported the plugin uninstalled.

2. Installed it through plugin/install and confirmed version 0.1.4 was cached.

3. Verified $CODEX_HOME/plugins/cache/openai-curated-remote/build-macos-apps/.codex-remote-plugin-install.json was created beside the 0.1.4/ bundle directory with mode 0600 and the expected contents:

   {
     "schema_version": 1,
     "remote_plugin_id": "plugins~Plugin_b80dd84519148191a409cde181c9b3d6"
   }

4. Deleted only the sidecar, restarted the app-server, and confirmed installed-plugin startup sync recreated it with the same contents.

5. Uninstalled through plugin/uninstall, confirmed plugin/read returned installed: false, and verified the local plugin cache root was removed.

6. Restored the account's original uninstalled state and removed the isolated home and copied credentials.

Split Overview

main
├── #27093  Debug analytics capture                     merged
│   └── #27099  Non-mutating plugin smoke               merged
│       └── #27100  Remote install/uninstall smoke      merged
└── #27102  Plugin telemetry metadata refactor          merged
    └── #27669  Persist remote plugin identity           ← this PR

Next:
└── Final PR: add explicit local and remote IDs to plugin analytics

This PR is based directly on main; prerequisite #27102 has merged. The original combined #26281 remains the aggregate reference until the final replacement PR is published.

[jameswt-oai]

/merge