[codex] Support npm marketplace plugin sources#29375
Conversation
| @@ -748,6 +774,117 @@ fn normalize_optional_git_selector(value: &Option<String>) -> Option<String> { | |||
| .map(str::to_string) | |||
| } | |||
|
|
|||
| fn normalize_npm_package( | |||
There was a problem hiding this comment.
main npm validator
| @@ -0,0 +1,229 @@ | |||
| use crate::plugin_bundle_archive::unpack_plugin_bundle_tar_gz; | |||
There was a problem hiding this comment.
main fetcher
charlesgong-openai
force-pushed
the
dev/charlesgong/support-npm-marketplace-sources
branch
2 times, most recently
from
9db763c to
8f1493d
Compare
charlesgong-openai
force-pushed
the
dev/charlesgong/support-npm-marketplace-sources
branch
from
cc63980 to
048cae4
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 048cae405c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
Codex Review: Didn't find any major issues. 👍 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
charlesgong-openai
deleted the
dev/charlesgong/support-npm-marketplace-sources
branch
2 participants
Why
Marketplace source deserialization treated
{"source":"npm", ...}as unsupported. The loader logged and skipped the entry, so npm-backed plugins never appeared inplugin list --availableandplugin addreturned "plugin not found".Codex plugins are installed from a plugin root, not from an npm dependency tree. For npm-backed marketplace entries, Codex should fetch the published package contents without running package scripts or installing unrelated dependencies.
What changed
npmmarketplace plugin sources withpackage, optional semverversionor version range, and optional HTTPSregistry.npm pack --ignore-scripts, then unpack the resulting tarball through the existing hardened plugin bundle extractor.package/archive root, and verify the extractedpackage.jsonname matches the requested package before installing.PluginSource, TUI source summaries, regenerated schema fixtures, and app-server documentation in sync.Impact
Marketplaces can distribute Codex plugins from public or configured private HTTPS npm registries using the same install flow as existing materialized plugin sources.
npmmust be available onPATHwhen an npm-backed plugin is installed.Fixes #27831
Validation
just write-app-server-schemajust test -p codex-core-plugins -p codex-app-server-protocol -p codex-app-server -p codex-cli1739 passed,11 failed, and6 timed out; the failures were unrelated local app-server environment failures fromsandbox-exec: sandbox_apply: Operation not permittedplus one missingtest_stdio_serverhelper binary.CODEX_HOMEto exercise the real npm materialization path end to end.