[codex] Support npm marketplace plugin sources

codex-rs/app-server-protocol/src/protocol/v2/plugin.rs

@@ -744,6 +744,15 @@ pub enum PluginSource {
         ref_name: Option<String>,
         sha: Option<String>,
     },
+    #[serde(rename_all = "camelCase")]
+    #[ts(rename_all = "camelCase")]
+    Npm {
+        package: String,
+        /// Optional npm version or version range.
+        version: Option<String>,
+        /// Optional HTTPS registry URL. Authentication stays in the user's npm config.
+        registry: Option<String>,
+    },
     /// The plugin is available in the remote catalog. Download metadata is
     /// kept server-side and is not exposed through the app-server API.
     Remote,

codex-rs/app-server-protocol/src/protocol/v2/tests.rs

@@ -2834,7 +2834,7 @@ fn skills_extra_roots_set_params_rejects_relative_roots() {
 }
 
 #[test]
-fn plugin_source_serializes_local_git_and_remote_variants() {
+fn plugin_source_serializes_local_git_npm_and_remote_variants() {
     let local_path = if cfg!(windows) {
         r"C:\plugins\linear"
     } else {
@@ -2868,6 +2868,21 @@ fn plugin_source_serializes_local_git_and_remote_variants() {
         }),
     );
 
+    assert_eq!(
+        serde_json::to_value(PluginSource::Npm {
+            package: "@acme/plugin".to_string(),
+            version: Some("^1.2.0".to_string()),
+            registry: Some("https://npm.example.com".to_string()),
+        })
+        .unwrap(),
+        json!({
+            "type": "npm",
+            "package": "@acme/plugin",
+            "version": "^1.2.0",
+            "registry": "https://npm.example.com",
+        }),
+    );
+
     assert_eq!(
         serde_json::to_value(PluginSource::Remote).unwrap(),
         json!({

codex-rs/app-server/src/request_processors/plugins.rs

@@ -101,6 +101,15 @@ fn marketplace_plugin_source_to_info(source: MarketplacePluginSource) -> PluginS
             ref_name,
             sha,
         },
+        MarketplacePluginSource::Npm {
+            package,
+            version,
+            registry,
+        } => PluginSource::Npm {
+            package,
+            version,
+            registry,
+        },
     }
 }
 
@@ -134,7 +143,7 @@ fn share_context_for_source(
                 creator_name: None,
                 share_principals: None,
             }),
-        MarketplacePluginSource::Git { .. } => None,
+        MarketplacePluginSource::Git { .. } | MarketplacePluginSource::Npm { .. } => None,
     }
 }
 

codex-rs/cli/src/plugin_cmd.rs

@@ -285,6 +285,20 @@ pub async fn run_plugin_list(
                         }
                         parts.join(", ")
                     }
+                    codex_core_plugins::marketplace::MarketplacePluginSource::Npm {
+                        package,
+                        version,
+                        registry,
+                    } => {
+                        let mut parts = vec![package.clone()];
+                        if let Some(version) = version {
+                            parts.push(format!("version `{version}`"));
+                        }
+                        if let Some(registry) = registry {
+                            parts.push(format!("registry `{registry}`"));
+                        }
+                        parts.join(", ")
+                    }
                 };
                 plugin_width = plugin_width.max(plugin.id.len());
                 status_width = status_width.max(state.len());
@@ -412,6 +426,13 @@ enum JsonPluginSource {
         #[serde(skip_serializing_if = "Option::is_none")]
         sha: Option<String>,
     },
+    Npm {
+        package: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        version: Option<String>,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        registry: Option<String>,
+    },
 }
 
 impl JsonPluginSource {
@@ -437,6 +458,15 @@ impl JsonPluginSource {
                 ref_name,
                 sha,
             } => Self::Git { url, ref_name, sha },
+            MarketplacePluginSource::Npm {
+                package,
+                version,
+                registry,
+            } => Self::Npm {
+                package,
+                version,
+                registry,
+            },
         }
     }
 }

codex-rs/core-plugins/src/lib.rs

@@ -9,6 +9,7 @@ pub mod marketplace_add;
 mod marketplace_policy;
 pub mod marketplace_remove;
 pub mod marketplace_upgrade;
+mod npm_source;
 mod plugin_bundle_archive;
 mod provider;
 pub mod remote;