default destructive-action policy for configured plugin app elicitations.

configured plugin entry when global `codexPlugins.enabled` is also true.

stable marketplace identity, required with `pluginName` for every resolved

entry. Supports `"openai-curated"` and `"workspace-directory"`. Entries

missing either identity field are ignored.

Codex plugin identity, required with `marketplaceName`. A

`workspace-directory` entry must use the exact marketplace-qualified

`summary.id` returned by `plugin/list`, for example

`"example-plugin@workspace-directory"`.

entries written by migration are the durable curated install and repair

eligibility set. Manually configured `workspace-directory` entries must already

be installed and enabled, and their owned apps must be accessible; OpenClaw

does not install or authenticate them. If Codex rejects the explicit workspace

catalog request, enabled workspace entries fail closed with

`marketplace_missing` while curated entries from the default catalog remain

available. `plugins["*"]` is not supported, there is no `install` switch, and

local `marketplacePath` values are intentionally not config fields because they

are host-specific. See

[Native Codex plugins](/plugins/codex-native-plugins) for app-server version and

readiness requirements.

summary: "Configure native Codex plugins for Codex-mode OpenClaw agents"

- You are configuring an existing workspace-directory Codex plugin

- Migration supports only `openai-curated` plugins that it observed as

- Manually configured `workspace-directory` plugins require a Codex app-server

whose `plugin/list` accepts `marketplaceKinds` and whose pathless workspace

summaries include `remotePluginId`. The plugin must already be installed and

enabled, and its owned apps must be accessible in `app/list`.

Migration remains limited to `openai-curated`. To use an existing

`workspace-directory` plugin, add it manually with the exact

marketplace-qualified `summary.id` returned by `plugin/list`. For example, if

Codex returns `example-plugin@workspace-directory`, configure that complete

value instead of its display name:

{

plugins: {

entries: {

codex: {

enabled: true,

config: {

codexPlugins: {

enabled: true,

plugins: {

"example-plugin": {

enabled: true,

marketplaceName: "workspace-directory",

pluginName: "example-plugin@workspace-directory",

},

},

},

},

},

},

},

}

OpenClaw does not call `plugin/install` or start authentication for a

`workspace-directory` plugin. Install, enable, and authenticate it in Codex

before adding or enabling the OpenClaw policy. OpenClaw keeps apps hidden when

the response omits the exact marketplace, plugin ID, detail ID, or app-readiness

evidence. If Codex rejects the explicit workspace `plugin/list` request,

OpenClaw reports `marketplace_missing` for each enabled workspace plugin and

keeps any independently discovered curated plugins available.

switch. If a curated plugin was written disabled because migration returned

For a `workspace-directory` entry, enabling it here changes only OpenClaw

policy; the plugin and app must already be active in Codex.

| State | Meaning |

| ---------- | ---------------------------------------------------------------------------------------------------------------------------------- |

| Installed | Codex has the plugin bundle in the target app-server runtime. |

| Enabled | Codex reports the plugin enabled, and OpenClaw config allows it for Codex harness turns. |

| Accessible | Codex app-server confirms the plugin's app entries are available for the active account and map to the configured plugin identity. |

For `openai-curated` plugins, migration is the durable install/eligibility

step:

For `workspace-directory` plugins, setup happens outside OpenClaw. OpenClaw

queries that marketplace only when at least one enabled workspace entry is

configured, resolves each plugin by exact `summary.id`, and reuses the existing

`plugin/read` ownership and `app/list` readiness checks. An uninstalled,

disabled, inaccessible, or unauthenticated plugin exposes no apps; OpenClaw

does not attempt installation or authentication.

Runtime app inventory is the target-session accessibility check for both

migrated curated plugins and manually configured workspace plugins. Codex

harness session setup computes a restrictive thread app config from the enabled

and accessible plugin apps; it is not recomputed on every turn, so

`/codex plugins enable`/`disable` only affect

- Runtime also supports explicit `workspace-directory` entries on app-server

builds whose `plugin/list` implements `marketplaceKinds` and returns

`remotePluginId` for pathless workspace summaries. These entries must use

their exact marketplace-qualified `summary.id` and must already be installed,

enabled, and app-accessible. A rejected workspace list request produces the

existing per-plugin `marketplace_missing` diagnostic; missing marketplace,

plugin, detail, or app evidence exposes no workspace app. Curated inventory

from the default list request remains usable.

- Non-curated marketplaces, cached plugin bundles, hooks, and Codex config

files are preserved in the migration report for manual review, not activated

automatically. Runtime accepts manually configured `workspace-directory`

entries; other marketplaces remain unsupported.

- Target runtime setup uses the target agent's Codex app-server identity when

building the thread app config. Curated plugin activation invalidates that

`workspace-directory` setup never runs this activation path.

A plugin app is exposed only when OpenClaw can map it back to the configured

`_default` is disabled, and only apps owned by enabled configured plugins or

Destructive plugin elicitations are allowed by default for configured Codex

| `marketplace_missing`, `plugin_missing` | Marketplace or exact plugin unavailable; the explicit workspace catalog request may have been rejected; workspace apps fail closed. | Verify the compatible app-server contract and exact ID described below. |

| `plugin_detail_unavailable` | OpenClaw could not read plugin ownership details. | Inspect the target app-server's `plugin/list` and `plugin/read` responses. |

| `plugin_disabled` | Codex reports the plugin installed but disabled. | Curated activation may repair it; enable a workspace plugin in Codex before retrying. |

| `plugin_activation_failed` | Plugin activation did not complete. | Use the attached diagnostic to distinguish marketplace, auth, refresh, or workspace-readiness failures. |

**Workspace plugin is installed but not visible:** confirm the workspace

`plugin/list` result reports the exact configured ID as installed and enabled,

then confirm `app/list` reports every owned app accessible for the same Codex

account. OpenClaw can enable an accessible app for the thread even when the

account inventory currently reports that app disabled. If you changed that state after the gateway cached app

inventory, wait for the one-hour cache refresh or restart the gateway, then use

`/new` or `/reset`. OpenClaw does not repair or authenticate workspace plugins.

If the explicit workspace list request is rejected, each enabled workspace

entry reports `marketplace_missing`; unrelated curated entries still proceed

from the default list response.

For `plugin_detail_unavailable`, a pathless workspace summary must include

`remotePluginId`; OpenClaw keeps owned apps hidden when that selector or the

subsequent `plugin/read` result is unavailable. For

`plugin_activation_failed`, curated plugins may report a marketplace, auth, or

post-install refresh failure. A workspace plugin reports this code when it is

not already active; install, enable, and authenticate it outside OpenClaw.

"enum": ["openai-curated", "workspace-directory"]

"help": "Expose explicit Codex plugin entries to Codex harness turns.",

"label": "Plugin Entries",

"help": "Explicit plugin entries. The wildcard key * is not supported.",