feat(codex): support workspace-directory plugins by kevinslin · Pull Request #104188 · openclaw/openclaw

kevinslin · 2026-07-11T05:20:58Z

AI-assisted: yes. I reviewed and understand the resulting code and behavior.

What Problem This Solves

Operators could configure native Codex plugins only from the curated marketplace. Plugins already active in an account-scoped workspace catalog could not be selected for Codex harness turns.

Why This Change Was Made

This extends the existing native-plugin policy and inventory flow with the workspace-directory marketplace. Workspace entries use their exact catalog ID, reuse the current remote detail and app-readiness paths, and must already be installed and enabled. OpenClaw never installs workspace plugins; curated installation behavior is unchanged.

User Impact

Operators can expose an explicitly allowlisted workspace-directory plugin to Codex turns with the same default-deny app policy, approval handling, and session binding used by curated plugins.

Evidence

Trust-boundary decision requested

Code and unit evidence, rather than the payload-free live trace, supports this proposed boundary: workspace plugins are admitted only by operator-configured exact catalog ID; each must already be installed and enabled; OpenClaw enables only app IDs owned by plugin/read and currently accessible through app/list; all other apps stay default-denied; wildcard/display-name matching and workspace plugin/install are not introduced. Please explicitly approve or reject that boundary.

clawsweeper · 2026-07-11T05:30:46Z

Codex review: needs maintainer review before merge. Reviewed July 11, 2026, 12:02 PM ET / 16:02 UTC.

Summary
The PR adds exact-ID, preinstalled workspace-directory plugins to native Codex configuration, inventory, app policy, session binding, tests, and docs.

PR surface: Source +99, Tests +462, Docs +97, Generated 0. Total +658 across 14 files.

Reproducibility: yes. Current main accepts only openai-curated, so a configured workspace-directory identity is deterministically excluded before inventory and thread-policy construction.

Review metrics: 1 noteworthy metric.

Config marketplace surface: 1 enum value added. The accepted native-plugin marketplace contract expands from curated-only to an account-scoped workspace catalog.

Stored data model
Persistent data-model change detected: database schema: extensions/codex/src/app-server/session-binding.test.ts, migration/backfill/repair: extensions/codex/openclaw.plugin.json, serialized state: extensions/codex/src/app-server/session-binding.test.ts, serialized state: extensions/codex/src/app-server/session-binding.ts. Confirm migration or upgrade compatibility proof before merge.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #104176
Summary: This PR is the direct candidate implementation for the canonical linked feature issue; the earlier marketplace PRs are distinct historical context.

Members:

canonical: [Feature]: Support workspace-directory Codex plugins #104176 - It requests the same exact-ID, preinstalled workspace-directory capability and remains open pending this PR.
adjacent_distinct: fix(codex): accept first-party OpenAI plugin marketplaces (bundled and primary-runtime) #82219 - It broadened different first-party marketplace identities and was later reverted.
adjacent_distinct: revert(codex): revert first-party marketplace allowlist #89998 - It reverted that broader marketplace allowlist and establishes the need for explicit product approval without superseding this narrower feature.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🦞 diamond lobster
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Risk before merge

[P1] Merging intentionally expands the accepted native-plugin configuration from curated-only to an account-scoped workspace catalog.
[P1] Compatible behavior depends on Codex app-server support for marketplaceKinds, workspace summaries with remotePluginId, and remote plugin detail lookup; older servers fail closed rather than providing the feature.
[P1] The patch makes operator-selected private workspace plugin apps available to native Codex agent turns, so exact-head proof cannot substitute for explicit maintainer acceptance of the trust boundary.

Maintainer options:

Approve the constrained contract (recommended)
Land after a native Codex owner explicitly accepts account-scoped workspace admission and the documented unsupported-server fail-closed behavior.
Retain curated-only behavior
Pause or close if private workspace plugins should remain outside OpenClaw native turns.

Next step before merge

[P2] No concrete branch repair remains; a native Codex owner must explicitly approve or reject the compatibility and private-plugin trust boundary.

Maintainer decision needed

Question: Should OpenClaw admit operator-allowlisted, already-installed workspace-directory Codex plugins into native turns under the proposed exact-ID, owned-app, and accessible-app checks?
Rationale: The branch is technically contained and well-proven, but exposing account-scoped private plugin apps is an intentional authorization and product-boundary choice that automation cannot approve.
Likely owner: bdjben — They are the clearest human feature-history signal on the immediately adjacent native Codex readiness and configuration work.
Options:
- Approve constrained boundary (recommended): Allow exact marketplace-qualified IDs, require installed and enabled state, intersect plugin-owned apps with accessible apps, and never install workspace plugins.
- Keep curated-only policy: Retain the existing native plugin trust boundary and decline workspace-directory support.

Security
Cleared: No concrete vulnerability or supply-chain defect was found; the intentional trust-boundary expansion remains a maintainer product decision rather than a patch security finding.

Review details

Best possible solution:

Land the constrained exact-ID, preinstalled, no-install workspace path only after a native Codex owner explicitly accepts the compatibility and account-scoped plugin trust boundary.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main accepts only openai-curated, so a configured workspace-directory identity is deterministically excluded before inventory and thread-policy construction.

Is this the best way to solve the issue?

Yes, subject to owner approval. Extending the existing inventory, ownership, approval, default-deny policy, and binding path is narrower and safer than creating a parallel private-plugin model.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 4b33199a65af.

Label changes

Label justifications:

P2: This is a bounded, strongly proven operator feature with limited blast radius but an explicit owner decision remaining.
merge-risk: 🚨 compatibility: The PR expands public config acceptance and relies on workspace marketplace fields available only in compatible Codex app-server versions.
merge-risk: 🚨 security-boundary: The PR makes operator-selected account-scoped plugin apps available to native Codex agent turns.
rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The contributor provides exact-head live Gateway and TUI proof against Codex app-server 0.144.0-alpha.4, with two workspace plugins completing bounded calls and a redacted trace showing zero installation calls.
proof: sufficient: Contributor real behavior proof is sufficient. The contributor provides exact-head live Gateway and TUI proof against Codex app-server 0.144.0-alpha.4, with two workspace plugins completing bounded calls and a redacted trace showing zero installation calls.

Evidence reviewed

PR surface:

Source +99, Tests +462, Docs +97, Generated 0. Total +658 across 14 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	6	147	48	+99
Tests	5	478	16	+462
Docs	2	127	30	+97
Config	0	0	0	0
Generated	1	3	3	0
Other	0	0	0	0
Total	14	755	97	+658

What I checked:

Current-main gap: Current main accepts only the curated marketplace in native Codex plugin policy, so workspace-directory entries cannot reach inventory or thread configuration. (extensions/codex/src/app-server/config.ts:75, 4b33199a65af)
Constrained admission path: The branch queries the workspace catalog only when configured, matches the exact marketplace-qualified ID, requires a remote detail ID, and contains unsupported-server RPC rejection as workspace-unavailable diagnostics. (extensions/codex/src/app-server/plugin-inventory.ts:92, c69db576848c)
No-install boundary: Workspace plugins that are not already active fail without calling app-server activation or installation; curated activation behavior remains separate. (extensions/codex/src/app-server/plugin-activation.ts:59, c69db576848c)
Upstream Codex contract: Sibling Codex source defines PluginListParams.marketplace_kinds, the WorkspaceDirectory kind, summary remote_plugin_id, and remote-detail lookup used by the branch. Checked ../codex/codex-rs/app-server-protocol/src/protocol/v2/plugin.rs:129, :137, :164, and :610, plus request processing around ../codex/codex-rs/app-server/src/request_processors/plugins.rs:531 and :682.
Real behavior proof: The PR discussion reports exact-head live Gateway and TUI runs against Codex app-server 0.144.0-alpha.4: two preinstalled workspace plugins completed bounded read-only tool calls, and the redacted method trace recorded zero plugin/install calls. (c69db576848c)
Feature history: Recent merged native Codex readiness work in fix (Computer Use) Stabilize Codex Computer Use readiness #103331 shaped the adjacent app-server config/runtime surface; the marketplace rollback in revert(codex): revert first-party marketplace allowlist #89998 provides direct history for treating marketplace expansion as an explicit owner decision. (extensions/codex/src/app-server/config.ts:75, 1b6393c51e9f)

Likely related people:

bdjben: Ben Badejo is credited on merged PR fix (Computer Use) Stabilize Codex Computer Use readiness #103331, which added and stabilized the immediately adjacent native Codex readiness and configuration surface. (role: introduced adjacent behavior; confidence: medium; commits: 1b6393c51e9f; files: extensions/codex/src/app-server/config.ts, extensions/codex/src/app-server/computer-use.ts)
Takhoffman: Tak Hoffman merged the recent Codex readiness PR that shaped the surrounding native app-server runtime and configuration surface. (role: merger; confidence: medium; commits: 1b6393c51e9f; files: extensions/codex/src/app-server/config.ts)
kevinslin: Beyond proposing this branch, Kevin Lin authored the merged marketplace rollback revert(codex): revert first-party marketplace allowlist #89998 after direct Codex contract inspection, providing relevant history on this exact boundary. (role: recent adjacent contributor; confidence: medium; commits: fce002ad0320; files: extensions/codex/src/app-server/config.ts, extensions/codex/src/app-server/plugin-activation.ts, extensions/codex/src/app-server/session-binding.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (10 earlier review cycles; latest 8 shown)

reviewed 2026-07-11T05:43:29.569Z sha 70968a5 :: needs real behavior proof before merge. :: [P1] Contain workspace catalog failures before thread startup
reviewed 2026-07-11T07:14:12.527Z sha a2ac4de :: needs real behavior proof before merge. :: none
reviewed 2026-07-11T07:43:53.367Z sha ef6766d :: needs maintainer review before merge. :: none
reviewed 2026-07-11T07:52:16.009Z sha ef6766d :: needs maintainer review before merge. :: none
reviewed 2026-07-11T07:59:06.389Z sha ef6766d :: needs maintainer review before merge. :: none
reviewed 2026-07-11T08:08:14.369Z sha ef6766d :: needs maintainer review before merge. :: none
reviewed 2026-07-11T08:16:11.724Z sha ef6766d :: needs maintainer review before merge. :: none
reviewed 2026-07-11T15:54:13.070Z sha c69db57 :: needs maintainer review before merge. :: none

kevinslin · 2026-07-11T07:22:57Z

Compatible-server live proof completed on the pre-rebase source; it was not rerun after rebase.

Live-tested source: a2ac4de355b51cd6ed84b21121e698e61664ba22, reported by the executable as OpenClaw 2026.7.2 (a2ac4de).
Current PR head: ef6766d98910e6406a8c8f4e898df4348b47632c.
Execution boundary: the Gateway and TUI ran inside Mac-local Docker Desktop; the Codex app-server ran natively on the Mac. The amd64 image was constructed on remote BuildBox and transferred without rebuilding.
Admission: two operator-configured exact-ID workspace-directory entries were found via plugin/list, resolved via plugin/read, already installed/enabled, and each owned one app currently accessible in app/list.
Live turns: two separate fresh TUI sessions completed bounded read-only codex_apps MCP tool calls and returned their expected markers. The method-only trace recorded two thread/start, two turn/start, and two turn/completed lifecycles.
No-install proof: the combined trace recorded 6 plugin/list, 9 plugin/read, 1 app/list, and 0 plugin/install calls.
Privacy: the trace retained method/tool status only. It did not retain query arguments/results, catalog IDs, credentials, or returned internal data.

After this proof, the branch was rebased onto current main. git range-diff shows the production/runtime patch replayed unchanged; the only conflict retained both an upstream supervision test assertion and this PR's marketplace test assertion.

Human trust-boundary decision still requested. Code and unit evidence—not the payload-free live trace—supports exact-ID, preinstalled-and-enabled workspace admission where enabled app IDs must be both owned by plugin/read and accessible in app/list, all other apps remain default-denied, and no wildcard/display-name matching or workspace installation is added. Please explicitly approve or reject that boundary.

kevinslin · 2026-07-11T07:30:02Z

@clawsweeper re-review

clawsweeper · 2026-07-11T07:30:05Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review published an exact durable review comment and queued an executing target-wide serialized router scan.
Run: https://github.com/openclaw/clawsweeper/actions/runs/29144786926
Updated: 2026-07-11T07:45:26.206Z

kevinslin · 2026-07-11T07:55:57Z

Exact-current-head live proof now supersedes the earlier pre-rebase run.

Tested source: ef6766d98910e6406a8c8f4e898df4348b47632c, reported by the executable as OpenClaw 2026.7.2 (ef6766d).
Runtime boundary: the image was built on remote BuildBox and transferred without rebuilding; Gateway and TUI ran inside Mac-local Docker Desktop; native Codex app-server 0.144.0-alpha.4 ran on the Mac.
Readiness: two operator-configured exact-ID workspace-directory plugins were found, already installed and enabled, and each owned one currently accessible app.
Live turns: separate fresh TUI sessions completed both bounded read-only codex_apps MCP calls and returned the expected markers.
RPC trace: 8 plugin/list, 13 plugin/read, 3 app/list, 2 thread/start, 2 turn/start, 2 turn/completed, and 0 plugin/install.
Privacy: the method-only trace retained tool identity/status but no request arguments, returned rows, gate data, catalog IDs, credentials, or tokens.
Verification: the deterministic Showboat proof and both rendered TUI videos verify successfully.

This closes the contributor-owned exact-head compatibility-proof gap. The remaining ClawSweeper gate is the explicit maintainer product/security decision on the constrained account-scoped workspace-plugin boundary.

* feat(codex): support workspace directory plugins * fix(codex): contain workspace catalog failures * chore(config): refresh documentation baseline

openclaw-barnacle Bot added docs Improvements or additions to documentation gateway Gateway runtime extensions: codex size: L maintainer Maintainer-authored PR labels Jul 11, 2026

clawsweeper Bot removed the merge-risk: 🚨 availability 🚨 May cause crashes, hangs, restart loops, stalls, or process outages. label Jul 11, 2026

kevinslin force-pushed the dev/kevinlin/codex-workspace-directory-plugins branch from a2ac4de to ef6766d Compare July 11, 2026 07:21

kevinslin added 3 commits July 11, 2026 08:39

feat(codex): support workspace directory plugins

4bf206d

fix(codex): contain workspace catalog failures

115c0cc

chore(config): refresh documentation baseline

c69db57

kevinslin force-pushed the dev/kevinlin/codex-workspace-directory-plugins branch from ef6766d to c69db57 Compare July 11, 2026 15:45

kevinslin merged commit b769964 into openclaw:main Jul 11, 2026
153 of 154 checks passed

kevinslin deleted the dev/kevinlin/codex-workspace-directory-plugins branch July 11, 2026 16:06

github-actions Bot mentioned this pull request Jul 11, 2026

📡 Upstream Digest — 2026-07-11 16:44 UTC curtismercier/openclaw-mods#1263

Open

Kenmege mentioned this pull request Jul 14, 2026

[Bug]: codexPlugins activation stalls every embedded-Codex turn — plugin/list timed out / LOCAL_REQUEST_CANCELLED; curated marketplace + plugin/install contract drift vs Codex 0.143+ #107305

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat(codex): support workspace-directory plugins#104188

feat(codex): support workspace-directory plugins#104188
kevinslin merged 3 commits into
openclaw:mainfrom
kevinslin:dev/kevinlin/codex-workspace-directory-plugins

kevinslin commented Jul 11, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jul 11, 2026 •

edited

Loading

Uh oh!

kevinslin commented Jul 11, 2026 •

edited

Loading

Uh oh!

kevinslin commented Jul 11, 2026

Uh oh!

clawsweeper Bot commented Jul 11, 2026 •

edited

Loading

Uh oh!

kevinslin commented Jul 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

kevinslin commented Jul 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Trust-boundary decision requested

Uh oh!

clawsweeper Bot commented Jul 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kevinslin commented Jul 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kevinslin commented Jul 11, 2026

Uh oh!

clawsweeper Bot commented Jul 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kevinslin commented Jul 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

kevinslin commented Jul 11, 2026 •

edited

Loading

clawsweeper Bot commented Jul 11, 2026 •

edited

Loading

kevinslin commented Jul 11, 2026 •

edited

Loading

clawsweeper Bot commented Jul 11, 2026 •

edited

Loading