0.14.5 — Local Codex marketplaces no longer stop policy matching

0.14.5 — Local Codex marketplaces no longer stop policy matching

A Codex plugin from a local marketplace now matches a policy, and two file
walks read less.

Highlights

• A local marketplace path no longer stops marketplace matching. Codex
  records a local marketplace as a path, not a URL. A marketplace target in a
  policy now does not match that plugin, and the evaluator still applies its
  exact plugin identifiers and its category default. Before, the path raised
  an error and policy evaluation of that inventory failed.
• The manifest-name index and the skill walk read only the files they use.
  The manifest-name index reads package.json and pyproject.toml and does not
  enter dependency directories. The project skill walk reads SKILL.md only.
  Results do not change. Collection reads fewer files in a large home directory.
• The mutable-reference check and the MCP parser share one uv option walker.
  A value-taking uv flag is skipped the same way in both.

Install

uv tool install openaca==0.14.5 or pip install openaca==0.14.5.

Compatibility

Pre-V0 — no back-compatibility hedging.

• A marketplace target does not match a plugin from a local marketplace.
  The plugin follows its exact identifiers and the category default.
• openaca:schema_version stays 0.7. The BOM document shape did not
  change.
• The overlay record schema is unchanged.