feat: support product-scoped plugins. by xl-openai · Pull Request #15041 · openai/codex

xl-openai · 2026-03-18T08:31:42Z

Added SessionSource::Custom(String) and --session-source.
Enforced plugin and skill products by session_source.
Applied the same filtering to curated background refresh.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dca59a99d4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-03-18T08:42:08Z

codex-rs/core/src/plugins/manager.rs

+            if product_restricted_plugin_names.contains(&plugin_id.plugin_name) {
+                info!(
+                    plugin = plugin_id.plugin_name,
+                    marketplace = OPENAI_CURATED_MARKETPLACE_NAME,
+                    session_source = %session_source,
+                    "skipping curated plugin cache refresh for product-restricted plugin"
+                );
+                continue;


Remove disallowed curated plugins from active cache

refresh_curated_plugin_cache skips product-restricted configured plugins with continue, but never uninstalls or clears an already-active cached version. load_plugin still resolves active_plugin_root for configured entries, so switching session_source can leave previously installed disallowed plugins active, defeating product scoping.

Useful? React with 👍 / 👎.

I think it is OK.

xl-openai · 2026-03-18T08:55:14Z

@codex review

chatgpt-codex-connector

💡 Codex Review

codex/codex-rs/app-server/src/codex_message_processor.rs

Lines 5617 to 5622 in d78c7c7

    
               plugins_manager 
        
                   .install_plugin_with_remote_sync(&config, auth.as_ref(), request) 
        
                   .await 
        
           } else { 
        
               plugins_manager.install_plugin(request).await 
        
           };

Enforce product policy in plugin/install

plugin/list now filters by policy.products, but plugin_install still installs any named plugin without checking session_source. Because install_plugin* receives no source restriction, a client can call plugin/install directly with a disallowed plugin name/path and bypass product gating.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-03-18T09:04:05Z

codex-rs/protocol/src/protocol.rs

+            | SessionSource::SubAgent(_)
+            | SessionSource::Unknown => Some(Product::Codex),


Preserve parent product for sub-agent sessions

Do not hard-map all SubAgent sources to Product::Codex. Sub-agents spawned from a custom source (e.g. chatgpt) will be evaluated as Codex, so product-scoped skill/plugin filtering can switch products mid-thread and expose the wrong gated content.

Useful? React with 👍 / 👎.

Posted in error by Codex; user requested a local-only review instead.

sayan-oai · 2026-03-18T17:54:39Z

codex-rs/core/src/codex.rs

        };
+        if cwds.is_empty() {
+            cwds = vec![cwd];
+        }


why do we need this change? to make cwds mut? this also grabs the session state lock regardless of whether cwds is empty, which seems mildly worse.

sayan-oai · 2026-03-18T18:03:31Z

codex-rs/core/src/skills/manager.rs

+        let outcome = crate::skills::filter_skill_load_outcome_for_product(
+            finalize_skill_outcome(load_skills_from_roots(roots), &config_layer_stack),
+            self.restriction_product,
+        );


nit: it seems a bit tedious to have this pattern of calling 3 helpers to get the outcome. you have to remember too much as the user. is it possible to clean up, or make one wrapper?

sayan-oai · 2026-03-18T18:57:45Z

codex-rs/core/src/plugins/manager.rs

            Option<String>,
        )>::new();
        let mut local_plugin_names = HashSet::new();
        for plugin in curated_marketplace.plugins {


do we need to check for product restrictions here too?

Good call add some logic to the actual sync time.

sayan-oai · 2026-03-18T19:03:34Z

codex-rs/core/src/plugins/manager.rs

        let plugin = marketplace
            .plugins
            .into_iter()
            .find(|plugin| plugin.name == request.plugin_name);


this also could go either way, but do we want to enforce product restrictions on plugin/read?

Good call will add PluginNotFound

sayan-oai · 2026-03-18T19:05:07Z

codex-rs/protocol/src/protocol.rs

+            "exec" => SessionSource::Exec,
+            "mcp" | "appserver" | "app-server" | "app_server" => SessionSource::Mcp,
+            "unknown" => SessionSource::Unknown,
+            _ => SessionSource::Custom(trimmed.to_string()),


do we want to coerce to lowercase? the values we match against in rollout/mod.rs is lowercase

sayan-oai · 2026-03-18T19:51:57Z

codex-rs/core/src/plugins/manager.rs

+        {
+            plugin_sources.insert(plugin_name, source_path);
+        } else {
+            product_restricted_plugin_names.insert(plugin_name);


product_restricted_plugin_names is a bit confusing IMO; maybe disallowed_plugin_names_for_product? because restriction_product means the product for this session and we are reusing restricted in a confusing way.

sayan-oai

small clarity nit:

maybe for readers it'd be nice to include a doc comment somewhere explaining that for skills:

if the plugin doesnt match the requested product, its filtered out
if the plugin matches but some bundled skills dont match, theyre filtered out
separately, if there are individual skills that dont match, theyre filtered out

you have to bounce around a few files to figure that out right now.

sayan-oai · 2026-03-19T05:19:27Z

codex-rs/protocol/src/protocol.rs

+            | SessionSource::Exec
+            | SessionSource::Mcp
+            | SessionSource::Unknown => Some(Product::Codex),
+            SessionSource::SubAgent(_) => None,


confirming, we are ok with subagents not inheriting the restriction product of parent thread? IIUC this means subagents cant use product-scoped plugins like their parents can

it is ok the ThreadManager is only inited once and the product should be set already.

chatgpt-codex-connector bot reviewed Mar 18, 2026

View reviewed changes

xl-openai force-pushed the xl/plugins3 branch from dca59a9 to d78c7c7 Compare March 18, 2026 08:52

chatgpt-codex-connector bot reviewed Mar 18, 2026

View reviewed changes

xl-openai force-pushed the xl/plugins3 branch 2 times, most recently from 70861d7 to 1955609 Compare March 18, 2026 11:12

This comment was marked as spam.

Sign in to view

sayan-oai reviewed Mar 18, 2026

View reviewed changes

feat: support product-scoped plugins.

d3b349c

xl-openai force-pushed the xl/plugins3 branch 4 times, most recently from cac3148 to 78e19a7 Compare March 19, 2026 04:56

sayan-oai approved these changes Mar 19, 2026

View reviewed changes

Address comments.

06e9a1a

xl-openai force-pushed the xl/plugins3 branch from 78e19a7 to 06e9a1a Compare March 19, 2026 06:21

xl-openai merged commit db5781a into main Mar 19, 2026
54 of 56 checks passed

xl-openai deleted the xl/plugins3 branch March 19, 2026 07:46

github-actions bot locked and limited conversation to collaborators Mar 19, 2026

	plugins_manager
	.install_plugin_with_remote_sync(&config, auth.as_ref(), request)
	.await
	} else {
	plugins_manager.install_plugin(request).await
	};

		\| SessionSource::SubAgent(_)
		\| SessionSource::Unknown => Some(Product::Codex),

Conversation

xl-openai commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

xl-openai commented Mar 18, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

This comment was marked as spam.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sayan-oai left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

xl-openai commented Mar 18, 2026 •

edited

Loading