feat: Add vertical remote plugin collection support

[xl-openai]

• Adds an explicit vertical marketplace kind for plugin/list that fail-open fetches collection=vertical only when full remote plugins are disabled.

• Renames the global remote marketplace/cache identity to openai-curated-remote and materializes remote installs with backend release versions and app manifests.

[xl-openai]

@codex can you verify there this change has no impact on the flows for none vertical plugins?

[chatgpt-codex-connector]

Verification Result

I verified the PR’s vertical collection path is isolated from non-vertical plugin flows. I did not make code changes, so I did not create a follow-up PR.

Findings

• The new vertical marketplace kind is additive to the existing plugin/list filter enum; existing local, workspace-directory, and shared-with-me wire values remain unchanged. codex-rs/app-server-protocol/src/protocol/v2/plugin.rsL141-L152
• The vertical collection fetch is gated on both conditions:
  • the request explicitly includes PluginListMarketplaceKind::Vertical, and
  • Feature::RemotePlugin is disabled. codex-rs/app-server/src/request_processors/plugins.rsL568-L595
• Non-vertical remote source selection still follows the existing branches:
  • omitted marketplace_kinds + remote plugins enabled => global remote source,
  • explicit workspace-directory => workspace directory source,
  • explicit shared-with-me + sharing enabled => shared-with-me source. codex-rs/app-server/src/request_processors/plugins.rsL597-L608
• The lower-level remote list request only adds collection=... when a non-None collection is passed, so normal global/workspace list calls do not get the vertical collection query parameter. codex-rs/core-plugins/src/remote.rsL1306-L1325
• Existing/new regression coverage directly checks that the default plugin/list path does not query the vertical collection and does not return the vertical/openai-curated marketplace. codex-rs/app-server/tests/suite/v2/plugin_list.rsL1978-L2028
• There is also coverage that an explicit local-only request does not append the global remote marketplace or issue /ps/plugins/list requests. codex-rs/app-server/tests/suite/v2/plugin_list.rsL2083-L2125
• The remote-plugin-enabled path explicitly treats Vertical as a no-op and asserts no collection=vertical request is sent. codex-rs/app-server/tests/suite/v2/plugin_list.rsL2030-L2080
• Workspace-directory coverage still asserts that only the workspace marketplace is returned and that no global-scope request is made. codex-rs/app-server/tests/suite/v2/plugin_list.rsL2328-L2390

Testing / Checks

• ✅ git diff --check HEAD^..HEAD
• ✅ cargo test -p codex-core-plugins remote_bundle::tests
• ⚠️ cargo test -p codex-app-server plugin_list — blocked by environment while building v8: the build script attempted to download librusty_v8_release_x86_64-unknown-linux-gnu.a.gz and received Tunnel connection failed: 403 Forbidden.
• ⚠️ cargo test -p codex-core-plugins remote — broader filter ran and compiled, but several HTTP-backed tests failed with local/mock HTTP 403 Forbidden / timeout behavior in this environment; the narrower remote_bundle::tests subset passed.

View task →