Issue #194: preserve Codex marketplace metadata

[NWYLZW]

Summary

• Preserve stable Codex marketplace identity and metadata across conversion, managed installation, runtime discovery, public serialization, and client presentation.
• Replace absolute-path-derived public identity with authoritative catalog/manifest identity and a shared root-free public runtime contract.
• Surface bounded Codex apps, capabilities, permissions, authentication, and connection requirements while redacting private install roots.
• Add managed-install identity, transaction, recovery, traversal, and adversarial coverage for upgrade/uninstall safety.

Root cause and user impact

Codex marketplace conversion did not preserve a stable manifest or the full app/capability/connection metadata needed by runtime discovery. Runtime and client fallbacks could therefore use an absolute install directory as the plugin request ID or display name, while installed plugins appeared with empty metadata. The same loose internal-to-public projection could expose private install roots through API, UI, diagnostics, or logs.

For users, this meant a newly installed Codex plugin could display a machine-specific absolute path, omit its useful capabilities and connection requirements, and behave inconsistently across duplicate installs or upgrades.

Current implementation

• Derives stable managed identity from the authoritative adapter, package/source, scope, and canonical npm registry authority rather than an attacker-controlled filesystem path.
• Converts Codex marketplace manifests and bounded .app.json metadata into strict runtime fields, including apps, capabilities, permissions, authentication, and connection requirements.
• Uses explicit root-free public runtime and diagnostic types plus allowlisted server serialization; client presentation consumes that contract without root, rootDir, sourceRoot, or pluginRoot.
• Redacts configured private roots, including literal roots with spaces and delimiters, while preserving valid HTTP(S) URLs.
• Adds transaction journals, tree identity checks, quarantine/recovery handling, and focused failure-injection tests for managed installs.
• Documents the Codex marketplace presentation and private install-root behavior.

Changelog

Included in the current head at changelog/0.1.0-beta.10/readme.md. The entry covers hardened marketplace metadata handling, actionable source errors, retryable install-source failures, and installed runtime metadata after install or refresh.

Screenshots

Privacy-reviewed macOS evidence is committed in evidence commit be8fdfbdc224dfa4e2425ab29c72231eb2c11b06, parented directly on the reviewed PR head. The three files contain no private filesystem paths, credentials, tokens, usernames, or secrets.

Screenshot SHA-256 values:

• airtable-installed.jpg: aa86d121899993f0ccd0147898145d6993113fcdf3a8e8698e47608deb3e02a1
• airtable-runtime-detail.jpg: f0ccf814820f523e11a73fc8b2ef96aa6599505738aefe87390d5e6b937d9c05
• plugin-list.jpg: d5c2f91052d59f43f55d623aa8cc425987b850182f5a2407d0a78b749acf01d2

Validation

The reviewed source/test tree is exact at current PR head 279696755634ceee562de8aa0201f72b11d6e148: all eight candidate paths match byte-for-byte. The evidence commit be8fdfbdc224dfa4e2425ab29c72231eb2c11b06 adds only the three screenshots above. The framed eight-path candidate fingerprint is ac7fe11344cb789860559e96ff1342129a2970d2b9bcc72dc35a36b8fc525e6a.

• Focused Vitest gates: 21/21 passed across public API boundary, route refresh/identity, runtime route ownership, detail rendering, and server marketplace reload ordering.
• Type checks: bundler, bundler:test, web, and web:test passed.
• ESLint, dprint, and git diff --check passed.
• macOS Browser validation completed on the exact candidate: real Airtable project remove/reinstall, enabled/project state, stable marketplace tuple route, hard refresh, current runtime list, authoritative native app airtable, app id asdk_app_693ca6ce2db08191bb52d66743c65184, and capabilities Read, Write.
• The API-shaped runtime identity was observed as scope codex-openai-plugins-airtable-52fa4877979453b87dbb90a4, source marketplace/codex/openai-plugins/airtable, version 0.1.3, enabled true; permissions, authentication, and connection requirements were null and no values were synthesized in the UI.
• Catalog/source errors remain independent: an external openai-curated-remote source-not-found message remained inline while the Airtable card and installed runtime detail stayed usable. This PR does not claim that external source availability is fixed.
• No persistent not-found or spinner remained after refresh. No new browser console warnings/errors were observed during the exact-candidate validation window.
• Validation scope is macOS only. Windows/Linux, full build, full test suite, and external source timeout/SSL remediation are not claimed.

Latest independent review: PASS

Independent high-risk code review reproduced the exact base, eight-path fingerprint, evidence artifact identities, and focused gates; no blocking security or correctness finding remained. Independent live visual review is recorded as PASS for the exact current candidate and evidence. Experience Review is therefore complete for this delivery scope.

Experience Review

• 已判断是否需要沉淀经验
• 如需要，已运行 $post-task-experience-review
• reviewer PASS 后才进入 merge

Closes #194

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
oneworks-dev	Ignored	Preview	Aug 4, 2026 3:20pm

[github-actions]

Experience Review

Before merge, make sure the PR body contains this completed checklist:

## Experience Review
- [x] 已判断是否需要沉淀经验
- [x] 如需要，已运行 `$post-task-experience-review`
- [x] reviewer PASS 后才进入 merge

Checklist to confirm:

• Decide whether this PR produced reusable project experience.
• If experience should be captured, run $post-task-experience-review.
• Merge only after the independent reviewer reports PASS.

[NWYLZW]

Audit: superseded by merged #310, the final current-main delivery for #194’s marketplace metadata and privacy-boundary scope. Closing without merge; branch preserved.