[codex] Preserve plugin apps in connector listings#27602
Merged
Conversation
This was referenced Jun 11, 2026
felixxia-oai
force-pushed
the
plugin-auth-aware-connector-listing
branch
from
June 11, 2026 13:42
e7efa5f to
ff11d44
Compare
felixxia-oai
changed the base branch from
plugin-auth-routing-route-model
to
plugin-auth-routing-app-mcp-name-dedupe
June 11, 2026 13:42
felixxia-oai
force-pushed
the
plugin-auth-routing-app-mcp-name-dedupe
branch
from
June 11, 2026 13:50
02ca35c to
e1af8cd
Compare
felixxia-oai
force-pushed
the
plugin-auth-aware-connector-listing
branch
from
June 11, 2026 13:52
ff11d44 to
57f261e
Compare
felixxia-oai
force-pushed
the
plugin-auth-routing-app-mcp-name-dedupe
branch
from
June 11, 2026 13:55
e1af8cd to
d4ed307
Compare
felixxia-oai
force-pushed
the
plugin-auth-aware-connector-listing
branch
from
June 11, 2026 13:55
57f261e to
367abd8
Compare
felixxia-oai
force-pushed
the
plugin-auth-routing-app-mcp-name-dedupe
branch
from
June 11, 2026 14:01
d4ed307 to
37dc34c
Compare
felixxia-oai
force-pushed
the
plugin-auth-aware-connector-listing
branch
from
June 11, 2026 14:02
367abd8 to
e3d001e
Compare
felixxia-oai
force-pushed
the
plugin-auth-routing-app-mcp-name-dedupe
branch
from
June 11, 2026 14:23
37dc34c to
1e22d98
Compare
felixxia-oai
force-pushed
the
plugin-auth-aware-connector-listing
branch
from
June 11, 2026 14:23
e3d001e to
e78b5d7
Compare
felixxia-oai
force-pushed
the
plugin-auth-routing-app-mcp-name-dedupe
branch
from
June 11, 2026 15:10
1e22d98 to
f93d67f
Compare
felixxia-oai
force-pushed
the
plugin-auth-aware-connector-listing
branch
from
June 11, 2026 15:10
e78b5d7 to
15ddc60
Compare
Contributor
Author
|
@codex review |
Contributor
|
Codex Review: Didn't find any major issues. Keep it up! ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
felixxia-oai
force-pushed
the
plugin-auth-routing-app-mcp-name-dedupe
branch
from
June 11, 2026 16:11
f93d67f to
3318660
Compare
felixxia-oai
force-pushed
the
plugin-auth-aware-connector-listing
branch
from
June 11, 2026 16:19
15ddc60 to
c638d3b
Compare
felixxia-oai
marked this pull request as ready for review
June 11, 2026 16:40
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c638d3b56d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
xl-openai
reviewed
Jun 11, 2026
felixxia-oai
marked this pull request as draft
June 11, 2026 18:25
felixxia-oai
force-pushed
the
plugin-auth-routing-app-mcp-name-dedupe
branch
2 times, most recently
from
June 11, 2026 19:15
f7c465a to
040d454
Compare
felixxia-oai
force-pushed
the
plugin-auth-aware-connector-listing
branch
from
June 11, 2026 19:23
c638d3b to
56443ba
Compare
felixxia-oai
force-pushed
the
plugin-auth-routing-app-mcp-name-dedupe
branch
from
June 11, 2026 19:27
040d454 to
f477890
Compare
felixxia-oai
force-pushed
the
plugin-auth-aware-connector-listing
branch
from
June 11, 2026 19:34
56443ba to
f17ae40
Compare
felixxia-oai
force-pushed
the
plugin-auth-aware-connector-listing
branch
from
June 11, 2026 20:48
47738aa to
b633689
Compare
felixxia-oai
force-pushed
the
plugin-auth-routing-app-mcp-name-dedupe
branch
from
June 11, 2026 20:54
88c8ed1 to
3b03c5a
Compare
felixxia-oai
force-pushed
the
plugin-auth-aware-connector-listing
branch
from
June 11, 2026 20:54
b633689 to
df6421f
Compare
felixxia-oai
force-pushed
the
plugin-auth-routing-app-mcp-name-dedupe
branch
from
June 11, 2026 21:01
3b03c5a to
763534c
Compare
felixxia-oai
force-pushed
the
plugin-auth-aware-connector-listing
branch
from
June 11, 2026 21:01
df6421f to
559560a
Compare
felixxia-oai
force-pushed
the
plugin-auth-routing-app-mcp-name-dedupe
branch
from
June 11, 2026 21:15
763534c to
b3bb8cf
Compare
felixxia-oai
force-pushed
the
plugin-auth-aware-connector-listing
branch
2 times, most recently
from
June 11, 2026 21:25
b9005c0 to
e1b01e3
Compare
felixxia-oai
force-pushed
the
plugin-auth-routing-app-mcp-name-dedupe
branch
from
June 11, 2026 21:34
b3bb8cf to
b3f6795
Compare
felixxia-oai
force-pushed
the
plugin-auth-aware-connector-listing
branch
from
June 11, 2026 21:54
e1b01e3 to
b5d3752
Compare
xl-openai
reviewed
Jun 12, 2026
felixxia-oai
force-pushed
the
plugin-auth-routing-app-mcp-name-dedupe
branch
from
June 12, 2026 09:45
b3f6795 to
531e011
Compare
felixxia-oai
force-pushed
the
plugin-auth-aware-connector-listing
branch
2 times, most recently
from
June 12, 2026 10:14
f5b1e24 to
97ce014
Compare
xl-openai
approved these changes
Jun 12, 2026
xl-openai
added a commit
that referenced
this pull request
Jun 13, 2026
## Context Plugins can expose more than one way for Codex to use them: App connectors for ChatGPT/SIWC-backed sessions and MCP servers for API key login sessions. The broader goal is to make `PluginsManager` the place that understands which plugin surfaces should be visible for the current auth route, so callers do not each have to make that decision themselves. This PR is the small setup step for that work. It lets the plugin manager be created with the current `AuthMode`, which gives the followup auth routing PRs the information they need without relying on setter injection. ## Stack - PR1: #27652 seed plugin manager auth at construction. - PR2: #27459 route plugin surfaces by auth mode. - PR3: #27607 dedupe plugin MCP servers by App declaration name. - PR4: #27602 preserve plugin Apps in connector listings. - PR5: #27461 skip install-time plugin MCP OAuth for matching App routes. ## Summary - Let `PluginsManager::new_with_restriction_product` accept an initial `AuthMode`. - Keep `PluginsManager::new` behavior unchanged for ordinary callers. ## Validation ```bash cargo test -p codex-core-plugins plugins_manager_tracks_auth_mode cargo test -p codex-core list_tool_suggest_discoverable_plugins git diff --check ``` --------- Co-authored-by: Xin Lin <xl@openai.com>
xl-openai
pushed a commit
that referenced
this pull request
Jun 13, 2026
## Context Some plugins expose both Apps and MCP servers. This PR moves auth-aware surface projection into `core-plugins::PluginsManager`, so callers get a consistent effective plugin view. Later PRs narrow the conflict rule and update listing/install paths. The high level goal of this PR is to set up the plumbing to conditionally filter App/MCP in the plugin manager layer. We start by removing MCP servers when using SIWC/Codex-backend auth, and removing Apps when using API-key-style auth. This PR is now stacked on #27652, which contains only the constructor plumbing for seeding `PluginsManager` with the current auth mode. ## Stack - PR1: #27652 seed plugin manager auth at construction. - PR2: #27459 route plugin surfaces by auth mode. - PR3: #27607 dedupe plugin MCP servers by App declaration name. - PR4: #27602 preserve plugin Apps in connector listings. - PR5: #27461 skip install-time plugin MCP OAuth for matching App routes. ## Summary - API-key/non-ChatGPT routes hide plugin Apps and keep plugin MCPs. - ChatGPT/SIWC with Apps enabled keeps plugin Apps and suppresses MCPs for dual-surface plugins. - MCP-only plugins stay available for ChatGPT/SIWC sessions. - Cached plugin load outcomes are re-projected when auth mode changes. ## Validation ```bash cargo test -p codex-core-plugins plugin_auth_projection cargo test -p codex-core list_tool_suggest_discoverable_plugins git diff --check ```
xl-openai
force-pushed
the
plugin-auth-routing-app-mcp-name-dedupe
branch
3 times, most recently
from
June 14, 2026 00:34
f247899 to
8235bab
Compare
xl-openai
added a commit
that referenced
this pull request
Jun 14, 2026
## Context
This is the next step in the plugin auth-routing stack. The earlier PRs
make `PluginsManager` auth-aware and move the broad App/MCP surface
decision into that layer. This PR narrows the ChatGPT/SIWC behavior so
we only hide a plugin MCP server when it conflicts with an App
declaration of the same name.
In product terms: if a plugin exposes both an App route and MCP route
for `foo`, ChatGPT/SIWC sessions should use the App route for `foo`. If
the same plugin also exposes a separate MCP server like `foo2`, that MCP
server should remain available.
```json
// .app.json
{
"apps": {
"foo": {
"id": "connector_abc"
}
}
}
```
```json
// .mcp.json
{
"mcpServers": {
"foo": {
"url": "https://mcp.foo.com/mcp"
},
"foo2": {
"url": "https://mcp.foo2.com/mcp"
}
}
}
```
## Stack
- PR1: #27652 seed plugin manager auth at construction.
- PR2: #27459 route plugin surfaces by auth mode.
- PR3: #27607 dedupe plugin MCP servers by App declaration name.
- PR4: #27602 preserve plugin Apps in connector listings.
- PR5: #27461 skip install-time plugin MCP OAuth for matching App
routes.
## Summary
- Preserve App declaration names in loaded plugin metadata.
- Keep public effective App outputs as deduped connector IDs for
existing callers.
- For ChatGPT/SIWC, suppress only plugin MCP servers whose names match
declared App names.
## Validation
```bash
cargo fmt --all
cargo test -p codex-core-plugins plugin_auth_projection
cargo test -p codex-core-plugins effective_apps
cargo test -p codex-core-plugins read_plugin_for_config_installed_git_source_reads_from_cache_without_cloning
cargo test -p codex-core explicit_plugin_mentions_use_apps_for_chatgpt_dual_surface_plugins
cargo test -p codex-core explicit_plugin_mentions_keep_non_conflicting_mcp_for_chatgpt_auth
cargo test -p codex-app-server --test all plugin_install_filters_disallowed_apps_needing_auth
git diff --check
```
---------
Co-authored-by: Xin Lin <xl@openai.com>
felixxia-oai
force-pushed
the
plugin-auth-aware-connector-listing
branch
from
June 15, 2026 11:06
7a57038 to
6370a49
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
This is PR4 in the plugin auth-routing stack. The earlier PRs make plugin surface projection auth-aware and narrow App/MCP conflicts by App declaration name. This PR keeps connector listing paths aligned with that projected plugin App set.
This means ChatGPT/SIWC users will still see plugin-provided Apps in connector listing surfaces like the Apps/connector picker, while API-key users will not see Apps they cannot use.
Stack
Summary
Validation