Meet Codex plugin packaging standards - #2
Merged
Conversation
Ports the Codex audit patch onto main and resolves its one collision with the host-loading fixes from #1. Codex packaging (from the audit, verified with the Codex validator and an isolated CODEX_HOME install): - `.codex-plugin/plugin.json` points at `./.mcp.json`, not `./mcp.json` - `interface.category`, `privacyPolicyURL`, `termsOfServiceURL` added; both legal URLs return 200 - `category` added to the `.agents/plugins/marketplace.json` entry - `check_codex_packaging()` in validate.py so the above cannot regress Collision resolved: - Codex's validator rejects any key but `mcpServers` in `.mcp.json`, while `mcp.json` must keep the Agent Plugins `$schema`. So `.mcp.json` drops `$schema`, and `check_mcp_discovery()` now compares the `mcpServers` map rather than bytes. Drift is still caught; confirmed by breaking it. - Regression-tested the change that motivated `.mcp.json` in the first place: Claude Code still reports `MCP servers (1)` with the Codex-shaped file. Skills 2, Agents 1, Hooks 1 unchanged. Docs: README layout table distinguishes the two MCP files; PLATFORMS.md drops the "untested against a live Codex install" caveat and records how the root `source.path: "./"` layout was exercised. Not independently verified here: the Codex validator and CLI install were run in the audit's sandbox; `codex` is not on this machine. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ports the Codex packaging audit onto
mainand resolves its one collision with the host-loading fixes from #1.The audit was based on
8fcbd49— the oldmain, before #1 merged. Six files merged cleanly; one collided.Codex packaging
.codex-plugin/plugin.jsonpoints at./.mcp.json, not./mcp.jsoninterface.category,privacyPolicyURL,termsOfServiceURLadded — both legal URLs verified to return 200categoryadded to the.agents/plugins/marketplace.jsonentrycheck_codex_packaging()invalidate.pyso none of the above can regressThe collision, and how it's resolved
Codex's validator rejects any key but
mcpServersin.mcp.json, so the audit drops$schema. Butcheck_mcp_discovery()(added in #1) required.mcp.jsonto be byte-identical tomcp.json, which keeps$schemafor Agent Plugins. Mutually exclusive as written..mcp.jsonnow drops$schema, and the check compares themcpServersmap rather than bytes. Drift is still caught — confirmed by pointing.mcp.jsonat a bogus URL and watching the check trip.Regression test
.mcp.jsonexists because without it Claude Code loads zero MCP servers. Dropping$schemacould have quietly undone that, so the plugin was reinstalled and inspected:Unchanged. All three gates pass:
validate.py,gen-host-components.py --check,claude plugin validate . --strict.Docs
README distinguishes the two MCP files. PLATFORMS.md drops the "untested against a live Codex install" caveat and records how the root
source.path: "./"layout was exercised.Not verified here
The Codex validator and
CODEX_HOMEinstall were run in the audit's sandbox;codexis not on this machine. Same forsync-from-mcp.sh --check, which the audit reports passing against a fresh clone.Cursor remains the one surface never exercised by a live editor install.
🤖 Generated with Claude Code