动态恢复当前 App 的全部内置插件 / Recover all bundled plugins from the current App manifest

[Yuimi-chaya]

中文

背景

旧 PR #1537 依赖固定的 Browser / Chrome / Computer Use 名单，并包含已经被当前上游移除的 Computer Use guard、provider switch 和配置维护链。新版 Codex App 直接在应用包内提供 openai-bundled marketplace；继续维护旧名单会遗漏后续新增插件，也可能让旧缓存遮蔽当前 App 的真实清单。

本 PR

• 从本次实际启动的 Codex App 目录读取包内 openai-bundled/.agents/plugins/marketplace.json。
• Windows、macOS 及常见 unpacked 资源布局均为只读探测；缺失、不可读或格式无效时 fail open，不影响原生流程。
• 将 App manifest 中的全部插件动态合并到普通 plugin/list 结果；未来新增插件无需修改 Codex++ 名单。
• 只补齐缺失插件与缺失元数据，不覆盖原生 disabled、hidden、available 或限制原因。
• 首次注入绑定实际解析的 App 目录；watchdog 重注入回退到保存路径/平台探测。
• 不写入 [marketplaces.openai-bundled]，不恢复 provider-switch guard、watchdog 配置维护或持久化 baseline。

本 PR 已取代 #1537 的维护方向；旧 PR 已关闭并保留为历史对照。

验证

• cargo test -p codex-plus-core --lib -j 2：227/227
• cargo test -p codex-plus-core --test cdp_bridge -j 2：109/109
• cargo test -p codex-plus-core --test launcher -j 2：79/79
• cargo test -p codex-plus-core --test bridge_routes -j 2：30/30
• App manifest / fallback 聚焦资产测试：6/6
• cargo check -p codex-plus-launcher -j 2
• node --check assets/inject/renderer-inject.js
• focused rustfmt checks for the changed core/test Rust files and git diff --check; the launcher entry file still has a pre-existing upstream rustfmt diff at launcher_main

真人验证

• Windows 本地安装了包含本 PR 同等逻辑的累计构建（累计提交 1548c87，保留其他尚未发布功能）。
• 用户已完成本地真人启动与插件 UI 验收，确认当前 App 的内置插件已全量显示并解锁。
• 该结果验证的是等价累计构建的 Windows 真实使用路径；聚焦 PR 分支二进制未单独安装，macOS 仍由 CI 覆盖。

English

Background

PR #1537 relied on a fixed Browser / Chrome / Computer Use allowlist and on Computer Use guard/provider-switch maintenance paths that current upstream has removed. Current Codex App packages the authoritative openai-bundled marketplace directly, so a fixed list can miss newly bundled plugins and let stale caches hide the App's current catalog.

This PR

• Reads the packaged openai-bundled/.agents/plugins/marketplace.json from the exact Codex App directory used for launch.
• Probes Windows, macOS, and common unpacked resource layouts read-only; missing or invalid manifests fail open.
• Dynamically merges every packaged plugin into ordinary plugin/list results, so future additions require no Codex++ allowlist update.
• Fills only missing plugins and metadata. Native disabled, hidden, available, and restriction fields remain authoritative.
• Pins initial injection to the resolved App directory and lets watchdog reinjection fall back to the saved/platform-resolved App path.
• Does not write [marketplaces.openai-bundled] or restore provider-switch guards, config watchdogs, or persistent baselines.

This supersedes the maintenance direction of #1537. The older PR is now closed and retained only as historical context.

Validation

• core lib: 227/227
• CDP bridge: 109/109
• launcher lifecycle: 79/79
• bridge routes: 30/30
• focused App-manifest/fallback asset tests: 6/6
• launcher cargo check
• renderer JavaScript syntax
• focused rustfmt checks for the changed core/test Rust files and diff checks; the launcher entry file still has a pre-existing upstream rustfmt diff at launcher_main

Human validation

• A cumulative Windows build carrying the same PR behavior was installed locally at cumulative commit 1548c87 while preserving the other unpublished local features.
• The user completed a real local launch and plugin UI acceptance test, confirming that the current App's bundled plugins are all visible and unlocked.
• This validates the equivalent cumulative Windows path; the focused PR binary was not installed separately, while macOS remains covered by CI.

CI

GitHub Actions run 32261490989 passed Windows artifacts, macOS x64, and macOS arm64.