feat: Use remote installed plugin cache for skills and MCP#20096
Conversation
xl-openai
commented
Apr 28, 2026
- Fetches and caches remote /installed plugin state
- Lets skills/list load skills from remote-installed cached plugins without requiring a local marketplace entry
- Routes plugin list/startup/install/uninstall changes through async plugin cache invalidation and MCP refresh
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 367099dff2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| fn remote_installed_plugins_cache_key(config: &Config) -> RemoteInstalledPluginsCacheKey { | ||
| // TODO(remote plugins): this cache is currently scoped only by base URL. A logout, API-key | ||
| // login, or ChatGPT account switch that does not schedule a remote-installed refresh can keep | ||
| // the previous account's remote installed state effective until the next refresh clears it. | ||
| // Include auth/account identity in the key, or clear this cache from account lifecycle handlers. | ||
| RemoteInstalledPluginsCacheKey { | ||
| chatgpt_base_url: config.chatgpt_base_url.clone(), | ||
| } |
There was a problem hiding this comment.
Scope remote installed cache to auth identity
remote_installed_plugins_cache_key only uses chatgpt_base_url. After logout or account switching on the same base URL, cached remote-installed plugins from the previous account can still be treated as effective (skills/MCP) until another refresh happens. That leaks stale cross-account plugin state and can expose the wrong account’s skills/tools.
Useful? React with 👍 / 👎.
|
@codex review again |
- anomalyco/opencode#24877: session directory routing fix (merge-after-nits) - anomalyco/opencode#24852: JSON skill serialization for non-Anthropic models (merge-after-nits) - openai/codex#20113: heredoc file_redirect sandbox bypass fix (merge-after-nits) - openai/codex#20096: remote installed plugin cache for skills/MCP (merge-after-nits)
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 108b13ded3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".