Spike: Revalidate repo-scoped marketplace behavior for Claude and Codex

[yacosta738]

Goal

Revalidate the vendor behavior behind #567 before implementing AgentSync plugin support.

Questions to answer

• Does codex-cli 0.147.0 honor repo-scoped .agents/plugins/marketplace.json?
• Does it honor .claude-plugin/marketplace.json as a legacy-compatible marketplace?
• Which surfaces differ: Codex CLI, Codex app, codex exec, and cache materialization?
• Does a clean clone require an explicit per-user install or only a repository declaration?
• What is the exact behavior of Claude Code 2.1.233 for project .claude/settings.json, extraKnownMarketplaces, and enabledPlugins?
• Which plugin manifest/components are actually compatible across both vendors?

Deliverables

1. Isolated reproduction matrix using temporary HOME/CODEX_HOME and a fixture marketplace.
2. Results for the issue's original versions plus the current supported versions.
3. Clear distinction between discovery, installation, enablement, and cache materialization.
4. Recommendation to update, split, or retain the current Import a plugin from a marketplace into a repo, so Claude and Codex both pick it up #567 scope.
5. No production implementation changes in this issue.

Acceptance criteria

• Reproduction commands and outputs are recorded.
• Any version-dependent behavior is explicitly versioned.
• The parent issue is updated with the decision and links to evidence.

[linear-code]

DALLAY-585

[yacosta738]

Initial vendor findings — pending CLI reproduction

Confirmed from current official documentation

1. Codex repository marketplaces are now documented. A repository may expose .agents/plugins/marketplace.json; .claude-plugin/marketplace.json remains a legacy-compatible path. Marketplace entries can use Git-backed sources with a ref or SHA. See OpenAI plugin packaging.
2. Codex discovery is not the same as installation. The documented local-marketplace flow still installs a plugin into the user-local ~/.codex/plugins/cache/<marketplace>/<plugin>/<version>/ path and stores enablement in ~/.codex/config.toml. Therefore, a committed repository marketplace file must not yet be treated as proof that a clean clone has an active, materialized plugin.
3. Claude separates declaration, trust, installation, and activation. Project settings can declare extraKnownMarketplaces and enabledPlugins, but repository settings wait for folder trust; the documented flow still installs a plugin explicitly and may require /reload-plugins. Installed plugins are copied to a cache. See Claude settings and Claude plugin marketplaces.
4. Scope implication. The MVP should not promise that cloning a repository silently populates either vendor's private cache. AgentSync can provide deterministic, repository-owned materialization for supported skills and MCP configuration, while vendor marketplace files remain discovery/declaration integrations unless the reproduction proves more.

Still pending

The exact matrix required by this spike remains to be run locally for codex-cli 0.147.0, Claude Code 2.1.233, and current supported versions using isolated temporary HOME/CODEX_HOME. We must record separate outcomes for discovery, installation, enablement, cache materialization, and codex exec versus interactive/app surfaces before unblocking the implementation design.

No production implementation changes have been made.

[yacosta738]

Final spike assessment — 2026-08-23

The local report verifies Codex CLI 0.147.0 behavior only: isolated HOME/CODEX_HOME, empty repo-scoped discovery on the tested CLI surface, explicit global local-marketplace registration, cache materialization, enablement, local-source upgrade rejection, and a 401-blocked codex exec. Claude remains DOCUMENTED / NOT LOCALLY VERIFIED because no subscription is available.

DALLAY-585 is NOT COMPLETE. The report lacks a complete command/output transcript, no interactive CLI or Codex desktop-app test is recorded, no separate current Codex version comparison is recorded, and the cleanup evidence is inconsistent: T10-final-clean.txt and the live isolated config still contain the fixture plugin cache and enabled plugin config. The marketplace section is absent, but plugin cleanup is not proven.

The report's broad “Codex has zero repo-scoped discovery” conclusion must be qualified to the CLI surface. Current OpenAI documentation says the ChatGPT desktop app reads repo .agents/plugins/marketplace.json and legacy .claude-plugin/marketplace.json and installs local plugins into ~/.codex/plugins/cache; that app behavior was not tested: https://developers.openai.com/plugins/build/plugins

Keep DALLAY-585 In Progress and DALLAY-586 blocked. No production code was changed. Evidence: /tmp/dallay-585-reproduction-report.md and /tmp/opencode/dallay585/. Linear: https://linear.app/dallay/issue/DALLAY-585

[yacosta738]

Follow-up version check — 2026-08-23

The current local binary was independently checked at /Users/acosta/.local/bin/codex and reports codex-cli 0.147.0, matching the report and the spike's original Codex version. This resolves the local current-version identity, but does not add a second version comparison or close the remaining gaps: interactive CLI, Codex desktop app, successful runtime activation, complete command/output transcript, and cleanup proof.

[yacosta738]

CLI rerun addendum — 2026-08-23

A corrected fresh rerun now provides complete CLI transcripts at /tmp/dallay585-rerun.0H5LGA/transcript.txt, /tmp/dallay585-discovery.wcoukI/transcript.txt, and /tmp/dallay585-errors.YKw2Qa/transcript.txt.

Codex CLI 0.147.0 results: all three pre-registration discovery probes returned an empty marketplaces list; both .agents and .claude-plugin schemas registered successfully; plugin add materialized the versioned cache and enabled the plugin; codex mcp list showed the inert /bin/false server as enabled without executing it; plugin and marketplace removal passed final cache/config assertions; collision, local-upgrade, dangling-path, and file:// rejection errors were reproduced with exit code 1.

The corrected rerun validates the CLI lifecycle and shows the original T10 artifact was stale/incomplete. The spike remains open because Codex desktop-app behavior and successful codex exec activation are unverified, and Claude remains DOCUMENTED / NOT LOCALLY VERIFIED. Keep DALLAY-585 In Progress and DALLAY-586 blocked. No production code changed.