Fetch remote installed plugins across all scopes (#37210)

## What changed

- Fetch the paginated installed-plugin snapshot without a `scope` query instead of issuing separate requests for global, user, and workspace plugins.
- Use the combined snapshot for installed-plugin caching and bundle synchronization while continuing to reconcile each scope's marketplace independently.

## Testing

- Cover pagination across mixed scopes, request query parameters, marketplace reconciliation, stale cache cleanup, and discoverable-plugin filtering.

GitOrigin-RevId: 7428a9db81d7ec04e65cc4b236b652278b200956

Author: mzeng-openai

codex-rs/app-server/tests/suite/v2/plugin_list.rs

@@ -1,3 +1,6 @@
+use std::collections::BTreeMap;
+use std::sync::Mutex;
+use std::sync::OnceLock;
 use std::time::Duration;
 
 use anyhow::Result;
@@ -55,6 +58,9 @@ const TEST_ALLOW_HTTP_REMOTE_PLUGIN_BUNDLE_DOWNLOADS: &str =
     "CODEX_TEST_ALLOW_HTTP_REMOTE_PLUGIN_BUNDLE_DOWNLOADS";
 const ALTERNATE_MARKETPLACE_RELATIVE_PATH: &str = ".claude-plugin/marketplace.json";
 const ALTERNATE_PLUGIN_MANIFEST_RELATIVE_PATH: &str = ".claude-plugin/plugin.json";
+type RemoteInstalledPluginFixtures = BTreeMap<String, BTreeMap<String, Vec<serde_json::Value>>>;
+static REMOTE_INSTALLED_PLUGIN_FIXTURES: OnceLock<Mutex<RemoteInstalledPluginFixtures>> =
+    OnceLock::new();
 
 fn write_plugins_enabled_config(codex_home: &std::path::Path) -> std::io::Result<()> {
     std::fs::write(
@@ -3379,8 +3385,7 @@ plugin_sharing = true
             )
         ]
     );
-    wait_for_remote_installed_scope_request(&server, "WORKSPACE").await?;
-    wait_for_remote_installed_scope_request(&server, "GLOBAL").await?;
+    wait_for_remote_installed_snapshot_request(&server).await?;
     Ok(())
 }
 
@@ -3466,8 +3471,7 @@ plugin_sharing = false
             true
         )]
     );
-    wait_for_remote_installed_scope_request(&server, "WORKSPACE").await?;
-    wait_for_remote_installed_scope_request(&server, "GLOBAL").await?;
+    wait_for_remote_installed_snapshot_request(&server).await?;
     Ok(())
 }
 
@@ -3553,7 +3557,7 @@ plugin_sharing = false
         ),
     )
     .await?;
-    wait_for_remote_installed_scope_request(&server, "USER").await?;
+    wait_for_remote_installed_snapshot_request(&server).await?;
     Ok(())
 }
 
@@ -4271,8 +4275,7 @@ async fn plugin_list_fetches_shared_with_me_kind() -> Result<()> {
         share_context.discoverability,
         Some(PluginShareDiscoverability::Unlisted)
     );
-    wait_for_remote_installed_scope_request(&server, "WORKSPACE").await?;
-    wait_for_remote_installed_scope_request(&server, "GLOBAL").await?;
+    wait_for_remote_installed_snapshot_request(&server).await?;
     wait_for_remote_plugin_request_count(&server, "/ps/plugins/list", /*expected_count*/ 0).await?;
     Ok(())
 }
@@ -4751,7 +4754,7 @@ async fn wait_for_remote_plugin_list_scope_request_count(
     Ok(())
 }
 
-async fn wait_for_remote_installed_scope_request(server: &MockServer, scope: &str) -> Result<()> {
+async fn wait_for_remote_installed_snapshot_request(server: &MockServer) -> Result<()> {
     timeout(DEFAULT_TIMEOUT, async {
         loop {
             let Some(requests) = server.received_requests().await else {
@@ -4760,10 +4763,7 @@ async fn wait_for_remote_installed_scope_request(server: &MockServer, scope: &st
             if requests.iter().any(|request| {
                 request.method == "GET"
                     && request.url.path().ends_with("/ps/plugins/installed")
-                    && request
-                        .url
-                        .query_pairs()
-                        .any(|(name, value)| name == "scope" && value == scope)
+                    && request.url.query_pairs().all(|(name, _)| name != "scope")
             }) {
                 return Ok::<(), anyhow::Error>(());
             }
@@ -4998,6 +4998,19 @@ async fn mount_shared_workspace_plugins(server: &MockServer, body: &str) {
 }
 
 async fn mount_remote_installed_plugins(server: &MockServer, scope: &str, body: &str) {
+    let plugins = serde_json::from_str::<serde_json::Value>(body)
+        .expect("installed plugin fixture should be valid JSON")["plugins"]
+        .as_array()
+        .expect("installed plugin fixture should contain plugins")
+        .clone();
+    REMOTE_INSTALLED_PLUGIN_FIXTURES
+        .get_or_init(Default::default)
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner)
+        .entry(server.uri())
+        .or_default()
+        .insert(scope.to_string(), plugins);
+
     Mock::given(method("GET"))
         .and(path("/backend-api/ps/plugins/installed"))
         .and(query_param("scope", scope))
@@ -5006,6 +5019,34 @@ async fn mount_remote_installed_plugins(server: &MockServer, scope: &str, body:
         .respond_with(ResponseTemplate::new(200).set_body_string(body))
         .mount(server)
         .await;
+
+    let server_uri = server.uri();
+    Mock::given(method("GET"))
+        .and(path("/backend-api/ps/plugins/installed"))
+        .and(query_param_is_missing("scope"))
+        .and(header("authorization", "Bearer chatgpt-token"))
+        .and(header("chatgpt-account-id", "account-123"))
+        .respond_with(move |_request: &wiremock::Request| {
+            let fixtures = REMOTE_INSTALLED_PLUGIN_FIXTURES
+                .get()
+                .expect("installed plugin fixtures should exist")
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner);
+            let scoped_plugins = fixtures
+                .get(&server_uri)
+                .expect("installed plugin fixtures should exist for this server");
+            let plugins = ["GLOBAL", "WORKSPACE", "USER"]
+                .into_iter()
+                .flat_map(|scope| scoped_plugins.get(scope).into_iter().flatten())
+                .cloned()
+                .collect::<Vec<_>>();
+            ResponseTemplate::new(200).set_body_json(serde_json::json!({
+                "plugins": plugins,
+                "pagination": {"limit": 50, "next_page_token": null},
+            }))
+        })
+        .mount(server)
+        .await;
 }
 
 async fn mount_empty_user_installed_plugins(server: &MockServer) {

codex-rs/app-server/tests/suite/v2/skills_list.rs

@@ -37,6 +37,7 @@ use wiremock::matchers::header;
 use wiremock::matchers::method;
 use wiremock::matchers::path;
 use wiremock::matchers::query_param;
+use wiremock::matchers::query_param_is_missing;
 
 const DEFAULT_TIMEOUT: Duration = Duration::from_secs(30);
 const WATCHER_TIMEOUT: Duration = Duration::from_secs(20);
@@ -579,6 +580,14 @@ async fn skills_list_loads_remote_installed_plugin_skills_from_cache() -> Result
             .mount(&server)
             .await;
     }
+    Mock::given(method("GET"))
+        .and(path("/backend-api/ps/plugins/installed"))
+        .and(query_param_is_missing("scope"))
+        .and(header("authorization", "Bearer chatgpt-token"))
+        .and(header("chatgpt-account-id", "account-123"))
+        .respond_with(ResponseTemplate::new(200).set_body_string(global_installed_body))
+        .mount(&server)
+        .await;
 
     let plugin_list_request_id = mcp
         .send_plugin_list_request(PluginListParams {

codex-rs/core-plugins/src/discoverable_tests.rs

@@ -33,6 +33,7 @@ use wiremock::ResponseTemplate;
 use wiremock::matchers::method;
 use wiremock::matchers::path;
 use wiremock::matchers::query_param;
+use wiremock::matchers::query_param_is_missing;
 
 #[tokio::test]
 async fn returns_fallback_plugins_when_remote_disabled_for_codex_auth() {
@@ -786,7 +787,7 @@ source = "/tmp/{sales_marketplace_name}"
 }
 
 #[tokio::test]
-async fn expands_cached_remote_plugins_by_loaded_apps() {
+async fn cached_remote_discovery_requires_installed_cache_and_filters_candidates() {
     let codex_home = tempdir().expect("tempdir should succeed");
     write_file(
         &codex_home.path().join(CONFIG_TOML_FILE),
@@ -801,6 +802,25 @@ plugins = true
         .and(query_param("scope", "GLOBAL"))
         .respond_with(ResponseTemplate::new(200).set_body_json(json!({
             "plugins": [
+                {
+                    "id": "plugins~Plugin_remote_github",
+                    "name": "github",
+                    "scope": "GLOBAL",
+                    "installation_policy": "AVAILABLE",
+                    "authentication_policy": "ON_USE",
+                    "status": "AVAILABLE",
+                    "release": {
+                        "display_name": "Remote GitHub",
+                        "description": "Remote GitHub long",
+                        "app_ids": ["github"],
+                        "interface": {"short_description": "Remote GitHub short"},
+                        "skills": [{
+                            "name": "github",
+                            "description": "Use GitHub",
+                            "interface": null
+                        }]
+                    }
+                },
                 {
                     "id": "plugins~Plugin_remote_unlisted",
                     "name": "remote-unlisted",
@@ -835,6 +855,32 @@ plugins = true
                             }
                         ]
                     }
+                },
+                {
+                    "id": "plugins~Plugin_remote_slack_not_available",
+                    "name": "slack",
+                    "scope": "GLOBAL",
+                    "installation_policy": "NOT_AVAILABLE",
+                    "authentication_policy": "ON_USE",
+                    "status": "AVAILABLE",
+                    "release": {
+                        "display_name": "Remote Slack",
+                        "description": "Remote Slack long",
+                        "interface": {"short_description": "Remote Slack short"}
+                    }
+                },
+                {
+                    "id": "plugins~Plugin_remote_figma_admin_disabled",
+                    "name": "figma",
+                    "scope": "GLOBAL",
+                    "installation_policy": "AVAILABLE",
+                    "authentication_policy": "ON_USE",
+                    "status": "DISABLED_BY_ADMIN",
+                    "release": {
+                        "display_name": "Remote Figma",
+                        "description": "Remote Figma long",
+                        "interface": {"short_description": "Remote Figma short"}
+                    }
                 }
             ],
             "pagination": {
@@ -860,20 +906,29 @@ plugins = true
     .await
     .expect("remote plugin catalog cache should write");
 
-    for scope in ["GLOBAL", "USER", "WORKSPACE"] {
-        Mock::given(method("GET"))
-            .and(path("/backend-api/ps/plugins/installed"))
-            .and(query_param("scope", scope))
-            .respond_with(ResponseTemplate::new(200).set_body_json(json!({
-                "plugins": [],
-                "pagination": {
-                    "next_page_token": null
-                }
-            })))
-            .expect(1)
-            .mount(&server)
-            .await;
-    }
+    assert_eq!(
+        list_discoverable_plugins(
+            &plugins_manager,
+            discovery_input(plugins.clone(), &[], &[], &["remote-unlisted-app"]),
+            Some(&auth),
+        )
+        .await,
+        Vec::new()
+    );
+
+    Mock::given(method("GET"))
+        .and(path("/backend-api/ps/plugins/installed"))
+        .and(query_param_is_missing("scope"))
+        .and(query_param_is_missing("includeDownloadUrls"))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "plugins": [],
+            "pagination": {
+                "next_page_token": null
+            }
+        })))
+        .expect(1)
+        .mount(&server)
+        .await;
     plugins_manager
         .build_and_cache_remote_installed_plugin_marketplaces(
             &plugins,
@@ -884,24 +939,55 @@ plugins = true
         .await
         .expect("remote installed plugin cache should write");
 
+    let expected_github = ToolSuggestDiscoverablePlugin {
+        id: "github@openai-curated-remote".to_string(),
+        remote_plugin_id: Some("plugins~Plugin_remote_github".to_string()),
+        name: "Remote GitHub".to_string(),
+        description: Some("Remote GitHub short".to_string()),
+        has_skills: true,
+        mcp_server_names: Vec::new(),
+        app_connector_ids: vec!["github".to_string()],
+    };
+    assert_eq!(
+        list_discoverable_plugins(
+            &plugins_manager,
+            discovery_input(plugins.clone(), &[], &[], &[]),
+            Some(&auth),
+        )
+        .await,
+        vec![expected_github.clone()]
+    );
+
     let discoverable_plugins = list_discoverable_plugins(
         &plugins_manager,
-        discovery_input(plugins, &[], &[], &["remote-unlisted-app"]),
+        discovery_input(plugins.clone(), &[], &[], &["remote-unlisted-app"]),
         Some(&auth),
     )
     .await;
 
     assert_eq!(
         discoverable_plugins,
-        vec![ToolSuggestDiscoverablePlugin {
-            id: "remote-unlisted@openai-curated-remote".to_string(),
-            remote_plugin_id: Some("plugins~Plugin_remote_unlisted".to_string()),
-            name: "Remote Unlisted".to_string(),
-            description: Some("Remote Unlisted short".to_string()),
-            has_skills: true,
-            mcp_server_names: Vec::new(),
-            app_connector_ids: vec!["remote-unlisted-app".to_string()],
-        }]
+        vec![
+            expected_github,
+            ToolSuggestDiscoverablePlugin {
+                id: "remote-unlisted@openai-curated-remote".to_string(),
+                remote_plugin_id: Some("plugins~Plugin_remote_unlisted".to_string()),
+                name: "Remote Unlisted".to_string(),
+                description: Some("Remote Unlisted short".to_string()),
+                has_skills: true,
+                mcp_server_names: Vec::new(),
+                app_connector_ids: vec!["remote-unlisted-app".to_string()],
+            },
+        ]
+    );
+    assert_eq!(
+        list_discoverable_plugins(
+            &plugins_manager,
+            discovery_input(plugins, &[], &["github@openai-curated-remote"], &[]),
+            Some(&auth),
+        )
+        .await,
+        Vec::new()
     );
 }