Replace local codex plugin with external GitHub source#9
Conversation
Switch codex plugin from local ./plugins/codex to openai/codex-plugin-cc GitHub repository. Remove local plugin files as they are now maintained upstream by OpenAI.
There was a problem hiding this comment.
Pull request overview
Switches the codex plugin in the Claude Code marketplace from a locally hosted plugin directory to an externally hosted GitHub repository, removing the in-repo plugin implementation files.
Changes:
- Remove the locally maintained
plugins/codexplugin assets (README, command, agent, and plugin manifest). - Update
.claude-plugin/marketplace.jsonto sourcecodexfromopenai/codex-plugin-ccon GitHub. - Update marketplace metadata for
codex(description/keywords/author) to reflect the upstream source.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| plugins/codex/README.md | Removes local plugin documentation now that the plugin is maintained upstream. |
| plugins/codex/commands/codex.md | Removes the local /codex command definition. |
| plugins/codex/agents/codex-runner.md | Removes the local Codex runner agent definition. |
| plugins/codex/.claude-plugin/plugin.json | Removes the local plugin manifest. |
| .claude-plugin/marketplace.json | Points codex plugin source to the external GitHub repo and updates metadata. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "name": "codex", | ||
| "source": "./plugins/codex", | ||
| "description": "⚠️ [EXPERIMENTAL] Integration with OpenAI Codex CLI for complex code generation and debugging - early development", | ||
| "version": "0.0.2-alpha", | ||
| "source": {"source": "github", "repo": "openai/codex-plugin-cc"}, | ||
| "description": "Integration with OpenAI Codex CLI for complex code generation and debugging", |
There was a problem hiding this comment.
The marketplace now pulls the codex plugin directly from a mutable external GitHub repo (openai/codex-plugin-cc). This introduces a supply-chain risk (upstream changes can alter executed commands/agents/hooks without review). Prefer pinning to an immutable ref (tag/commit) if the marketplace spec supports it, or mirroring/vendor the plugin into this repo / an internal, reviewed fork; at minimum document and enforce an update/review process for upstream changes before they reach users.
Address review feedback: pin external source to immutable ref to mitigate supply-chain risk from mutable upstream changes.
Switch codex plugin from local ./plugins/codex to openai/codex-plugin-cc GitHub repository. Remove local plugin files as they are now maintained upstream by OpenAI.