fix(codex): install global plugins through `codex plugin add`

[corylanou]

Problem

scripts/install-codex.sh --user currently writes Codex's private marketplace cache layout itself and then appends enabled plugin entries to ~/.codex/config.toml.

On Codex CLI 0.144.6, the supported installer publishes versioned roots through codex plugin add. The manual flow can expose an enabled plugin before the corresponding cache root is ready. On a first session after installation, both SessionStart and Stop from go-workflow@gopher-ai failed with exit code 127. The cache/config timestamps matched the session start, while a subsequent clean session succeeded.

The prior 1.7.1 active-root preservation fix prevents deleting an already-loaded root, but it still relies on Codex's private cache/config implementation and does not close this first-install race.

Proposed change

• Require a Codex version that supports codex plugin add.
• Register or upgrade the gopher-ai marketplace.
• Install each Codex-capable plugin with codex plugin add <plugin>@gopher-ai.
• Stop hand-writing cache roots and plugin enablement entries.
• Make --prune-cache retain the current versioned root rather than a commit-hash root.
• Update installer output and documentation to describe the public CLI flow.
• Ship as a patch release so fleet machines can rerun the universal installer.

Acceptance criteria

• --user invokes codex plugin add for all six Codex plugins.
• The installer does not manually append [plugins.*] enabled = true entries.
• A clean first Codex session reports no SessionStart or Stop hook exit-127 errors.
• Reinstalling the same version does not invalidate an active plugin root.
• Publishing a new version retains the prior root until explicit post-session pruning.
• Existing installation, hook, and shared-sync tests pass.

Local implementation

A validated implementation is currently prepared on local branch fix/codex-plugin-cli-install.

[corylanou]

Codex Workpad

Plan

• Inspect issue state, dependencies, current installer behavior, and Codex 0.144.6 plugin commands.
• Replace private cache/config publication with the public marketplace and plugin installation CLI.
• Make explicit cache pruning retain complete current-version roots and preserve older roots until the current root is ready.
• Add focused installation coverage, update guidance, and synchronize patch-release manifests at 1.7.2.
• Run focused checks and the full configured validation gate.
• Commit, push, and open non-draft PR fix(codex): install global plugins through CLI #254 with Fixes #253.
• Confirm current-head CI, PR comments, inline comments, reviews, and unresolved review threads.

Implementation and validation evidence

• --user capability-checks codex plugin add, registers or upgrades the gopher-ai marketplace through the CLI, and invokes plugin add for all six Codex-capable plugins.
• The installer no longer publishes cache roots or appends enabled plugin entries to config.toml.
• Focused installation suite passed at 1.7.2, including first install, reinstall, marketplace upgrade, incomplete-root recovery, pruning, legacy cleanup, unsupported CLI, and missing CLI cases.
• Diff hygiene, shell syntax, and ShellCheck passed for touched scripts.
• The exact configured Detent validation gate passed before the first push and again after the CI portability correction.
• Initial SHA 01ed857 exposed one GitHub runner portability failure because new test assertions used unavailable rg; commit b3b29f1 switched those assertions to the suite's existing portable grep dependency.
• PR fix(codex): install global plugins through CLI #254 is open, non-draft, references Fixes #253, and is mergeable with clean merge state.
• Latest pushed SHA b3b29f195e8f674626e01f0156390aeed90e5c59 has nine completed successful checks. No PR comments, inline comments, submitted reviews, or unresolved review threads remain.

Gate telemetry

• Quiet-window wait: not started; the issue remains in the In Progress lane until Detent consumes this completion signal.
• Local merge gate: not run in this lane; the full pre-review gate passed twice.
• Current-head PR CI duration: 64 seconds from workflow start through final scanner completion.
• Slow check: Scan go-workflow ran for 57 seconds; all other checks completed sooner.
• Post-merge main CI: not started because the PR is not merged.

schema: 1
status: complete
blockers: []
human_action: null

[corylanou]

Auto-promoted this issue from In Progress to Merging.

• reason: ready
• pull request: fix(codex): install global plugins through CLI #254
• mergeable_state: clean
• workpad_comment: fix(codex): install global plugins through codex plugin add #253 (comment)