Codex Desktop 26.513.20950 composer plugin mentions hang when shared-with-me catalog returns 404

What happened?

In Codex Desktop, typing @ in the composer opens the mention menu, but the Plugins section stays on Loading plugins... indefinitely. File search below it still works.

This started after updating to Codex Desktop 26.513.20950 / build 2816.

Environment

• Codex Desktop: 26.513.20950, build 2816
• Bundled CLI: codex-cli 0.131.0-alpha.9
• macOS
• Auth mode: ChatGPT login

Root-cause evidence

Current app-server, using temporary CODEX_HOME variants:

• plugin/list with marketplaceKinds: ["local"] succeeds.
• plugin/list with marketplaceKinds: ["shared-with-me"] fails when only auth.json is present.
• plugin/list with marketplaceKinds: ["local", "shared-with-me"] fails the same way.
• Empty/config-only temp homes produce expected auth-required errors instead.
• Removing installed plugin config, including openai-developers, does not fix it.

Stable failing read path:

/backend-api/ps/plugins/installed -> 404 {"detail":"Not Found"}

A supported private share/write probe fails in the same backend surface before upload:

/backend-api/public/plugins/workspace/upload-url -> 404 {"detail":"Not found"}

I also tested:

• Fresh login/re-login
• Reinstalling Codex
• Rebooting macOS
• Installing/logging into the OpenAI Developers plugin
• forced_chatgpt_workspace_id with ChatGPT account id, user id, account-user id, default org id, and auth subject
• Temp auth variants with tokens.account_id changed to the same plausible ids
• Feature flags including remote_plugin, apps, tool_search, tool_suggest, and enable_mcp_apps

None made the shared catalog resolve. --disable plugins avoids the path only by removing plugins entirely, which is not a usable fix.

Version comparison

Archived official build 26.506.20924 / codex-cli 0.129.0-alpha.15 returns successfully for marketplaceKinds: ["shared-with-me"] against the same auth-only temp home. It returns an empty result instead of failing the whole plugin list.

Build archaeology also found that 26.513.20950 is the first cached official build where the composer webview passes:

{ additionalMarketplaceKinds: ["shared-with-me"] }

Expected behavior

If a remote shared/workspace plugin catalog endpoint returns 404 for an account/workspace with no shared plugins, Codex should treat it as an empty remote catalog and still render local plugins in composer mentions.

Alternatively, if the 404 means the account/workspace plugin-service surface is not provisioned, the relevant backend records/endpoints should be initialized so these paths return empty lists rather than 404.

Actual behavior

The current composer path depends on shared-with-me; when that remote catalog call fails, the Plugins mention section stays stuck on Loading plugins... forever even though local plugins are available.

Impact

This makes official/local plugin mentions unusable from the composer on the affected account/workspace, despite local plugin discovery itself working.