Support npm package sources in marketplace.json plugin entries (currently silently ignored)
What variant of Codex are you using?
CLI
What feature would you like to see?
Summary
Plugin entries in marketplace.json only materialize for local and git sources. An
npm source, as supported by the Claude Code marketplace format that
.agents/plugins/marketplace.json mirrors, is silently dropped: marketplace add accepts the manifest, but the plugin never shows up in plugin list --available and plugin add says it was not found.
Two asks:
- Support
{"source": "npm", "package": "<name>"}: fetch from the npm registry, validate.codex-plugin/plugin.json, install into the cache like the other sources. - At minimum, error on unrecognized source types instead of silently dropping the plugin.
## Reproduction
codex-cli 0.138.0 and 0.139.0, macOS arm64, sandboxed HOME/CODEX_HOME. Manifest entry:
``json``
{
"name": "polygraph",
"source": { "source": "npm", "package": "@polygraph/codex-plugin" }
}
```
$ codex plugin marketplace add <marketplace-root> --json
{ "marketplaceName": "polygraph-plugins", "alreadyAdded": false }
$ codex plugin add polygraph@polygraph-plugins --json
Error: plugin polygraph was not found in marketplace polygraph-plugins
$ codex plugin list --available --json
{ "installed": [], "available": [] }
```
The package is a valid Codex plugin and installs fine through a local source.
## Use case
We publish the same plugin for multiple agent CLIs from one repo. Claude Code installs it straight from npm {"source": {"source": "npm", "package": "@polygraph/claude-plugin"}}). For Codex, npm is also the canonical channel (@polygraph/codex-plugin), but the marketplace snapshot has to contain the plugin bytes, so we either commit built artifacts into git or run a custom installer that downloads from npm and hands a local-source marketplace to codex plugin add. npm-source support would remove that extra machinery and match how the same marketplace already behaves in Claude Code.
Additional information
_No response_