Local marketplace plugins with installPolicy=INSTALLED_BY_DEFAULT are not auto-installed

What version of Codex is running?

codex-cli 0.140.0

Which model is Codex using?

Not relevant to plugin marketplace behavior.

What platform is your computer?

Linux

What steps reproduce the bug?

1. Add a local marketplace whose .agents/plugins/marketplace.json contains plugins with:

``json
"policy": {
"installation": "INSTALLED_BY_DEFAULT",
"authentication": "ON_INSTALL"
}
``

1. Verify Codex registers the marketplace:

``bash
codex plugin marketplace list
``

Output includes:
``text
MARKETPLACE ROOT
personal /home/crduser
openai-curated /home/crduser/.codex/.tmp/plugins
data-agent-kit /home/crduser/Documents/data-agent-kit
``

1. Verify the marketplace metadata is parsed and surfaced by Codex:

``bash
codex plugin list --marketplace data-agent-kit --available --json
``

Example output:
``json
{
"installed": [],
"available": [
{
"pluginId": "alloydb@data-agent-kit",
"marketplaceName": "data-agent-kit",
"installed": false,
"enabled": false,
"marketplaceSource": {
"sourceType": "local",
"source": "/home/crduser/Documents/data-agent-kit"
},
"installPolicy": "INSTALLED_BY_DEFAULT",
"authPolicy": "ON_INSTALL"
}
]
}
``

1. Check what is actually installed:

``bash
codex plugin list --marketplace data-agent-kit --json
``

Actual output:
``json
{
"installed": [],
"available": []
}
``

What did you expect to happen?

I expected plugins marked with installPolicy: INSTALLED_BY_DEFAULT in the marketplace manifest to be automatically installed, or at minimum for Codex docs/CLI behavior to clearly indicate that local marketplace registration does not trigger default installation.

What actually happened?

Codex parses and surfaces installPolicy: INSTALLED_BY_DEFAULT in codex plugin list --available --json, but no plugins are installed after the marketplace is added. The policy appears to be recognized as metadata but not enforced as installation behavior.

Additional context

The marketplace is configured as a local source in ~/.codex/config.toml:

[marketplaces.data-agent-kit]
last_updated = "2026-06-18T04:49:21Z"
source_type = "local"
source = "/home/crduser/Documents/data-agent-kit"

The marketplace manifest being used is the local repo file, not a copied file under ~/.codex:

/home/crduser/Documents/data-agent-kit/.agents/plugins/marketplace.json

That manifest contains entries like:

{
  "name": "alloydb",
  "policy": {
    "installation": "INSTALLED_BY_DEFAULT",
    "authentication": "ON_INSTALL"
  }
}

So this does not look like a malformed manifest. It looks like Codex is reading the policy but not acting on it.