Bundled spreadsheets plugin emits invalid icon path warnings on every startup

Summary

The bundled spreadsheets plugin from the OpenAI Primary Runtime emits two skill-metadata warnings on every fresh Codex startup. The warnings are caused by paths in the bundled plugin, not by a user's config.toml.

WARN codex_core_skills::loader: ignoring interface.icon_small: icon path with '..' must resolve under plugin assets/
WARN codex_core_skills::loader: ignoring interface.icon_large: icon path with '..' must resolve under plugin assets/

Environment

• Codex surface: Codex Desktop
• Bundled CLI: codex-cli 0.144.2
• Platform: Windows x64
• Affected plugin: spreadsheets@openai-primary-runtime

Account identifiers, subscription details, and local machine identifiers are intentionally omitted because they are not relevant to this local metadata-validation issue.

Steps to reproduce

1. Install or enable the bundled spreadsheets@openai-primary-runtime plugin.
2. Start a fresh Codex process.
3. Inspect the startup log.
4. Observe one warning for interface.icon_small and one for interface.icon_large.

No related config.toml setting is required.

Root cause

The plugin metadata at:

skills/excel-live-control/agents/openai.yaml

references a sibling skill's asset:

icon_small: ../spreadsheets/assets/file-spreadsheet.png
icon_large: ../spreadsheets/assets/file-spreadsheet.png

A path containing .. is accepted only when its resolved target remains under the plugin-level assets/ directory. These paths instead resolve into a sibling skill directory, so the loader correctly rejects them and ignores both optional icons.

Expected behavior

Bundled plugin metadata should pass validation and load both icons without warnings.

Verified package fix

I tested the following package-only correction:

1. Copy the icon to skills/excel-live-control/assets/file-spreadsheet.png.
2. Change both metadata values to ./assets/file-spreadsheet.png.
3. Revalidate and reinstall the plugin package.

Results:

• official plugin validation passed for both source and installed cache;
• source and installed-cache file hashes matched;
• two independent fresh Codex starts produced zero target warnings;
• excel-live-control remained discoverable;
• all five plugins in the same Primary Runtime snapshot passed validation.

Optional loader diagnostic hardening

The package correction is the primary fix. Separately, I prepared and tested a small loader diagnostic improvement that leaves validation behavior unchanged but adds these structured warning fields:

• plugin_id
• skill_dir
• raw_path
• resolved_path
• allowed_root

The existing invalid plugin-icon regression test was extended to assert those fields.

Local verification:

• just fmt: passed
• just test -p codex-core-skills: 118 tests passed
• git diff --check: passed

I understand that external code contributions to this repository are invitation-only. If maintainers want the diagnostic hardening after reviewing this issue, I can provide the tested patch through the invited contribution workflow.

Privacy note

This report intentionally excludes email addresses, local usernames, absolute home/workspace paths, account and subscription identifiers, thread or run identifiers, authentication material, and unrelated log lines.