Legacy openai-curated snapshot remains registered after migration and exposes Superpowers 5.1.3

Summary

After the curated-plugin marketplace migration, Codex still discovers and registers a legacy local \openai-curated\ snapshot from \$CODEX_HOME/.tmp/plugins\, even when the user configuration has no \[marketplaces.openai-curated]\ entry.

That legacy snapshot exposes \superpowers\ version \5.1.3\ through \codex plugin list --available\. The row is reported as \installed: false\ and \enabled: false\, so this does not prove that 5.1.3 is currently active. The confirmed problem is stale marketplace registration/residue.

This is distinct from reports that the curated Superpowers package is merely behind upstream: the current \openai-curated-remote\ cache/catalog in the same environment already contains Superpowers \6.2.0\, while the old snapshot is still enumerated.

Environment

• Codex CLI \0.145.0\
• Linux x86_64
• Observed 2026-07-24
• The report uses normalized paths and excludes account, host, project, and session identifiers.

Reproduction

1. Start with a Codex installation that has migrated to the remote curated-plugin catalog.
2. Leave the legacy marketplace checkout and its sync marker under \$CODEX_HOME/.tmp/plugins\ / \$CODEX_HOME/.tmp/plugins.sha\.
3. Remove or omit any explicit \[marketplaces.openai-curated]\ block from the user configuration.
4. Run:

\\\sh
codex plugin marketplace list --json
codex plugin list --json --available
\\\

1. Observe that \openai-curated\ is still listed and points to the legacy local snapshot.
2. Observe an available row equivalent to:

\\\text
superpowers@openai-curated
version: 5.1.3
installed: false
enabled: false
\\\

Sanitized observations

• The explicit configuration contains the current bundled marketplace but no \openai-curated\ marketplace block.
• \codex plugin marketplace list --json\ nevertheless includes:

\\\text
openai-curated -> $CODEX_HOME/.tmp/plugins
\\\

• The old snapshot contains 180 plugin directories and is approximately 87 MB, along with marketplace metadata and the sync marker.
• The current remote cache/catalog contains \superpowers\ \6.2.0\.
• A filesystem search found only the old \5.1.3\ manifest and the current \6.2.0\ manifest; there was no second active \5.1.3\ installation.

Expected behavior

• A marketplace checkout/cache should not become an active or enumerated marketplace solely because it remains on disk.
• After migration, the legacy \openai-curated\ snapshot should either be removed safely or be explicitly marked inactive/hidden.
• Inactive legacy snapshots should not contribute entries to \plugin list --available\, plugin/skill discovery, or install suggestions.
• Migration/cleanup should be bounded and safe: preserve active/bundled marketplaces, then garbage-collect obsolete snapshots and sync markers.
• Inventory output should make configured snapshots, account-installed plugins, and remote-cache artifacts unambiguous.

Actual behavior

The old snapshot is automatically rediscovered despite the absence of an explicit marketplace configuration entry. It makes an obsolete, uninstalled 5.1.3 package look like a current marketplace option and leaves a large set of stale plugin files behind.

I did not observe 5.1.3 loaded into the current prompt or marked installed/enabled during this check. The issue is the confirmed stale registration and residual state; a separate report covers the case where stale cached skills are actually resolved.

Requested fix

Please make marketplace migration/state loading explicit and self-cleaning:

1. Do not auto-register legacy marketplace roots from cache presence alone.
2. Add a migration that removes or quarantines the old \openai-curated\ snapshot and its sync marker once the remote marketplace is active.
3. Exclude inactive/uninstalled legacy entries from discovery and \--available\ output.
4. Add a regression test covering: no explicit old-market config + legacy \.tmp/plugins\ present + newer remote catalog => old marketplace is not listed.

Related issues

• #33506 — configured-only plugin inventory can show \superpowers@openai-curated\ 5.1.3 as uninstalled alongside a newer account-installed remote entry.
• #28846 — \openai-curated\ Superpowers package is outdated.
• #29517 — update the curated Superpowers pin.
• #30993 — stale cached plugin skill can still resolve from a not-installed marketplace entry.
• #32058 — stale marketplace temporary directories can accumulate.

Those issues are related, but this report focuses on legacy marketplace auto-discovery and cleanup after migration.

Privacy

All local paths are normalized to \$CODEX_HOME\. No usernames, hostnames, project names, raw configuration dumps, credentials, session IDs, or private file contents are included.