OpenAI Developers plugin is enabled and injects skills even though I never installed it

What version of Codex CLI is running?

codex-cli 0.146.0

What subscription do you have?

ChatGPT Plus

Which model were you using?

gpt-5.6-sol

What platform is your computer?

Darwin 25.5.0 arm64 arm (macOS)

What terminal emulator and version are you using?

VS Code integrated terminal 1.130.0

Codex doctor report

{
  "schemaVersion": 1,
  "overallStatus": "ok",
  "codexVersion": "0.146.0",
  "auth": {
    "mode": "chatgpt",
    "storedChatGPTTokens": true,
    "storedApiKey": false
  },
  "runtime": {
    "installMethod": "brew",
    "platform": "macos-aarch64"
  },
  "config": {
    "model": "gpt-5.6-sol",
    "modelProvider": "openai",
    "featureFlagOverrides": "none",
    "relevantEnabledFeatures": [
      "plugins",
      "remote_plugin",
      "plugin_sharing",
      "skill_search",
      "mentions_v2"
    ]
  }
}

What issue are you seeing?

Fresh Codex CLI sessions inject five skills from the remote openai-developers plugin even though I did not knowingly install or enable that plugin in Codex, ChatGPT, or a workspace:

openai-developers:agents-sdk
openai-developers:build-chatgpt-app
openai-developers:chatgpt-app-submission
openai-developers:openai-api-troubleshooting
openai-developers:openai-platform-api-key

There are no matching plugin entries in ~/.codex/config.toml and no repo-local plugin or skill configuration.

More importantly, the app-server's authoritative plugin/installed RPC returns this internally inconsistent row:

{
  "id": "openai-developers@openai-curated-remote",
  "remotePluginId": "plugin_connector_1p_32dba5a7095c8191adca04ee30276304",
  "version": "1.2.3",
  "name": "openai-developers",
  "source": { "type": "remote" },
  "installed": true,
  "enabled": true,
  "installPolicy": "AVAILABLE",
  "installPolicySource": null,
  "mustShowInstallationInterstitial": true,
  "authPolicy": "ON_INSTALL",
  "availability": "AVAILABLE"
}

AVAILABLE, mustShowInstallationInterstitial: true, and ON_INSTALL indicate that explicit installation should still be required, but the same response marks the plugin installed and enabled.

The ordinary codex plugin list output is also confusing because it only shows the local openai-curated marketplace row as not installed, while the separate account-level openai-curated-remote installation is what affects sessions.

What steps can reproduce the bug?

1. Ensure there is no openai-developers plugin entry in ~/.codex/config.toml.
2. Start a fresh interactive codex session.
3. Inspect the model-visible ### Available skills startup metadata or the persisted rollout developer message.
4. Observe the five openai-developers:* skills loaded from:

``text
~/.codex/plugins/cache/openai-curated-remote/openai-developers/1.2.3/skills/
``

1. Query app-server plugin/installed with experimental API enabled.
2. Observe the contradictory row above: installed: true and enabled: true, but policy AVAILABLE, installation interstitial required, auth on install, and no policy source.

Thread showing the behavior: 019fae0e-6ed8-7d32-a389-fb83eb5a50aa.

What is the expected behavior?

A plugin with installPolicy: AVAILABLE, mustShowInstallationInterstitial: true, and authPolicy: ON_INSTALL should not become installed/enabled or contribute skills to model context until the user completes the installation flow.
The CLI should also present local and remotely synchronized installation state consistently instead of showing not installed in codex plugin list while loading the remote plugin.

Source-code inspection

The following is 100% AI generated: at current main commit 9a6668f674d74b35418fa534b3b6285a315d0765, the observed path is:

1. fetch_remote_installed_plugins trusts the account-level installed-plugin endpoint for global, workspace, and user scopes.
2. remote_installed_plugin_to_cache_entry carries through enabled, install policy, policy source, interstitial requirement, and auth policy without validating contradictory combinations.
3. remote_installed_plugins_to_config publishes any returned plugin whose bundle exists in the local cache as effective plugin config.
4. load_plugins_from_layer_stack merges those remote-installed configs.
5. Session initialization adds the resulting plugin skill roots to the skills snapshot.

This suggests the incorrect installed state may originate in the plugin-service response, but the CLI currently has no fail-closed handling or diagnostic for this inconsistent policy combination.

Additional information

Related but distinct reports:

• #35128 covers a plugin explicitly installed in ChatGPT becoming active in Codex CLI.
• #26275 covers a plugin explicitly installed on another device appearing in a remote CLI.
• #29450 covers plugins reappearing after users uninstall them.
• #21425 requests separating installed plugin availability from default skill injection.