[Feature Request] Add Kimi Codex OAuth to the curated plugin marketplace

What feature would you like to see?

I maintain P-A-N-52/kimi-codex-oauth. Please consider adding Kimi Codex OAuth v0.1.1 to the Curated section of Kimi Code's default plugin marketplace, via plugins/marketplace.json.

This is an independently maintained third-party plugin for Kimi Code. It lets users with a local, file-based Codex CLI ChatGPT OAuth login use that account from Kimi Code through an openai_responses provider. It requires Node.js 18+ and has no npm runtime dependencies.

The plugin starts a Node.js proxy bound to 127.0.0.1, refreshes OAuth credentials when needed, and synchronizes model metadata from the account's upstream model list. It includes setup, status, and uninstall commands. Its SessionStart hook starts the proxy and synchronizes managed provider/model configuration. No Kimi Code source changes are needed for the integration.

Proposed marketplace entry, pinned to the published v0.1.1 ZIP:

{
  "id": "kimi-codex-oauth",
  "tier": "curated",
  "displayName": "Kimi Codex OAuth",
  "version": "0.1.1",
  "description": "Use the local Codex CLI ChatGPT OAuth login from Kimi Code through a loopback Responses proxy.",
  "homepage": "https://github.com/P-A-N-52/kimi-codex-oauth",
  "keywords": ["openai", "chatgpt", "codex", "oauth", "responses"],
  "source": "https://github.com/P-A-N-52/kimi-codex-oauth/releases/download/v0.1.1/kimi-codex-oauth-v0.1.1.zip"
}

Additional information

Release and review materials

• v0.1.1 release and installation ZIP, licensed under MIT.
• README: requirements, installation, upgrade, and removal.
• Data flow and permissions.
• Testing scope and limitations and changelog.

The ZIP contains kimi.plugin.json at its root. Its SHA-256 is a6ddc0354b83b13c3584e27e0b90e34d3ae825e11894b00e802a85bf66f3cc9a; the release also includes SHA256SUMS.txt.

Permissions and runtime boundaries

The plugin reads the user's Codex OAuth file cache (~/.codex/auth.json by default) and updates it after a successful token refresh. It also writes its managed Kimi Code provider/model configuration after validation and a private backup. Credential/config replacement uses private temporary files and atomic replacement, preserves the original Windows ACL, and restricts POSIX permissions. Cleanup preserves personal configuration, referenced models, and the Codex login cache; a dry-run mode is available.

Model inputs and access tokens are sent directly to the ChatGPT backend, and refresh tokens are sent to OpenAI's OAuth endpoint. There is no author-operated relay or plugin telemetry. The local /v1/responses and /v1/models endpoints do not enforce caller authentication: local-proxy is a placeholder key, so other processes that can reach the loopback port can call them. The stop endpoint uses a separate per-instance control key. These details are documented in PRIVACY.md.

This project does not claim affiliation with or endorsement by Kimi or OpenAI. It currently supports file-based ChatGPT OAuth credentials, not API-key login or a system keyring. The README documents account/service-term limitations.

Validation

• All six CI jobs passed for Windows, macOS, and Linux with Node.js 18 and 24, on release commit 6999c151296e7085022ff2a73dfd7e073305e592.
• Local Windows / Node.js 24.18.0: 29 tests, 27 passed, 2 POSIX-only tests skipped, 0 failed.
• A local Kimi Code 0.41.0 configuration check accepted a valid isolated candidate and rejected malformed TOML.
• I previously used the plugin on macOS with Kimi Code 0.39.0; the macOS and Node.js versions were not recorded.
• Automated tests use isolated directories, synthetic credentials, and mocked upstream responses. They are not a claim of a new, complete v0.1.1 real-account end-to-end test on macOS.

Following the contribution policy, I am opening an issue for maintainers to evaluate this catalog inclusion request. If accepted, the proposed entry above is ready for the team to apply; I can provide a PR if explicitly invited.

Maintainer: P-A-N-52. Contact email: 3401976613@qq.com.

Read plugins/marketplace.json and compare its existing entry format with the proposed Kimi Codex OAuth v0.1.1 entry. Verify the release ZIP URL and metadata against the linked release materials; done when the curated entry is added without invalidating the marketplace file.