Codex Desktop silently materializes an older capability-regressed remote plugin bundle during task startup

What version of the Codex App are you using?

Codex Desktop / app-server CLI 0.149.0-alpha.4.3 on Windows.

Plugin

data-analytics@openai-curated-remote

What issue are you seeing?

A previously working remote plugin bundle was silently replaced/materialized with an older bundle during new-task startup:

• Last known working bundle: 0.2.35-13ceeea1f599
• Newly materialized bundle: 0.2.10-13ceeea1f599
• Required component present in the working bundle: scripts/data-app.mjs
• The newly materialized bundle does not contain that component; its scripts directory only contains normalize-widget-assets.mjs.

A local dashboard project generated by the plugin still contains the plugin-authored build contract instructing it to run scripts/data-app.mjs. The source remains editable, but the dashboard can no longer be rebuilt because the plugin's required local builder disappeared.

This is a capability regression, not merely a display-version mismatch.

Evidence and timing

All timestamps below are Asia/Shanghai:

• New task/session initialized: 2026-09-04 01:07:22
• Task context loaded: approximately 01:07:26
• Older bundle directory materialized: 01:07:30.756
• First agent tool invocation: approximately 01:07:40

The plugin bundle was therefore materialized before the agent could issue any command. The user did not request plugin installation, update, removal, downgrade, or rematerialization. Local session records contain no agent plugin-management or filesystem command preceding materialization.

The earlier 0.2.35 builder had successfully completed an offline dashboard build before the replacement. No npm or project-local dependency installation was required.

Steps to reproduce

The exact server-side routing condition is not locally observable, but the observed sequence was:

1. Use a dashboard whose generated build contract depends on data-analytics/.../scripts/data-app.mjs.
2. Verify that the dashboard builds successfully with remote plugin bundle 0.2.35-13ceeea1f599.
3. Start a new Codex Desktop task while the plugin is installed.
4. Inspect %CODEX_HOME%/plugins/cache/openai-curated-remote/data-analytics/.
5. Observe that 0.2.10-13ceeea1f599 is materialized and the previous bundle is absent.
6. Attempt the documented offline build; the required scripts/data-app.mjs entry point is missing.

Expected behavior

• Plugin resolution should not silently replace a newer capability-complete bundle with an older capability-incomplete bundle.
• A remote rollback should preserve the plugin's published build contract or keep the last-known-good bundle active.
• Activation should be transactional and run a capability/self-test before removing the previous bundle.
• The resolver should record selection provenance: requested version, catalog revision, routing/rollback reason, previous version, compatibility result, and activation outcome.
• Generated projects should have either a stable versioned builder contract or a supported recovery path when the remote bundle changes.

Actual behavior

Task initialization automatically materialized an older bundle that removed a required local build entry point. No visible warning, rollback reason, compatibility check, or supported recovery action was provided. The existing generated dashboard is now blocked from rebuilding even though its project files are intact.

Impact

• Existing plugin-generated dashboards cannot be rebuilt.
• Users may incorrectly be told to install unrelated npm dependencies even though the original builder was self-contained.
• The local cache no longer contains the last-known-good builder, so recovery may require another remote plugin download/materialization.
• There is no locally auditable way to identify why the lower bundle was selected.

Related issue

Possibly adjacent to #29103, which reports remote marketplace plugin cache persistence/cleanup problems, but this report concerns version regression and loss of a previously available capability during task startup.

Suggested fix

Use monotonic/explicit version resolution, capability manifests, transactional activation, last-known-good retention, and a deterministic cache audit event. If a deliberate rollback is required, validate generated-project compatibility before activation and preserve the prior bundle for automatic recovery.

Privacy

This report intentionally omits usernames, absolute local paths, task IDs, prompts, and project/business data. Exact redacted local timestamps and hashes can be supplied privately if maintainers provide a protected intake path.

Start by tracing task startup and remote plugin materialization around %CODEX_HOME%/plugins/cache/openai-curated-remote/data-analytics/, using the reported transition from 0.2.35-13ceeea1f599 to 0.2.10-13ceeea1f599 as the reproduction. Check how the resolver handles capability changes such as the missing scripts/data-app.mjs; done should include an auditable selection reason, compatibility protection for generated projects, and recovery of the last-known-good bundle.