Codex Desktop rejects OpenAI-curated plugin manifests using policy.products: CHAT

What version of Codex is affected?

Windows Microsoft Store package OpenAI.Codex 26.901.5280.0, bundled codex-cli 0.153.4.

The app-server startup trace identifies the Desktop client as 26.901.41600 in RPC metadata.

Platform

Windows 11 x64.

What is happening?

On a fresh Codex Desktop start, the plugin loader repeatedly rejects three manifests from the OpenAI-curated remote cache because their policy.products list contains CHAT:

invalid openai.yaml: policy.products[0]: unknown variant `CHAT`, expected one of `CHATGPT`, `chatgpt`, `CODEX`, `codex`, `ATLAS`, `atlas`

The affected cached skills observed are:

• chatgpt-codex-plugin-autopilot
• host-workspace-operator
• sandbox-python-executor

For example, the curated chatgpt-codex-plugin-autopilot manifest currently contains:

policy:
  products:
    - CHAT
    - CODEX
  allow_implicit_invocation: true

The warnings recur while Codex processes plugin/app surfaces (plugins_for_config, app/installed, and thread resume), and the affected manifests are ignored.

Reproduction

1. Start Codex Desktop on Windows with the current OpenAI-curated remote plugin cache available.
2. Let startup/plugin discovery complete.
3. Inspect the app-server logs.
4. Observe the loader rejecting the manifests above with unknown variant CHAT.

This reproduced immediately after a full quit/restart on the versions listed above.

Expected behavior

OpenAI-curated manifests shipped/fetched for the current Codex build should use a policy.products value accepted by that build (apparently CHATGPT rather than CHAT), or the parser should intentionally support the curated value if CHAT is still part of the remote schema.

Additional notes

• I did not edit the managed plugin cache locally.
• codex plugin list itself exits successfully; this report is specifically about curated manifests being rejected during discovery/loading.
• I searched open and closed issues for the exact error / curated plugin name before filing and did not find a matching report.

Start with the plugin loader and app-server startup logs, focusing on manifest validation during plugins_for_config, app/installed, and thread resume. Reproduce with the listed Windows package and curated manifests, then verify that the affected manifests are accepted and loaded without the unknown-variant warning.