Plugin Management dependency lookup reports outer success when the nested tool result failed

Problem

When get_plugin_dependencies cannot resolve a specific plugin reference, the nested result correctly reports isError: true and plugin_not_found. The outer MCP result reports isError: false and the text Action completed.. Consumers that inspect the outer error flag or visible completion message can classify the failed action as successful.

Reproduction

Run this read-only call in Code Mode:

const response = await tools.mcp__codex_apps__plugin_management_get_plugin_dependencies({
  plugin_reference: "audit-no-such-plugin-gdce8vp5@openai-curated-remote"
});
const inner = response.structuredContent.result ?? response.structuredContent;
text({
  outerIsError: response.isError,
  outerText: response.content.filter(x => x.type === 'text').map(x => x.text),
  innerIsError: inner.isError,
  status: inner.structuredContent.status,
  errorCode: inner.structuredContent.error_code
});

Observed:

{
  "outerIsError": false,
  "outerText": ["Action completed."],
  "innerIsError": true,
  "status": "failed",
  "errorCode": "plugin_not_found"
}

The nested message states that the reference did not identify a public globally listed plugin with a current release. Two test-agent calls and an independent parent call produced the same error-state discrepancy.

Expected behavior

Propagate the action failure to the outer result used by generic MCP/Code Mode consumers, and avoid a successful completion message for a failed lookup. Preserve the specific plugin_not_found diagnostic. Add a negative-read regression test that checks the outer flag as well as the nested result.

Environment and scope

Observed September 6, 2026 in Codex Code Mode, installed CLI 0.153.4, macOS 26.6.2, Plugin Management package 0.1.0. Refresh returned the same version and byte-identical files. Hosted backend version and the layer responsible for the outer envelope are unknown.

The expected lookup failure is not itself the defect. This report concerns the contradictory error/completion state. It is separate from the missing declared result layer tracked in #43132; the reproduction accommodates that shape difference.

No permission changes, installs, removals, or connection changes were performed. Targeted open/closed openai/codex searches for get_plugin_dependencies found no existing issue at the time of preparation.

No source file or test is named. Start by tracing get_plugin_dependencies through the Plugin Management and MCP/Code Mode outer-envelope path, comparing the nested result with the response consumed by generic clients. Done means a failed plugin lookup propagates the outer error state, omits the successful completion message, preserves plugin_not_found, and has a negative-read regression test.