Codex Security 0.1.24 repeatedly resolves stale Atlassian connector despite current Rovo plugin

What version of the Codex App are you using (From “About Codex” dialog)?

26.908.70816 (9275)

What subscription do you have?

ChatGPT Pro

What platform is your computer?

Darwin 27.0.0 arm64 arm

What issue are you seeing?

Codex Desktop repeatedly reports connector_692de805e3ec8191834719067174a384 is not connected even though the current Atlassian Rovo plugin is installed and enabled.

The two plugins use different app identities:

• Codex Security 0.1.24 declares connector_692de805e3ec8191834719067174a384 under the atlassian key.
• Atlassian Rovo 2.0.0 declares asdk_app_6a83901dde988191b3f3cefdcc19acfa.

Plugin dependency inspection reports the Codex Security Atlassian dependency as:

app_id: connector_692de805e3ec8191834719067174a384
optional: true
reason: no_unique_canonical_plugin

Direct status inspection reports that connector as not_installed, while Atlassian Rovo 2.0.0 is installed and user-enabled. The optional unresolved connector is surfaced instead of using the current Rovo app or remaining dormant until a Jira workflow is selected.

What steps can reproduce the bug?

1. Install and enable Codex Security 0.1.24.
2. Install and enable Atlassian Rovo 2.0.0.
3. Start a Codex Desktop task with Codex Security available, or invoke a Codex Security workflow.
4. Observe: connector_692de805e3ec8191834719067174a384 is not connected.
5. Inspect Codex Security plugin dependencies. The atlassian entry is unresolved with no_unique_canonical_plugin, even though the current Rovo ASDK plugin is enabled.

A repository issue search for the exact connector ID returned no existing open or closed issues.

What is the expected behavior?

Codex Security should resolve the installed Atlassian Rovo ASDK app when a Jira workflow is explicitly selected. If Jira is not being used, the optional Atlassian dependency should remain dormant and should not produce a connection warning.

Additional information

Relevant packaged metadata:

// codex-security/0.1.24/.app.json
{
  "atlassian": {
    "id": "connector_692de805e3ec8191834719067174a384",
    "capabilities": ["read", "write"]
  }
}

// app-6a83901dde988191b3f3cefdcc19acfa/2.0.0/.app.json
{
  "app-6a83901dde988191b3f3cefdcc19acfa": {
    "id": "asdk_app_6a83901dde988191b3f3cefdcc19acfa",
    "required": true
  }
}

The stale connector ID is also hardcoded in Codex Security's track-findings/SKILL.md and track-findings/references/jira.md.

Suggested fix: update Codex Security to reference the current Rovo ASDK app, or defer resolution of this optional dependency until the user explicitly selects Jira tracking.

Start by inspecting codex-security/0.1.24/.app.json, track-findings/SKILL.md, and track-findings/references/jira.md, then reproduce the dependency status with Codex Security 0.1.24 and Atlassian Rovo 2.0.0 installed. Done means the current Rovo app is used when Jira tracking is selected, while the optional dependency produces no warning when Jira is not used.