codex: address PR review feedback (#28582)

codex-rs/core-plugins/src/remote.rs

@@ -10,6 +10,7 @@ use codex_app_server_protocol::PluginInterface;
 use codex_app_server_protocol::SkillInterface;
 use codex_login::CodexAuth;
 use codex_login::default_client::build_reqwest_client;
+use codex_login::default_client::chatgpt_cloudflare_cookie_header;
 use codex_plugin::AppConnectorId;
 use codex_plugin::AppDeclaration;
 use codex_plugin::PluginId;
@@ -1878,12 +1879,31 @@ async fn send_plugin_service_request_with_preview(
 ) -> Result<reqwest::Response, reqwest::Error> {
     let (client, request) = request.build_split();
     let mut request = request?;
-    let headers = request.headers_mut();
-    let existing_cookie_headers = headers
+    let cloudflare_cookie = (preview_enabled && !request.headers().contains_key(COOKIE))
+        .then(|| chatgpt_cloudflare_cookie_header(request.url().as_str()))
+        .flatten();
+    apply_plugin_service_routing_cookie(
+        request.headers_mut(),
+        preview_enabled,
+        cloudflare_cookie.as_deref(),
+    );
+
+    client.execute(request).await
+}
+
+fn apply_plugin_service_routing_cookie(
+    headers: &mut reqwest::header::HeaderMap,
+    preview_enabled: bool,
+    cloudflare_cookie: Option<&[u8]>,
+) {
+    let mut existing_cookie_headers = headers
         .get_all(COOKIE)
         .iter()
         .map(|value| value.as_bytes().to_vec())
         .collect::<Vec<_>>();
+    if let Some(cloudflare_cookie) = cloudflare_cookie {
+        existing_cookie_headers.push(cloudflare_cookie.to_vec());
+    }
     let existing_cookie_headers = existing_cookie_headers
         .iter()
         .map(Vec::as_slice)
@@ -1896,6 +1916,4 @@ async fn send_plugin_service_request_with_preview(
     {
         headers.insert(COOKIE, routing_cookie);
     }
-
-    client.execute(request).await
 }

codex-rs/core-plugins/src/remote/catalog_cache.rs

@@ -1,6 +1,7 @@
 use super::RemotePluginDirectoryItem;
 use super::RemotePluginServiceConfig;
 use codex_login::CodexAuth;
+use codex_utils_plugins::plugin_service_routing::plugin_service_preview_enabled;
 use serde::Deserialize;
 use serde::Serialize;
 use std::path::Path;
@@ -16,6 +17,8 @@ struct RemotePluginCatalogCacheKey {
     account_id: Option<String>,
     chatgpt_user_id: Option<String>,
     is_workspace_account: bool,
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    plugin_service_preview: bool,
 }
 
 impl RemotePluginCatalogCacheKey {
@@ -25,6 +28,7 @@ impl RemotePluginCatalogCacheKey {
             account_id: auth.get_account_id(),
             chatgpt_user_id: auth.get_chatgpt_user_id(),
             is_workspace_account: auth.is_workspace_account(),
+            plugin_service_preview: plugin_service_preview_enabled(),
         }
     }
 }
@@ -109,3 +113,7 @@ fn cache_path(codex_home: &Path, cache_key: &RemotePluginCatalogCacheKey) -> Pat
         .join(REMOTE_PLUGIN_CATALOG_DISK_CACHE_DIR)
         .join(format!("{cache_key_hash:016x}.json"))
 }
+
+#[cfg(test)]
+#[path = "catalog_cache_tests.rs"]
+mod tests;

codex-rs/core-plugins/src/remote/catalog_cache_tests.rs

@@ -0,0 +1,21 @@
+use super::*;
+
+#[test]
+fn remote_plugin_catalog_cache_is_scoped_by_plugin_service_preview() {
+    let regular = RemotePluginCatalogCacheKey {
+        chatgpt_base_url: "https://chatgpt.com/backend-api".to_string(),
+        account_id: Some("account".to_string()),
+        chatgpt_user_id: Some("user".to_string()),
+        is_workspace_account: true,
+        plugin_service_preview: false,
+    };
+    let preview = RemotePluginCatalogCacheKey {
+        plugin_service_preview: true,
+        ..regular.clone()
+    };
+
+    assert_ne!(
+        cache_path(Path::new("/codex-home"), &regular),
+        cache_path(Path::new("/codex-home"), &preview)
+    );
+}

codex-rs/core-plugins/src/remote_tests.rs

@@ -299,6 +299,23 @@ fn recommended_plugins_ignore_invalid_remote_plugin_ids() {
     );
 }
 
+#[test]
+fn plugin_service_routing_preserves_cloudflare_cookie_jar_values() {
+    let mut headers = reqwest::header::HeaderMap::new();
+    let cloudflare_cookie = HeaderValue::from_static("cf_clearance=clearance; _cfuvid=visitor");
+
+    apply_plugin_service_routing_cookie(
+        &mut headers,
+        /*preview_enabled*/ true,
+        Some(cloudflare_cookie.as_bytes()),
+    );
+
+    assert_eq!(
+        headers.get(COOKIE).and_then(|value| value.to_str().ok()),
+        Some("cf_clearance=clearance; _cfuvid=visitor; oai-chat-plugin-service-preview=true"),
+    );
+}
+
 #[tokio::test]
 async fn plugin_service_request_does_not_add_preview_cookie_when_disabled() {
     let server = MockServer::start().await;