## What changed
- Import supported Claude commands that lack a usable frontmatter description by deriving the skill description from the source command name.
- Preserve commands with explicit descriptions when multiple source paths normalize to the same skill name, and skip ambiguous fallback-only collisions.
- Apply the expanded detection and import behavior to both user-level and repository-level command directories.
## Testing
- Add service tests for commands without frontmatter, normalized-name collisions, unsupported templates, and post-import detection.
GitOrigin-RevId: 53691193128a6b1be192c4f83bdf563980a0e55d
## Why
Plugin imports persist user-global enabled state. Repository-controlled settings
must not be allowed to select executable plugin content for installation.
## What changed
- Detect plugin migrations only from home-scoped external agent settings.
- Reject plugin imports with a non-empty project `cwd` before loading Codex
configuration, while continuing to treat an empty `cwd` as home scope.
## Testing
- Cover repository-scoped detection with remote, installed, and project-relative
marketplaces.
- Verify that forged project-scoped imports fail without writing `config.toml`.
GitOrigin-RevId: 53cb46ae049cb49283187312d475d40cf42e35ab
## Why
Repository-scoped imports must not follow redirected Codex paths and write
generated configuration outside the repository.
## What changed
- Reject repository migration scopes when generated configuration paths are
symlinks or, on Windows, reparse points.
- Recheck hook and subagent destinations during import, skipping redirected
directories, files, and dangling links without reporting them as imported.
## Testing
Add service and app-server coverage for redirected generated destinations,
including a repository path replaced with a symlink after detection.
GitOrigin-RevId: 3afb521ead9d76250f0e967eccfdd1dc194f027a
## What changed
- Give `PluginsManager` a shared `AuthManager` instead of a separately mutable authentication-mode snapshot.
- Read the current authentication mode and credentials from that shared manager for plugin discovery, startup tasks, CLI commands, MCP setup, and external-agent migration.
- Update test helpers and coverage to exercise plugin projections and curated marketplace selection as authentication changes.
GitOrigin-RevId: 600c94de5130eda2da5727e1a0b4d39083fefc56
## Why
The model provider does not reliably identify which curated plugin catalog is
available. ChatGPT authentication can be used with a custom provider, while an
unauthenticated session should use the API-compatible catalog regardless of its
provider.
## What changed
- Select the ChatGPT curated catalog only for authentication modes that use the
Codex backend; use the API curated catalog for API-key and unauthenticated
sessions.
- Initialize standalone plugin managers with the current authentication mode
across CLI, app-server, MCP, and external-agent migration paths.
- Preserve authentication mode while detecting and importing migrated plugins.
## Testing
- Cover catalog and skill routing across ChatGPT, API-key, unauthenticated,
Bedrock, and custom-provider configurations.
- Verify authenticated plugin migration uses the ChatGPT curated marketplace.
GitOrigin-RevId: 660a339ee8891c33aad961078d3a979242a6a166
## What changed
- Discover and import home-level Cursor skills from both `skills` and
`skills-cursor`.
- Keep repository-level Cursor migration scoped to `skills`.
- Deduplicate skill names when reporting migration candidates from multiple
source directories.
## Testing
- Add coverage for detecting and importing user and Cursor-managed skills.
- Verify repository detection continues to use the `skills` directory.
GitOrigin-RevId: 7b5e96a0d9c5ca14c61230e336728f2e4930a3b0
## Why
External-agent migration treated symlinked empty text targets as overwritable files. Writing migrated configuration through such a target could modify a file outside the repository.
## What changed
- Use symlink metadata when checking whether a migration target is missing or empty, so only regular files are considered overwritable.
- Preserve symlinked `AGENTS.md` and `.codex/hooks.json` targets during both detection and import.
## Testing
Added Unix regression coverage for existing and dangling symlink targets for both guidance and hooks migration.
See https://github.com/openai/codex/pull/26021.
GitOrigin-RevId: 13c78e7458d1c02abdb22b38ba88ed66bb5a154b
## What changed
- Preserve the original title when importing an external-agent session and return it with successful session entries from `externalAgentConfig/import/readHistories`.
- Add dedicated history-record success types so externally completed imports can optionally supply a session title without changing the live import result type.
## Testing
- Verify imported session titles are returned by the app server and persisted when session import ledger entries are created or refreshed.
GitOrigin-RevId: e896688a5763c238f1e1dc8b4672a7aa7bc1ed4c
## What changed
- Treat enabled plugins from `claude-code-plugins` as coming from
`anthropics/claude-code` when no marketplace source is already known.
- Preserve an explicitly discovered source instead of replacing it with the
inferred source.
## Testing
- Add a migration test covering inference from `enabledPlugins`.
GitOrigin-RevId: f061963356493027968e282a51538866d2bf31f4
## What changed
- Move migration detection, import orchestration, models, and reporting from
`codex-app-server` into `codex-external-agent-migration`.
- Keep app-server protocol conversion in a dedicated boundary module.
- Organize source-specific configuration, sessions, hooks, plugins, commands,
subagents, and memory handling behind shared migration adapters.
- Relocate and split the migration tests alongside the extracted service.
GitOrigin-RevId: 3378ec2064806a28136d6ac98664ca1d75414a4e
stefanstokic-oai