## Why
Response body reads could outlive the manual download timeout or fail outside the existing fallback and retry handlers.
## What changed
- Read successful manual response bodies within the fetch timeout and transport fallback so stalled or failed reads fall back to `curl`. Leave `HEAD` responses unconsumed.
- Await model metadata response bodies inside the retry handler so read failures use the existing three-attempt retry loop.
## Testing
Add regression tests for manual body timeouts and truncated bodies falling back to `curl` before caching, plus model metadata body failures succeeding on retry or stopping after three attempts. All four tests pass with `node --test codex-rs/skills/tests/openai_docs_downloads.test.mjs`.
GitOrigin-RevId: 528595307ef86ad2522dc8ae488baadc001ad961
## What changed
- Delete the `plugin-creator` skill, its assets, reference docs, helper scripts, and associated Python tests.
- Update the app-server skills context budget warning test to expect six omitted skills instead of seven.
GitOrigin-RevId: 005b1ab7f2f7c2933e6c297d01541746cc489f68
## Why
The root Python formatting pass only covered `scripts/`, leaving Python utilities elsewhere in the repository outside `just fmt` and `just fmt-check`.
## What changed
- Run the scripts Ruff formatter from the repository root.
- Exclude `sdk/python`, which has its own formatter pass, and `codex-rs/vendor`.
- Apply Ruff formatting to the newly covered Python files and update the formatter coverage test.
GitOrigin-RevId: 73ac82b8bb9c713d589724f6c4f926399febb513
## What changed
- Require selected skill paths to resolve within the cloned repository and reject
symlinked path components.
- Reject special files and symlinks that escape the selected skill or resolve to
anything other than a regular file.
- Add regression tests showing that escaping symlinks are rejected while links
to regular files within the skill are installed as file contents.
GitOrigin-RevId: d4c3f09fb630dea96b34ea5552de571b36f1ceca
## Why
Plugin and marketplace names can flow into generated install commands, so the
plugin creator must reject names outside the supported identifier syntax before
using them or changing files.
## What changed
- Centralize validation for plugin names, including dotted names, and marketplace
names.
- Apply validation when reading marketplaces, validating manifests, updating
cachebusters, and scaffolding plugins.
- Validate existing marketplace state before scaffold writes so invalid or
duplicate entries leave plugin and marketplace files unchanged.
## Testing
Add regression tests for accepted identifiers, unsafe and malformed names,
dotted plugin names, and failure paths that must not modify files.
GitOrigin-RevId: 9db68c2313a1539c5ab44d777966e33b460ceb71
Konstantine Kahadze