feat: expose codex plugin governance capabilities

tests/codex-app-server-protocol-snapshot-script.test.mjs

@@ -46,6 +46,15 @@ if (args[0] === "app-server" && args[1] === "generate-json-schema") {
       { properties: { method: { const: "thread/metadata/update" } } },
       { properties: { method: { const: "thread/shellCommand" } } },
       { properties: { method: { const: "thread/unsubscribe" } } },
+      { properties: { method: { const: "plugin/install" } } },
+      { properties: { method: { const: "plugin/uninstall" } } },
+      { properties: { method: { const: "plugin/read" } } },
+      { properties: { method: { const: "plugin/skill/read" } } },
+      { properties: { method: { const: "plugin/share/save" } } },
+      { properties: { method: { const: "plugin/share/checkout" } } },
+      { properties: { method: { const: "plugin/share/delete" } } },
+      { properties: { method: { const: "plugin/share/updateTargets" } } },
+      { properties: { method: { const: "plugin/share/list" } } },
       { properties: { method: { const: "skills/extraRoots/set" } } },
       { properties: { method: { const: "hooks/list" } } },
       { properties: { method: { const: "turn/interrupt" } } },
@@ -100,8 +109,22 @@ process.exit(2);
     assert.equal(manifest.supports.threadShellCommand, true);
     assert.equal(manifest.supports.threadUnsubscribe, true);
     assert.equal(manifest.supports.turnInterrupt, true);
+    assert.equal(manifest.supports.pluginInstall, true);
+    assert.equal(manifest.supports.pluginUninstall, true);
+    assert.equal(manifest.supports.pluginRead, true);
+    assert.equal(manifest.supports.pluginSkillRead, true);
+    assert.equal(manifest.supports.pluginShare, true);
     assert.deepEqual(manifest.methods, [
       "hooks/list",
+      "plugin/install",
+      "plugin/read",
+      "plugin/share/checkout",
+      "plugin/share/delete",
+      "plugin/share/list",
+      "plugin/share/save",
+      "plugin/share/updateTargets",
+      "plugin/skill/read",
+      "plugin/uninstall",
       "skills/extraRoots/set",
       "thread/archive",
       "thread/compact/start",

tests/device-detail-capabilities-route.test.ts

@@ -163,6 +163,15 @@ test("device detail exposes Codex App Server discovered model and extension summ
           userInitiatedOnly: true,
           labels: ["归档", "恢复", "分叉", "压缩", "回滚", "改名", "元数据", "活跃干预", "中断", "Shell", "取消订阅"],
         },
+        pluginGovernanceSummary: {
+          actionCount: 9,
+          lifecycleActionCount: 2,
+          shareActionCount: 4,
+          readActionCount: 3,
+          skillReadAvailable: true,
+          userInitiatedOnly: true,
+          labels: ["安装", "卸载", "读取", "Skill 读取", "共享保存", "共享拉取", "共享删除", "共享目标", "共享列表"],
+        },
       },
     },
   };
@@ -182,6 +191,7 @@ test("device detail exposes Codex App Server discovered model and extension summ
   assert.equal(cards.capabilities.items.codexThreads, "线程：3 个 · 已加载 2 个 · 活跃 1 个 · 最新 2026-06-03 16:20");
   assert.equal(cards.capabilities.items.codexTurns, "轮次：3 个 · 运行中 1 个 · 完成 2 个 · 最新 2026-06-03 16:21");
   assert.equal(cards.capabilities.items.codexThreadActions, "线程操作：11 项 · 生命周期 5 项 · 活跃干预 2 项 · Shell 可用");
+  assert.equal(cards.capabilities.items.codexPluginGovernance, "插件治理：9 项 · 安装/卸载 2 项 · 共享 4 项 · Skill 读取可用");
 });
 
 test("device detail exposes folder and project conflict skeleton from workspace policy", async () => {

tests/local-agent-codex-app-server-runner.test.mjs

@@ -123,6 +123,15 @@ test("codex app-server discovery includes governance and MCP summaries without l
     userInitiatedOnly: true,
     labels: ["归档", "恢复", "分叉", "压缩", "回滚", "改名", "元数据", "活跃干预", "中断", "Shell", "取消订阅"],
   });
+  assert.deepEqual(metadata.pluginGovernanceSummary, {
+    actionCount: 9,
+    lifecycleActionCount: 2,
+    shareActionCount: 4,
+    readActionCount: 3,
+    skillReadAvailable: true,
+    userInitiatedOnly: true,
+    labels: ["安装", "卸载", "读取", "Skill 读取", "共享保存", "共享拉取", "共享删除", "共享目标", "共享列表"],
+  });
 
   const serialized = JSON.stringify(metadata);
   assert.equal(serialized.includes("sk-secret-should-not-leak"), false);