1 00:00:00,119 --> 00:00:05,539 If you run codex plugin search right now on version zero point one forty seven point 2 00:00:05,579 --> 00:00:09,760 zero, something pretty radical happens behind the scenes. 3 00:00:09,819 --> 00:00:14,759 Before we break down this portable plugin architecture, a quick hat tip to Jellypod 4 00:00:14,799 --> 00:00:16,520 for keeping our daily show powered up. 5 00:00:17,139 --> 00:00:21,180 But yeah, instead of just reading a static manifest file sitting on your disk, 6 00:00:21,699 --> 00:00:24,199 Codex is doing something way more ambitious. 7 00:00:24,569 --> 00:00:28,969 Wait, so when you type that search command, it is not just looking at your local 8 00:00:29,089 --> 00:00:29,829 folder anymore? 9 00:00:30,366 --> 00:00:30,966 Exactly. 10 00:00:31,426 --> 00:00:35,546 It actually queries four totally distinct tiers at the exact same time. 11 00:00:36,226 --> 00:00:41,206 It checks your local dot codex slash plugins directory, your personal user 12 00:00:41,306 --> 00:00:46,546 directory, your shared team workspace setup, and then remote registries across the 13 00:00:46,587 --> 00:00:46,767 web. 14 00:00:47,271 --> 00:00:50,171 Four layers simultaneously. 15 00:00:50,971 --> 00:00:55,392 So, wait, how does it handle showing you all of that without turning into a total 16 00:00:55,411 --> 00:00:56,852 messy list of duplicates? 17 00:00:57,208 --> 00:01:02,888 It aggregates both the local and remote plugin indexes into a single unified result 18 00:01:02,952 --> 00:01:03,288 list. 19 00:01:03,448 --> 00:01:08,728 And under the hood, each entry comes back with its eligibility metadata, 20 00:01:08,768 --> 00:01:13,208 current installation state, and any authorization requirements attached to it. 21 00:01:13,368 --> 00:01:18,488 You do not have to mess around with manual path mapping or cloning repositories by 22 00:01:18,552 --> 00:01:19,368 hand anymore. 23 00:01:19,634 --> 00:01:22,274 Oh, that is huge for team setups! 24 00:01:22,734 --> 00:01:26,974 I remember back in my testing days, every time someone built a useful script, 25 00:01:27,274 --> 00:01:29,875 they would just throw a custom script into a Slack channel. 26 00:01:30,335 --> 00:01:35,454 Then half the team is running outdated local setups that diverge immediately. 27 00:01:35,635 --> 00:01:39,875 Now you can literally just commit the declared capabilities right into the 28 00:01:39,914 --> 00:01:44,654 repository config, and everyone on the team gets instant, reproducible agent 29 00:01:44,734 --> 00:01:45,194 plugins. 30 00:01:45,759 --> 00:01:46,419 Precisely. 31 00:01:46,899 --> 00:01:53,399 It turns agent capability distribution into a clean, declared code dependency rather 32 00:01:53,440 --> 00:01:56,300 than a bunch of loose shell scripts passed around in chat. 33 00:01:56,694 --> 00:02:01,894 Okay, but if we are pulling plugins from remote registries and shared workspace 34 00:02:01,934 --> 00:02:06,734 configs, what stops a malicious plugin from wandering off where it shouldn't? 35 00:02:07,286 --> 00:02:12,206 That is where the zero point one forty seven point zero security updates come in. 36 00:02:12,826 --> 00:02:16,866 They tightened up runtime execution to strictly enforce plugin boundaries. 37 00:02:17,486 --> 00:02:22,087 On top of that, if a network security policy update fails for any reason, 38 00:02:22,667 --> 00:02:27,126 the system automatically fails closed by completely denying network access. 39 00:02:27,786 --> 00:02:33,466 Plus, during plugin installation, Codex now explicitly skips symlinks to eliminate 40 00:02:33,626 --> 00:02:35,046 host path traversal risks. 41 00:02:36,662 --> 00:02:38,742 Skip symlinks entirely? 42 00:02:39,503 --> 00:02:39,742 Wait... 43 00:02:40,182 --> 00:02:45,083 if you are building and testing a local plugin, doesn't that break the standard 44 00:02:45,142 --> 00:02:50,422 workflow where developers symlink their dev folder into dot codex slash plugins? 45 00:02:51,649 --> 00:02:53,909 Yep, you caught the friction point right there. 46 00:02:54,549 --> 00:03:00,210 Symlinking local development plugins into dot codex slash plugins is explicitly 47 00:03:00,329 --> 00:03:02,229 blocked during install now. 48 00:03:02,309 --> 00:03:07,329 So if you are authoring plugins, you have to pass direct path overrides during local 49 00:03:07,389 --> 00:03:10,369 testing instead of relying on filesystem symlinks. 50 00:03:11,657 --> 00:03:16,636 A little bit of developer friction in exchange for not accidentally letting a bad 51 00:03:16,736 --> 00:03:18,956 actor path traverse out of the sandbox. 52 00:03:19,576 --> 00:03:21,196 Probably a fair trade-off. 53 00:03:21,583 --> 00:03:23,023 Definitely a fair trade. 54 00:03:23,163 --> 00:03:27,823 And there are some really slick quality of life additions in this release too. 55 00:03:27,983 --> 00:03:33,503 You get persistent manual section ordering to organize those massive conversation 56 00:03:33,563 --> 00:03:35,903 threads in the TUI interface. 57 00:03:36,031 --> 00:03:42,063 They also added automatic migration of Cursor managed skills during slash import, 58 00:03:42,083 --> 00:03:45,903 and it does it cleanly without creating duplicate session records. 59 00:03:46,236 --> 00:03:49,976 Oh, and didn't they fix that annoying Ghostty terminal issue too? 60 00:03:50,494 --> 00:03:51,074 They did! 61 00:03:51,475 --> 00:03:56,614 They patched the terminal input queue for Ghostty so keypresses do not get dropped 62 00:03:56,654 --> 00:03:59,314 while the Model Context Protocol server is booting up. 63 00:04:00,034 --> 00:04:05,335 When you step back and look at it, pairing strict runtime sandboxing with multi tier 64 00:04:05,394 --> 00:04:10,555 remote catalog discovery really marks Codex turning the corner from a simple local 65 00:04:10,715 --> 00:04:15,054 CLI into a modular, enterprise ready agent runtime. 66 00:04:15,482 --> 00:04:19,262 Yeah, it really feels like the tooling is growing up fast. 67 00:04:19,963 --> 00:04:20,642 Good stuff today. 68 00:04:21,222 --> 00:04:21,942 Talk soon, everyone!