feat(codex): `agentbox install codex` — install + enable the Codex plugin by madarco · Pull Request #121 · madarco/agentbox

madarco · 2026-06-26T17:50:35Z

What

Installing AgentBox left the Codex plugin (the agentbox / agentbox-info skills that drive AgentBox from Codex) a manual chore: codex plugin marketplace add + codex plugin add, then enabling it in the Codex app. This automates all three so it's installed and enabled by default.

How

New apps/cli/src/commands/install-codex.ts (mirrors install-herdr.ts), gated on Codex being present (~/.codex + codex on PATH), best-effort so it never aborts agentbox install:

codex plugin marketplace add madarco/agentbox (writes [marketplaces.agentbox])
codex plugin add agentbox@agentbox (downloads the bundle)
Enable by default: append [plugins."agentbox@agentbox"] enabled = true to ~/.codex/config.toml when no such table exists. Codex has no plugin enable CLI — this is the exact key the TUI toggle writes (verified in openai/codex source).

Wired into the agentbox install wizard (runs when Codex is detected) and a standalone agentbox install codex.

Robustness

Respects an explicit disable: skips the network re-add when already installed (codex plugin add re-enables a deliberately-disabled plugin), and the config write only appends when the key is absent — so enabled = false is honored. --force bypasses to re-enable.
Never corrupts config.toml: appends a delimited managed block only when no plugins."agentbox@agentbox" table exists (a duplicate table is a TOML parse error); a malformed config is left untouched. smol-toml is used read-only for the presence check.

Verification

Unit tests (10) cover the append-if-absent / respect-disable / idempotency / parse-error logic.
E2E against codex 0.142 (isolated CODEX_HOME): fresh → installed + enabled; user-disabled + re-run → stays disabled; --force → re-enabled. codex plugin list shows installed, enabled.
pnpm lint, pnpm check:plugin-skill, build all green.

Docs: cli.mdx install section + plugins/agentbox/README.md.

https://claude.ai/code/session_01PTY4KwAeZdAVvgSWxjpYfs

Note

Low Risk
Changes only local Codex config and best-effort CLI subprocesses; writes are guarded by parse checks and explicit user disable, and failures do not abort agentbox install.

Overview
Adds agentbox install codex and runs the same flow automatically during agentbox install when Codex is present (~/.codex and the codex CLI on PATH).

The new command registers the madarco/agentbox marketplace, runs codex plugin add agentbox@agentbox, and turns the plugin on by appending a delimited managed block to ~/.codex/config.toml when no existing plugins."agentbox@agentbox" table is there. Re-runs skip plugin add if already installed (so a deliberate disable is not undone); user/TUI enabled = false is honored; malformed TOML is left unchanged. smol-toml is added for read-only presence checks, with unit tests for the upsert logic.

Docs in cli.mdx and plugins/agentbox/README.md describe the one-command install path.

^{Reviewed by Cursor Bugbot for commit b9a98fe. Configure here.}

…ugin Installing agentbox left the Codex plugin (the `agentbox`/`agentbox-info` skills) a manual chore: `codex plugin marketplace add` + `codex plugin add`, then a toggle in the Codex app. Automate all three. New `install-codex.ts` (mirrors install-herdr.ts), gated on Codex being present (~/.codex + `codex` on PATH), best-effort so it never aborts `agentbox install`: - `codex plugin marketplace add madarco/agentbox` + `codex plugin add agentbox@agentbox` - enable by default: append `[plugins."agentbox@agentbox"] enabled = true` to ~/.codex/config.toml when no such table exists. Codex has no `plugin enable` CLI — this is the same key the TUI toggle writes. Robustness: - Skips the network re-add when already installed (codex plugin add re-enables a deliberately-disabled plugin), so a user's explicit disable is respected; --force bypasses to re-enable. - The config write only appends when the key is absent — never duplicates the table (a second table is a TOML parse error) and respects enabled = false. Wired into the `agentbox install` wizard (runs when Codex is detected) and a standalone `agentbox install codex`. Adds smol-toml to apps/cli (read-only parse for the presence check). Unit tests cover the upsert/respect-disable logic; e2e verified against codex 0.142 (fresh -> enabled, disabled re-run -> stays off, --force -> re-enabled). Docs: cli.mdx + plugin README. Claude-Session: https://claude.ai/code/session_01PTY4KwAeZdAVvgSWxjpYfs

vercel · 2026-06-26T17:50:40Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
agentbox-web	Skipped		Jun 26, 2026 10:22pm

madarco · 2026-06-26T17:50:49Z

bugbot run

cursor

Cursor Bugbot has reviewed your changes using default effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b9a98fe. Configure here.}

cursor · 2026-06-26T17:51:53Z

+  result.enableStatus = status;
+  if (status === 'added' && text !== existing) {
+    mkdirSync(dirname(cfgPath), { recursive: true });
+    writeFileSync(cfgPath, text);


Config cleanup not written

High Severity

installCodexPlugin only writes config.toml when enableStatus is added, but upsertCodexPluginEnable can return different text for user-enabled or user-disabled after stripping a stale managed block. Those fixes never hit disk, so duplicate plugins."agentbox@agentbox" tables can remain and break TOML parsing for Codex.

^{Reviewed by Cursor Bugbot for commit b9a98fe. Configure here.}

cursor · 2026-06-26T17:51:53Z

+      `AgentBox Codex plugin is present but disabled in ${cfgPath} — leaving it off. ` +
+        `Enable it in Codex (or set enabled = true) to use it.`,
+    );
+  }


Force skips config re-enable

Medium Severity

--force is described as re-applying the managed enable block and bypassing a deliberate disable, but opts.force only skips the “already installed” guard for codex plugin add. The enable step always calls upsertCodexPluginEnable without force, so an explicit enabled = false table is never overridden and the flag cannot re-enable via config as documented.

Additional Locations (1)

apps/cli/src/commands/install-codex.ts#L238-L239

^{Reviewed by Cursor Bugbot for commit b9a98fe. Configure here.}

cursor · 2026-06-26T17:51:53Z

+
+  const head = stripped.replace(/\s+$/, '');
+  const text = (head.length > 0 ? `${head}\n\n` : '') + codexPluginEnableBlock() + '\n';
+  return { text, status: 'added' };


Managed disable stripped away

Medium Severity

upsertCodexPluginEnable strips the managed block before parsing, so turning the plugin off by setting enabled = false inside that block is erased. A later install sees no plugin table and appends a fresh managed block with enabled = true, undoing the user’s disable.

^{Reviewed by Cursor Bugbot for commit b9a98fe. Configure here.}

Addresses the CI failure and Cursor Bugbot findings on the enable step: - commands.test.ts asserted the exact `install` subcommand list — add `codex`. - The managed-block approach conflicted with the `[plugins."agentbox@agentbox"]` table Codex itself writes (`plugin add` / TUI toggle): a second table is a TOML parse error, and the strip+regenerate path could (a) leave a stale duplicate unwritten and (b) override a disable set inside the block. Replace it: parse config.toml read-only and - append a plain `[plugins."agentbox@agentbox"] enabled = true` table only when the key is ABSENT (Codex usually writes it itself on `plugin add`); - respect a present value (enabled defaults true; only explicit `false` is off); - with --force, flip a disabled entry to true via a targeted in-place line edit that preserves the rest of the file (comments/order/formatting). Always write when the text changed (fixes the "cleanup not written" gap). E2E re-verified vs codex 0.142: fresh -> enabled; disabled re-run -> stays off with comments preserved; --force -> re-enabled, file still single-table valid TOML. Claude-Session: https://claude.ai/code/session_01PTY4KwAeZdAVvgSWxjpYfs

madarco · 2026-06-26T22:22:19Z

All three findings fixed in 2ee88f3 by dropping the managed-block approach (it conflicted with the [plugins."agentbox@agentbox"] table Codex itself writes):

Config cleanup not written — the enable step now writes whenever the text changed (not only on added), and there's no managed block to leave stale; we only ever append a plain table when the key is absent.
Force skips config re-enable — --force now flips a present enabled = false to true via a targeted in-place line edit (rest of the file preserved).
Managed disable stripped away — no managed block exists anymore; a present table is respected, never stripped/regenerated.

Also fixed the CI failure (commands.test.ts asserted the exact install subcommand list — added codex). E2E re-verified vs codex 0.142.

bugbot run

vercel Bot deployed to Preview June 26, 2026 17:50 View deployment

cursor Bot reviewed Jun 26, 2026

View reviewed changes

vercel Bot deployed to Preview June 26, 2026 22:22 View deployment

madarco merged commit 2ee88f3 into nightly Jun 26, 2026
3 checks passed

madarco deleted the feat/install-codex-plugin branch June 26, 2026 22:33

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(codex): `agentbox install codex` — install + enable the Codex plugin#121

feat(codex): `agentbox install codex` — install + enable the Codex plugin#121
madarco merged 2 commits into
nightlyfrom
feat/install-codex-plugin

madarco commented Jun 26, 2026 •

edited by cursor Bot

Loading

Uh oh!

vercel Bot commented Jun 26, 2026 •

edited

Loading

Uh oh!

madarco commented Jun 26, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Jun 26, 2026

Uh oh!

cursor Bot Jun 26, 2026

Uh oh!

cursor Bot Jun 26, 2026

Uh oh!

madarco commented Jun 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

madarco commented Jun 26, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

How

Robustness

Verification

Uh oh!

vercel Bot commented Jun 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

madarco commented Jun 26, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Jun 26, 2026

Choose a reason for hiding this comment

Config cleanup not written

Uh oh!

cursor Bot Jun 26, 2026

Choose a reason for hiding this comment

Force skips config re-enable

Uh oh!

cursor Bot Jun 26, 2026

Choose a reason for hiding this comment

Managed disable stripped away

Uh oh!

madarco commented Jun 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

madarco commented Jun 26, 2026 •

edited by cursor Bot

Loading

vercel Bot commented Jun 26, 2026 •

edited

Loading