openai-plugin-refresh

Refresh the ChatGPT/Codex stdio plugin (issue #699, follow-up to #703): - pin @stackql/mcp-server 0.12.732 (was 0.10.591) and stamp it from the shared renderer: new openai-plugin vector plus make openai-plugin-manifest, run as part of npm-manifest so a release cannot skip it - validate.py enforces pin == packaging/mcpb/npm/package.json and that the icon assets exist; the openai-plugin workflow also triggers on package.json - add the plugin icon (composerIcon / logo) - listings.md row for the OpenAI plugin directory; document the desktop Chat limitation (openai/codex#38162); runbook step 10 reflects the make target - carry release housekeeping: npm/pypi manifests to 0.12.732, drop the accidentally committed mcp-publisher binary and ignore it Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
jeffreyaven · Oct 5, 2026 · Oct 5, 2026 · Oct 5, 2026 · 2cfcb1e9ddc286782d062ba4e3ed4fe7e8c64499
commit 2cfcb1e9ddc286782d062ba4e3ed4fe7e8c64499
diff --git a/.github/workflows/openai-plugin.yml b/.github/workflows/openai-plugin.yml
@@ -5,6 +5,7 @@ on:
     paths:
       - '.agents/plugins/marketplace.json'
       - 'packaging/openai-plugin/**'
+      - 'packaging/mcpb/npm/package.json'
       - '.github/workflows/openai-plugin.yml'
   workflow_dispatch:
 

diff --git a/.gitignore b/.gitignore
@@ -1,3 +1,6 @@
+# mcpb
+mcp-publisher
+
 # CI staging
 go.sum.bkp
 /tmp

diff --git a/docs/chatgpt-codex-plugin.md b/docs/chatgpt-codex-plugin.md
@@ -12,6 +12,15 @@ Supported clients:
 ChatGPT web cannot run a local stdio server. Plugins are not available in the
 Codex IDE extension.
 
+## Known limitation: desktop Chat sessions
+
+The ChatGPT desktop app can start the plugin, complete the MCP handshake, and
+still not expose the StackQL tools to a Chat session. This is an open upstream
+bug, [openai/codex#38162](https://github.com/openai/codex/issues/38162),
+reproduced on desktop builds through 26.924. Codex threads in the desktop app
+and Codex CLI are unaffected. If a Chat session reports that no StackQL tools
+are available, start a Codex thread instead.
+
 ## Install
 
 Install Node.js 18 or later, then run:

diff --git a/docs/stackql_release_process.md b/docs/stackql_release_process.md
@@ -148,13 +148,9 @@ mcp-publisher login github
 make registry-publish VERSION=X.Y.Z
 ```
 
-### 10. Update the ChatGPT/Codex stdio plugin
+### 10. Commit the ChatGPT/Codex stdio plugin bump
 
-After 7a confirms `@stackql/mcp-server@X.Y.Z` is live, update the local plugin in a follow-up PR:
-
-a. Set `version` in `packaging/openai-plugin/plugins/stackql/.codex-plugin/plugin.json` to `X.Y.Z`.
-b. Set the pinned `@stackql/mcp-server@X.Y.Z` in `packaging/openai-plugin/plugins/stackql/bin/stackql-mcp.js`.
-c. Run:
+`make npm-pack` in 8a also stamped the plugin: `version` in `packaging/openai-plugin/plugins/stackql/.codex-plugin/plugin.json` and the pinned `@stackql/mcp-server@X.Y.Z` in `packaging/openai-plugin/plugins/stackql/bin/stackql-mcp.js` (`make openai-plugin-manifest VERSION=X.Y.Z` stamps just those two). After 8a confirms `@stackql/mcp-server@X.Y.Z` is live, verify and commit them together with the `package.json` / `pyproject.toml` bumps; the plugin validator fails when the pin and `packaging/mcpb/npm/package.json` disagree:
 
 ```bash
 npm view @stackql/mcp-server@X.Y.Z version

diff --git a/packaging/mcpb/Makefile b/packaging/mcpb/Makefile
@@ -62,6 +62,7 @@ OCI_STAGE := .oci-stage
         server-json registry-publish check-published clean clean-bin \
         linux-x64 linux-arm64 windows-x64 darwin-universal \
         oci-stage oci oci-push npm-manifest npm-pack pypi-manifest pypi-build \
+        openai-plugin-manifest \
         list help
 
 all: download package
@@ -237,7 +238,7 @@ oci-push: oci-stage
 # Render npm/platforms.json (bundle URLs + sha256 pins) and stamp the package
 # version. Run AFTER the .mcpb assets are published - it fetches the canonical
 # .sha256 files from the GitHub release, same rule as 'make server-json'.
-npm-manifest: check-version
+npm-manifest: check-version openai-plugin-manifest
 	bash scripts/render-npm-manifest.sh --version $(VERSION)
 
 # Build the publishable tarball. Publishing stays manual (npm 2FA):
@@ -246,6 +247,13 @@ npm-pack: npm-manifest
 	cd npm && npm pack
 	@echo "tarball ready under npm/ - publish manually with: cd npm && npm publish --access public"
 
+# --- ChatGPT/Codex stdio plugin -------------------------------------------------
+# Stamp packaging/openai-plugin (plugin.json version + the @stackql/mcp-server
+# pin in the launcher) so the plugin tracks the npm wrapper. Runs as part of
+# npm-manifest; commit the result together with the package.json bump.
+openai-plugin-manifest: check-version
+	bash scripts/render-platforms.sh --version $(VERSION) --vector openai-plugin
+
 # --- PyPI wrapper --------------------------------------------------------------
 # Same ordering rule as npm-manifest: run AFTER the .mcpb assets are published.
 pypi-manifest: check-version

diff --git a/packaging/mcpb/README.md b/packaging/mcpb/README.md
@@ -424,14 +424,12 @@ The local plugin under `packaging/openai-plugin` is an addendum to this release
 flow. It launches the npm wrapper over stdio and does not change the MCPB,
 Anthropic submission, PyPI, OCI, or MCP Registry artifacts.
 
-Update it only after `@stackql/mcp-server@X.Y.Z` is published:
-
-1. Set `version` in
-   `packaging/openai-plugin/plugins/stackql/.codex-plugin/plugin.json` to
-   `X.Y.Z`.
-2. Set the pinned `@stackql/mcp-server@X.Y.Z` in
-   `packaging/openai-plugin/plugins/stackql/bin/stackql-mcp.js`.
-3. From the repository root, run:
+`make npm-manifest` (and therefore `make npm-pack`) stamps the plugin's
+`version` and the pinned `@stackql/mcp-server@X.Y.Z` in the launcher; to stamp
+only the plugin run `make openai-plugin-manifest VERSION=X.Y.Z`. The plugin
+validator fails when the pin and `npm/package.json` disagree, so commit the
+plugin files together with the npm manifest. Once `@stackql/mcp-server@X.Y.Z`
+is published, from the repository root run:
 
 ```bash
 npm view @stackql/mcp-server@X.Y.Z version
@@ -462,6 +460,8 @@ make oci-push VERSION=X.Y.Z     multi-arch image build + push (needs docker logi
 make npm-manifest VERSION=X.Y.Z render npm/platforms.json from PUBLISHED .sha256s
 make npm-pack VERSION=X.Y.Z     build the @stackql/mcp-server tarball (publish is
                                 manual: cd npm && npm publish --access public)
+make openai-plugin-manifest VERSION=X.Y.Z   stamp the ChatGPT/Codex plugin pin
+                                (also runs as part of npm-manifest)
 make pypi-manifest VERSION=X.Y.Z render pypi platforms.json from PUBLISHED .sha256s
 make pypi-build VERSION=X.Y.Z   build sdist+wheel (publish is manual:
                                 python -m twine upload pypi/dist/*)

diff --git a/packaging/mcpb/listings.md b/packaging/mcpb/listings.md
@@ -26,6 +26,7 @@ are not listed here.
 | GitHub MCP Registry | GitHub discovery surface | Auto-ingest from official registry | ✅ Published | 2026-06-24 | [github-mcp](https://github.com/mcp?search=stackql)<br/>[api.mcp.github.com](https://api.mcp.github.com/v0/servers) | Listed as `io.github.stackql/stackql-mcp` (entry created 2026-06-24) via auto-ingest from the official registry. Sync is an hourly sweep of the official registry plus ~20 min of read-API caching: 0.11.669 was published to the official registry 2026-09-08 02:54Z, the GitHub entry updated 03:47Z and became visible 04:0xZ, so allow up to 2 hours. `make check-published` reports the advertised version; nothing to do on our side | 2026-09-08 |
 | VS Code MCP Gallery | IDE client gallery (@mcp in Extensions view) | Ingests from GitHub MCP Registry | 🟡 Blocked upstream | 2026-06-16 | [docs](https://code.visualstudio.com/docs/agent-customization/mcp-servers) | Downstream of GitHub MCP Registry - the `@mcp` gallery pulls from it, so this follows automatically once that row lands. No separate submission. Manual `.vscode/mcp.json` with npx works today regardless of gallery listing | 2026-06-16 |
 | Anthropic Connectors / Desktop Extensions Directory | Vendor directory (Claude) | Review form, Anthropic-vetted | 🟡 Pending Review | 2026-06-13 |  | Follow up on submission review ([Google Form](https://docs.google.com/forms/u/0/d/e/1FAIpQLScHtjkiCNjpqnWtFLIQStChXlvVcvX8NPXkMfjtYPDPymgang/viewform?usp=form_confirm)) | 2026-06-13 |
+| OpenAI Plugin directory (ChatGPT + Codex) | Vendor directory (OpenAI) | GitHub marketplace, self-serve (`.agents/plugins/marketplace.json`, see `docs/chatgpt-codex-plugin.md`); public directory via platform.openai.com/plugins needs a remote HTTPS MCP endpoint | 🟡 Marketplace only | 2026-08-04 | `codex plugin marketplace add stackql/stackql --sparse .agents/plugins --sparse packaging/openai-plugin` | Not in the public directory: submission needs a public streamable-HTTP endpoint, OAuth 2.1 and a domain token at `/.well-known/openai-apps-challenge`; a local stdio server is only listable via an OpenAI-contact exception. Desktop Chat may hide local MCP tools (openai/codex#38162); Codex threads and CLI work | 2026-10-05 |
 | Docker MCP Catalog | Curated infra catalogue | PR to docker/mcp-registry | 🟡 In Progress (upstream PR pending) | 2026-06-15 |  | server.yaml prepared in the stackql/mcp-registry fork (community-image, points at public stackql/stackql-mcp); pending PR to docker/mcp-registry upstream + their review | 2026-06-15 |
 | npm | Package registry | `npm publish` | ✅ Published | 2026-06-15 | [@stackql/mcp-server](https://www.npmjs.com/package/@stackql/mcp-server) | npx launcher | 2026-06-15 |
 | PyPI | Package registry | `twine upload` | ✅ Published | 2026-06-15 | [stackql-mcp-server](https://pypi.org/project/stackql-mcp-server/) | uvx/pip launcher | 2026-06-15 |

diff --git a/packaging/mcpb/mcp-publisher b/packaging/mcpb/mcp-publisher
diff --git a/packaging/mcpb/npm/package.json b/packaging/mcpb/npm/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@stackql/mcp-server",
-  "version": "0.12.718",
+  "version": "0.12.732",
   "description": "StackQL MCP server - SQL-native query and provisioning engine for cloud infrastructure, served over MCP. Downloads the signed stackql binary on first run.",
   "bin": {
     "stackql-mcp": "bin/stackql-mcp.js"

diff --git a/packaging/mcpb/pypi/pyproject.toml b/packaging/mcpb/pypi/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "stackql-mcp-server"
-version = "0.12.718"
+version = "0.12.732"
 description = "StackQL MCP server - SQL-native query and provisioning engine for cloud infrastructure, served over MCP. Downloads the signed stackql binary on first run."
 readme = "README.md"
 license = "MIT"

diff --git a/packaging/mcpb/scripts/render-platforms.sh b/packaging/mcpb/scripts/render-platforms.sh
@@ -19,6 +19,7 @@
 #   cargo   cargo/platforms.json                               cargo/Cargo.toml [package] version
 #   go      go/embed/platforms.json                            (module version is the git tag)
 #   dotnet  dotnet/src/StackQL.Mcp/platforms.json              dotnet/Directory.Build.props <Version>
+#   openai-plugin  (none - it launches the npm wrapper)        ../openai-plugin/plugins/stackql: .codex-plugin/plugin.json "version" + bin/stackql-mcp.js pin
 #
 # Usage:
 #   scripts/render-platforms.sh --version 0.10.601            # all vectors
@@ -33,6 +34,7 @@ PYPI_DIR="${PYPI_DIR:-$ROOT_DIR/pypi}"
 CARGO_DIR="${CARGO_DIR:-$ROOT_DIR/cargo}"
 GO_DIR="${GO_DIR:-$ROOT_DIR/go}"
 DOTNET_DIR="${DOTNET_DIR:-$ROOT_DIR/dotnet}"
+PLUGIN_DIR="${PLUGIN_DIR:-$ROOT_DIR/../openai-plugin/plugins/stackql}"
 # Canonical source for the .sha256 pins - always the GitHub release, the source
 # of truth. Overridable for testing but normally left alone.
 RELEASE_BASE="${RELEASE_BASE:-https://github.com/stackql/stackql/releases/download}"
@@ -41,7 +43,7 @@ RELEASE_BASE="${RELEASE_BASE:-https://github.com/stackql/stackql/releases/downlo
 # hold. This is the baseUrl written into platforms.json.
 DOWNLOAD_BASE="${DOWNLOAD_BASE:-https://releases.stackql.io/stackql}"
 
-ALL_VECTORS="npm pypi cargo go dotnet"
+ALL_VECTORS="npm pypi cargo go dotnet openai-plugin"
 
 VERSION="${VERSION:-}"
 VECTOR="all"
@@ -51,7 +53,7 @@ while [ $# -gt 0 ]; do
     --version=*) VERSION="${1#*=}"; shift ;;
     --vector)    VECTOR="$2"; shift 2 ;;
     --vector=*)  VECTOR="${1#*=}"; shift ;;
-    -h|--help)   sed -n '2,26p' "$0"; exit 0 ;;
+    -h|--help)   sed -n '2,27p' "$0"; exit 0 ;;
     *) echo "unknown argument: $1" >&2; exit 2 ;;
   esac
 done
@@ -145,13 +147,35 @@ render_dotnet() {
   sed_inplace "s#<Version>[^<]*</Version>#<Version>$VERSION</Version>#" "$props"
 }
 
+render_openai_plugin() {
+  # No platforms.json: the plugin launches the npm wrapper and inherits its
+  # pins. Stamp the manifest version and the @stackql/mcp-server pin so the
+  # plugin tracks the wrapper release (the plugin validator enforces parity
+  # with npm/package.json).
+  local manifest="$PLUGIN_DIR/.codex-plugin/plugin.json" launcher="$PLUGIN_DIR/bin/stackql-mcp.js"
+  grep -q '"@stackql/mcp-server@[0-9][0-9.]*"' "$launcher" || {
+    echo "error: $launcher has no @stackql/mcp-server pin to stamp" >&2; exit 1; }
+  sed_inplace "s#\"@stackql/mcp-server@[0-9][0-9.]*\"#\"@stackql/mcp-server@$VERSION\"#" "$launcher"
+  if command -v cygpath >/dev/null 2>&1; then
+    manifest="$(cygpath -m "$manifest")"
+  fi
+  PKG_JSON="$manifest" NEW_VERSION="$VERSION" node -e "
+const fs = require('fs');
+const p = process.env.PKG_JSON;
+const pkg = JSON.parse(fs.readFileSync(p, 'utf8'));
+pkg.version = process.env.NEW_VERSION;
+fs.writeFileSync(p, JSON.stringify(pkg, null, 2) + '\n');
+"
+  echo "stamped $PLUGIN_DIR (version $VERSION)"
+}
+
 if [ "$VECTOR" = "all" ]; then
   vectors="$ALL_VECTORS"
 else
   vectors="$VECTOR"
 fi
 for v in $vectors; do
-  "render_$v"
+  "render_${v//-/_}"
 done
 
 echo "pins (v$VERSION):"

diff --git a/packaging/openai-plugin/README.md b/packaging/openai-plugin/README.md
@@ -62,5 +62,7 @@ python packaging/openai-plugin/scripts/smoke-test.py
 The smoke test exercises the plugin entrypoint, MCP initialization, tool
 discovery, provider download, and a provider query over stdio.
 
-For a release update, change the version in `plugin.json` and the pinned npm
-package in `bin/stackql-mcp.js` after that npm version is published.
+For a release update, run `make openai-plugin-manifest VERSION=X.Y.Z` from
+`packaging/mcpb` (it also runs as part of `make npm-manifest`). It stamps the
+version in `plugin.json` and the pinned npm package in `bin/stackql-mcp.js`;
+commit both once that npm version is published.
diff --git a/packaging/openai-plugin/plugins/stackql/.codex-plugin/plugin.json b/packaging/openai-plugin/plugins/stackql/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "stackql",
-  "version": "0.10.591",
+  "version": "0.12.732",
   "description": "Query and manage cloud infrastructure with StackQL over a local MCP stdio server.",
   "author": {
     "name": "StackQL Studios",
@@ -33,6 +33,8 @@
       "List the cloud providers available through StackQL.",
       "Use StackQL to inventory resources in my cloud account.",
       "Use StackQL to investigate configuration drift in my cloud environment."
-    ]
+    ],
+    "composerIcon": "./assets/icon.png",
+    "logo": "./assets/icon.png"
   }
 }
diff --git a/packaging/openai-plugin/plugins/stackql/assets/icon.png b/packaging/openai-plugin/plugins/stackql/assets/icon.png
diff --git a/packaging/openai-plugin/plugins/stackql/bin/stackql-mcp.js b/packaging/openai-plugin/plugins/stackql/bin/stackql-mcp.js
@@ -8,7 +8,7 @@ const stackqlRoot =
   process.env.STACKQL_PLUGIN_CONFIG_DIR || path.join(os.homedir(), ".stackql");
 const args = [
   "-y",
-  "@stackql/mcp-server@0.10.591",
+  "@stackql/mcp-server@0.12.732",
   "--approot",
   stackqlRoot,
   "--env.file",

diff --git a/packaging/openai-plugin/scripts/validate.py b/packaging/openai-plugin/scripts/validate.py
@@ -67,6 +67,16 @@ def validate() -> None:
     require('"--configfile"' in launcher, "launcher must configure .stackqlrc")
     require('"--auth"' not in launcher, "launcher must use provider default authentication")
 
+    npm_manifest = load_json(REPO_ROOT / "packaging" / "mcpb" / "npm" / "package.json")
+    require(npm_manifest.get("version") == version,
+            "plugin pin and packaging/mcpb/npm/package.json versions differ")
+
+    interface = manifest.get("interface", {})
+    for key in ("composerIcon", "logo"):
+        icon_ref = interface.get(key, "")
+        require(icon_ref.startswith("./"), f"interface.{key} must be a ./-relative path")
+        require((PLUGIN_ROOT / icon_ref).is_file(), f"interface.{key} target is missing")
+
 
 if __name__ == "__main__":
     try: