fix(daemon): isolate plugin-started Local Codex runs (#6273)

Disable Codex plugins only for externally attributed Open Design Plugin runs so Local Codex cannot recursively enter collect_brief or Cloud login. Preserve normal Local Codex plugin loading and the existing operator-wide override.

Validated with the focused runtime args suite, workspace typecheck, guard, and an isolated source smoke that produced a valid artifact without Cloud login.

Co-authored-by: Cheems <94773058+itscheems@users.noreply.github.com>

Author: open-design-crew[bot]

apps/daemon/src/runtimes/defs/codex.ts

@@ -228,7 +228,10 @@ export const codexAgentDef = {
       const args = resumeSessionId
         ? ['exec', 'resume', '--json', '--skip-git-repo-check', ...sandboxArgs]
         : ['exec', '--json', '--skip-git-repo-check', ...sandboxArgs];
-      if (process.env.OD_CODEX_DISABLE_PLUGINS === '1') {
+      if (
+        runtimeContext.disablePlugins === true
+        || process.env.OD_CODEX_DISABLE_PLUGINS === '1'
+      ) {
         args.push('--disable', 'plugins');
       }
       // `-C <cwd>` and `--add-dir <dir>` are CREATE-only flags: `codex exec

apps/daemon/src/runtimes/types.ts

@@ -65,6 +65,11 @@ export type RuntimeContext = {
   // also persists) and the daemon seeds it with the full transcript.
   resumeSessionId?: string | null;
   newSessionId?: string;
+  // Per-run plugin isolation for agent subprocesses. External Plugin entry
+  // points use this for Local Codex so the child cannot recursively load the
+  // same Codex Plugin and route itself into another Open Design workflow.
+  // Operator-wide overrides remain owned by each runtime definition.
+  disablePlugins?: boolean;
 };
 
 // Marker on a RuntimeAgentDef declaring that the adapter's CLI maintains

apps/daemon/src/server.ts

@@ -35,6 +35,7 @@ import {
 } from './prompts/stable-sections.js';
 import { emittedRenderableQuestionForm } from './question-form-detect.js';
 import { resolveProjectRoot } from './project-root.js';
+import { OPEN_DESIGN_PLUGIN_ID } from './mcp-observability.js';
 import {
   resolveDaemonCliPath,
   resolveDaemonPluginPreviewsDir,
@@ -6281,6 +6282,10 @@ export async function startServer({
           promptFilePath: promptFile?.path,
           resumeSessionId: agentResumeCtx.resumeSessionId,
           newSessionId: agentResumeCtx.newSessionId,
+          disablePlugins:
+            def.id === 'codex'
+            && run.externalPluginAnalytics?.externalPluginId
+              === OPEN_DESIGN_PLUGIN_ID,
         },
       );
     } catch (err) {

apps/daemon/tests/runtimes/registry-and-args.test.ts

@@ -152,6 +152,32 @@ test('codex args disable plugins when OD_CODEX_DISABLE_PLUGINS is 1', () => {
   });
 });
 
+test('codex args disable plugins for an externally attributed Local Codex run', () => {
+  withEnvSnapshot(['OD_CODEX_DISABLE_PLUGINS', 'OD_CODEX_SANDBOX'], () => {
+    delete process.env.OD_CODEX_DISABLE_PLUGINS;
+    delete process.env.OD_CODEX_SANDBOX;
+
+    withPlatform('darwin', () => {
+      const args = codex.buildArgs('', [], [], {}, {
+        cwd: '/tmp/od-project',
+        disablePlugins: true,
+      });
+
+      assert.deepEqual(args.slice(0, 9), [
+        'exec',
+        '--json',
+        '--skip-git-repo-check',
+        '--sandbox',
+        'workspace-write',
+        '-c',
+        'sandbox_workspace_write.network_access=true',
+        '--disable',
+        'plugins',
+      ]);
+    });
+  });
+});
+
 test('codex args use workspace-write sandbox on macOS and Linux', () => {
   withEnvSnapshot(['OD_CODEX_DISABLE_PLUGINS', 'OD_CODEX_SANDBOX', 'WSL_DISTRO_NAME'], () => {
     delete process.env.OD_CODEX_DISABLE_PLUGINS;