fix(plugins): load Codex MCP server from root config

scripts/plugin-mcp-launcher.mjs

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
 
 import { spawn } from "node:child_process";
-import { mkdtemp, rm } from "node:fs/promises";
+import { access, mkdtemp, rm } from "node:fs/promises";
 import { constants, tmpdir } from "node:os";
 import { join } from "node:path";
+import { fileURLToPath } from "node:url";
 
 import { packageRunnerCommand } from "./lib/packageRunnerCommand.mjs";
 
@@ -26,6 +27,32 @@ if (
 }
 
 async function launch(packageSpecifier) {
+  // npm installs already carry the release-pinned runtime. Run it in this
+  // process so the plugin keeps the caller's working directory and the
+  // runtime retains ownership of provider and worker cleanup.
+  const { default: bundledPackage } = await import("../package.json", {
+    with: { type: "json" },
+  });
+  let bundledRuntimeMatchesPin =
+    packageSpecifier === `${bundledPackage.name}@${bundledPackage.version}`;
+  if (bundledRuntimeMatchesPin) {
+    try {
+      await access(new URL("../dist/mcp/main.js", import.meta.url));
+    } catch (cause) {
+      if (!isMissing(cause)) throw cause;
+      bundledRuntimeMatchesPin = false;
+    }
+  }
+  if (bundledRuntimeMatchesPin) {
+    process.argv = [
+      process.execPath,
+      fileURLToPath(new URL("./rea.mjs", import.meta.url)),
+      "mcp",
+    ];
+    await import("./rea.mjs");
+    return;
+  }
+
   const [command, ...args] = packageRunnerCommand(
     "npx",
     packageSpecifier,
@@ -93,3 +120,12 @@ async function launch(packageSpecifier) {
     }
   });
 }
+
+function isMissing(cause) {
+  return (
+    typeof cause === "object" &&
+    cause !== null &&
+    "code" in cause &&
+    cause.code === "ENOENT"
+  );
+}

scripts/verify-package-pack.mjs

@@ -71,21 +71,38 @@ export async function verifyPackagePack({ root, workspace }) {
     const manifest = JSON.parse(
       (await exec("tar", ["-xOf", tarball, `package/${path}`])).stdout,
     );
+    const serverConfig = path.startsWith(".codex")
+      ? JSON.parse(
+          (
+            await exec("tar", [
+              "-xOf",
+              tarball,
+              "package/.mcp.json",
+            ])
+          ).stdout,
+        )
+      : manifest;
+    const expectedArgs = [
+      `${path.startsWith(".claude") ? "${CLAUDE_PLUGIN_ROOT}/" : "./"}scripts/plugin-mcp-launcher.mjs`,
+      `${packedManifest.name}@${packedManifest.version}`,
+    ];
     if (
       manifest.version !== packedManifest.version ||
       manifest.skills !== "./skills" ||
-      manifest.mcpServers?.rea?.command !== "node" ||
-      (path.startsWith(".codex") && manifest.mcpServers?.rea?.cwd !== ".") ||
-      JSON.stringify(manifest.mcpServers?.rea?.args) !==
-        JSON.stringify([
-          `${path.startsWith(".claude") ? "${CLAUDE_PLUGIN_ROOT}/" : "./"}scripts/plugin-mcp-launcher.mjs`,
-          `${packedManifest.name}@${packedManifest.version}`,
-        ])
+      (path.startsWith(".codex")
+        ? manifest.mcpServers !== "./.mcp.json" ||
+          serverConfig.mcpServers?.rea?.cwd !== "."
+        : false) ||
+      serverConfig.mcpServers?.rea?.command !== "node" ||
+      JSON.stringify(serverConfig.mcpServers?.rea?.args) !==
+        JSON.stringify(expectedArgs)
     )
       throw new Error(
         `Packaged plugin ${path} does not match the exact runtime and canonical skill release`,
       );
   }
+  if (!packedFiles.includes("package/.mcp.json"))
+    throw new Error("Packaged Codex MCP server declaration is missing");
   for (const path of [
     "scripts/plugin-mcp-launcher.mjs",
     "scripts/lib/packageRunnerCommand.mjs",