## Summary
Adds **Build Web Data Visualization**, a Codex plugin for designing,
building, testing, and exporting web-based data visualizations. It
routes requests to the right workflow for charts, dashboards, maps,
WebGL/Three.js scenes, D3/SVG, Gantt charts, diagrams, reports, PDFs,
and slide exports.
The plugin uses a compact implicit router with explicit specialist
skills, keeping common visualization requests lightweight while
preserving deeper guidance when needed.
Also updates **Plugin Eval** so token budget scoring accounts for
explicit-only skills separately from implicit active context.
## Summary
- Port the connector-native simple Google Doc creation boundary from
openai/openai#950198 into the Google Drive plugin.
- Add the native-create direct reference for simple Docs that only need
text, headings, bullets, links, and light formatting.
- Keep DOCX-first creation as the default for polished or
layout-sensitive deliverables, and bump the Google Drive plugin version
to 0.1.1.
## Validation
- `git diff --check`
- `python -c "import json;
json.load(open('plugins/google-drive/.codex-plugin/plugin.json'));
print('plugin json ok')"`
- `python -c "import pathlib,re;
root=pathlib.Path('plugins/google-drive/skills/google-docs');
refs=set(re.findall(r'references/[-A-Za-z0-9_]+\\.md',
(root/'SKILL.md').read_text())); missing=[r for r in refs if not
(root/r).exists()]; print('checked', len(refs), 'refs'); raise
SystemExit('missing refs: '+str(missing) if missing else 0)"`
- `rg -n "google-drive-codex|Google Drive
Codex|plugins/google-drive-codex"
plugins/google-drive/skills/google-docs
plugins/google-drive/.codex-plugin/plugin.json`
## Summary
- Port the Google Docs direct request workflow from openai/openai#947695
into the Google Drive plugin.
- Add direct batchUpdate request composition guidance, meeting-notes
fast path guidance, smart chip/building block notes, and PDF export
visual QA reference material.
- Keep the existing DOCX-first path for polished net-new Docs while
improving connector-first editing guidance.
## Validation
- `git diff --check`
- `python -c "import json;
json.load(open('plugins/google-drive/.codex-plugin/plugin.json'));
print('plugin json ok')"`
- `python -c "import pathlib,re;
root=pathlib.Path('plugins/google-drive/skills/google-docs');
refs=set(re.findall(r'references/[-A-Za-z0-9_]+\\.md',
(root/'SKILL.md').read_text())); missing=[r for r in refs if not
(root/r).exists()]; print('checked', len(refs), 'refs'); raise
SystemExit('missing refs: '+str(missing) if missing else 0)"`
## Why
Net-new Google Docs and Google Slides artifacts have a higher quality
bar when they are authored locally with the dedicated
document/presentation artifact workflows first, then converted into
native Google Workspace files. Those authoring paths provide the local
rendering and QA loops needed for layout, polish, and content
verification before handoff. Directly creating a blank Google Doc or
Slides deck through Google APIs is still possible, but it should be an
explicit user override rather than the default path.
## What changed
- Updated the Google Drive router so new Google Docs and Google Slides
requests route to the specialized Docs/Slides skills, which own the
required local-file-to-native-import workflow.
- Updated the Google Docs skill to require local `.docx` creation
through `[@documents](plugin://documents@openai-primary-runtime)`,
followed by `mcp__codex_apps__google_drive_import_document` with
`upload_mode: "native_google_docs"`.
- Updated the Google Docs import reference to document the native import
action, install/reinstall handling, conversion verification, and
source-file preservation mode.
- Updated the Google Slides skill to require local `.pptx` creation
through
`[@presentations](plugin://presentations@openai-primary-runtime)`,
followed by `mcp__codex_apps__google_drive_import_presentation` with
`upload_mode: "native_google_slides"`.
- Updated the Google Slides import reference to document import-action
availability checks, native conversion verification, direct-to-Slides
anti-patterns, and PowerPoint preservation mode.
## Validation
- `git diff --check`
- `/home/dev-user/.virtualenvs/openai/bin/python
/home/dev-user/code/openai/skills/lint_skills.py
/home/dev-user/code/openai-plugins/plugins/google-drive/skills/google-docs`
- `/home/dev-user/.virtualenvs/openai/bin/python
/home/dev-user/code/openai/skills/lint_skills.py
/home/dev-user/code/openai-plugins/plugins/google-drive/skills/google-slides`
- `/home/dev-user/.virtualenvs/openai/bin/python
/home/dev-user/code/openai/skills/lint_skills.py
/home/dev-user/code/openai-plugins/plugins/google-drive/skills/google-drive`
Related source changes:
- https://github.com/openai/openai/pull/919518
- https://github.com/openai/openai/pull/919139
---------
Co-authored-by: Codex <noreply@openai.com>
## Summary
- Add Slack skill guidance for bucketed per-minute RPM limits.
- Tell agents to avoid immediate same-bucket retries on 429s, respect
explicit wait hints, and back off on repeated 429s.
- Clarify that useful work can continue through other Slack tool buckets
while one bucket is cooling down.
## Why
Slack tools share quotas by bucket rather than by individual tool.
Without bucket-aware retry guidance, agents can amplify rate-limit
pressure by retrying equivalent tools immediately or by serially
exhausting the same quota bucket.
## Validation
- Ran `git diff --check`.
- Markdown-only skill update; no automated test suite run.
## Summary
- Import Zoom combined plugin content from zoom/zoom-plugin-codex commit
6f30034c94b4594daaf814cd9bf4cf972b90a323 into the existing app-backed
Zoom plugin.
- Add Zoom developer commands, reviewer agents, and 53 developer skills
under plugins/zoom while preserving the Zoom app connector mapping and
marketplace identity.
- Mark only the imported developer skills explicit-only with adjacent
agents/openai.yaml files using policy.allow_implicit_invocation: false;
the regular Zoom app/plugin surface remains implicitly invokable.
## Validation
- jq empty plugins/zoom/.codex-plugin/plugin.json plugins/zoom/.app.json
.agents/plugins/marketplace.json
- Ruby validation for all Zoom SKILL.md frontmatters and 53 skill-level
Zoom agents/openai.yaml policy files, plus confirmation that
plugins/zoom/agents/openai.yaml does not disable implicit invocation
- git diff --check HEAD^ HEAD -- plugins/zoom
- node plugins/plugin-eval/scripts/plugin-eval.js analyze plugins/zoom
--format json completed; it reports high static token budget because the
upstream Zoom reference library is large.
## Summary
- tighten Notion skill guidance around the deployed app contract
- repair invalid or misleading tool-call examples across the four
curated Notion skills
- switch database-creation references from REST-style objects to the SQL
DDL form exposed by the live app
## Root cause
Several deployed plugin examples had drifted from the live Apps SDK /
Notion MCP surface. They either omitted connector-required fields, used
unsupported command names, or showed payload shapes that fail connector
validation before they ever reach Notion.
## What changed
- require explicit `filters: {}` in search examples and remove
pseudo-boolean query syntax such as `or` / `+`
- make fetch examples concrete and reinforce that only Notion URLs / IDs
should be fetched
- make create-page examples include explicit `parent` + `pages`
- fix `notion-query-data-sources` to use the top-level `data` wrapper
and collection URLs as SQL table names
- replace invalid `insert_content_after` examples with `update_content`
search-and-replace payloads
- document the deployed `update-page` quirk that requires both
`properties` and `content_updates` top-level fields
- fix `notion-create-comment` examples to use `page_id`
- update database-creation references to the live SQL DDL schema format
## Validation
- live Notion connector probes on 2026-05-19:
- `search` succeeds with `filters: {}` and fails connector validation
when `filters` is omitted
- `query-data-sources` succeeds with the `data` wrapper and fails
connector validation without it
- `create-pages` and `create-database` reject omitted `parent`;
explicit-parent payloads get past schema validation
- `update-page(update_content)` requires `properties: {}`;
`update-page(update_properties)` requires `content_updates: []`
- `create-comment` with object-style `rich_text` passes connector
validation
Sync the Figma plugin skill bundle with
`figma/mcp-server-guide@a742f0a700a7772ff5ed85f7c9fc1dad5afa9fcc`
(`v2.2.12`).
This pulls in Figma's latest guidance updates across the `figma-use`,
FigJam, Slides, design-generation, and library-generation skill
surfaces. The imported changes sharpen the runtime guidance that came up
in recent threads, including editor-context boundaries, text/font
handling, and more efficient Plugin API traversal patterns, while
keeping the local plugin layout unchanged.
Context:
https://openai.slack.com/archives/C09CKPM5UKT/p1779133790898629?thread_ts=1778698066.370709&cid=C09CKPM5UKT
## Summary
- Add a Slack skill write-safety guardrail requiring fresh
channel/thread reads before acting on relative message targets like
"last message".
- Call out reactions, replies, edits, and other writes so stale cached
reads are not reused for message actions.
## Why
The reported issue was that "last message" stayed bound to an older read
result, so a reaction was applied to an hour-old message until the agent
was told to recheck. The skill should force a fresh resolution
immediately before acting on recency-based targets.
## Validation
- Ran `git diff --check`.
- Verified the diff is limited to one insertion in
`plugins/slack/skills/slack/SKILL.md`.
## Summary
- Register the existing Asana plugin in
`.agents/plugins/marketplace.json`.
- Point the marketplace entry at `./plugins/asana` with the standard
available/on-install policy and Productivity category.
## Validation
- Parsed `.agents/plugins/marketplace.json`,
`plugins/asana/.codex-plugin/plugin.json`, and `plugins/asana/.app.json`
with `jq`.
- Checked the marketplace for duplicate plugin names.
- Verified the appended Asana entry shape with `jq`.
## Summary
Plugin Creator now documents the shorter local-plugin handoff URL that
the app can interpret directly.
[#237](https://github.com/openai/plugins/pull/237) teaches the skill to
end marketplace-backed creation flows with named View and Share links;
this follow-up updates those examples so the skill only emits the
normalized plugin name, the absolute marketplace path, and optional
share mode.
The documented shape is:
```txt
codex://plugins/<normalized-plugin-name>?marketplacePath=<absolute-marketplace-json-path>
codex://plugins/<normalized-plugin-name>?marketplacePath=<absolute-marketplace-json-path>&mode=share
```
The skill text now states exactly where the normalized plugin name
belongs, exactly where the absolute marketplace path belongs, and that
it should not add `pluginName` or `hostId` query parameters.
## Testing
Tests: plugin-creator skill validation.
## Summary
Plugin creation now defaults to the personal marketplace path that Codex
can render and share directly.
Before this change, the curated `plugin-creator` skill centered
repo-local plugin scaffolds and repo-root marketplace updates. That made
the common personal-plugin path less explicit, and the public skill copy
did not include the final deeplink handoff back into Codex after
marketplace-backed creation.
This PR makes personal plugins the default flow. Marketplace-backed
scaffolds now default to `~/plugins/<plugin-name>` plus
`~/.agents/plugins/marketplace.json`. If the current Git repo already
has `.agents/plugins/marketplace.json` and the user has not said whether
the plugin is personal or team-shared, the skill asks which marketplace
to update. The skill also ends marketplace-backed creation with named
`View <plugin-name>` and `Share <plugin-name>` deeplinks.
## What changed
- default scaffold and marketplace paths to the personal plugin location
- document the explicit repo/team override path for shared codebases
- ask for user intent only in the ambiguous existing-repo-marketplace
case
- add the final named Codex deeplink handoff after marketplace-backed
creation
- refresh the marketplace reference sample to the `policy.installation`
and `policy.authentication` shape
## Design decisions
- Personal plugins are the default because they are the path users can
create, open, and share without first deciding to commit plugin code
into a team repo.
- Existing repo marketplaces are the one ambiguous case worth
interrupting for. They can mean “add this to the codebase” rather than
“make something for me personally.”
- The deeplink labels include the plugin name so the assistant can
present readable links instead of raw `codex://...` URLs.
## Testing
Tests: skill validation, Python compile checks, personal-default
scaffold smoke, repo-override scaffold smoke, and whitespace checks.
## Summary
- restore the HeyGen plugin under plugins/heygen
- add the plugin to .agents/plugins/marketplace.json so it appears in
the public catalog
- wire the plugin through .app.json and update the bundled skill docs to
match the app-backed flow
## Notes
- this is a fresh branch from origin/main, not a continuation of the
prior reverted branch
Why: the OpenAI Developers plugin is now the OpenAI-owned Codex plugin
for developer workflows, so ChatGPT Apps guidance should live there
instead of requiring developers to discover and install a separate
ChatGPT Apps plugin.
This merges the ChatGPT Apps build and submission skills into
`plugins/openai-developers`. The OpenAI Developers manifest and README
now describe ChatGPT Apps support alongside OpenAI API keys and Agents
SDK workflows, the plugin declares read/write capability because the
moved submission skill inspects local app code, and the plugin version
is bumped to `1.1.0` for the new workflow surface.
The standalone `chatgpt-apps` plugin is removed from the marketplace and
its skill files are moved under OpenAI Developers, so developers get the
ChatGPT Apps SDK scaffolding and `chatgpt-app-submission.json`
generation flows from one plugin.
I checked the OpenAI Developers node tests and JSON parsing locally. The
README's distribution validation command points at a script path that is
not present in this repository clone, so I could not run that
validation.
## Why
ChatGPT app developers can generate `chatgpt-app-submission.json` even
when their MCP tools omit the optional `outputSchema` field. That should
stay non-blocking, but the generated handoff should still point out
missing output schemas because they give models more structure for using
tool results.
## What changed
The `chatgpt-app-submission` skill now records tools whose descriptors
or source definitions omit `outputSchema` or set it to `null`. The
generated JSON remains unchanged, and the skill reports a concise
final-response warning with the affected tool names and a link to the
MCP tool spec.
The `chatgpt-apps` plugin manifest version is bumped from `0.1.0` to
`0.1.1` because the packaged skill content changed.
Co-authored-by: Codex <noreply@openai.com>
## Summary
- Add OpenAI skill interface metadata for all OpenAI Developers skills
so UI copy stays concise.
- Set the Agents SDK display name explicitly while keeping the skill ID
as hyphen-case `agents-sdk` for validator compatibility.
- Shorten API troubleshooting and API key skill descriptions for UI
surfaces.
## Tests
- `yq . plugins/openai-developers/skills/agents-sdk/agents/openai.yaml
plugins/openai-developers/skills/openai-api-troubleshooting/agents/openai.yaml
plugins/openai-developers/skills/openai-platform-api-key/agents/openai.yaml`
- `python3
/Users/mifan/.codex/skills/.system/skill-creator/scripts/quick_validate.py
plugins/openai-developers/skills/openai-api-troubleshooting`
- `python3
/Users/mifan/.codex/skills/.system/skill-creator/scripts/quick_validate.py
plugins/openai-developers/skills/openai-platform-api-key`
- `python3
/Users/mifan/.codex/skills/.system/skill-creator/scripts/quick_validate.py
plugins/openai-developers/skills/agents-sdk`
- `oaipkg run cloud_plugins_import plugin validate
/private/tmp/openai-plugins-publication-master/plugins/openai-developers`
- `node --test
plugins/openai-developers/tests/openai-platform-api-key.test.mjs`
## Summary
Adds the OpenAI Developers plugin under `plugins/openai-developers` with
its plugin manifest, OpenAI Platform app connector manifest, assets,
skills, helper script, README, tests, and eval references.
Registers `openai-developers` in the curated marketplace manifest so it
can be discovered from the public plugin catalog.
Updates the plugin repository metadata to point at
`https://github.com/openai/plugins/tree/main/plugins/openai-developers`
and keeps the production OpenAI Platform connector id in `.app.json`.
Incorporates the OpenAI Developers pieces from openai/openai#890108 by
adding the Agents SDK lifecycle skill, documenting it in the README, and
updating the plugin metadata for Agents SDK usage.
## Validation
- `jq . .agents/plugins/marketplace.json`
- `jq . plugins/openai-developers/.codex-plugin/plugin.json
plugins/openai-developers/.app.json`
- `python3
/Users/mifan/.codex/skills/.system/skill-creator/scripts/quick_validate.py
plugins/openai-developers/skills/agents-sdk`
- `git diff --check`
- `node --test
plugins/openai-developers/tests/openai-platform-api-key.test.mjs`: 21
passed, 2 skipped because the skipped checks depend on monorepo-only
fixture paths that are not present in `openai/plugins`.
## Summary
- Coordinate `frontend-app-builder` with other installed skills when an
app needs provider-backed capabilities.
- Clarify that provider setup should not block Image Gen concepting,
static UI work, or design review that does not exercise provider-backed
behavior.
- Require `openai-developers:openai-platform-api-key` for
AI/model-generated output when available, instead of fake keys,
placeholder env vars, or manual API-key setup instructions.
Adds Zotero to the Codex official plugin marketplace so customers can
install it from the curated plugin list.
Zotero provides a local-library workflow for searching a user’s Zotero
Desktop library, exporting BibTeX, inserting citation keys, reading
indexed full text, and importing BibTeX/RIS records through the local
Zotero connector server.
The plugin entry is registered in the marketplace catalog with the
Research category and includes the plugin manifest, skill instructions,
local API reference, CLI helper, and icon asset.
## Summary
- add a Salesforce app-only Codex plugin backed by the canonical
Salesforce connector
- add Salesforce to the curated plugin marketplace so it can appear in
the Codex plugins directory
- include a minimal local icon asset
## Testing
- python3 -m json.tool plugins/salesforce/.app.json
- python3 -m json.tool plugins/salesforce/.codex-plugin/plugin.json
- python3 -m json.tool .agents/plugins/marketplace.json
- git diff --check
No secrets added.
## Why
The ChatGPT Apps plugin needs a broader submission-prep workflow than
the old MCP tool hint justification helper. Developers should be able to
run one skill from their local MCP server repo and get the
`chatgpt-app-submission.json` file that onboard can use to prefill
reviewable submission fields.
## Workflow demo
https://github.com/user-attachments/assets/5b6ba645-22e8-4f90-9d3f-2cb8ad603ceb
## What Changed
This updates the plugin metadata to ChatGPT Apps and describes it as a
plugin for building ChatGPT Apps and preparing submission materials.
The old `mcp-tool-hint-justifications` skill is replaced by
`chatgpt-app-submission`. The new skill tells Codex to inspect local app
metadata, MCP tool descriptors, tool implementations, explicit hint
annotations, widget metadata, and CSP values before writing
`chatgpt-app-submission.json`.
The generated file contract covers `app_info`, required `tools`,
`test_cases`, and `negative_test_cases`. The skill also requires concise
review-facing justifications, at least five positive test cases, at
least three negative test cases, exact MCP action names, and a subtitle
of 30 characters or less.
For review checks that do not have first-class onboard fields, the skill
reports findings in its final response instead of writing them into
JSON. That includes sensitive input solicitation, tool data use, tool
naming or description issues, and weak CSPs. The skill keeps the
Apache-2.0 license with the renamed skill directory.
Codex plugin for [HeyGen](https://heygen.com) — create AI avatar videos
and personalized video messages.
## What's included
Two skills that chain together:
- **heygen-avatar** — turn a photo into a persistent digital twin.
Handles avatar lookup, instant-avatar creation, voice selection (or
voice cloning), and writes an `AVATAR` file the video skill reads back.
- **heygen-video** — identity-first presenter videos via the HeyGen v3
Video Agent pipeline. Encodes prompting, asset routing, aspect-ratio
correction, and avatar/voice resolution.
## Source of truth
Skills are authored in
[`heygen-com/skills`](https://github.com/heygen-com/skills) (under
`heygen-avatar/` and `heygen-video/` at the repo root) and mirrored
here. File issues about skill content on that repo.
## What changed from upstream
The upstream repo keeps skills at the root (no `skills/` subdir) and
`heygen-video/SKILL.md` references shared docs via `../references/...`.
The bundled copy here is restructured to match the Codex plugin
convention:
- skills moved into `skills/heygen-avatar/` and `skills/heygen-video/`
so the manifest can use the documented `"skills": "./skills/"` form
- the 9 shared reference files are bundled inside
`skills/heygen-video/references/` (only `heygen-video` reads them)
- `heygen-video/SKILL.md` paths rewritten from `../references/...` →
`references/...` — the only content delta from upstream
No changes to skill prose or behavior. Bundle is 372 KB.
## Requirements
The skills shell out to the HeyGen CLI and need a HeyGen API key. Either
install the CLI from https://static.heygen.ai/cli/install.sh and export
`HEYGEN_API_KEY`, or connect HeyGen via MCP — the skills detect MCP and
skip the CLI path.
## Test plan
- [x] `plugin.json` parses as JSON
- [x] Manifest fields match the schema documented at
<https://developers.openai.com/codex/plugins/build>
- [x] Skill paths in `heygen-video/SKILL.md` resolve to the bundled
`references/` dir
- [x] Assets (PRISM_ORB icon at 512×512 and 1024×1024) flattened onto
white background — render the same on light/dark marketplace tiles
- [ ] Install via Codex plugin marketplace once merged
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sync skill guidance from heygen-com/hyperframes#504. Tells agents to
hand back the Studio project URL
(http://localhost:<port>/#project/<project-name>) instead of the source
index.html path, which won't render outside the Studio runtime.
Co-authored-by: Miguel Ángel <miguel.sierra@heygen.com>
Kevin Lee