fix: harden plugin feature gating (#15020)

1. Use requirement-resolved config.features as the plugin gate.
2. Guard plugin/list, plugin/read, and related flows behind that gate.
3. Skip bad marketplace.json files instead of failing the whole list.
4. Simplify plugin state and caching.

codex-rs/cli/src/main.rs

@@ -331,6 +331,17 @@ struct AppServerCommand {
     )]
     listen: codex_app_server::AppServerTransport,
 
+    /// Session source stamped into new threads started by this app-server.
+    ///
+    /// Known values such as `vscode`, `cli`, `exec`, and `mcp` map to built-in
+    /// sources. Any other non-empty value is recorded as a custom source.
+    #[arg(
+        long = "session-source",
+        value_name = "SOURCE",
+        default_value = "vscode"
+    )]
+    session_source: String,
+
     /// Controls whether analytics are enabled by default.
     ///
     /// Analytics are disabled by default for app-server. Users have to explicitly opt in
@@ -643,12 +654,17 @@ async fn cli_main(arg0_paths: Arg0DispatchPaths) -> anyhow::Result<()> {
             None => {
                 reject_remote_mode_for_subcommand(root_remote.as_deref(), "app-server")?;
                 let transport = app_server_cli.listen;
+                let session_source = codex_protocol::protocol::SessionSource::from_startup_arg(
+                    app_server_cli.session_source.as_str(),
+                )
+                .map_err(|err| anyhow::anyhow!("invalid --session-source: {err}"))?;
                 codex_app_server::run_main_with_transport(
                     arg0_paths.clone(),
                     root_config_overrides,
                     codex_core::config_loader::LoaderOverrides::default(),
                     app_server_cli.analytics_default_enabled,
                     transport,
+                    session_source,
                 )
                 .await?;
             }
@@ -1615,6 +1631,7 @@ mod tests {
             app_server.listen,
             codex_app_server::AppServerTransport::Stdio
         );
+        assert_eq!(app_server.session_source, "vscode");
     }
 
     #[test]
@@ -1624,6 +1641,13 @@ mod tests {
         assert!(app_server.analytics_default_enabled);
     }
 
+    #[test]
+    fn app_server_session_source_accepts_custom_value() {
+        let app_server =
+            app_server_from_args(["codex", "app-server", "--session-source", "atlas"].as_ref());
+        assert_eq!(app_server.session_source, "atlas");
+    }
+
     #[test]
     fn remote_flag_parses_for_interactive_root() {
         let cli = MultitoolCli::try_parse_from(["codex", "--remote", "ws://127.0.0.1:4500"])