feat: support product-scoped plugins. (#15041)

1. Added SessionSource::Custom(String) and --session-source.
  2. Enforced plugin and skill products by session_source.
  3. Applied the same filtering to curated background refresh.

codex-rs/app-server/src/main.rs

@@ -4,6 +4,7 @@ use codex_app_server::run_main_with_transport;
 use codex_arg0::Arg0DispatchPaths;
 use codex_arg0::arg0_dispatch_or_else;
 use codex_core::config_loader::LoaderOverrides;
+use codex_protocol::protocol::SessionSource;
 use codex_utils_cli::CliConfigOverrides;
 use std::path::PathBuf;
 
@@ -21,6 +22,15 @@ struct AppServerArgs {
         default_value = AppServerTransport::DEFAULT_LISTEN_URL
     )]
     listen: AppServerTransport,
+
+    /// Session source used to derive product restrictions and metadata.
+    #[arg(
+        long = "session-source",
+        value_name = "SOURCE",
+        default_value = "vscode",
+        value_parser = SessionSource::from_startup_arg
+    )]
+    session_source: SessionSource,
 }
 
 fn main() -> anyhow::Result<()> {
@@ -32,6 +42,7 @@ fn main() -> anyhow::Result<()> {
             ..Default::default()
         };
         let transport = args.listen;
+        let session_source = args.session_source;
 
         run_main_with_transport(
             arg0_paths,
@@ -39,6 +50,7 @@ fn main() -> anyhow::Result<()> {
             loader_overrides,
             /*default_analytics_enabled*/ false,
             transport,
+            session_source,
         )
         .await?;
         Ok(())