[plugin] build updated openai package with deployment card guidance

[joshuasoup]

why

The OpenAI plugin needs to be generated from the current upstream source, while retaining its submission adaptations. The published skills also do not explain when to use the new live deployment card or how its connection can differ from the Vercel connector.

what changed

Add bun run build:openai to generate the plugin directory and submission ZIP from this repository. This is internal submission tooling; the main README stays unchanged. openai/ holds the manifest, display metadata, one shared branding image, package readme, and content adaptations. Runtime skills and workflow references come from the normal source tree.

The build excludes unsupported skills, hooks, app manifests, and authoring files. It derives the version from package.json, regenerates workflow references from the adapted skills, and produces a deterministic ZIP. Conflicting adaptations fail the build while preserving the last successful artifact. CI builds and uploads the ZIP after tests pass.

Sync the latest upstream, including OpenCode support and the build:all rename. OpenAI-only deployment, CLI, and knowledge guidance now routes visual requests to open_deployments, explains its current inputs, card refreshes and expandable build logs, and keeps data analysis and runtime logs on their dedicated tools. It explains availability, separate provider authentication, and truthful fallback behavior. Normal client skills and hooks are unchanged by these adaptations.

how it was tested

• Generated-file check, full build, typecheck, skill validation, and all 1,083 tests passed locally.
• Packaging tests verify widget retrieval metadata, generated guidance, and unchanged source skills, as well as ZIP extraction, deterministic output, source updates, conflict handling, and new-skill metadata checks.
• Generated 33 skills and 201 files with valid relative Markdown links. OpenAI submission adaptations are retained; unused images are excluded.
• Read the current mcp ui and deployment-test Codex chats and checked the live tool schema. A live open_deployments call on the sandbox project returned its READY deployment, URL, and commit. This confirms the tool response; native card rendering was not verified in this run.
• The ZIP has not been submitted or published to OpenAI. GitHub CI passed; downloaded the updated artifact and verified its ZIP bytes exactly match the local build.

---

Update (@molebox)

Merged main and fixed the review findings.

• Metadata for new skills: added skillInterfaces for daemons and vercel-flags, which are now on main and were breaking build:openai. The build ignores entries for skills that don't exist yet, so vercel-tracing ([skills] Add vercel-tracing skill #336) and offload-to-sandbox ([skills] Add offload-to-sandbox skill #326) are pre-added, and a test pins that behaviour. With both PRs merged in, the build produced 37 skills and the patch applied.
• Tests: removed the hard-coded counts (33 skills, 201 files). The expected skill list now comes from the skill directories on disk, and every runtime file must be in the ZIP. New tests check that overlong or ...-truncated descriptions fail the build.
• content.patch: regenerated against current main. Only the knowledge-update hunk was broken. The patched text uses only vercel inspect <url> and vercel inspect <url> --logs.
• Codex limits: short_description must be 25–64 characters (openai/codex openai_yaml.md and skill-creator validation). Every description is rewritten to be complete and within range, and the build now fails rather than truncating. "Edge Functions" is removed from vercel-functions. Display names fixed ("Chat SDK", "Vercel CLI", "Deployments & CI/CD", "AI SDK", "Workflow SDK").
• excludedSkills: emptied. All six entries were already deleted from main ([skills] Remove the Next.js framework skills in favor of Next.js's bundled docs #282, [skills] remove shadcn and next-forge #291).
• Manifest: author and developer changed to "Vercel" (matching .claude-plugin and .cursor-plugin), and the edge-functions keyword removed. .codex-plugin/plugin.json is kept. OpenAI now recommends a root plugin.json with the Agent Plugins $schema and treats .codex-plugin as a compatibility fallback, which is worth deciding before submission.
• CLAUDE.md: added a build:openai Quick Reference entry and an "OpenAI Package" section covering per-skill metadata and how to refresh content.patch.
• Verified: the Vercel MCP tool names and parameters match the docs. Kept _vercel_jwt as the bypass cookie name, based on agent-browser's protected-deployments skill and @vercel/firewall.
• Not verified: the cookie's Secure flag (needs a live bypass secret), and whether OpenAI accepts the ZIP.

Checks: build:openai (35 skills, 206 files), build:*:check, validate, and bun run test (1125 pass).

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github/​actions/​upload-artifact@​ea165f8d65b6e75b540449e92b4886f43607fa02

View full report