fix(install): preserve codex plugin registrations during sync

scripts/lib/manifest.ps1

@@ -77,6 +77,18 @@ function Sync-ManagedDestination {
         } else {
             $newBytes = [System.IO.File]::ReadAllBytes($_.FullName)
         }
+        if ($relative -eq 'config.toml' -and (Test-Path -LiteralPath $target)) {
+            $localConfig = [System.IO.File]::ReadAllText($target)
+            $pluginTables = [regex]::Matches($localConfig, '(?m)^[ \t]*\[(?:plugins|marketplaces)(?:\.|\])[\s\S]*?(?=^[ \t]*\[|\z)')
+            if ($pluginTables.Count -gt 0) {
+                $content = [System.Text.Encoding]::UTF8.GetString($newBytes).TrimEnd([char[]]"`r`n")
+                if ($content -match '(?m)^[ \t]*\[(?:plugins|marketplaces)(?:\.|\])') {
+                    throw 'Cannot overwrite local plugin configuration with generated plugin tables.'
+                }
+                $preserved = ($pluginTables | ForEach-Object { $_.Value.TrimEnd([char[]]"`r`n") }) -join "`n"
+                $newBytes = [System.Text.Encoding]::UTF8.GetBytes("$content`n`n$preserved`n")
+            }
+        }
         $newHash = Get-Sha256HashOfBytes $newBytes
         $newManifest[$relative] = $newHash
 

scripts/lib/manifest.sh

@@ -78,6 +78,22 @@ sync_managed_destination() {
     else
       new_hash=$(sha256_of_file "$source_file")
     fi
+    if [ "$relative" = config.toml ] && [ -f "$target" ]; then
+      local plugin_tables
+      plugin_tables=$(awk '
+        /^[ \t]*\[/ { preserve = ($0 ~ /^[ \t]*\[(plugins|marketplaces)(\.|\])/) }
+        preserve { print }
+      ' "$target")
+      if [ -n "$plugin_tables" ]; then
+        if printf '%s\n' "$content" | grep -Eq '^[[:blank:]]*\[(plugins|marketplaces)(\.|\])'; then
+          printf 'Cannot overwrite local plugin configuration with generated plugin tables.\n' >&2
+          return 1
+        fi
+        content="$content"$'\n\n'"$plugin_tables"$'\n'
+        needs_sub=true
+        new_hash=$(sha256_of_string "$content")
+      fi
+    fi
     new_manifest[$relative]=$new_hash
 
     exists=false