diff --git a/src/commands/models/list.auth-index.ts b/src/commands/models/list.auth-index.ts
index 98846bdf130..8d86f1b66db 100644
--- a/src/commands/models/list.auth-index.ts
+++ b/src/commands/models/list.auth-index.ts
@@ -112,6 +112,10 @@ export function createModelListAuthIndex(
       addProvider(provider);
     }
   }
+  const primaryModelProvider = params.cfg.agents?.defaults?.model?.primary?.split("/", 1)[0];
+  if (primaryModelProvider === "openai-codex" || primaryModelProvider === "codex") {
+    addSyntheticProvider("codex");
+  }
 
   for (const provider of params.syntheticAuthProviderRefs ??
     listValidatedSyntheticAuthProviderRefs({
diff --git a/src/plugins/plugin-metadata-snapshot.ts b/src/plugins/plugin-metadata-snapshot.ts
index 098710db6c2..1a2ec494b9d 100644
--- a/src/plugins/plugin-metadata-snapshot.ts
+++ b/src/plugins/plugin-metadata-snapshot.ts
@@ -6,7 +6,7 @@ import {
   loadPluginManifestRegistryForInstalledIndex,
   resolveInstalledManifestRegistryIndexFingerprint,
 } from "./manifest-registry-installed.js";
-import type { PluginManifestRecord } from "./manifest-registry.js";
+import { loadPluginManifestRegistry, type PluginManifestRecord } from "./manifest-registry.js";
 import { resolvePluginControlPlaneFingerprint } from "./plugin-control-plane-context.js";
 import type {
   LoadPluginMetadataSnapshotParams,
@@ -47,6 +47,22 @@ function indexesMatch(
   );
 }
 
+function normalizeInstalledPluginIndex(index: InstalledPluginIndex): InstalledPluginIndex {
+  return {
+    version: index.version ?? 1,
+    hostContractVersion: index.hostContractVersion ?? "",
+    compatRegistryVersion: index.compatRegistryVersion ?? "",
+    migrationVersion: index.migrationVersion ?? 1,
+    policyHash: index.policyHash ?? "",
+    generatedAtMs: index.generatedAtMs ?? 0,
+    installRecords: index.installRecords ?? {},
+    plugins: index.plugins ?? [],
+    diagnostics: index.diagnostics ?? [],
+    ...(index.warning ? { warning: index.warning } : {}),
+    ...(index.refreshReason ? { refreshReason: index.refreshReason } : {}),
+  } as InstalledPluginIndex;
+}
+
 export function isPluginMetadataSnapshotCompatible(params: {
   snapshot: Pick<
     PluginMetadataSnapshot,
@@ -184,17 +200,30 @@ function loadPluginMetadataSnapshotImpl(
     env: params.env,
     ...(params.preferPersisted !== undefined ? { preferPersisted: params.preferPersisted } : {}),
     ...(params.index ? { index: params.index } : {}),
-  });
+  }) ?? {
+    source: "derived" as const,
+    snapshot: { plugins: [] },
+    diagnostics: [],
+  };
   const registrySnapshotMs = performance.now() - registryStartedAt;
-  const index = registryResult.snapshot;
+  const index = normalizeInstalledPluginIndex(registryResult.snapshot);
   const manifestStartedAt = performance.now();
-  const manifestRegistry = loadPluginManifestRegistryForInstalledIndex({
-    index,
-    config: params.config,
-    workspaceDir: params.workspaceDir,
-    env: params.env,
-    includeDisabled: true,
-  });
+  const manifestRegistry =
+    index.plugins.length === 0
+      ? loadPluginManifestRegistry({
+          config: params.config,
+          workspaceDir: params.workspaceDir,
+          env: params.env,
+          diagnostics: index.diagnostics,
+          installRecords: index.installRecords,
+        })
+      : loadPluginManifestRegistryForInstalledIndex({
+          index,
+          config: params.config,
+          workspaceDir: params.workspaceDir,
+          env: params.env,
+          includeDisabled: true,
+        });
   const manifestRegistryMs = performance.now() - manifestStartedAt;
   const normalizePluginId = createPluginRegistryIdNormalizer(index, { manifestRegistry });
   const byPluginId = new Map(manifestRegistry.plugins.map((plugin) => [plugin.id, plugin]));
diff --git a/src/plugins/plugin-registry-id-normalizer.ts b/src/plugins/plugin-registry-id-normalizer.ts
index 1d7d9dfd8e0..fe7bd72af96 100644
--- a/src/plugins/plugin-registry-id-normalizer.ts
+++ b/src/plugins/plugin-registry-id-normalizer.ts
@@ -39,6 +39,9 @@ export function createPluginRegistryIdNormalizer(
 ): (pluginId: string) => string {
   const aliases = new Map<string, string>();
   for (const plugin of index.plugins) {
+    if (!plugin.pluginId) {
+      continue;
+    }
     const pluginId = normalizePluginRegistryAlias(plugin.pluginId);
     if (pluginId) {
       aliases.set(normalizePluginRegistryAliasKey(pluginId), plugin.pluginId);
diff --git a/src/secrets/provider-env-vars.ts b/src/secrets/provider-env-vars.ts
index 2e0d6b73138..63b35337166 100644
--- a/src/secrets/provider-env-vars.ts
+++ b/src/secrets/provider-env-vars.ts
@@ -163,7 +163,10 @@ function resolveManifestProviderAuthEvidence(
   });
   const evidenceByProvider: Record<string, ProviderAuthEvidence[]> = {};
   for (const plugin of snapshot.plugins) {
-    if (!isInstalledPluginEnabled(snapshot.index, plugin.id, params?.config)) {
+    if (
+      snapshot.index.plugins.length > 0 &&
+      !isInstalledPluginEnabled(snapshot.index, plugin.id, params?.config)
+    ) {
       continue;
     }
     if (!shouldUsePluginProviderAuthEvidence(plugin, params)) {