fix(codex): treat a literal null from the CLI as an empty list, not a 500

server/__tests__/codex-cli.test.js

@@ -321,6 +321,19 @@ describe("codex-cli run outcomes", () => {
     }
   });
 
+  it("treats a literal `null` on stdout as an empty list, not a crash", async () => {
+    // `null` is valid JSON, so it parses and slips past the unparseable-output
+    // guard. Reading `.installed` off it would surface as a 500 from a route
+    // whose whole contract is that CLI output never produces one.
+    const restore = stubCodex("echo null");
+    try {
+      assert.deepEqual((await cli.pluginList()).data, []);
+      assert.deepEqual((await cli.marketplaceList()).data, []);
+    } finally {
+      restore();
+    }
+  });
+
   it("unwraps `codex plugin marketplace list --json`'s {marketplaces} object into a bare array", async () => {
     const restore = stubCodex(`cat <<'JSON'\n{"marketplaces":[{"name":"sg"}]}\nJSON`);
     try {

server/lib/codex-cli.js

@@ -258,8 +258,10 @@ async function mcpRemove(name) {
  */
 async function pluginList() {
   const result = await runCodex(["plugin", "list", "--json"]);
+  // `data` is null when stdout was the literal `null` — JSON that parses to
+  // nothing. Guard it: a CLI's output must never reach the route as a 500.
   if (result.data !== undefined && !Array.isArray(result.data)) {
-    result.data = Array.isArray(result.data.installed) ? result.data.installed : [];
+    result.data = Array.isArray(result.data?.installed) ? result.data.installed : [];
   }
   return result;
 }
@@ -283,7 +285,7 @@ async function pluginRemove(spec) {
 async function marketplaceList() {
   const result = await runCodex(["plugin", "marketplace", "list", "--json"]);
   if (result.data !== undefined && !Array.isArray(result.data)) {
-    result.data = Array.isArray(result.data.marketplaces) ? result.data.marketplaces : [];
+    result.data = Array.isArray(result.data?.marketplaces) ? result.data.marketplaces : [];
   }
   return result;
 }