feat: support multi-plugin Codex marketplace repos

[kantorcodes]

Summary

• add repository-mode discovery for Codex marketplace roots that declare local plugins in .agents/plugins/marketplace.json
• scan and verify each local plugin under ./plugins/... while skipping remote marketplace entries
• update the CLI, schemas, and GitHub Action docs/summary so plugin_dir: "." works for multi-plugin repos

Verification

• ./.venv/bin/ruff check .
• ./.venv/bin/ruff format --check .
• ./.venv/bin/pytest -q
• ./.venv/bin/python -m build

[gemini-code-assist]

Code Review

This pull request introduces repository-mode scanning, allowing the tool to discover and scan multiple local plugins defined in a marketplace manifest. It updates the CLI, GitHub Action, and JSON schemas to support this new scope while maintaining single-plugin compatibility. Two issues were identified in the review: a logic bug in repo_detect.py that incorrectly handles remote plugin skipping, and the accidental removal of additionalProperties: false in the findingRef schema definition.

[kilo-code-bot]

Code Review Summary

Status: No New Issues | Recommendation: Merge

Overview

No new issues identified in this review.

Notes on Existing Comments

Two existing comments were reviewed:

1. repo_detect.py:109 - Already addressed in the current code (lines 91-100 now correctly filter remote plugins before validation).
2. schemas/scan-result.v1.json:164 - The findingRef definition in the diff shows "additionalProperties": false is present at line 165, so this concern has been resolved.

Files Reviewed (14 files)

• README.md - Documentation updates for multi-plugin repo support
• action/README.md - Action documentation updates
• action/action.yml - Input description update
• schemas/scan-result.v1.json - Schema extension for repository scope
• schemas/verify-result.v1.json - Schema extension for repository scope
• src/codex_plugin_scanner/action_runner.py - CLI integration for repository mode
• src/codex_plugin_scanner/cli.py - CLI updates for repository mode
• src/codex_plugin_scanner/marketplace_support.py - Validation improvements
• src/codex_plugin_scanner/models.py - New data models for repository scanning
• src/codex_plugin_scanner/repo_detect.py - New file for repository detection
• src/codex_plugin_scanner/reporting.py - JSON output updates for repository mode
• src/codex_plugin_scanner/scanner.py - Repository scanning logic
• src/codex_plugin_scanner/verification.py - Repository verification logic
• tests/fixtures/multi-plugin-repo/ - Test fixtures

---

_{Reviewed by minimax-m2.5-20260211 · 874,126 tokens}