[codex] Add cross-repo plugin sources to marketplace manifests

[xli-oai]

Summary

• add first-class marketplace support for git-backed plugin sources
• keep the newer marketplace parsing behavior from main, including alternate manifest locations and string local sources
• materialize remote plugin sources during install, detail reads, and non-curated cache refresh
• expose git plugin source metadata through the app-server protocol

Details

This teaches the marketplace parser to accept all of the following:

• local string sources such as "source": "./plugins/foo"
• local object sources such as {"source":"local","path":"./plugins/foo"}
• remote repo-root sources such as {"source":"url","url":"https://github.com/org/repo.git"}
• remote subdir sources such as {"source":"git-subdir","url":"owner/repo","path":"plugins/foo","ref":"main","sha":"..."}

It also preserves the newer tolerant behavior from main: invalid or unsupported plugin entries are skipped instead of breaking the whole marketplace.

Validation

• cargo test -p codex-core plugins::marketplace::tests
• just fix -p codex-core
• just fmt

Notes

• A full cargo test -p codex-core run still hit unrelated existing failures in agent and multi-agent tests during this session; the marketplace-focused suite passed after the rebase resolution.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 03cb3e141f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Resolve relative git URLs from marketplace root

normalize_git_plugin_source_url allows ./ and ../ git URLs, but clone_git_plugin_source executes git clone with cwd set to None. That makes relative URLs resolve from the process working directory instead of the marketplace file's root, so installs/detail reads can clone the wrong repo or fail whenever cwd differs.

Useful? React with 👍 / 👎.

[xl-openai]

Could be a follow up PR but we need to deal with the actual loading of those plugins.

[xli-oai]

Could be a follow up PR but we need to deal with the actual loading of those plugins.

Yes! 👍