feat: validate official marketplace source objects

[kantorcodes]

Summary

• validate the official marketplace.json source object shape from the Codex curated marketplace spec
• require category metadata alongside installation and authentication policy
• tighten local-path safety checks and cover the new source contract in tests

Verification

• python3 -m pytest tests/test_marketplace.py -q

[gemini-code-assist]

Code Review

This pull request refactors the marketplace validation logic, simplifying the check functions and enforcing a schema that requires local sources. The review feedback identifies several missing type checks for plugin entries that could lead to runtime errors and highlights inconsistencies in success and remediation messages regarding the support for remote URLs and required fields like 'category'.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Overview

All previously reported issues have been addressed in the latest commits. The code now includes proper type checks for plugin entries in all three validation functions.

Files Reviewed (3 files)

• src/codex_plugin_scanner/checks/marketplace.py - No new issues
• tests/fixtures/with-marketplace/marketplace.json - No issues
• tests/test_marketplace.py - No issues

Resolved Issues (from previous review)

File	Line	Status
marketplace.py	119	Fixed - Type check added for plugin entries
marketplace.py	222	Fixed - Type check added for plugin entries
marketplace.py	288	Fixed - Type check added for plugin entries
marketplace.py	251	Fixed - Remediation now includes category field
marketplace.py	305	Fixed - Success message updated to match logic
marketplace.py	321	Fixed - Remediation message updated

---

_{Reviewed by minimax-m2.5-20260211 · 498,966 tokens}