Read cached metadata for installed Git plugins

[xli-oai]

Summary

• Populate plugin/list interface metadata for installed Git-sourced marketplace plugins from the active cached plugin bundle.
• Preserve marketplace category precedence so list behavior matches plugin/read.
• Keep existing fallback behavior when the cache or manifest is missing or invalid.

Test Plan

• cd codex-rs && just fmt
• cd codex-rs && cargo test -p codex-core-plugins list_marketplaces_installed_git_source_reads_metadata_from_cache_without_cloning
• cd codex-rs && cargo test -p codex-app-server plugin_list_returns_installed_git_source_interface_from_cache
• cd codex-rs && just fix -p codex-core-plugins
• cd codex-rs && just fix -p codex-app-server
• git diff --check

Server-truth check: OpenAI monorepo app-server generated types already expose PluginSummary.interface, and the webview consumes it for plugin cards. This PR keeps the protocol/schema unchanged and fills the existing field from the cached installed bundle for Git-backed cross-repo plugins.

[xli-oai]

@codex review

[xli-oai]

Note on the small installed / enabled diff in list_marketplaces_for_config:

This does not remove the behavior. The previous code computed the values inline when building ConfiguredMarketplacePlugin:

installed: installed_plugins.contains(&plugin_key),
enabled: enabled_plugins.contains(&plugin_key),

The PR hoists those exact same checks into local variables because the new cached-metadata path needs installed before the struct is built:

let installed = installed_plugins.contains(&plugin_key);
let enabled = enabled_plugins.contains(&plugin_key);

if installed && matches!(&plugin.source, MarketplacePluginSource::Git { .. }) {
    // read active cached plugin root and use its plugin.json interface metadata
}

Then the struct gets the same values:

installed,
enabled,

Concrete example: for toolkit@debug, installed is still exactly installed_plugins.contains("toolkit@debug"), and enabled is still exactly enabled_plugins.contains("toolkit@debug"). The only behavior change is that installed Git-sourced plugins can use cached bundle metadata for interface before the list entry is returned.

id: plugin_key.clone() became id: plugin_key because plugin_key is not used after the struct is created, so moving it avoids an unnecessary clone without changing the duplicate-source behavior described by the existing comment.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[xli-oai]

we display remote plugin detail iff plugin is:

1. installed
2. marketplace is git backed
3. plugin root is valid
4. plugin manifest exists

[xli-oai]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Chef's kiss.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".