Correct plugin sources in marketplace.json

[opwvhk]

Summary

According to Clause documentation1, there is no local source type. Instead, we should use the path directly.

When using this structure with GitHub Copilot, it works.

Type of change

• Skill change (.claude/skills/<name>/) — eval fixtures updated below
• Tool / bridge contract (tools/<system>/*.md)
• Python package (tools/*/ with pyproject.toml)
• Groovy reference impl
• Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
• Documentation (docs/, README.md, CONTRIBUTING.md)
• Project template (projects/_template/)
• CI / dev loop (prek, workflows, validators)
• Other: Marketplace

Test plan

Before the change:

• installing via Jetbrains seems to work, but plugins are not available
• installing via GitHub Copilot CLI fails

After the change:

• installing via Jetbrains to works, and plugins are available
• installing via GitHub Copilot CLI succeeds

• prek run --all-files passes
• For Python packages touched: uv run pytest / ruff check / mypy passes
• For Groovy bridges touched: command-line invocation tested end-to-end
• For skill changes: eval suite passes for the affected skill
  (PYTHONPATH=tools/skill-evals/src python3 -m skill_evals.runner tools/skill-evals/evals/<skill>/)
• For skill behaviour changes: a new or updated eval fixture is included in this PR
  (a regression test for the bug fixed / the behaviour added — see CONTRIBUTING.md)
• Other:

RFC-AI-0004 compliance

• HITL — any new mutation is gated on explicit user confirmation
• Sandbox — no new unrestricted host access; network reach declared in the adapter
• Vendor neutrality — placeholders (<PROJECT>, <tracker>, <upstream>, <security-list>) used in all skill / tool prose (the check-placeholders prek hook is the mechanical gate)
• Conversational + correctable — agentic-override path documented if behaviour is adopter-tunable
• Write-access discipline — no autonomous outbound messages; drafts only, sent on confirmation
• Privacy LLM — private content does not reach a non-approved LLM; redactor invoked where needed

Linked issues

Fixes #1621

Notes for reviewers (optional)

Please read the related documentation. By using docs from another source than where the fix is tested, vendor neutrality should be ensured.

[potiuk]

LGTM. The {"source": "local", "path": …} object is the Codex catalog shape. The root catalog that Copilot reads takes a relative path string, which is also what check-family-plugins.py --fix already writes into .claude-plugin/marketplace.json. Leaving .agents/plugins/marketplace.json on the object form is also correct, since that is the file Codex reads.

Smaller observations

• tools/dev/check-family-plugins.py should check that each catalog uses the right format for its client, not just that the plugin names match. check_client_catalogs() only compares names today, which is how the Codex shape got into the Copilot catalog unnoticed. A check that every entry in the root marketplace.json has a "./plugins/<name>" string source would catch the next copy in prek rather than on someone's install. A follow-up PR is fine.
• docs/setup/marketplace.md:734 still says the root marketplace.json is "Not yet live-installed". Your test plan is the first live install, so that row can be updated too.

---

This review was drafted by an AI-assisted tool and
confirmed by an Apache Magpie maintainer. The maintainer
approving this PR has read the findings and signed off. If
something feels off, please reply on the PR and a maintainer
will follow up.

More on how Apache Magpie handles maintainer review:
Contributing guide.