Hosted Marketplace Feed Stack

This is PR6 in the hosted marketplace feed stack. The stack should land in order, with maintainer review at each step before the later PRs wire hosted marketplace data into broader user flows.

1. Refactor external plugin catalog toward feeds #95846: refactor the bundled external plugin catalog toward the feed-shaped data model.
2. Add hosted external catalog feed loader #95868: add the lazy hosted marketplace feed loader for the configured public feed URL, with guarded HTTPS fetch, checksum, schema, size, timeout, and bundled fallback behavior.
3. Add hosted catalog snapshot fallback #95877: add accepted hosted snapshot fallback so a failed or unchanged hosted fetch can reuse the last valid feed payload.
4. Persist hosted catalog snapshots in state #95964: persist hosted marketplace feed snapshots in OpenClaw state.
5. Add hosted catalog source profile validation #95969: add marketplace source profile validation for hosted feed install candidates.
6. Add hosted catalog config profiles #95981: add configurable marketplaces.feeds and marketplaces.sources profiles.
7. Add marketplace feed refresh command #96155: add openclaw plugins marketplace refresh as the explicit manual snapshot refresh path.
8. Add marketplace feed entries command #96158: add openclaw plugins marketplace entries as the explicit manual read path over hosted, snapshot, or bundled fallback entries.
9. Add marketplace feed telemetry #96194: add marketplace feed telemetry.

The broader follow-up after this stack is to decide whether and how marketplace entries should feed install/search/startup behavior, add automatic conditional refresh using ETag / Last-Modified, or move to ClawHub producer-side validation for /v1/feeds/plugins and /v1/feeds/skills.

Summary

This is PR6 in the hosted feeds stack. It wires the local OpenClaw config surface for marketplace feed profiles and local package source profiles, then adds a small bridge so the hosted external plugin catalog loader can consume config.marketplaces instead of taking only ad hoc in-memory profile config.

This sits on PR5's live ClawHub defaults: clawhub-public points at https://clawhub.ai/v1/feeds/plugins, public-clawhub represents ClawHub candidates, and public-npm remains available for npm-backed candidates. The config schema examples use that shape so reviewers can see how tenant or organization marketplace profiles would extend the same model.

Source profiles intentionally carry only a local source name and type in this slice; registry/base URL endpoints are rejected until installer resolution can enforce them. Feed profile URLs are also plain HTTPS URLs only: credentials, query strings, and fragments are rejected while feed auth/SecretRef support is not implemented.

This update also addresses Patrick's naming/API-shape feedback by using marketplace terminology for the persisted config surface: marketplaces.feeds and marketplaces.sources, rather than catalog.feeds and catalog.sources.

This intentionally does not implement product activation of configured feeds, feed refresh scheduling, feed auth execution, signed feed verification, or installer registry switching. Auth and signed verification are rejected by this config schema until the corresponding loader/envelope enforcement exists. The purpose of this PR is to make the RFC's local ownership model concrete: feeds and sources are local config, while remote feed entries can only refer to configured source names.

What Changed

• Adds marketplaces.feeds and marketplaces.sources config types and Zod schema validation.
• Supports the concrete local fields used by this stack today: plain HTTPS feed URL, unsigned verification opt-in, and npm/ClawHub/Git source profile names/types.
• Rejects feed auth, URL credentials/query/fragments, signed verification config, and source endpoint fields for now so users cannot configure security or installer contracts the loader does not yet enforce.
• Adds config labels/help so the new section appears coherently in generated schema/docs surfaces.
• Adds loadConfiguredHostedOfficialExternalPluginCatalogEntries(...) as the bridge from OpenClaw config to the hosted catalog loader introduced by the earlier stack.

Validation

• pnpm exec oxfmt src/config/schema.help.ts src/config/schema.labels.ts src/config/types.marketplaces.ts src/config/types.openclaw.ts src/config/types.ts src/config/zod-schema.marketplaces.test.ts src/config/zod-schema.ts src/plugins/official-external-plugin-catalog.ts src/plugins/official-external-plugin-catalog.test.ts scripts/plugin-sdk-surface-report.mjs
• pnpm exec oxlint --deny-warnings src/config/schema.help.ts src/config/schema.labels.ts src/config/types.marketplaces.ts src/config/types.openclaw.ts src/config/types.ts src/config/zod-schema.marketplaces.test.ts src/config/zod-schema.ts src/plugins/official-external-plugin-catalog.ts src/plugins/official-external-plugin-catalog.test.ts scripts/plugin-sdk-surface-report.mjs
• CI=1 node scripts/test-projects.mjs src/plugins/official-external-plugin-catalog.test.ts src/config/zod-schema.marketplaces.test.ts (10 marketplace schema tests, 45 hosted catalog/plugin tests)
• node scripts/plugin-sdk-surface-report.mjs --check
• node scripts/run-vitest.mjs run --config test/vitest/vitest.tooling.config.ts --reporter=verbose test/scripts/plugin-sdk-surface-report.test.ts (8 tests passed after one transient rerun)
• pnpm tsgo:core:test
• pnpm tsgo:core
• pnpm config:docs:gen and pnpm config:docs:check (docs/.generated/config-baseline.sha256 updated)
• git diff --check origin/main...HEAD and git diff --check
• GitHub required checks on head ef4d81cd08: pass/skip only
• codex review --base origin/main (no actionable correctness issues before the URL hardening; ClawSweeper then requested the plain-URL hardening now included)

Real behavior proof

Behavior or issue addressed:
OpenClaw config can provide a named hosted marketplace feed profile and local source profiles, and the hosted loader uses that config.marketplaces bridge to load the live ClawHub feed.

Real environment tested:
Windows checkout C:\src\openclaw-prflow\.worktrees\pr-95981 at pushed PR6 head ef4d81cd08, source harness via node --import tsx, live HTTPS request to https://clawhub.ai/v1/feeds/plugins.

Exact steps or command run after this patch:

1. Set OpenClaw config with marketplaces.feeds.clawhub.url = https://clawhub.ai/v1/feeds/plugins.
2. Set source profiles public-clawhub.type = clawhub and public-npm.type = npm.
3. Ran loadConfiguredHostedOfficialExternalPluginCatalogEntries(config, { feedProfile: "clawhub", snapshotStore: null }).
4. Resolved the sample entry through resolveOfficialExternalPluginInstall(entry, { catalogConfig: config.marketplaces }).
5. Final stack validation passed formatter, lint, focused tests, tsgo:core:test, tsgo:core, git diff --check, GitHub required checks, and Codex review.

Evidence after fix:

{
  "head": "ef4d81cd08",
  "resultSource": "hosted",
  "metadata": {
    "url": "https://clawhub.ai/v1/feeds/plugins",
    "status": 200,
    "etag": "\"sha256:76a49aad745fe828c7f88b5a870ad67b5953c5235b4c928b1d6189584b257b63-gzip\"",
    "lastModified": "Sun, 28 Jun 2026 12:47:16 GMT",
    "checksum": "sha256:76a49aad745fe828c7f88b5a870ad67b5953c5235b4c928b1d6189584b257b63"
  },
  "entryCount": 59,
  "feed": {
    "id": "clawhub-official",
    "sequence": 19
  },
  "firstEntry": {
    "id": "@expediagroup/expedia-openclaw",
    "install": {
      "clawhubSpec": "clawhub:@expediagroup/[email protected]",
      "defaultChoice": "clawhub",
      "expectedIntegrity": "sha256-s1XdoEQDvsqri7qwaf0eewV4Ji50WeWYzFsZYVtb2rk="
    }
  }
}

Observed result after fix:
The configured marketplaces feed profile loaded the live hosted feed as hosted, validated configured source refs, and produced 59 entries. The sample ClawHub entry resolves to a ClawHub install spec and expected ClawHub artifact integrity, with no npm install spec emitted for that ClawHub-source candidate.

What was not tested:
Signed-feed enforcement and authenticated private feed profiles are intentionally later slices.