Hosted Marketplace Feed Stack

This is PR7 in the hosted marketplace feed stack. The stack should land in order, with maintainer review at each step before the later PRs wire hosted marketplace data into broader user flows.

1. Refactor external plugin catalog toward feeds #95846: refactor the bundled external plugin catalog toward the feed-shaped data model.
2. Add hosted external catalog feed loader #95868: add the lazy hosted marketplace feed loader for the configured public feed URL, with guarded HTTPS fetch, checksum, schema, size, timeout, and bundled fallback behavior.
3. Add hosted catalog snapshot fallback #95877: add accepted hosted snapshot fallback so a failed or unchanged hosted fetch can reuse the last valid feed payload.
4. Persist hosted catalog snapshots in state #95964: persist hosted marketplace feed snapshots in OpenClaw state.
5. Add hosted catalog source profile validation #95969: add marketplace source profile validation for hosted feed install candidates.
6. Add hosted catalog config profiles #95981: add configurable marketplaces.feeds and marketplaces.sources profiles.
7. Add marketplace feed refresh command #96155: add openclaw plugins marketplace refresh as the explicit manual snapshot refresh path.
8. Add marketplace feed entries command #96158: add openclaw plugins marketplace entries as the explicit manual read path over hosted, snapshot, or bundled fallback entries.
9. Add marketplace feed telemetry #96194: add marketplace feed telemetry.

The broader follow-up after this stack is to decide whether and how marketplace entries should feed install/search/startup behavior, add automatic conditional refresh using ETag / Last-Modified, or move to ClawHub producer-side validation for /v1/feeds/plugins and /v1/feeds/skills.

Summary

Adds openclaw plugins marketplace refresh, a manual activation slice for the hosted marketplace feed stack. The command reads config.marketplaces, calls the configured hosted external plugin catalog loader, writes the accepted snapshot, and reports whether the accepted catalog came from the hosted feed, the last-known-good snapshot, or bundled fallback.

This gives maintainers a safe way to exercise the live https://clawhub.ai/v1/feeds/plugins path and any locally configured marketplaces.feeds profile without changing startup, onboarding, doctor, install, search, or provider-repair behavior yet.

What Changed

• Adds plugins marketplace refresh with:
  • --feed-profile <name> for a configured marketplace feed profile.
  • --feed-url <url> for the existing guarded explicit hosted URL path.
  • --expected-sha256 <hash> for checksum-pinned refresh checks.
  • --json for automation-friendly source/feed/metadata output.
• Keeps the command lazy-loaded with the existing plugin runtime boundary.
• Reports hosted, hosted-snapshot, and bundled-fallback results.
• Fails checksum-pinned refreshes when the accepted result is not a fresh hosted payload, so automation cannot silently accept bundled fallback after a checksum mismatch.
• Normalizes bare and prefixed SHA-256 pins to the loader checksum format.
• Rejects explicit hosted feed URLs with credentials, query strings, or fragments before fetch/snapshot persistence.
• Keeps direct default ClawHub URL refresh behavior aligned with the default profile, while requiring manifest sourceRef for non-default direct feed URLs.
• Updates the plugin CLI reference docs for plugins marketplace refresh.
• Adds focused tests for CLI routing, refresh output, fallback reporting, redacted feed URL output, checksum normalization, URL rejection, source-ref enforcement, and pinned-refresh failure.

Validation

• pnpm exec oxfmt --check src/cli/plugins-cli.runtime.ts src/cli/plugins-cli.marketplace-refresh.test.ts src/plugins/official-external-plugin-catalog.ts src/plugins/official-external-plugin-catalog.test.ts docs/cli/plugins.md
• pnpm exec oxlint --deny-warnings src/cli/plugins-cli.runtime.ts src/cli/plugins-cli.marketplace-refresh.test.ts src/plugins/official-external-plugin-catalog.ts src/plugins/official-external-plugin-catalog.test.ts
• git diff --check
• $env:CI='1'; node scripts/test-projects.mjs src/cli/plugins-cli.lazy.test.ts src/cli/plugins-cli.marketplace-refresh.test.ts src/plugins/official-external-plugin-catalog.test.ts (8 CLI refresh/lazy tests and 51 catalog tests passed)
• pnpm docs:check-mdx
• pnpm tsgo:core
• codex review --base origin/main (no actionable correctness issues)

Note: pnpm format:docs:check still fails on this Windows host before checking this file because the repo-wide docs formatter builds an oxfmt command line that exceeds the Windows command-line length limit. The targeted oxfmt --check docs/cli/plugins.md and pnpm docs:check-mdx passed.

Real behavior proof

Behavior or issue addressed:
openclaw plugins marketplace refresh is the first manual activation path for hosted marketplace feeds. It accepts a fresh hosted payload and writes the accepted snapshot without enabling install/search/startup consumption.

Real environment tested:
Windows checkout C:\src\openclaw-prflow\.worktrees\pr-96155 at pushed PR7 head 1614070e92 (runtime proof path unchanged from 034ab82b95; current head adds docs-only refresh-behavior clarification), source CLI runtime harness via node --import tsx, isolated state dir C:\tmp\openclaw-feeds-proof\pr96155-refresh-034ab82, live HTTPS request to https://clawhub.ai/v1/feeds/plugins.

Exact steps or command run after this patch:

1. Set runtime config snapshot with marketplaces.feeds.clawhub-public.url = https://clawhub.ai/v1/feeds/plugins.
2. Set source profiles public-clawhub.type = clawhub and public-npm.type = npm.
3. Ran runPluginMarketplaceRefreshCommand({ feedProfile: "clawhub-public", json: true }).
4. Reused the same OPENCLAW_STATE_DIR and called loadConfiguredHostedOfficialExternalPluginCatalogEntries(config, { feedProfile: "clawhub-public", offline: true }) to verify the refresh wrote a durable snapshot.

Evidence after fix:

{
  "source": "hosted",
  "entries": 59,
  "metadata": {
    "url": "https://clawhub.ai/v1/feeds/plugins",
    "status": 200,
    "etag": "\"sha256:76a49aad745fe828c7f88b5a870ad67b5953c5235b4c928b1d6189584b257b63-gzip\"",
    "lastModified": "Sun, 28 Jun 2026 12:47:16 GMT",
    "checksum": "sha256:76a49aad745fe828c7f88b5a870ad67b5953c5235b4c928b1d6189584b257b63"
  },
  "feed": {
    "id": "clawhub-official",
    "generatedAt": "2026-06-28T12:47:09.109Z",
    "sequence": 19
  }
}

Offline snapshot verification from the same state dir:

{
  "proofHead": "034ab82b95",
  "stateDir": "C:\\tmp\\openclaw-feeds-proof\\pr96155-refresh-034ab82",
  "offlineSource": "hosted-snapshot",
  "offlineEntries": 59,
  "offlineFeed": {
    "id": "clawhub-official",
    "sequence": 19
  },
  "offlineChecksum": "sha256:76a49aad745fe828c7f88b5a870ad67b5953c5235b4c928b1d6189584b257b63"
}

Observed result after fix:
The refresh command accepted the live hosted ClawHub payload, reported source: hosted, returned 59 entries, and persisted a snapshot that the loader could read back offline from the same state directory.

What was not tested:
This proof does not install plugins from the refreshed feed. Installation, search, startup consumption, feed auth, and signed-feed enforcement are later slices.