Add marketplace feed entries command by giodl73-repo · Pull Request #96158 · openclaw/openclaw

giodl73-repo · 2026-06-23T17:05:42Z

## Hosted Marketplace Feed StackThis is PR8 in the hosted marketplace feed stack. The stack should land in order, with maintainer review at each step before later PRs wire hosted marketplace data into broader user flows.1. #95846: refactor the bundled external plugin catalog toward the feed-shaped data model.2. #95868: add the lazy hosted marketplace feed loader for the configured public feed URL, with guarded HTTPS fetch, checksum, schema, size, timeout, and bundled fallback behavior.3. #95877: add accepted hosted snapshot fallback so a failed or unchanged hosted fetch can reuse the last valid feed payload.4. #95964: persist hosted marketplace feed snapshots in OpenClaw state.5. #95969: add marketplace source profile validation for hosted feed install candidates.6. #95981: add configurable `marketplaces.feeds` and `marketplaces.sources` profiles.7. #96155: add `openclaw plugins marketplace refresh` as the explicit manual snapshot refresh path.8. #96158: add `openclaw plugins marketplace entries` as the explicit manual read path over hosted, snapshot, or bundled fallback entries.9. #96194: add marketplace feed telemetry.## SummaryAdds `openclaw plugins marketplace entries`, an explicit read path over the configured OpenClaw marketplace feed. The command lists normalized entries and reports whether they came from a fresh hosted payload, an accepted hosted snapshot, or bundled fallback data.## What Changed- Adds `plugins marketplace entries` with `--feed-profile`, `--feed-url`, `--offline`, and `--json`.- Normalizes listed entries into id, label, kind, package/version, and install metadata.- Reuses the hosted catalog loader offline mode so callers can read the latest accepted snapshot without fetching the feed.- Updates plugin CLI docs and lazy CLI dispatch coverage.- Adds focused entries-command tests for parser dispatch, JSON output, redacted feed URLs, bundled fallback output, and offline snapshot behavior.## ValidationPrepared head: `1289a25156` rebased onto current `main`; includes the ClawSweeper-requested docs coverage for entries `--feed-profile` and `--feed-url`.- `pnpm exec oxfmt --check docs/cli/plugins.md src/cli/plugins-cli.ts src/cli/plugins-cli.runtime.ts src/cli/plugins-cli.lazy.test.ts src/cli/plugins-cli.marketplace-entries.test.ts`- `pnpm exec oxlint --deny-warnings src/cli/plugins-cli.ts src/cli/plugins-cli.runtime.ts src/cli/plugins-cli.lazy.test.ts src/cli/plugins-cli.marketplace-entries.test.ts`- `$env:CI='1'; node scripts/test-projects.mjs src/cli/plugins-cli.lazy.test.ts src/cli/plugins-cli.marketplace-entries.test.ts`- `pnpm tsgo:core`- `pnpm docs:check-mdx`- `git diff --check`- `codex review --base origin/main`Codex review reported no actionable correctness issues.## Real Behavior ProofBehavior tested at `1289a25156`: offline entries reads through the runtime command without a hosted fetch and renders normalized bundled fallback entries.Real environment: Windows checkout `C:\src\openclaw-prflow\.worktrees\pr-96158`, isolated `OPENCLAW_HOME=%TEMP%\openclaw-pr96158-proof`, source runtime via `node --import tsx`.Command:```bashnode --import tsx -e "const runtime = await import('./src/cli/plugins-cli.runtime.ts'); await runtime.runPluginMarketplaceEntriesCommand({ offline: true, json: true });"```Observed excerpt:```json{ "source": "bundled-fallback", "error": "hosted catalog feed offline mode", "entryCount": 74, "entries": [ { "label": "WeCom", "id": "wecom-openclaw-plugin", "kind": "channel", "name": "@wecom/wecom-openclaw-plugin", "install": { "npmSpec": "@wecom/[email protected]" } } ]}```What was not tested: this proof intentionally uses offline bundled fallback mode, not a fresh hosted request. Fresh hosted refresh is covered by #96155.

clawsweeper · 2026-06-24T01:34:59Z

Codex review: needs maintainer review before merge. Reviewed June 28, 2026, 5:07 PM ET / 21:07 UTC.

Summary
The PR adds openclaw plugins marketplace entries with feed profile, feed URL, offline, and JSON options, normalized feed entry output, docs, lazy dispatch coverage, and focused tests.

PR surface: Source +125, Tests +224, Docs +12. Total +361 across 5 files.

Reproducibility: not applicable. this is a feature PR, not a current-main bug report. Current main and v2026.6.10 do not provide plugins marketplace entries, and the PR body includes after-fix terminal output for the offline JSON path.

Review metrics: 1 noteworthy metric.

CLI surface added: 1 command added, 4 options added. The command and options become a documented automation contract after release, so maintainers should review the surface deliberately.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

none.

Risk before merge

[P1] Merging creates a documented CLI command plus JSON/text output shape that users or automation may script against after release; maintainers should explicitly accept that public contract.

Maintainer options:

Accept the entries CLI contract (recommended)
A maintainer can accept the new command, options, and JSON/text output as the intended public scripting surface once the normal merge gates are green.
Pause or narrow the public surface
If maintainers do not want this hosted-feed read surface public yet, keep the PR paused or ask for a narrower hidden/internal path before merge.

Next step before merge

[P2] The protected maintainer label and new documented CLI/output surface require human acceptance, not an automated repair PR.

Security
Cleared: The diff adds a CLI read/list surface over the existing guarded hosted-feed loader and redaction helpers, with no new dependency, workflow, lockfile, secret, or code-execution surface.

Review details

Best possible solution:

Land only after maintainers accept the entries command, options, and output shape as intentional public CLI surface, leaving telemetry to #96194 and broader activation to later work.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a feature PR, not a current-main bug report. Current main and v2026.6.10 do not provide plugins marketplace entries, and the PR body includes after-fix terminal output for the offline JSON path.

Is this the best way to solve the issue?

Yes, pending maintainer acceptance: the implementation reuses the existing hosted catalog loader, redaction helper, source-profile validation, and install resolver instead of creating a parallel marketplace reader. The remaining question is product/API acceptance of the new CLI/output contract.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 686a2876c7f4.

Label changes

Label justifications:

P2: This is a normal-priority marketplace CLI feature with limited runtime blast radius but meaningful public API review needs.
merge-risk: 🚨 compatibility: The PR adds a documented CLI command plus option and output contracts that users or automation may rely on after release.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes after-fix Windows terminal output invoking the runtime entries command in offline JSON mode and showing normalized bundled fallback entries; no contributor action is needed for proof.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix Windows terminal output invoking the runtime entries command in offline JSON mode and showing normalized bundled fallback entries; no contributor action is needed for proof.

Evidence reviewed

PR surface:

Source +125, Tests +224, Docs +12. Total +361 across 5 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	2	125	0	+125
Tests	2	224	0	+224
Docs	1	13	1	+12
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	5	362	1	+361

What I checked:

Root policy read and applied: Root AGENTS.md was read fully; its PR review, CLI public-surface, plugin-boundary, compatibility, and protected-label guidance affected this review. (AGENTS.md:29, 686a2876c7f4)
Scoped guides read: The touched docs path and hosted plugin loader side were checked against docs/AGENTS.md and src/plugins/AGENTS.md. Public docs: docs/AGENTS.md. (docs/AGENTS.md:1, 686a2876c7f4)
Live PR state: The PR is open, mergeable, ready for review, and labeled maintainer, proof: sufficient, P2, and merge-risk: compatibility. (1289a25156b8)
Current main behavior: Current main registers marketplace refresh and list but no marketplace entries command, so this PR is still necessary if maintainers want that command. (src/cli/plugins-cli.ts:282, 686a2876c7f4)
Latest release behavior: v2026.6.10 has only the marketplace list command in this group, so the entries command is not already shipped. (src/cli/plugins-cli.ts:246, aa69b12d0086)
PR command registration: The PR head registers plugins marketplace entries with --feed-profile, --feed-url, --offline, and --json under the existing marketplace group. (src/cli/plugins-cli.ts:293, 1289a25156b8)

Likely related people:

giodl73-repo: Authored and merged multiple hosted marketplace feed stack predecessors that established the loader, source-profile validation, config bridge, snapshot storage, and refresh command this PR builds on. (role: recent area contributor; confidence: high; commits: 102a65477e8d, 70e0fd4d8b91, 1b0766080a30; files: src/cli/plugins-cli.ts, src/cli/plugins-cli.runtime.ts, src/plugins/official-external-plugin-catalog.ts)
vincentkoc: Authored the merged Claude marketplace registry install/list work that introduced the adjacent local marketplace CLI and loader surface. (role: earlier marketplace surface contributor; confidence: medium; commits: ff2e864c98cb; files: src/cli/plugins-cli.ts, src/plugins/marketplace.ts)
steipete: Recent plugin CLI and marketplace reference refreshes touched the same docs page and are relevant for docs/API-surface review. (role: adjacent docs contributor; confidence: medium; commits: 56960e33e658, 86c799f4e1ba; files: docs/cli/plugins.md)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

giodl73-repo · 2026-06-24T03:52:26Z

Rebased on the shared marketplace URL redaction fix from #96155 and added entries-command coverage so JSON/text output redacts query strings, fragments, username, and password from emitted feed URLs and fallback errors. @clawsweeper re-review

giodl73-repo · 2026-06-28T18:20:29Z

@clawsweeper re-review

giodl73-repo · 2026-06-28T19:31:11Z

@clawsweeper re-review

clawsweeper · 2026-06-28T19:31:14Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

giodl73-repo · 2026-06-28T19:41:20Z

@clawsweeper re-review

clawsweeper · 2026-06-28T19:41:24Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

giodl73-repo · 2026-06-28T20:59:17Z

@clawsweeper re-review

clawsweeper · 2026-06-28T20:59:20Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

giodl73-repo · 2026-06-28T21:11:35Z

Merged via squash.

Prepared head SHA: 1289a25156b8784439a2df4d0e34718895bd1ff6
Merge commit: 9bb004359ee5ee15b0881c2bce89bd4385db5a3a

Thanks @giodl73-repo!

@giodl73-repo

Merged via squash. Prepared head SHA: 1289a25 Co-authored-by: giodl73-repo <[email protected]> Co-authored-by: giodl73-repo <[email protected]> Reviewed-by: @giodl73-repo

@giodl73-repo

Merged via squash. Prepared head SHA: 1289a25 Co-authored-by: giodl73-repo <[email protected]> Co-authored-by: giodl73-repo <[email protected]> Reviewed-by: @giodl73-repo

@giodl73-repo

Merged via squash. Prepared head SHA: 1289a25 Co-authored-by: giodl73-repo <[email protected]> Co-authored-by: giodl73-repo <[email protected]> Reviewed-by: @giodl73-repo

@giodl73-repo

Merged via squash. Prepared head SHA: 1289a25 Co-authored-by: giodl73-repo <[email protected]> Co-authored-by: giodl73-repo <[email protected]> Reviewed-by: @giodl73-repo

openclaw-barnacle Bot added docs Improvements or additions to documentation cli CLI command changes size: M maintainer Maintainer-authored PR labels Jun 23, 2026

openclaw-barnacle Bot added size: L and removed size: M labels Jun 24, 2026

giodl73-repo force-pushed the feeds-hosted-catalog-marketplace-refresh branch from 76baf5a to 9dcb7b7 Compare June 24, 2026 02:48

giodl73-repo force-pushed the feeds-hosted-catalog-marketplace-entries branch from ebe4078 to c1029ae Compare June 24, 2026 02:48

openclaw-barnacle Bot added size: M and removed size: L labels Jun 24, 2026

giodl73-repo force-pushed the feeds-hosted-catalog-marketplace-refresh branch from 9dcb7b7 to 0e4486b Compare June 24, 2026 03:51

giodl73-repo force-pushed the feeds-hosted-catalog-marketplace-entries branch from c1029ae to cb818b4 Compare June 24, 2026 03:51

clawsweeper Bot added merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. and removed merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. labels Jun 24, 2026

giodl73-repo force-pushed the feeds-hosted-catalog-marketplace-refresh branch from 0e4486b to 15b033a Compare June 24, 2026 13:45

giodl73-repo force-pushed the feeds-hosted-catalog-marketplace-entries branch from cb818b4 to 13cea8e Compare June 24, 2026 13:45

giodl73-repo force-pushed the feeds-hosted-catalog-marketplace-entries branch from c8f2d3e to 77dbf95 Compare June 28, 2026 19:30

giodl73-repo force-pushed the feeds-hosted-catalog-marketplace-entries branch from 77dbf95 to fd69293 Compare June 28, 2026 19:40

Add marketplace feed entries command

1289a25

giodl73-repo force-pushed the feeds-hosted-catalog-marketplace-entries branch from fd69293 to 1289a25 Compare June 28, 2026 20:55

giodl73-repo merged commit 9bb0043 into main Jun 28, 2026
101 checks passed

giodl73-repo deleted the feeds-hosted-catalog-marketplace-entries branch June 28, 2026 21:11

github-actions Bot mentioned this pull request Jun 28, 2026

📡 Upstream Digest — 2026-06-28 22:55 UTC curtismercier/openclaw-mods#1170

Open

steipete mentioned this pull request Jul 9, 2026

Control UI Plugins: curated catalog, install, enable/disable, and ClawHub discovery #103135

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Add marketplace feed entries command#96158

Add marketplace feed entries command#96158
giodl73-repo merged 1 commit into
mainfrom
feeds-hosted-catalog-marketplace-entries

giodl73-repo commented Jun 23, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jun 24, 2026 •

edited

Loading

Uh oh!

giodl73-repo commented Jun 24, 2026

Uh oh!

giodl73-repo commented Jun 28, 2026

Uh oh!

giodl73-repo commented Jun 28, 2026

Uh oh!

clawsweeper Bot commented Jun 28, 2026 •

edited

Loading

Uh oh!

giodl73-repo commented Jun 28, 2026

Uh oh!

clawsweeper Bot commented Jun 28, 2026 •

edited

Loading

Uh oh!

giodl73-repo commented Jun 28, 2026

Uh oh!

clawsweeper Bot commented Jun 28, 2026 •

edited

Loading

Uh oh!

Uh oh!

giodl73-repo commented Jun 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

giodl73-repo commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented Jun 24, 2026

Uh oh!

giodl73-repo commented Jun 28, 2026

Uh oh!

giodl73-repo commented Jun 28, 2026

Uh oh!

clawsweeper Bot commented Jun 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented Jun 28, 2026

Uh oh!

clawsweeper Bot commented Jun 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented Jun 28, 2026

Uh oh!

clawsweeper Bot commented Jun 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

giodl73-repo commented Jun 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

giodl73-repo commented Jun 23, 2026 •

edited

Loading

clawsweeper Bot commented Jun 24, 2026 •

edited

Loading

clawsweeper Bot commented Jun 28, 2026 •

edited

Loading

clawsweeper Bot commented Jun 28, 2026 •

edited

Loading

clawsweeper Bot commented Jun 28, 2026 •

edited

Loading