From d43dda465d8eb61aef6d2ee0de4e15bf148b7e91 Mon Sep 17 00:00:00 2001 From: "Quinn H." Date: Wed, 25 Mar 2026 12:59:21 +0800 Subject: [PATCH] fix: note marketplace streaming and ClawHub URL (#54160) (thanks @QuinnH496) * fix: correct ClawHub URL in system prompt and use streaming download in marketplace - Fix #54154: Change clawhub.com to clawhub.ai in system prompt - Fix #54156: Replace arrayBuffer() with streaming pipeline for marketplace plugin downloads to avoid OOM on memory-constrained devices * fix: guard marketplace archive stream body * fix: note marketplace streaming and ClawHub URL (#54160) (thanks @QuinnH496) --------- Co-authored-by: Li Enying Co-authored-by: Ayaan Zaidi --- CHANGELOG.md | 1 + src/plugins/marketplace.test.ts | 34 +++++++++++++++++++++++++++++++++ src/plugins/marketplace.ts | 8 +++++++- 3 files changed, 42 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ce3341c2757..bbfdbcd4829 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -32,6 +32,7 @@ Docs: https://docs.openclaw.ai - Feishu/docx block ordering: preserve the document tree order from `docx.document.convert` when inserting blocks, fixing heading/paragraph/list misordering in newly written Feishu documents. (#40524) Thanks @TaoXieSZ. - Agents/cron: suppress the default heartbeat system prompt for cron-triggered embedded runs even when they target non-cron session keys, so cron tasks stop reading `HEARTBEAT.md` and polluting unrelated threads. (#53152) Thanks @Protocol-zero-0. - TUI/chat: preserve pending user messages when a slow local run emits an empty final event, but still defer and flush the needed history reload after the newer active run finishes so silent/tool-only runs do not stay incomplete. (#53130) Thanks @joelnishanth. +- Marketplace/agents: correct the ClawHub skill URL in agent docs and stream marketplace archive downloads to disk so installs avoid excess memory use and fail cleanly on empty responses. (#54160) Thanks @QuinnH496. - Gateway/channels: keep channel startup sequential while isolating per-channel boot failures, so one broken channel no longer blocks later channels from starting. (#54215) Thanks @JonathanJing. - Docs/IRC: fix five `json55` code-fence typos in the IRC channel examples so Mintlify applies JSON5 syntax highlighting correctly. (#50842) Thanks @Hollychou924. - Telegram/forum topics: recover `#General` topic `1` routing when Telegram omits forum metadata, including native commands, interactive callbacks, inbound message context, and fallback error replies. (#53699) thanks @huntharo diff --git a/src/plugins/marketplace.test.ts b/src/plugins/marketplace.test.ts index 63777eae834..3cfafb87827 100644 --- a/src/plugins/marketplace.test.ts +++ b/src/plugins/marketplace.test.ts @@ -41,6 +41,7 @@ describe("marketplace plugins", () => { afterEach(() => { installPluginFromPathMock.mockReset(); runCommandWithTimeoutMock.mockReset(); + vi.unstubAllGlobals(); }); it("lists plugins from a local marketplace root", async () => { @@ -214,6 +215,39 @@ describe("marketplace plugins", () => { }); }); + it("returns a structured error for archive downloads with an empty response body", async () => { + await withTempDir(async (rootDir) => { + vi.stubGlobal( + "fetch", + vi.fn(async () => new Response(null, { status: 200 })), + ); + await fs.mkdir(path.join(rootDir, ".claude-plugin"), { recursive: true }); + await fs.writeFile( + path.join(rootDir, ".claude-plugin", "marketplace.json"), + JSON.stringify({ + plugins: [ + { + name: "frontend-design", + source: "https://example.com/frontend-design.tgz", + }, + ], + }), + ); + + const { installPluginFromMarketplace } = await import("./marketplace.js"); + const result = await installPluginFromMarketplace({ + marketplace: path.join(rootDir, ".claude-plugin", "marketplace.json"), + plugin: "frontend-design", + }); + + expect(result).toEqual({ + ok: false, + error: "failed to download https://example.com/frontend-design.tgz: empty response body", + }); + expect(installPluginFromPathMock).not.toHaveBeenCalled(); + }); + }); + it("rejects remote marketplace git plugin sources before cloning nested remotes", async () => { mockRemoteMarketplaceClone({ plugins: [ diff --git a/src/plugins/marketplace.ts b/src/plugins/marketplace.ts index 855ebdcce5b..ab29689517b 100644 --- a/src/plugins/marketplace.ts +++ b/src/plugins/marketplace.ts @@ -1,6 +1,8 @@ +import { createWriteStream } from "node:fs"; import fs from "node:fs/promises"; import os from "node:os"; import path from "node:path"; +import { Writable } from "node:stream"; import { resolveArchiveKind } from "../infra/archive.js"; import { resolveOsHomeRelativePath } from "../infra/home-dir.js"; import { runCommandWithTimeout } from "../process/exec.js"; @@ -591,12 +593,16 @@ async function downloadUrlToTempFile(url: string): Promise< if (!response.ok) { return { ok: false, error: `failed to download ${url}: HTTP ${response.status}` }; } + if (!response.body) { + return { ok: false, error: `failed to download ${url}: empty response body` }; + } const pathname = new URL(url).pathname; const fileName = path.basename(pathname) || "plugin.tgz"; const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-marketplace-download-")); const targetPath = path.join(tmpDir, fileName); - await fs.writeFile(targetPath, Buffer.from(await response.arrayBuffer())); + const fileStream = createWriteStream(targetPath); + await response.body.pipeTo(Writable.toWeb(fileStream)); return { ok: true, path: targetPath,