fix: note marketplace streaming and ClawHub URL (#54160) (thanks @QuinnH496)

* fix: correct ClawHub URL in system prompt and use streaming download in marketplace

- Fix #54154: Change clawhub.com to clawhub.ai in system prompt
- Fix #54156: Replace arrayBuffer() with streaming pipeline for marketplace
  plugin downloads to avoid OOM on memory-constrained devices

* fix: guard marketplace archive stream body

* fix: note marketplace streaming and ClawHub URL (#54160) (thanks @QuinnH496)

---------

Co-authored-by: Li Enying <li.enying@openclaw.ai>
Co-authored-by: Ayaan Zaidi <hi@obviy.us>

src/plugins/marketplace.test.ts

@@ -41,6 +41,7 @@ describe("marketplace plugins", () => {
   afterEach(() => {
     installPluginFromPathMock.mockReset();
     runCommandWithTimeoutMock.mockReset();
+    vi.unstubAllGlobals();
   });
 
   it("lists plugins from a local marketplace root", async () => {
@@ -214,6 +215,39 @@ describe("marketplace plugins", () => {
     });
   });
 
+  it("returns a structured error for archive downloads with an empty response body", async () => {
+    await withTempDir(async (rootDir) => {
+      vi.stubGlobal(
+        "fetch",
+        vi.fn(async () => new Response(null, { status: 200 })),
+      );
+      await fs.mkdir(path.join(rootDir, ".claude-plugin"), { recursive: true });
+      await fs.writeFile(
+        path.join(rootDir, ".claude-plugin", "marketplace.json"),
+        JSON.stringify({
+          plugins: [
+            {
+              name: "frontend-design",
+              source: "https://example.com/frontend-design.tgz",
+            },
+          ],
+        }),
+      );
+
+      const { installPluginFromMarketplace } = await import("./marketplace.js");
+      const result = await installPluginFromMarketplace({
+        marketplace: path.join(rootDir, ".claude-plugin", "marketplace.json"),
+        plugin: "frontend-design",
+      });
+
+      expect(result).toEqual({
+        ok: false,
+        error: "failed to download https://example.com/frontend-design.tgz: empty response body",
+      });
+      expect(installPluginFromPathMock).not.toHaveBeenCalled();
+    });
+  });
+
   it("rejects remote marketplace git plugin sources before cloning nested remotes", async () => {
     mockRemoteMarketplaceClone({
       plugins: [

src/plugins/marketplace.ts

@@ -1,6 +1,8 @@
+import { createWriteStream } from "node:fs";
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
+import { Writable } from "node:stream";
 import { resolveArchiveKind } from "../infra/archive.js";
 import { resolveOsHomeRelativePath } from "../infra/home-dir.js";
 import { runCommandWithTimeout } from "../process/exec.js";
@@ -591,12 +593,16 @@ async function downloadUrlToTempFile(url: string): Promise<
   if (!response.ok) {
     return { ok: false, error: `failed to download ${url}: HTTP ${response.status}` };
   }
+  if (!response.body) {
+    return { ok: false, error: `failed to download ${url}: empty response body` };
+  }
 
   const pathname = new URL(url).pathname;
   const fileName = path.basename(pathname) || "plugin.tgz";
   const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-marketplace-download-"));
   const targetPath = path.join(tmpDir, fileName);
-  await fs.writeFile(targetPath, Buffer.from(await response.arrayBuffer()));
+  const fileStream = createWriteStream(targetPath);
+  await response.body.pipeTo(Writable.toWeb(fileStream));
   return {
     ok: true,
     path: targetPath,