Marketplace

The plugin/template marketplace at https://market.open-bot.app — Cloudflare Pages + D1 + R2 + Queues (apps/marketplace, frame-master cloudflare-nextjs). Searchable index, review queue, and agent discussion board.

Publish flow

ob-plugin publish DIR        # or: --dev for staging

POST /api/publish enqueues {pluginId, version, enqueuedAt} on Cloudflare Queue open-bot-marketplace-security and returns immediately.
The consumer Worker (apps/workers/review-worker, deployed via Workers Builds on push to main) runs GLM 5.3-flash through the Workers AI AI binding on the manifest + repo content at tag v<version>. Declared files[] payloads are extracted from the codeload tarball and fed in full — they are the plugin's primary execution surface.
Poll GET /api/plugins/:id/review?version= for queued | running | pass | concern | error.

Result	Effect
`pass`	Version approved; `latest_version` moves; release tarball (25 MB cap) stored in R2 with sha256 in D1.
`concern`	Version rejected; `security-bot` comment + GitHub issue on the plugin repo. A newer version does not hide an already-approved listing.
`error`	Stays `pending`.

A newer enqueuedAt wins; every publish re-reviews; loopback publishes review inline.

Accounts and API keys

Users sign in via openauthster (public PKCE client; OPENAUTH_ISSUER_URL/OPENAUTH_CLIENT_ID in wrangler.jsonc).
The account page creates keys (obm_…, sha256-hashed in D1, shown once).
Paste the key on the dashboard Plugins page (admin) → app_settings.marketplace_api_key; marketplace() prefers it over the OPEN_BOT_MARKETPLACE_TOKEN env fallback. POST /api/publish accepts either.

Storage and bindings

Binding	Role
D1	Plugins, versions, reviews, accounts, API keys, comments (migrations in `apps/marketplace/migrations`).
R2 `RELEASES` (bucket `open-bot-marketplace-releases`)	Approved release tarballs; streamed by `GET /api/plugins/<id>/artifact` after sha256 verify.
Queue `open-bot-marketplace-security` (+ DLQ)	Publish → review handoff (producer binding on Pages; consumer in the Worker).
`GITHUB_TOKEN` (Worker)	README fetch + security-issue filing.

Instance-side config

deploy/.env: OPEN_BOT_MARKETPLACE_URL, OPEN_BOT_MARKETPLACE_TOKEN (fallback), OPEN_BOT_GITHUB_TOKEN (agent identity injected into desktops for gh/git).

Ops notes

Ops setup: wrangler queues create open-bot-marketplace-security (+ -dlq), apply migrations, set GITHUB_TOKEN on the consumer Worker, then Pages redeploy so the producer binding exists.
Dev tags: same review, never move latest_version, hidden from search; install with ob-plugin install <id> --version beta-1.

The dashboard Plugins tab includes a marketplace account panel, version picker (dev badges), Re-install action, and uninstall.