Add the managed plugin CLI

feeds/skills/.system/files/netclaw-operations/SKILL.md

@@ -3,7 +3,7 @@ name: netclaw-operations
 description: "REQUIRED when the user asks about scheduling, reminders, cron jobs, timers, background jobs, diagnostics, troubleshooting, MCP tools, daemon health, identity updates, or Netclaw capabilities and self-maintenance."
 metadata:
   author: netclaw
-  version: "2.74.4"
+  version: "2.76.0"
 ---
 
 # Netclaw Operations

feeds/skills/.system/files/netclaw-operations/references/skills.md

@@ -1,6 +1,3 @@
-# Skill Management
-
-
 ## Skill Management
 
 
@@ -17,7 +14,7 @@ commands below only for explicit operator inspection and diagnostics.
 | Command | What it does |
 |---------|--------------|
 | `netclaw skill list` | List all discovered skills with source, version, status |
-| `netclaw skill sync` | Run one external source sync pass and report each source result |
+| `netclaw skill sync [--retry-rejected]` | Run one external source sync pass and report each source result |
 | `netclaw skill show <name>` | Show skill metadata and full content |
 | `netclaw skill validate <path>` | Validate a SKILL.md file's frontmatter format |
 | `netclaw skill remove <name>` | Remove a native skill (refuses system/external) |
@@ -37,6 +34,38 @@ Register additional skill directories (e.g. `~/.claude/skills/`):
 | `netclaw skill source enable <name>` | Enable a disabled source |
 | `netclaw skill source disable <name>` | Disable without removing |
 
+### Managed agent plugins
+
+The daemon can install Agent Plugin packages from a public GitHub repository.
+Netclaw supports Agent Plugins 1.0.0 and the Codex compatibility format.
+Netclaw imports skills only.
+It does not activate hooks, MCP servers, agents, scripts, or other executable components.
+
+| Command | What it does |
+|---------|--------------|
+| `netclaw plugin install owner/repository` | Install from the repository's default branch |
+| `netclaw plugin install owner/repository --branch main` | Track a named branch |
+| `netclaw plugin install owner/repository --tag v1.2.0` | Resolve a tag once and pin its commit |
+| `netclaw plugin install owner/repository --commit <sha>` | Pin an exact commit |
+| `netclaw plugin list [--json]` | Show each source and its installed package identity |
+| `netclaw plugin enable <source-id>` | Enable and sync a source |
+| `netclaw plugin disable <source-id>` | Disable a source |
+| `netclaw plugin remove <source-id>` | Remove a source |
+
+Use `--id` to set the stable source ID.
+Use `--format auto|agent-plugin|codex` to select the package contract.
+The default `auto` format prefers a recognized Agent Plugins manifest.
+Use `--subdirectory` when the plugin root is below the repository root.
+Plugin mutations require confirmation unless the operator supplies `--yes`.
+The install command waits for the daemon restart and its immediate sync.
+A download failure leaves the valid source configured for a later sync.
+A scanner rejection records the commit and keeps prior installed content active.
+Use `netclaw skill sync --retry-rejected` to test known rejected commits again.
+The daemon removes the rejection record after a successful explicit retry.
+
+The source ID controls later lifecycle commands.
+The package manifest supplies a separate package name after a successful sync.
+
 The daemon restores its system skills from its binary before its first scan.
 If this restore fails, confirm that Netclaw owns the skills directory and can
 write to its parent. If the error reports a reparse point, remove it from the

scripts/smoke/run-smoke.sh

@@ -67,6 +67,7 @@ LIGHT_SCENARIOS=(
   pairing
   mcp-setup
   skill-sync
+  plugin-management
   webhook-routes
 )
 FULL_SCENARIOS=("${LIGHT_SCENARIOS[@]}")