Skip to content

PLUGIN_API.md

Latest commit

 

History

History
41 lines (34 loc) · 1.44 KB

PLUGIN_API.md

File metadata and controls

41 lines (34 loc) · 1.44 KB
Raw

Plugin API v1

Metadata collectors use a manifest-based, opt-in API. Disabled plugin code is discovered but never imported.

plugins/
  example/
    plugin.json
    collector.py

{
  "id": "org.example.collector",
  "name": "Example Collector",
  "version": "1.0.0",
  "api_version": 1,
  "entrypoint": "collector.py",
  "permissions": ["network"]
}

The entrypoint exports a MetadataCollectorPlugin subclass. Desktop installs live in the managed application plugin directory and begin disabled. Enabling a plugin records its SHA-256 checksum; normal metadata collection loads it only while the manifest ID and approved checksum still match. Each result is limited to 2 MiB, cover/update counts are bounded, failures are isolated, and every run is audited in SQLite. Known title and publisher values are never replaced by a plugin fallback.

Enabled collectors run in a child process with a 30-second timeout and a bounded result file. POSIX builds also request CPU, address-space, and output-file limits. A timeout or worker crash does not terminate the desktop collection job.

Requested access is disclosure metadata, not an operating-system sandbox. Plugin code still executes with the user's account permissions, so only enable source and publishers you trust. Editing an enabled entrypoint automatically prevents it from loading until it is reviewed and enabled again.

Root-level legacy Python plugins load only with allow_legacy=True.