Plugins

Install marketplace plugins and understand action, auth, connect, and channel capabilities.

Capabilities

Plugins extend OpenNeko through a manifest. You define a plugin with definePlugin(); its manifest declares the capabilities it offers, the hosts it may reach, and the secret keys it needs. Current capability kinds are action, auth, connect, and channel.

Capability	Purpose	Key fields
action	Expose an agent-callable or workflow-callable operation	kind, description, default_mode
auth	Provide deployment-wide SSO signin	providerLabel
connect	Provide per-operator OAuth or external account connection	providerLabel, scopes, flow
channel	Provide inbound or outbound conversation surfaces	providerLabel, profile, directions, ingress

Marketplaces and manifests

The official marketplace is https://open-neko.github.io/plugins/marketplace.json and lists first-party @open-neko packages. Operators can add their own marketplace.json URLs explicitly and carry the trust decision for them; OpenNeko vouches only for the official marketplace.

Marketplace commands

openneko marketplace add https://example.com/marketplace.json
openneko install @open-neko/plugin-parallel-search
openneko install @example/private-plugin --unverified

The registry watches openneko.plugins.json and the secrets file. Sandboxes start lazily on first use, and openneko doctor checks whether the host can run the OpenShell plugin runtime.

Install and policy

Plugin install and uninstall are plugin_management actions by default. The approval role depends on the deployment profile, and install policy can be tightened through feature-gated controls.

Plugin commands

openneko install @open-neko/plugin-slack
openneko remove @open-neko/plugin-slack
openneko list

Plugin operations can auto-proxy into the worker container. Keep the worker, manifest path, plugin install directory, and secrets store in sync when debugging plugin behavior.

Secrets and egress

Plugin env requirements can request injection into egress or the box. Network allowlists are enforced at the VM or sandbox boundary, and plugin credentials should stay in worker-side secret handling rather than browser state.

Use action default_mode to express safe defaults; risky writes still belong behind review.
Use connect for per-operator accounts and auth for singleton SSO.
Prefer channel capabilities for Slack or similar conversation ingress instead of ad hoc webhooks.
Bundle a skill when the plugin needs agent instructions to use its tools well.