Developers
Five permissions and one plain limit.
A plugin does nothing until you approve the permissions it asks for. The permissions limit what OmniConflux does for the plugin, not what the plugin's own process does on your machine: a plugin is a program you run, with your rights.
The plain limit
A plugin is a program you run, with your rights. OmniConflux refuses every call the approved permissions do not cover, and it never hands a plugin data or power its permissions do not name. That limits what OmniConflux does for the plugin. It does not limit what the plugin's own process does on your machine: version 1 has no operating-system sandbox, so a plugin can do anything you can do there. A sandbox is later work.
The app says it in one sentence before you approve: “A plugin is a program that runs as you. Permissions limit what OmniConflux does for it, not what it can do on this machine.” Plugins run as you and can share data with each other, so install a plugin only when you would run it as a program of your own.
Nothing runs before you approve it
- An installed plugin waits. It starts only after you approve it in the app, and only you can approve it: there is no approval on the command line, in a script or from the phone.
- The approval prompt shows the plugin's name, id, version and publisher, marked unverified; who installed it, when it was not you; each permission with its sentence; each command; what changed since the last approval; the first 12 characters of its hash; and the permissions of your other plugins.
- An approval is for one exact copy: a hash over every file of the plugin, the manifest included. OmniConflux checks the copy against it before every start.
- A changed plugin needs approval again. A changed manifest or a changed file keeps it from starting until you approve the new copy. An update waits beside the approved copy, which keeps running until you approve or discard the update.
- There is no approval of part of a list, and no approval that holds for a later version.
What each permission allows and never allows
OmniConflux checks the permission on every call, against the approved list, before it reads the call's params. A call without its permission fails with permission-denied, which names the permission. No call asks for a permission while a plugin runs, and no permission implies another.
events.read
The app shows: “See when sessions and lanes start, stop, wait for an approval and get a verdict. Never what was said or written.”
Covers events.subscribe, events.unsubscribe, event, events.dropped.
Allows
- The nine event kinds, for every session OmniConflux runs or follows on another machine and for every lane it dispatched, from the moment the plugin subscribes.
Never allows
- Anything said or written in a session: prompts, answers, tool input, file contents or command lines.
- Any event kind outside the nine.
- Events from before it subscribed. There is no replay.
- Choosing single sessions. It chooses by kind only.
lists.read
The app shows: “See the lists of your sessions, lanes and seats, with the folders they work in.”
Covers sessions.list, lanes.list, seats.list.
Allows
- Reading three lists a page at a time: your sessions, your lanes and the seats of your fleet. Rows hold ids, states, seat and model names, branch names, and the absolute paths of repositories and worktrees.
Never allows
- Reading anything inside those folders.
- A session's transcript, prompt, usage figures or attached clients.
- A lane's statement, acceptance command, checks, defects or evidence.
- A seat's account, sign-in details or version.
- Any other list OmniConflux keeps, such as approvals, missions or usage.
- Changing anything.
commands.add
The app shows: “Add its commands to the command list, shown under the plugin's name.”
Covers command.run.
Allows
- The commands of its approved manifest appear in the app's command list while the plugin is approved and switched on. When you choose one, the plugin gets it and the app shows the text the plugin returns.
Never allows
- A command its approved manifest does not hold. No call adds, renames or removes a command while it runs.
- A key binding, a screen, a panel, a notification, a link, an image, markup or colour. A result is plain text of at most 16,384 characters.
- A command shown without the plugin's name.
- Running a command for any reason other than you choosing it in the app.
- Learning what you were doing. It gets the command and, for a command that takes text, the one line you typed: no folder, no selection, no session.
storage.own
The app shows: “Keep up to 1 MiB of its own data on this machine.”
Covers storage.get, storage.set, storage.delete, storage.list.
Allows
- Up to 128 keys of text, each value at most 16,384 characters, and 1,048,576 bytes in all. The data survives restarts and updates and is deleted with the plugin.
Never allows
- A path. A key is a name of 1 to 64 lowercase letters, digits, dots, underscores and hyphens, starting with a letter or a digit, and it is never used as a file name.
- Another plugin's data.
- More than its limits of keys and bytes.
tasks.create
The app shows: “Ask you to start a task. You are asked every time, and nothing starts unless you allow it.”
Covers tasks.create.
Allows
- Asking you to start one task: a builder seat works in a new worktree of a repository, a verifier seat of another provider family checks the result, and a named command is the acceptance check. You read the whole request in the app and answer it there.
Never allows
- Starting anything without your answer to this very request, in the app. No rule, permission mode, risk score, earlier answer or phone can answer it.
- Answering its own request.
- A repository OmniConflux does not already work in, or a network share.
- Confirming its own acceptance command, adding checks, letting a check use the network, choosing another machine, or sending input to the session it started.
- More than 3 requests waiting at once, or more than 20 in 24 hours. A request you do not answer in 30 minutes expires.
Switching off and removing
- You can switch a plugin off from the app or the command line, and it stops. Only the app switches it on again.
- A plugin that crashes is started again after a wait that grows to at most a minute. At its fifth crash in ten minutes it stays stopped.
- Removing a plugin stops it and deletes its copies, its approval, its data and its commands. Lanes it started that are still at work stop with it unless you keep them.
- Changes a plugin made outside its own folders are not undone when you remove it.
Plugins ship inside the app
OmniConflux 0.3.0 is released for Omarchy, macOS on Apple silicon and Windows, in a closed beta with a waitlist. Plugins and the SDK ship inside the app from 0.3.0, and the SDK is not on a package registry.