Add Agent Plugins marketplace with spec 1.0.0 support - #536
Open
SDSLeon wants to merge 10 commits into
Open
Conversation
SDSLeon
commented
Aug 8, 2026
SDSLeon
commented
Owner
- Introduce Agent Plugins spec 1.0.0: bundles GitHub, Outlook, browser/chrome/computer-use tools, and subagent-delegation plugins with manifests, skills, and MCP configs.
- Add a Plugins marketplace and settings UI to browse, install, and manage plugins, plus OAuth and error-diagnostic handling.
- Load and enforce plugins at runtime in the supervisor with validation diagnostics, path containment, skill policy, and MCP server integration.
- Map native provider plugins (Codex, Claude) and annotate MCP tools with read-only/destructive/open-world hints.
- Track and display Claude sub-agent resume rows; drop the Manage tab and "apps" concept in favor of the marketplace.
- Add bundled plugin catalog, settings UI, localized metadata, and skills - Apply plugin MCP and skill policies across thread launches and subagents - Preserve launch configuration through recovery, restart, and remote sync - Expand integration smoke coverage and runtime tests
Replace the invented in-memory plugin manifest with a conformant client for Agent Plugins Specification 1.0.0: on-disk plugin.json, skills/ and mcp.json discovery at fixed locations, realpath package-boundary enforcement, and narrowest-boundary failure isolation. Plugin MCP servers become provider-agnostic McpServer records, so a package authored for the spec reaches every provider Poracode supports without the provider knowing the spec exists. Ships the four built-ins as real packages plus GitHub (official remote MCP) and Outlook (community ms-365-mcp-server). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Master had no plugin system, so the plugin work carries forward. Master-side changes adopted: subagentMcp -> crossagentMcp, removal of orchestratorThreadBridge, the regrouped settings sidebar (plugins re-added under Agents), and the new MCP OAuth owner payload. Settings > Plugins is now only the marketplace plus plugin detail. MCP servers and Skills already have their own settings pages, so the second management view was duplicating them. Removes "apps" — the invented contribution type that let a package toggle Poracode's own built-in MCP servers. A package now contributes exactly what the Agent Plugins specification defines: skills and mcp.json servers. Built-in servers are governed solely by the MCP Servers page and the composer toggles, as they were before the plugin work. Where a merge conflict was purely apps plumbing, master's side won. Behavior change: installing a package no longer switches its built-in server on, and plugin skills are no longer hidden when a companion server is off. Gating is now host/project support plus per-contribution enablement. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
- Skip globally disabled MCP servers and carry the effective launchConfig through spawn, restart, and session recovery - Filter plugin skill segments on steer with WSL-aware path resolution and fail-closed policy checks - Add a retry state to plugin settings load failures and switch plugin buttons to HeroUI Button - Localize the OAuth sign-out error message and update all i18n catalogs - Add coverage for config propagation, disabled-server conformance, and WSL skill paths
- Slugify bundled plugin skill names (ci-debug, github, reviewer, outlook-*) to match their folders and enforce it in the conformance suite - Show OAuth sign-in errors on the plugin detail page and localize the new marketplace/diagnostic strings across all 12 catalogs - Validate MCP server skill presence against the plugin manifest at runtime and report missing data-folder diagnostics - Stamp the plugin registry cache with manifest/MCP file mtimes so edits invalidate cached entries - Harden WSL plugin-skill root policy, MCP server authorization, and catalog disabled-server state with tests
- Annotate MCP tools with openWorld/destructive/readOnly hints across browser, chrome, computer-use, and crossagent registries - Map catalog plugins to Codex native plugins and built-in MCP servers, threading them through plugin resolution, skill turns, and session launch - Support plugin mentions in the composer, carrying pluginId/pluginName through serialization, slash chips, and prompt segments - Drop skill segments on plugin skill policy failure and extend skill scan and import environment handling - Bump plugin store revision, re-extract locale catalogs, and update smoke scenarios and targeted tests
The bundled plugin manifests were bumped to 1.1.0 in af654c1, but the sharedSettingsStore and PluginMarketplace suites still asserted 1.0.0. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.