Manifest and permissions reference

Use this reference to check the exact release metadata and permission boundary for a community plugin.

• Plugin manifest field reference lists every accepted manifest field, default, validation rule, and cross-file relationship.
• Plugin permission reference lists every accepted permission, its review description, risk label, and implication.
• Permission-gated Plugin API operations maps typed public operations to the permission they require and identifies always-available operations.
• Approved host command reference is the complete api.invoke allowlist, including argument and result shapes.

The manifest schema and command allowlist are strict. An unknown manifest field, permission name, or host command is unsupported rather than ignored.

Plugin permissions gate supported Plugin API operations and approved host commands. They do not sandbox community plugin JavaScript. See Community plugin trust model for the complete trust boundary.