Muxie Get Muxie
Plugin development Explanation

Security & publishing

The plugin trust model, the muxie-plugin:// scheme, and the rules for keeping the extension catalog current.

This page describes Muxie’s current plugin trust model and the rules that keep the hook and slot catalogs accurate as the app grows.

Trust model

Plugins are trusted code — the same model as Obsidian and VS Code. A plugin gets real access to the machine and the app:

  • Main entries run with full Node access in the Electron main process.
  • Renderer entries run inside the app’s CSP and are served only over the privileged muxie-plugin:// scheme. Remote code and eval’d code stay blocked, and the protocol refuses paths outside the plugin’s own directory.

Because a main entry has full Node access, only install plugins you trust — treat installing a plugin like running a program you downloaded.

A manifest-declared permission system (where a plugin would request specific capabilities and the user would grant them) is future work, not something the current model enforces.

Keeping the catalog current

Muxie’s extension surfaces are documented catalogs, and the project rule (from CLAUDE.md) is that the catalogs must stay in sync with the code:

  • Every new UI surface gets a slot. Adding a toolbar, menu, panel area, bar, or list that plugins could plausibly extend? Add a key to SlotItemMap and render it with useSlot(...) at that location — then document it in the Slot catalog.
  • Every new lifecycle moment gets a hook. Adding a notable main-process or renderer event (a connection established, a feature opened, a long task finished)? Add it to MainHookMap / RendererHookMap and emit it at that point — then document it in the Hook catalog.
  • Registrations must stay disposable. Anything a plugin can register must be tracked by its context and undone on deactivate (the hot-unload invariant) — never add a plugin-facing API that bypasses context tracking.

New hooks, slots, and context APIs must be documented in the same change that adds them.

For the bigger picture of how the system fits together, see the Plugin overview.