Skip to content
Closed
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
docs(www): note plugin trust, use pnpm wording
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011TYMJKMx7fnbFmfjDukDze
  • Loading branch information
claude committed Oct 10, 2026
commit 872ac1076ab1a8579ea81105faa0cb8df01e12b6
6 changes: 6 additions & 0 deletions sites/www/content/docs/plugins/index.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,12 @@ A plugin is a JavaScript module that default-exports one plugin definition. You

Loading never touches the network. If a plugin is declared but not installed, CodeWork tells you to run `codework plugin install` instead of quietly fetching it. See [resolve-only loading](/docs/plugins/install#resolve-only-loading).

<Callout type="warn" title="Only install plugins you trust">
A plugin's code runs inside the CodeWork process with your user's access, and CodeWork has no permission prompts:
tools a plugin registers run without asking. CodeWork never runs install scripts, but the plugin itself is trusted
once it loads.
</Callout>

## Plugin kinds

Every plugin declares a `kind`, which is the part of the agent it extends. The kind also decides when it runs: all tool plugins are set up before any prompt plugin, so a prompt plugin always sees the complete tool set.
Expand Down
2 changes: 1 addition & 1 deletion sites/www/content/docs/plugins/install.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ Installed @acme/codework-tool-proc@1.2.0 (acme.tool.proc)
1 installed, 2 already present, 1 local
```

This is the plugin equivalent of `npm install` with no arguments. It writes nothing to settings, skips anything already in the store, and skips local paths, which are loaded where they are.
This is the plugin equivalent of `pnpm install` with no arguments. It writes nothing to settings, skips anything already in the store, and skips local paths, which are loaded where they are.

## Resolve-only loading

Expand Down