zooqueen
adb8e1f802
Squash merge of 1,462 upstream commits with openclaw→hanzo-bot naming transforms applied. Conflicts resolved favoring our main branch to preserve existing customizations. Key upstream additions: - iOS Security Stack (concurrency locks, runtime guards, TTS fallback) - Discord CDN hostname allowlisting for SSRF protection - Discord mention handling improvements - Various bug fixes and stability improvements
2.4 KiB
summary, read_when, title
| summary | read_when | title | ||
|---|---|---|---|---|
| CLI reference for `bot plugins` (list, install, uninstall, enable/disable, doctor) |
|
plugins |
bot plugins
Manage Gateway plugins/extensions (loaded in-process).
Related:
- Plugin system: Plugins
- Plugin manifest + schema: Plugin manifest
- Security hardening: Security
Commands
bot plugins list
bot plugins info <id>
bot plugins enable <id>
bot plugins disable <id>
bot plugins uninstall <id>
bot plugins doctor
bot plugins update <id>
bot plugins update --all
Bundled plugins ship with Bot but start disabled. Use plugins enable to
activate them.
All plugins must ship a bot.plugin.json file with an inline JSON Schema
(configSchema, even if empty). Missing/invalid manifests or schemas prevent
the plugin from loading and fail config validation.
Install
bot plugins install <path-or-spec>
Security note: treat plugin installs like running code. Prefer pinned versions.
Npm specs are registry-only (package name + optional version/tag). Git/URL/file
specs are rejected. Dependency installs run with --ignore-scripts for safety.
If a bare install spec matches a bundled plugin id (for example diffs), Bot
installs the bundled plugin directly. To install an npm package with the same
name, use an explicit scoped spec (for example @scope/diffs).
Supported archives: .zip, .tgz, .tar.gz, .tar.
Use --link to avoid copying a local directory (adds to plugins.load.paths):
bot plugins install -l ./my-plugin
Uninstall
bot plugins uninstall <id>
bot plugins uninstall <id> --dry-run
bot plugins uninstall <id> --keep-files
uninstall removes plugin records from plugins.entries, plugins.installs,
the plugin allowlist, and linked plugins.load.paths entries when applicable.
For active memory plugins, the memory slot resets to memory-core.
By default, uninstall also removes the plugin install directory under the active
state dir extensions root ($BOT_STATE_DIR/extensions/<id>). Use
--keep-files to keep files on disk.
--keep-config is supported as a deprecated alias for --keep-files.
Update
bot plugins update <id>
bot plugins update --all
bot plugins update <id> --dry-run
Updates only apply to plugins installed from npm (tracked in plugins.installs).