Manifest Reference

Schema

Field	Type	Required	Description
`id`	string	✓	Reverse-domain unique ID
`name`	string or map	✓	Display name, supports locales
`description`	string		Short summary
`version`	string	✓	SemVer
`sdkapi`	number	Recommended	SDK API version, format YYMMDD (e.g., 251212)
`entry`	string	✓	Path to init entry
`preload`	string		Renderer preload file
`dev.enable`	boolean		Enable hot reload
`permissions`	object		Permission declarations, see below
`permissionReasons`	object		Reasons for permissions
`acceptedInputTypes`	string		`text`, `image`, `files`, `html`
`features`	object		CoreBox commands, widgets, workflow nodes

SDK API Version (sdkapi)

The sdkapi field declares the SDK API version the plugin is compatible with. Format is YYMMDD (year-month-day).

Current version: 251212 (2025-12-12)
Not declared or below 251212: Permission checks are bypassed, but users will see a warning about legacy SDK
Equal to or above 251212: Full permission enforcement enabled

New plugins should always declare the latest sdkapi version for complete permission protection.

Permissions

The permission system controls plugin access to sensitive APIs. See Permission API docs for details.

Declaration Format

"permissions": {
  "required": ["clipboard.read", "network.internet"],
  "optional": ["storage.shared"]
},
"permissionReasons": {
  "clipboard.read": "Read text from clipboard for translation",
  "network.internet": "Connect to translation API"
}

Available Permissions

Permission ID	Risk	Description
`fs.read`	Medium	Read files
`fs.write`	High	Write files
`fs.execute`	High	Execute files
`clipboard.read`	Medium	Read clipboard
`clipboard.write`	Low	Write clipboard (auto-granted)
`network.local`	Low	Local network
`network.internet`	Medium	Internet access
`network.download`	Medium	Download files
`system.shell`	High	Execute commands
`system.notification`	Low	System notifications
`system.tray`	Medium	System tray
`ai.basic`	Low	Basic AI
`ai.advanced`	Medium	Advanced AI
`ai.agents`	High	AI Agents
`storage.plugin`	Low	Plugin storage (auto-granted)
`storage.shared`	Medium	Shared storage
`window.create`	Low	Create windows (auto-granted)
`window.capture`	High	Screen capture

Example

{
  "id": "com.tuff.todo",
  "name": {
    "default": "Todo",
    "zh-CN": "待办"
  },
  "description": "Capture and sync todos",
  "version": "1.3.0",
  "sdkapi": 251212,
  "entry": "init/index.ts",
  "features": [
    {
      "type": "corebox",
      "id": "todo.new",
      "title": "Create Todo",
      "keywords": ["todo", "task"],
      "queryMode": "text"
    }
  ],
  "permissions": {
    "required": ["clipboard.read"],
    "optional": ["storage.shared"]
  },
  "permissionReasons": {
    "clipboard.read": "Read todo content from clipboard"
  },
  "acceptedInputTypes": ["text", "files"]
}

Validation Checklist

id must be unique and alphanumeric with dots.
version follows major.minor.patch for update ordering.
Declaring network requires whitelisting external domains.

Frequent Issues

Issue	Fix
Missing entry	Set `entry` to `init/index.ts` and ensure the file exists.
Excessive permissions	Request only what you truly need, especially for v1.
Keyword collisions	Namespace features like `todo.*` to avoid conflicts.