Manifest Reference

Schema

Field	Type	Required	Description
`id`	string	✓	Reverse-domain unique ID
`name`	string or map	✓	Display name, supports locales
`description`	string		Short summary
`version`	string	✓	SemVer
`sdkapi`	number	Recommended	SDK API version, format YYMMDD (e.g., 260215)
`category`	string	Conditional	Category id synced with Nexus (e.g., `utilities`, `productivity`) (required when `sdkapi >= 260114`)
`entry`	string	✓	Path to init entry
`preload`	string		Renderer preload file
`dev.enable`	boolean		Enable hot reload
`permissions`	object		Permission declarations, see below
`permissionReasons`	object		Reasons for permissions
`acceptedInputTypes`	string		`text`, `image`, `files`, `html`
`features`	object		CoreBox commands, widgets, workflow nodes

SDK API Version (sdkapi)

The sdkapi field declares the SDK API version the plugin is compatible with. Format is YYMMDD (year-month-day).

Current version: 260215 (2026-02-15)
Not declared or below 251212: Permission checks are bypassed, but users will see a warning about legacy SDK
251212 ~ 260113: Full permission enforcement enabled
Equal to or above 260114: Requires category for UI grouping (in addition to 251212 baseline)
Equal to or above 260215: Can use plugin SQLite SDK (usePluginSqlite)

New plugins should always declare the latest sdkapi version for complete permission protection.

Permissions

The permission system controls plugin access to sensitive APIs. See Permission API docs for details.

Declaration Format

"permissions": {
  "required": ["clipboard.read", "network.internet"],
  "optional": ["storage.shared"]
},
"permissionReasons": {
  "clipboard.read": "Read text from clipboard for translation",
  "network.internet": "Connect to translation API"
}

Available Permissions

Permission ID	Risk	Description
`fs.read`	Medium	Read files
`fs.write`	High	Write files
`fs.execute`	High	Execute files
`clipboard.read`	Medium	Read clipboard
`clipboard.write`	Low	Write clipboard (auto-granted)
`network.local`	Low	Local network
`network.internet`	Medium	Internet access
`network.download`	Medium	Download files
`system.shell`	High	Execute commands
`system.notification`	Low	System notifications
`system.tray`	Medium	System tray
`intelligence.basic`	Low	Basic intelligence
`intelligence.admin`	High	Admin intelligence
`intelligence.agents`	High	Intelligence agents
`storage.plugin`	Low	Plugin storage (auto-granted)
`storage.shared`	Medium	Shared storage
`storage.sqlite`	Medium	Plugin SQLite database access
`window.create`	Low	Create windows (auto-granted)
`window.capture`	High	Screen capture

Example

{
  "id": "com.tuff.todo",
  "name": {
    "default": "Todo",
    "zh-CN": "Text"
  },
  "description": "Capture and sync todos",
  "version": "1.3.0",
  "sdkapi": 260215,
  "category": "utilities",
  "entry": "init/index.ts",
  "features": [
    {
      "type": "corebox",
      "id": "todo.new",
      "title": "Create Todo",
      "keywords": ["todo", "task"],
      "queryMode": "text"
    }
  ],
  "permissions": {
    "required": ["clipboard.read", "storage.sqlite"],
    "optional": ["storage.shared"]
  },
  "permissionReasons": {
    "clipboard.read": "Read todo content from clipboard",
    "storage.sqlite": "Store todo data in local SQLite"
  },
  "acceptedInputTypes": ["text", "files"]
}

Validation Checklist

id must be unique and alphanumeric with dots.
version follows major.minor.patch for update ordering.
Declaring network requires whitelisting external domains.

Frequent Issues

Issue	Fix
Missing entry	Set `entry` to `init/index.ts` and ensure the file exists.
Excessive permissions	Request only what you truly need, especially for v1.
Keyword collisions	Namespace features like `todo.*` to avoid conflicts.