echo-plugins

Echo Plugin Authoring

Use this skill whenever the user asks to create or change an optional Echo plugin. Chat, Trajectory, Code, Git, Settings, Terminal, workspace services, and existing Echo tools are core features; do not recreate or override them with plugins.

Non-negotiable safety boundary

• Work only under a path inside the active workspace.
• Use echo_plugin_scaffold to create a reviewable source skeleton, normal workspace file tools and shell_command to implement/build/test it, echo_plugin_validate to inspect the finished package, and echo_plugin_stage only when the package is ready for human review.
• Never claim a stage is installed, enabled, or running. Staging returns a real pending-stage ID. Only the owner can approve it through Echo's trusted review UI.
• No model-callable operation can approve, enable, update, or execute newly downloaded/generated native code.
• Never place a secret value in the manifest, source, workspace configuration, logs, UI messages, tool output, or tests. Declare a secret setting and use the resolved runtime configuration.
• Native backends run with the Echo owner's OS permissions. Manifest permissions disclose intent and require approval; they are not an OS sandbox.

Package layout

Every installable package is self-contained:

echo-plugin.json
README.md
LICENSE
assets/
ui/<view>/index.html
ui/<view>/app.js
ui/<view>/style.css
backend/<goos>-<goarch>/<executable>

Source-only folders may additionally contain backend-src/, tests, and .github/workflows/. GitHub releases/repositories must already contain usable artifacts: Echo never runs remote build scripts, package-manager hooks, or lifecycle scripts.

Manifest v1

The published editor/CI schema lives at docs/plugins/echo-plugin.schema.json. Use it for early feedback, then run echo_plugin_validate; the host validator is authoritative for package files, path confinement, namespaces, and core collisions.

{
  "manifestVersion": 1,
  "id": "example-plugin",
  "name": "Example Plugin",
  "version": "1.0.0",
  "description": "What it adds",
  "echo": { "api": "^1" },
  "permissions": [],
  "runtime": {
    "protocol": "echo-jsonrpc-1",
    "targets": {
      "windows-amd64": { "path": "backend/windows-amd64/example-plugin.exe", "args": [] },
      "linux-amd64": { "path": "backend/linux-amd64/example-plugin", "args": [] },
      "darwin-amd64": { "path": "backend/darwin-amd64/example-plugin", "args": [] },
      "darwin-arm64": { "path": "backend/darwin-arm64/example-plugin", "args": [] }
    }
  },
  "contributes": { "views": [], "tools": [], "settings": [], "rpc": [] }
}