Plugin manifest

PluginManifest (re-exported via @coro-ai/plugin-sdk) describes everything the runner needs before it ever import()s your runtime.

Field	Purpose
id	Stable slug (github, gitlab, anthropic, …) used in config + logs
kind	scm | tracker | executor (future kinds extend via string widening)
version / displayName	Telemetry + dashboard cards
hostCompatibility	Semver range checked against runner HOST_PLUGIN_API_VERSION
configSchema	Zod object validated on plugins.installed.<id>.config before init() runs
capabilities?	Optional boolean map surfaced to feature gates
webhook?	Descriptor for cloud HMAC verification + route suffix (pathSuffix)
mcpToolMap?	Thin remaps from canonical Coro helpers to upstream MCP tool ids
allowedMcpTools / disallowedMcpTools?	Curated allow/deny sheets for MCP servers you attach
intelligence?	Contribution list (skills/snippets) layered into _intelligence/
ui?	Optional dashboard overrides (customPanel id for OAuth-heavy providers)

Drop-in filesystem plugins use coro-plugin.json mirroring manifest metadata plus:

Field	Purpose
entry	Relative ES/CJS module exporting createPlugin()

Both shapes must agree on id so the CLI + loader stay consistent.