Publishing plugins

Authoring loop

1. coro plugin init my-provider --kind scm|tracker scaffolds ~/.coro/plugins/my-provider/ with coro-plugin.json, TypeScript sources, and intelligence/snippets/.
2. Implement ScmPluginBase / TrackerPluginBase plus optional mcpServer() + normalizeInbound.
3. npm run build emits index.js next to coro-plugin.json (loader requires this layout for drop-ins).
4. coro plugin list (runner online) verifies registration; restart coro start after installs.

Publishing to npm

• Package name convention: @scope/coro-plugin-foo or coro-plugin-foo.
• Include coro-plugin.json at published root (CLI copies or rewrites entry paths when installing).

Consumers run:

coro plugin install @coro-ai/plugin-gitlab
# or
coro plugin install git+https://github.com/org/plugin.git --id gitlab

coro plugin install executes npm install inside ~/.coro/plugins/<id>/, guarantees a manifest exists (synthesising pointing into node_modules if needed), and reminds you to restart the runner.

Trust model

Plugins run in-process with runner credentials — treat them like admin code:

• Pin versions / verify checksums when installing from git URLs.
• Prefer first-party @coro-ai/* packages for regulated environments.
• Review allowedMcpTools to ensure a plugin is not exfiltrating excess scope.

coro plugin uninstall <id> wipes the drop-in directory; built-ins remain bundled with @coro-ai/runner.

Private registries

Because install is plain npm, configure .npmrc in the plugin host directory (or globally) for authenticated feeds before invoking coro plugin install.