Feature add-ons

The feature plugin platform is being prepared for a future desktop release. The catalog contains only releases that have completed review; an empty catalog does not imply that the local example builds are already published or verified.

Add-ons extend the official CodeMux desktop app without requiring an app fork or rebuild. They are separate from themes, footer presets, agent skills, and MCP servers. No add-on is installed or enabled by default.

Install and review

Open Settings → Add-ons. Browse reviewed releases, import a .cmxaddon file, or paste a catalog ID or an exact link such as https://codemux.org/addons/codemux.project-brief?version=1.0.0 into Install from link / ID. This illustrates the link format, not an available release.

Review the parsed package name, publisher/source, exact version, digest, and access. An imported file is Local / unverified, even when its author claims an official name. Replacing a catalog installation with a local source requires explicit review. Choose Install & enable to start using it, or Install to keep the package inert until you enable it.

The website's Copy install link button copies an exact release link. It does not launch a local web server, register an OS protocol, or authorize installation. The desktop verifies the downloaded bytes against the reviewed SHA-256 and fails if the specified release is unavailable; it never silently substitutes another version.

What an add-on can do

A package can contribute commands, project panels, composer actions, and one active composer accessory. Only a declared, granted operation can read local project metadata or a bounded Git summary, append text to the current draft, open an HTTPS link, or call a listed external origin using listed methods.

Appending requires a recent user interaction. It preserves the current draft and never submits a message or materializes a workspace. Project and composer handles expire when their targets change. Workspace-bound surfaces are unavailable for remote workspaces; remote browser clients cannot invoke plugin operations.

Plugins run in separate, bounded native processes. UI is rendered by trusted CodeMux components from validated data; plugin code is not loaded into the main renderer. This boundary is not a claim of protection against an engine vulnerability.

Credentials and private data

Configure ordinary settings and named credentials in the host-owned package detail view. A credential can be used only for its declared origin; plugin code cannot read its value. Persisted values use the operating system credential store. If that store is unavailable or locked, choose Store new values for this session only explicitly. CodeMux never falls back to a plaintext credential file or your CodeMux account token.

Remove deletes credentials even if you choose Keep data for reinstall from the same source. If deletion is temporarily unavailable, the removed package remains inert and Settings shows a retryable cleanup warning. Retained data stays bound to the prior installation and source; another publisher cannot claim it by reusing the name.

Updates, rollback, and recovery

Updates are manual. CodeMux rechecks the catalog about once a day and marks catalog installs with an Update … available badge. Check for update fetches a fresh catalog, downloads the selected release, and opens review. New access requires a new grant. Update activation is probed with external effects denied, private state is snapshotted, and package, grant, and private data are switched together. Rollback restores the previous release and its matching snapshot; private changes since that update are lost. Completed external actions and data sent to external services cannot be undone by uninstall or rollback.

Pause all add-ons works independently of plugin health. You can also start the app with --disable-addons or CODEMUX_DISABLE_ADDONS=1. A plugin fault disables that plugin until you choose Retry. An interrupted activation can pause plugins on the next launch without blocking core application startup.

Previously enabled packages work offline against the last accepted blocklist. Browse shows cached catalog freshness. Online installs and updates require a fresh successful fetch. Offline machines cannot learn new revocations until they reconnect. A catalog listing is a review signal, not a guarantee against all defects.

Build your own

Anyone can write an add-on with the public SDK. Start with Build an add-on, then follow the Project Brief walkthrough.