External plugins are distributed as GitHub releases with provenance attestations and pinned in clawpatrol.lock.hcl (see the plugins doc). There is no place to discover plugins, no index of which ones exist, and every config has to spell out a full source.
Direction: a registry that lets a config reference a plugin by name and version, with discovery (a list operators can browse), integrity (checksums and provenance, as today), and an update path.
Open design questions: whether the registry is a static index file published from a repository or a service; how third-party plugins get listed and vetted; how it interacts with the existing lockfile and trust-on-first-use; whether clawpatrol grows a subcommand for search/install. Sequenced after the current maintenance work.
External plugins are distributed as GitHub releases with provenance attestations and pinned in
clawpatrol.lock.hcl(see the plugins doc). There is no place to discover plugins, no index of which ones exist, and every config has to spell out a full source.Direction: a registry that lets a config reference a plugin by name and version, with discovery (a list operators can browse), integrity (checksums and provenance, as today), and an update path.
Open design questions: whether the registry is a static index file published from a repository or a service; how third-party plugins get listed and vetted; how it interacts with the existing lockfile and trust-on-first-use; whether
clawpatrolgrows a subcommand for search/install. Sequenced after the current maintenance work.