Plugins

The dashboard and CLI discover plugins through /api/plugins. Each response keeps package inclusion, administrator enablement, subscription entitlement, platform support, and runtime health separate.

POST /api/plugins/{id}/actions/{action}/authorize evaluates an action without changing state. Every descriptor-declared action can be executed through the corresponding action endpoint. The generic host owns ordinary lifecycle actions and dispatches provider-specific operations such as reset, uninstall, and persistent-data purge back to the declaring plugin. Purge authorization requires {"confirm_persistent_data_loss":true}. Successful provider-specific operations return the plugin’s validated action receipt; host lifecycle actions do not manufacture provider receipts.

Descriptor-declared CLI commands use structured argument arrays and are available through both /api/plugins/contributions/cli/{command} and the native daemon route /stackie/v1/plugins/contributions/cli/{command}. No command string is evaluated by a shell.