Why a plugin can rewrite the system prompt

When we started, plugins could add tools, providers and channels — the obvious surface. Then we watched two techniques go around GitHub in the same month, both of which were purely instructional. No new capability, no integration. Just better phrasing of what the model should do, and measurably better output as a result.

One appended terseness guidance and cut output length by roughly a third with no loss of accuracy on code or error text. The other appended a decision ladder that made the model reach for reuse and the standard library before writing anything new. Both were a few hundred words. Both were, in every meaningful sense, upgrades to the AI.

And both were unshareable. To adopt either, you read someone's repo, understood their intent, and re-engineered your own prompt assembly. Every team did that work separately, and most teams never did it at all.

Making the prompt an extension point

So we exposed the assembly step. A plugin can declare SystemPromptBuilt and receive the prompt before it reaches the model, along with the agent's configuration. It returns whatever it wants the model to see.

onSystemPromptBuilt(ctx) {
  return ctx.append(BREVITY_DOCTRINE);
}

That is the entire mechanism. It is also, obviously, the most dangerous hook we have. A plugin at that position can read the agent's instructions and shape every response it gives. Which is why the trust boundary had to land before the feature did.

Two execution paths

Third-party plugins run in an isolated V8 environment and talk to the platform over gRPC. They get the surface they declared and nothing adjacent — no filesystem, no sockets, no secrets, no other sessions. First-party capabilities run native. The path is chosen by who wrote the code, not by what the code says it does.

The result is a catalog where installing a stranger's work is a reasonable Tuesday afternoon decision. That is the point. The state of the art here moves weekly, and a platform where adopting the newest thinking takes one click compounds faster than one where every improvement is a fork.