FOR DEVELOPERS

You are the supply side.

The catalog is worth something only because people build for it. A plugin is a TypeScript project against a typed SDK: you declare which hooks you want, you get exactly that surface, and you publish under an immutable version. Untrusted code runs sandboxed, which means users can install yours without reading it first.

index.ts — a prompt skill
// index.ts — a SystemPromptBuilt middleware
// "middleware" is an ambient global from the SDK — no imports, no exports.

const GUIDANCE =
  "\n\nAnswer in as few words as carry the meaning.\n" +
  "Never abbreviate code, commands, error text\n" +
  "or URLs — reproduce those exactly.";

globalThis.middleware.systemPrompt = async (context) => {
  return context.systemPrompt + GUIDANCE;
};
index.ts — a compaction provider
// index.ts — a compaction provider
// "compaction" and "host" are ambient globals from the SDK.

globalThis.compaction.summarize = async (context) => {
  const { messages, focus } = context;
  const result = await host.session!.llm!.complete({
    messages: [
      { role: "system", content: SUMMARY_DOCTRINE },
      { role: "user", content: serialize(messages) },
    ],
  });
  return result.assistant.text ?? "";
};
THE SDK SURFACE

Declare a hook, receive exactly that.

Every hook is typed, and the sandbox grants nothing you did not ask for. A plugin that declared only systemPrompt cannot read files, open sockets, or see another agent's session.

middleware.systemPromptReceives the assembled prompt and returns the replacement. No cancel — a turn always needs a prompt. Runs before every model call.
compaction.summarizeReceives the session's historical messages and returns one summary string, replacing the built-in summarizer entirely. A blank or oversized result falls back to the built-in and posts a transcript notice.
13 more middleware hooksInbound and outbound messages, todos, notify scheduling, the three SSH command hooks, and session-clear — each typed to its own context, most able to call cancel(reason) to veto the operation before it happens.
events.*Fire-and-forget lifecycle notifications — installed, session started, session cleared or deleted, updated, uninstalled. Delivery is at-least-once, so handlers must be idempotent.
tools.<name>A name, a JSON schema for its arguments, and a handler. Shows up in the agent's tool list and in the transcript like any built-in.
host.*The capability-gated surface — host.session, host.agents, host.models, host.workspace, host.media, host.llm, host.ssh. A member's mere presence on host is the grant; you don't get what you didn't declare.
PUBLISHING

Immutable versions, visible tiers.

There's no CLI to install — a plugin is a folder package: a readme.md with your name and description in the frontmatter, and an index.ts against the typed SDK. What you publish can never change under a user; a version is a fixed artifact, and an upgrade is a decision they make with a diff in front of them.

1Author
A folder package against the typed SDK — a readme.md for your name and description, an index.ts for the code. No scaffold, no CLI: it's TypeScript.
2Upload
A zip goes to the Portal API. The backend bundles it and introspects exactly which hooks and tools it registers — the same path whether you're testing or shipping.
3Publish
A version is minted immutable the moment it's accepted. Ship a fix as a new semantic version, never a mutation of an old one.
4Get installed
Community plugins run sandboxed by default. Ship consistently and apply for the verified tier, which puts your identity on the card.
publishing — the Portal API
$ zip -r caveman.zip . -x tsconfig.json

$ curl -X POST $BASE/plugins -H "Authorization: Bearer $TOKEN" \
    -d '{"slug":"caveman","displayName":"Caveman"}'

$ curl -X POST $BASE/plugins/$ID/versions/zip -H "Authorization: Bearer $TOKEN" \
    -F file=@caveman.zip -F semVer=2.1.0
  → caveman@2.1.0 published (immutable)
  → capabilities introspected: SystemPromptBuilt
  → tier: community · sandboxed

Why build here.

Your technique reaches everyone at once. A prompt improvement you found last week can be running in every crew that installs it, without anyone forking anything.The sandbox lowers the trust barrier. Users install unreviewed code because it cannot hurt them. That is your distribution.You keep the credit. Author identity on the card, version history, and a changelog readers can follow.
Read the SDK docsBrowse the catalog

Crews of expert agents that finish the work.

Create an account, add your model key, and write your first agent's soul. The rest of the crew can arrive in one click.

Assemble your crewRead the docs