Plugin System
Moraya supports an extensible plugin system for adding new capabilities beyond the built-in features.
Plugin Manifest
Each plugin includes a plugin.json manifest file:
{
"id": "example-plugin",
"name": "Example Plugin",
"version": "1.0.0",
"apiVersion": "1.0",
"entry": {
"darwin-arm64": "bin/plugin-arm64",
"darwin-x64": "bin/plugin-x64",
"win32-x64": "bin/plugin.exe",
"linux-x64": "bin/plugin"
},
"permissions": ["editor:read", "editor:write"],
"sandboxLevel": "local"
}Sandbox Levels
Plugins run in one of three sandbox levels:
| Level | Runtime | Network Access | Description |
|---|---|---|---|
| sandbox | JavaScript | No | Most restricted, future JS-only plugins |
| local | Native binary | No | Native execution without network |
| system | Native binary | Yes | Full access (requires explicit user approval) |
Permissions
Plugins must declare the permissions they need:
| Permission | Description |
|---|---|
editor:read | Read editor content |
editor:write | Modify editor content |
ai:chat | Access AI chat functionality |
ai:image | Access AI image generation |
ai:voice | Access voice transcription |
ai:voice:capture | Access microphone capture |
net:external | Make external network requests |
Users approve permissions at install time. Plugins cannot exceed their declared permissions.
Installing Plugins
From ZIP File
- Open Settings (
Cmd+,) > Plugins tab - Click “Install from File”
- Select the plugin ZIP file
- Moraya validates the manifest and verifies the SHA256 hash
- Review permissions and confirm installation
From URL
- Open Settings > Plugins tab
- Click “Install from URL”
- Enter the plugin download URL and expected SHA256 hash
- Moraya downloads, verifies, and installs the plugin
Plugin Management
The Plugins tab in Settings provides:
- Enable/Disable — Toggle individual plugins on or off
- Plugin details — View name, version, permissions, and sandbox level
- Uninstall — Remove a plugin and its data
- Data isolation — Each plugin’s data is stored in
{appDataDir}/plugins/{pluginId}/data/
Communication
Plugins communicate with Moraya via JSON-RPC over stdio, similar to MCP servers. Requests are proxied through the Tauri backend for security.