Host capabilities and permissions

A request that operates on a service must call await context.access.require(serviceId, "inspect" | "execute" | "manage") in addition to declaring its procedure permission. context.services.get(id) checks service visibility and returns null for a missing or inaccessible service. The service catalog includes an optional iconUrl for presentation.

context.services.signals(id) returns the visible service adapter’s declared signals as qualified IDs and severity types, without opening a connection. A missing or inaccessible service returns null. This optional capability requires a host that supports the signal catalog; plugins should check for it when they depend on enumerating signals before the first event occurs.

Plugins can discover and operate any visible adapter service through the generic service catalog:

const resources = await context.services.listResources(serviceId);
const actions = await context.services.listActions(serviceId);
const result = await context.services.queryResource(
  serviceId,
  resourceId,
  input,
);
const actionResult = await context.services.executeAction(
  serviceId,
  actionId,
  input,
);

Discovery returns the adapter’s declared IDs, descriptions, and input schemas without opening a connection. The host keeps credentials private, validates inputs against the adapter definition, and checks inspect for resources and execute for actions. Plugins do not need to import or name concrete adapters.

Plugins can also discover resources and actions contributed by other visible plugins through context.plugins:

const plugins = await context.plugins.list();
const resources = await context.plugins.listResources(pluginId);
const actions = await context.plugins.listActions(pluginId);
const data = await context.plugins.queryResource(
  pluginId,
  resourceId,
  input,
);
const result = await context.plugins.executeAction(
  pluginId,
  actionId,
  input,
);

The host filters discovery by the caller’s plugin inspect permission, validates resource and action inputs against their declarations, and checks the permission declared on each action before invoking it. Plugin code never receives another plugin’s context or storage handle.

Installation administration

await context.access.requireAdmin() requires an owner/admin request identity and plugin manage permission. Use it for installation-wide settings or secrets that service-level manage permission cannot authorize. Both additions are optional host capabilities for compatibility; plugins using them must require a host that implements them. Background jobs run as trusted installation operations.

Compatibility

The new host capabilities are additive. An older plugin can continue using its existing pages and storage. A plugin using a capability absent from its host receives an explicit unavailable-capability error.

Declare the minimum host capabilities your plugin needs in its README and release notes. Matching PLUGIN_API_VERSION does not guarantee every optional capability exists on an older host. Request permissions are enforced by the host; background jobs run as trusted installation code, without request identity.