Linus Rath
cbeeca3ea5
feat: let plugins edit the message being written from composer buttons and menus
2026-10-14 11:35:00 +02:00
Linus Rath
1bd4f743a1
feat: give plugins the app's own controls and draw their dialogs like the app's dialogs
2026-10-14 11:10:14 +02:00
Linus Rath
607f1b2496
feat: let plugin notifications carry a link to the plugin's own server
2026-10-14 10:58:19 +02:00
Linus Rath
7f7f6bf949
fix: check the name, type and size of blobs plugins upload, and the email id of email.setKeyword and email.removeKeyword
2026-10-14 10:00:03 +02:00
Linus Rath
78f72e0c03
fix: give plugins settings that change after they started, let their frames copy to the clipboard and tell them the user's time zone
2026-10-14 09:01:03 +02:00
Linus Rath
c3cf0ddcff
feat: tell plugins whether the admin has set up their accounts and keys
2026-10-14 08:24:28 +02:00
Linus Rath
1e62fbbee1
fix: start each plugin once, so its hooks don't fire twice
2026-10-14 08:22:55 +02:00
Linus Rath
289e975d38
fix: give large attachment offloads time to finish and let cloud pickers write links into the text
2026-10-14 07:40:32 +02:00
Linus Rath
ae2130f5c8
feat: let a plugin ask a question on top of its own dialog
2026-10-14 06:47:53 +02:00
Linus Rath
929ccb8bee
fix: stream answers to proxied requests that send a body, and allow keyless services the admin sets up
2026-10-14 06:42:40 +02:00
Linus Rath
85c6cbcac8
feat: let plugins move messages between folders and archive them
2026-10-14 06:31:07 +02:00
Linus Rath
72be961383
feat: let plugins create repeating events under a stable id of their own
2026-10-14 06:29:15 +02:00
Linus Rath
1f89e89ce5
feat: let plugins refresh their message-list badges, which now need only the read permission
2026-10-14 06:26:10 +02:00
Linus Rath
49511dff38
feat: let plugins read their own non-secret admin settings without the admin permission
2026-10-14 06:23:10 +02:00
Linus Rath
e9b2ef3258
fix: let plugin frames use forms without letting them post anywhere
2026-10-14 06:19:12 +02:00
Linus Rath
8bf4df4513
feat: add a notifications panel for plugin notifications and app errors
2026-10-14 05:25:16 +02:00
Linus Rath
1ba53655e5
fix: let identity hooks stop a plugin's change, send notification clicks to plugins that show notifications, and mark reading mail as high risk
2026-10-14 04:37:24 +02:00
Linus Rath
8ad8f44e78
Merge branch 'feat/plugin-host-apis' into feat/plugin-system-audit
...
# Conflicts:
# lib/plugin-sandbox/permission-text.ts
# lib/plugin-sandbox/permissions.ts
# lib/protocol-handlers/mailto.ts
# locales/en/common.json
2026-10-14 04:34:14 +02:00
Linus Rath
5d9268c923
feat: let plugins add buttons, calendar day labels and pages, and use connected accounts from the sandbox
2026-10-14 04:31:43 +02:00
Linus Rath
3a83c00e00
feat: describe every place a plugin can show UI in one catalogue, with a permission for each area
2026-10-14 04:31:43 +02:00
Linus Rath
437bb1d11a
test: require every plugin permission to gate a method, hook or slot
2026-10-14 04:28:24 +02:00
Linus Rath
3a65964d26
feat: let plugins show notifications that name the plugin
2026-10-14 04:26:16 +02:00
Linus Rath
ead925c1b8
feat: let plugins open a filled-in composer and save drafts
2026-10-14 04:23:17 +02:00
Linus Rath
08e2d65944
feat: let untrusted plugins save attachments and message sources of a given message
2026-10-14 04:16:31 +02:00
Linus Rath
60257bb732
feat: let users connect accounts for plugins in a dialog the plugin can't read, and disconnect them in settings
2026-10-14 04:14:13 +02:00
Linus Rath
8fd6bc42c3
feat: let plugins read any message, list a folder and see the folders
2026-10-14 04:13:33 +02:00
Linus Rath
121d8ba30c
feat: let plugins manage templates, sender signatures and the out-of-office reply
2026-10-14 04:06:06 +02:00
Linus Rath
3df031edd1
feat: let plugins read and change calendar events and tasks
2026-10-14 04:02:47 +02:00
Linus Rath
a3cb9e630e
refactor: describe every plugin hook in one catalogue
...
The hook buses, the permission each hook needs and the docs were three
separate lists that had drifted: 145 of 198 hooks were never fired and
nothing noticed. `lib/plugin-hook-catalog.ts` now names each hook with
its kind, permission, payload and when it fires; the permission check
reads it, and a test fails for any catalogued hook without a call site.
Groups still being wired in this branch are listed in that test.
Also:
- new before-hooks for archive, spam, read state, star, keywords, folder
changes, RSVP, event import, tasks, file moves, settings, identities,
filters and out-of-office, plus onComposerClose and onSyncStateChange
- removed hooks that can never fire: the S/MIME group (S/MIME is a
plugin now), onMobileViewSwitch, onSidebarAppChange and the
registerShortcut pseudo-hook
- smime:read no longer grants anything; manifests that name it still
install, with a warning
2026-10-14 03:14:29 +02:00
Linus Rath
8ef7ec022f
fix: deliver a plugin OAuth callback only to the plugin that started the flow
2026-10-14 03:04:17 +02:00
Linus Rath
bf1d8fd2c3
fix: stop keeping unanswered plugin hook calls and old slot callbacks around
2026-10-14 03:02:12 +02:00
Linus Rath
ada81d5f8f
fix: hide the Next.js dev badge inside plugin slots and warn that dev sandboxes are not isolated
2026-10-14 03:01:13 +02:00
Linus Rath
3bfc0e69d0
fix: check attachments a plugin adds to the composer and keep callbacks out of shouldShow
2026-10-14 02:58:47 +02:00
Linus Rath
2adb1e2b12
fix: size toolbar plugin slots to their content and give composer plugin buttons their own row
2026-10-14 02:53:46 +02:00
Linus Rath
cef2438c33
fix: let untrusted plugins upload attachments for the composer again
2026-10-14 02:34:31 +02:00
Linus Rath
f048db7b52
fix: count each plugin hook failure once and keep a plugin that kept failing turned off
2026-10-14 02:33:45 +02:00
Linus Rath
a491eab317
fix: hash WKD names with WebCrypto instead of shipping a Node crypto polyfill to the browser
2026-10-14 02:31:39 +02:00
Linus Rath
23c4c654d7
fix: limit what a plugin can store, download, toast and send to a WKD lookup, and report refused admin config writes
2026-10-14 02:30:54 +02:00
Linus Rath
22846b4a9b
fix: keep blob uploads privileged-only and derive the WebAuthn salt from the calling plugin
2026-10-14 02:28:11 +02:00
Linus Rath
bb562362b8
fix: lay out plugin slots right-to-left in Arabic, Hebrew and Persian and use the app font size
2026-10-14 02:24:45 +02:00
Linus Rath
a21dbc92ec
fix: switch running plugins to a new language right away and fall back from de-CH to de
2026-10-14 02:23:40 +02:00
Linus Rath
8f70951555
fix: give plugins their default settings and apply setting changes without a reload
2026-10-14 02:21:45 +02:00
Linus Rath
eadff464a3
fix: keep plugin shortcuts behind ui:keyboard and off the keys the app and browser use
2026-10-14 02:19:10 +02:00
Linus Rath
ff1d1f399d
fix: limit plugin dialogs to one at a time, name the plugin in each and offer to turn it off
2026-10-14 02:15:45 +02:00
Linus Rath
be3debdcb4
fix: never send a message when a plugin that checks it before sending fails or does not answer
2026-10-14 02:11:59 +02:00
Linus Rath
592db209db
fix: sign plugin bundles when they are installed and require the signature for privileged plugins
2026-10-14 02:05:47 +02:00
Linus Rath
e720be7e17
feat: let users install their own plugins, with admin review of the actual code
...
The admin page offered "User Plugin Uploads" and "Require Admin
Approval", but nothing in Settings used them: there was no upload, no
uninstall and no way to ask for approval, and the admin had no list of
requests. The approval code that existed pinned a hash of the code only
and showed the admin a manifest the browser sent, never the code.
Now:
- Settings > Plugins has an install button (when uploads are allowed),
a remove button for the user's own plugins, and lists in plain
language what each plugin may do, high-risk items first
- an install sends the ZIP to the server, which reads the manifest and
code itself and pins the request to a hash of both
- the admin Plugins tab lists requests with the code and approves or
denies them; a user may have 10 open requests
- a user plugin is checked again on every start, so a revoked approval
or turning user plugins off takes effect
- the consent dialog and the plugin settings are translated, use the
theme colours, and show the sites a plugin may send data to
2026-10-14 02:03:26 +02:00
Linus Rath
c45533646e
fix: give slot plugins the message, event or contact only with the matching read permission
2026-10-14 01:31:30 +02:00
Linus Rath
9bff740a89
fix: keep plugin network access to the origins in its manifest
2026-10-14 01:27:02 +02:00
Linus Rath
4d733aa598
chore: remove unused exports and the dead plugin error boundary
2026-10-13 13:36:51 +02:00
Linus Rath