API Reference
This section is the complete API reference for xbot plugin development, generated from the actual source code. It covers both the Go plugin SDK (plugin/ package) and the web frontend plugin API (web/src/plugin-api/).
| Document | Description |
|---|---|
| Manifest Schema | Complete plugin.json schema with every field, validation rule, and contribution type |
| PluginContext API | The permission-filtered API surface available to plugins during activation |
| PluginTool API | Tool definition, execution, result types, and the fluent result builder |
| Hook Events | All 13 lifecycle hook events and the HookPayload field reference |
| Environment Variables | XBOT_* variables injected into script plugin processes |
| Permissions List | All 23 permission strings, their meaning, and which APIs they gate |
| Trigger Events | Activation events and widget trigger matcher formats |
| Widget Zones | UI slot names where widgets can render |
| Component Types | Declarative L1 component types for web views |
| RPC Methods | Backend RPC method table (host RPC + frontend ctx.rpc) |
| Event Types | Lifecycle events, typed event bus (EventMap), and notifier types |
xbot plugins have two distinct API surfaces:
- Go SDK (
plugin/package) — in-process native plugins and the host side of stdio plugins. Types:Plugin,PluginContext,PluginTool,HookPayload, etc. - Web Plugin API (
web/src/plugin-api/, package@xbot/plugin-api) — type-safe ESM frontend plugins. Types:PluginManifest,PluginContext<P>,EventMap,BackendRPC, etc. Capabilities are types: thepermissionsarray in the manifest determines which capability interfaces exist on the context at compile time.
Every capability a plugin uses must be declared in plugin.json under permissions. The PermissionChecker (see Permissions List) enforces this at runtime; the web API enforces it at compile time via PluginContext<P>.
The wildcard "*" grants all permissions (Go side only). Invalid permissions fail manifest validation at load time.