From 65107c484be0e5ffc9c38b00211b2c2a3441594c Mon Sep 17 00:00:00 2001 From: Guillermo Montero Date: Thu, 17 Sep 2026 14:02:47 +0200 Subject: [PATCH] docs(plugins): scope the folder-drop safety claim to Python plugins --- CHANGELOG.md | 4 ++++ docs/plugin-authoring-guide.md | 5 ++++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5259aee07..91c48e234 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -353,6 +353,10 @@ breaking changes may land in a minor release. ### Fixed +- Docs: clarified that the "dropping a plugin folder in never runs code" guarantee + applies to Python plugins only, declarative plugin shell hooks still run on + discovery. + - Adopt the current bundle's deferred-work ids before writing a reset sweep task's intent (DW-144). Keep dispatch and ledger-close ids aligned, and journal both old and new ids as `sweep-bundle-dwids-adopted` when they differ. diff --git a/docs/plugin-authoring-guide.md b/docs/plugin-authoring-guide.md index dc5125de2..3fdf65e5e 100644 --- a/docs/plugin-authoring-guide.md +++ b/docs/plugin-authoring-guide.md @@ -11,7 +11,10 @@ Unity game-engine layer. A plugin can: Plugins are **folder-drop**: a directory with a `plugin.toml` manifest (plus any helper scripts) dropped under `.bmad-loop/plugins//`. No registration, no install step. A plugin that ships **in-process Python** is loaded only when you -**trust** it by name — dropping a folder in never runs code. +**trust** it by name — dropping a `[python]` plugin folder in never runs its +code. Declarative plugins (shell hooks, no `[python]` module) are not gated the +same way and run as soon as they are discovered — see +[Trust & safety](#trust--safety) for both tiers. > Already wrote a [CLI adapter profile](../README.md#other-coding-clis) or the old > `[engine]` block? Same idea — declarative TOML + optional scripts, discovered and