ContextQMD
Back to Super Productivity

Manage Plugins

docs/wiki/2.21-Manage-Plugins.md

18.18.02.2 KB
Original Source

Manage Plugins

Plugins can add integrations, controls, and custom views to Super Productivity. They are executable code with significant access to your app data and are not strongly sandboxed from the app. Install only plugins whose source and author you trust.

Install and Inspect a Plugin

  1. Open Settings → Plugins.
  2. Read the security warning and inspect the plugin's listed permissions, hooks, and network hosts.
  3. Under Install Plugin, choose a plugin ZIP file.
  4. Enable the plugin with its toggle and configure it if a settings button is available.

Community plugins are not reviewed or guaranteed by the Super Productivity team. Back up your data before installing one; see [[2.02-Restore-Data-From-Backup]].

Understand the Trust Boundary

  • Host-side plugin.js code runs in the app renderer and can read or change app data.
  • Iframe plugins use a filtered Plugin API as their supported interface, but they are same-origin with the host. The iframe bridge is not a security boundary.
  • Manifest names, versions, and permissions for uploaded plugins are supplied by the plugin itself. Review the source rather than relying on labels alone.

Node.js and Full Machine Access

nodeExecution is available only in the Electron desktop app. It permits a plugin to run native code with the same access to files and processes as your user account.

The Electron main process displays a native Allow/Deny prompt before granting this permission. Uploaded plugins are marked as unverified third-party code, and the safe choice is Deny unless you have inspected and trust the source. Consent for an uploaded plugin is local to that device and is cleared when the plugin is disabled, removed, or uploaded again.

The web app cannot grant nodeExecution.

Disable or Remove a Plugin

  • Turn off the plugin's toggle to disable it and revoke its native execution consent.
  • Use Remove to uninstall an uploaded plugin.
  • If suspicious behavior continues, restart the app after disabling or removing the plugin.
  • [[2.15-Develop-a-Plugin]] — Build a plugin
  • [[3.01-API]] — Plugin API reference
  • [[3.05-Web-App-vs-Desktop]] — Platform differences
  • [[3.06-User-Data]] — Data and permissions