Community plugins
Anyone can publish a Macotron plugin. Macotron lists every GitHub repository with the macotron-plugin topic, and installs one only after you read it and approve it.
Install a community plugin
- Open Settings → Plugins, select Catalog, and switch to Community.
- Browse or search the list. Each row shows the title, the owner, the star count, and when the repository last changed. GitHub opens the repository.
- Select Add. Macotron downloads the source and runs nothing yet.
- Read the install sheet. It names the repository and says who wrote the plugin, and that it runs with the same access Macotron has. The scan runs over the code, as it does for any changed plugin (see Security). View Source… opens the code.
- Approve it. Only then does the file reach your
plugins/folder.
Stars sort the list, but stars are not a sign of trust: they can be bought. Read the code, or ask your coding agent to explain it, before you approve.
If a plugin with the same file name is already installed, the sheet warns you before it replaces it.
Updates
Nothing installs or updates by itself. When the published code of an installed community plugin differs from your copy, the Community list marks it Update, and the Macotron menu shows a plugin update row. An update opens the same sheet as a first install, so you read the new code before it runs.
Update All in Settings → Plugins opens one review sheet for each community plugin in turn.
Publish your own
- Name the repository
macotron-plugin-<name>. - Put one plugin in it. Put the script in the root as
<name>.js;plugin.jsandindex.jsalso work. - Write
titleanddescriptioninmacotron.plugin({ … }). Macotron shows those, not the GitHub description. - Add the
macotron-plugintopic to the repository.
That is all. There is no index to edit, no pull request, and no review queue. macotron-plugin-weather holding weather.js installs as weather.js. macotron-plugin-cleanshot is a working example.
Macotron caches the GitHub search for an hour, so a new repository can take that long to show up.
What Macotron does not check
- Names. Two repositories can use the same name. The sheet shows the owner so you can tell them apart.
- Permissions. A plugin declares permissions, but Macotron cannot hold it to them.
- Signatures. Plugins are not signed. The hash check and the review sheet catch every change before it runs.
When a published plugin turns out to be harmful, its hash goes on the block list, and every Mac stops running those bytes at its next launch. See The block list.