🔐
Capabilities are explicit
Commands, slash actions, decorations, settings, and focused-block writes each require a declared capability. Tine rejects undeclared effects and stale write preconditions.
Experimental in Tine 0.6 · native to Tine
Small extensions.
Bounded authority.
Tine plugins are WebAssembly guests with explicit capabilities and host-owned controls. They can add useful behavior without receiving unrestricted access to the app, your files, the browser runtime, or arbitrary graph paths.
API 0.2 is experimental. Tine plugins are not compatible with Logseq's @logseq/libs or Obsidian's plugin API.
A deliberately narrow host
A plugin receives a bounded event and returns inert effects that Tine validates and applies. It does not run JavaScript inside Tine or gain a hidden general-purpose bridge.
🧱
The host owns the UI
Plugins return known effects and decorations rather than arbitrary HTML or CSS. Declarative settings render in Tine's own bounded controls.
📦
Versions are immutable
Packages are addressed by identity, version, and digest. Installation leaves them disabled; enabling is a separate, explicit choice after review.
🛡️
Review evidence is visible
The signed catalogue shows source, platform declarations, capabilities, package and report digests, automated findings, and any required human approval.
Install and stay in control
- Open Settings → Plugins → Browse to inspect the signed community catalogue, or choose a local
manifest.jsonand.wasmtogether. - Review the package's identity, supported platforms, requested capabilities, provenance, and safety report.
- Install it disabled, then enable it explicitly under Installed.
- Change plugin-owned options through Tine's host-rendered settings controls.
- Disable without uninstalling, or remove one app-local package version. Neither action changes graph files.
- Cached signed revocations apply before startup activation, even while the live catalogue is unavailable.
F-Droid builds omit the network-backed community plugin and theme catalogue to comply with that store's runtime-code-download policy. Local plugin/theme packages, already-installed plugins, the bounded plugin host, and built-in themes remain available. Other Tine builds retain the signed catalogue.
Plugins and themes are separate
Executable plugins use the WebAssembly API. Token themes contain no code: they are strictly
validated color packages installed under Settings → Appearance → Themes.
Your graph's logseq/custom.css still takes priority.
Available extension points
Command-palette entries, slash commands, bounded block decorations, declarative settings, and preconditioned edits to the focused block.
Not available
No direct DOM, Tauri, filesystem, process, network, global keyboard, or arbitrary graph access; no arbitrary settings UI.
First examples
Bullet threading, query-filter shortcuts, and a behavioral port of heading-level shortcuts.
Porting is explicit
A Logseq or Obsidian plugin needs a deliberate port. The port-gap report records what is faithful, omitted, host-provided, or intentionally privileged.