Boundary

First-party adapters compile into Helm. Each third-party plugin runs lazily as one Bubblewrap-contained child process. If Helm cannot construct the sandbox, the plugin does not run. Distribution packages are trusted installation sources; local unsigned bundles require developer mode.

Protocol

Plugins use the JSON-RPC 2.0 specification over stdin/stdout with LSP-style Content-Length framing and a separately negotiated helm-plugin/1.x contract. Messages are capped at 1 MiB. The contract defines initialization, capabilities, failure, shutdown, and bounded declarative page schemas.

Authority

Plugins receive structured snapshots and propose declarative changes. The core checks authorization on every host operation, validates every value and path, and alone performs writes, reloads, and rollback. Plugins cannot contribute native widgets, HTML, JavaScript, shell fragments, Lua, QML, arbitrary commands, or network access in 0.1.

User interface

A plugin may describe settings groups, controls, validation, state, and help through versioned metadata. Helm renders native controls and treats all plugin-provided text as untrusted plain content.

Sandbox policy

The host follows Bubblewrap's official security guidance: a new session, all namespaces unshared, no network, a cleared environment, read-only runtime and plugin files, no home or session bus, and a private temporary directory. Helm fails closed if Bubblewrap is unavailable.