Capabilities and review
Declare the access your plugin needs. The user decides what to grant.
The manifest lists requested capabilities. Installing a package grants none. Users enable access in Plugins / Installed, and can revoke it later. Hay checks the current plugin identity, task ownership, and grants at each operation.
Hay account sign-in is a host-level prerequisite for app access, not a plugin capability. It does not grant model, storage, browser or coding access. No capability exposes the account’s verification code or session token.
Capability reference
| Capability | Supported access |
|---|---|
storage | storage.get, storage.set, sources.list, and outputs.*. |
files.read | documents.list; only documents explicitly imported for the plugin. |
models.invoke | agent.run, models.generate; also required to execute a coding run. Permitted context goes to the selected provider. |
browser.read | browser.open; request approval to open a URL and return visible text. |
browser.control | browser.create, sessions, observe, act, screenshot, close, and browser change events. |
github.read | Approved public GitHub.com PR snapshots through github.readPullRequest. |
github.private.read | Private PR reads, in addition to github.read, a host-managed account connection, an allowed repository, and approval. |
coding.read | coding.project, readFile, list, get, review; preview also needs browser.control. |
coding.run | coding.createSpec, run, wait, stop; coding-spec output handoff. A run also needs models.invoke. |
coding.commit | Request coding.commit and coding.integrate after user review. |
A grant is not blanket approval
A granted browser or coding capability makes the corresponding service available. Navigations, browser actions, coding execution, output handoffs, commits, and integration can still need a concrete host review. Plugins cannot dismiss or approve these requests themselves.
Hay presents requests inline in the originating conversation. A pending request does not block other replies. A user can stop a task or decline the request; the plugin must handle rejection.
Model access
Model access sends the plugin’s prompts and explicitly permitted context to the workspace’s selected model provider. That provider’s data policy applies. A browser tab or local document is not automatically model context for every request.
No verified zero-data-retention route is configured in the current desktop implementation. A workspace requiring such a route blocks inference rather than silently choosing another provider.
Revocation and ownership
Pausing, uninstalling, or revoking access stops owned work where appropriate. A plugin cannot read another plugin’s namespace, claim another task’s output by guessing an ID, or choose a new filesystem root. Host-managed credentials never appear in plugin messages or results.