* feat(plugins): add local-only secret storage API for plugins Add setSecret/getSecret/deleteSecret to the plugin API, backed by a dedicated 'sup-plugin-secrets' IndexedDB that is never part of Super Productivity's sync, exports, or backups (mirrors the existing OAuth token store). Secrets are namespaced per plugin and purged on uninstall. Unblocks credential-using plugins (e.g. IMAP mailbox -> task) that must not put passwords in persistDataSynced or synced issue-provider config. Also purge plugin OAuth tokens on uninstall (best-effort, alongside the secret purge) — they previously leaked past uninstall. Refs #7511 * fix(plugins): purge plugin secrets and OAuth tokens on cache clear clearUploadedPluginsFromMemory (the 'Clear plugin cache' action) wiped plugin code and persisted nodeExecution consent (#8512 Phase 2) but left secrets and OAuth tokens in their dedicated stores. A same-id re-upload after a cache clear has no existingState, so the re-upload purge never fires and the new plugin could inherit the previous plugin's credentials — the same id-reuse gap #8512 closed for consent. Purge both here too, best-effort and idempotent, mirroring the per-plugin uninstall purge. --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| src | ||
| .gitignore | ||
| .npmignore | ||
| DEVELOPMENT.md | ||
| package-lock.json | ||
| package.json | ||
| publish.sh | ||
| PUBLISHING.md | ||
| README.md | ||
| tsconfig.json | ||
@super-productivity/plugin-api
Official TypeScript definitions for developing Super Productivity plugins.
Installation
npm install @super-productivity/plugin-api
Usage
TypeScript Plugin Development
import type {
PluginAPI,
PluginManifest,
PluginHooks,
} from '@super-productivity/plugin-api';
// Your plugin code with full type support
PluginAPI.registerHook(PluginHooks.TASK_COMPLETE, (taskData) => {
console.log('Task completed!', taskData);
PluginAPI.showSnack({
msg: 'Task completed successfully!',
type: 'SUCCESS',
ico: 'celebration',
});
});
// Register a header button
PluginAPI.registerHeaderButton({
label: 'My Plugin',
icon: 'extension',
onClick: () => {
PluginAPI.showIndexHtmlAsView();
},
});
// Register a keyboard shortcut
PluginAPI.registerShortcut({
id: 'my_shortcut',
label: 'My Custom Shortcut',
onExec: () => {
PluginAPI.showSnack({
msg: 'Shortcut executed!',
type: 'SUCCESS',
});
},
});
Plugin Manifest
{
"name": "My Awesome Plugin",
"id": "my-awesome-plugin",
"manifestVersion": 1,
"version": "1.0.0",
"minSupVersion": "13.0.0",
"description": "An awesome plugin for Super Productivity",
"hooks": ["taskComplete", "taskUpdate"],
"permissions": ["showSnack", "getTasks", "addTask", "showIndexHtmlAsView"],
"iFrame": true,
"uiKit": true,
"icon": "icon.svg"
}
Available Types
Core Types
PluginAPI- Main plugin API interfacePluginManifest- Plugin configurationPluginHooks- Available hook typesPluginBaseCfg- Runtime configuration
Data Types
TaskData- Task informationProjectData- Project informationTagData- Tag information
UI Types
DialogCfg- Dialog configurationDialogResult- Dialog return valueSnackCfg- Notification configurationPluginMenuEntryCfg- Menu entry configurationPluginShortcutCfg- Keyboard shortcut configuration
Plugin Development Guide
1. Available Hooks
enum PluginHooks {
TASK_COMPLETE = 'taskComplete',
TASK_UPDATE = 'taskUpdate',
TASK_DELETE = 'taskDelete',
FINISH_DAY = 'finishDay',
LANGUAGE_CHANGE = 'languageChange',
PERSISTED_DATA_CHANGED = 'persistedDataChanged',
ACTION = 'action',
}
PERSISTED_DATA_CHANGED fires on any persistent-data change to this
plugin after the host has finished its initial boot load — including
remote sync deliveries and bulk imports. Handler receives no payload;
re-call loadSyncedData(key?) for any key your plugin tracks to get
fresh data (scoped to the calling plugin). Contract: call
loadSyncedData() on plugin init for the initial state; then use this
hook for subsequent changes. There is no replay-on-register, no
per-key discrimination in the event, and no guaranteed ordering across
rapid changes. Handlers must be idempotent.
2. Required Permissions
Add these to your manifest.json based on what your plugin needs:
showSnack- Show notificationsnotify- System notificationsshowIndexHtmlAsView- Display plugin UIopenDialog- Show dialogsgetTasks- Read tasksgetArchivedTasks- Read archived tasksgetCurrentContextTasks- Read current context tasksgetSelectedTask- Read the task selected in the task detail panelgetFocusedTask- Read the currently focused task row, if anyaddTask- Create tasksgetAllProjects- Read projectsaddProject- Create projectsgetAllTags- Read tagsaddTag- Create tagspersistDataSynced- Persist plugin datagetAppState- Read-only snapshot of application state
3. Plugin Structure
my-plugin/
├── manifest.json
├── plugin.js
├── index.html (optional, if iFrame: true)
└── icon.svg (optional)
4. Example Plugin
// plugin.js
console.log('My Plugin initializing...', PluginAPI);
// Register hook for task completion
PluginAPI.registerHook(PluginAPI.Hooks.TASK_COMPLETE, function (taskData) {
console.log('Task completed!', taskData);
PluginAPI.showSnack({
msg: '🎉 Task completed!',
type: 'SUCCESS',
ico: 'celebration',
});
});
// Register header button
PluginAPI.registerHeaderButton({
label: 'My Plugin',
icon: 'dashboard',
onClick: function () {
PluginAPI.showIndexHtmlAsView();
},
});
// Read full app state
const state = await PluginAPI.getAppState();
License
MIT - See the main Super Productivity repository for details.
Contributing
Please contribute to the main Super Productivity repository.