Manage Plugins

Plugins can add integrations, controls, and custom views to Super Productivity. They are executable code with significant access to your app data and are not strongly sandboxed from the app. Install only plugins whose source and author you trust.

Install and Inspect a Plugin

1. Open Settings → Plugins.
2. Under Install Plugin at the bottom of the page, choose a plugin ZIP file. Read the security warning that appears and confirm to install. A confirmation message names the installed plugin, which is listed under Uploaded plugins and marked Third-party. Built-in plugins follow, grouped into Integrations (issue and calendar providers) and Other plugins.
3. Expand the plugin's Details to inspect its declared permissions and hooks. Checked permissions are the ones the app enforces: running system commands (desktop only), sending plugin API requests to the listed hosts, and deleting projects through the plugin API. Plugins are not sandboxed, so these do not limit what a plugin's own code can do, such as reading your data or contacting other servers; see below. Details also show what the plugin says it sends off your device and to whom. The install warning shows the same, with "(changed in this version)" in its heading when an update changes it, and connecting a new integration shows it below the sign-in fields. For third-party plugins this is the author's own statement, which the app cannot check.
4. Enable the plugin with its toggle and configure it if a settings button is available.

An uploaded or community plugin is installed on this device only: sync does not copy the plugin itself, so install it on every device where you want it. Its on/off state and the data it saves through the app do sync. A plugin that needs nodeExecution runs only in the desktop app (see below).

Install or Update a Listed Community Plugin

Community Plugins on the same page lists plugins made by other users. In the desktop and mobile apps, some entries have an Install button: it downloads the version named on the button, refuses the file unless it is exactly the file that was listed, and then installs it after the same security warning as a ZIP upload. The download happens before the warning so that the warning can show what the plugin sends; nothing is installed or run unless you confirm. In the web app these entries have a Download link instead; install the downloaded ZIP as above. Entries with neither link to the plugin's page, where you download the ZIP yourself. If an install fails to download, do the same.

A listed plugin you have installed shows Installed. When the list names a newer version, the list entry and the plugin's card show an Update button (Download in the web app). The list ships with the app, so it is checked without going online and new versions show up after you update Super Productivity.

Community plugins are not reviewed or guaranteed by the Super Productivity team. Back up your data before installing one; see 2.02-Restore-Data-From-Backup.

Understand the Trust Boundary

• Host-side plugin.js code runs in the app renderer and can read or change app data.
• Iframe plugins use a filtered Plugin API as their supported interface, but they are same-origin with the host. The iframe bridge is not a security boundary.
• Manifest names, versions, and permissions for uploaded plugins are supplied by the plugin itself. Review the source rather than relying on labels alone.

Node.js and Full Machine Access

nodeExecution is available only in the Electron desktop app. It permits a plugin to run native code with the same access to files and processes as your user account.

The Electron main process displays a native Allow/Deny prompt before granting this permission. Uploaded plugins are marked as unverified third-party code, and the safe choice is Deny unless you have inspected and trust the source. Consent is remembered on that device only, for built-in and uploaded plugins alike. Disabling the plugin on that device clears it, and so do removing or re-uploading an uploaded plugin. Disabling it on another device that syncs with this one does not.

The web app cannot grant nodeExecution.

App Auto Track (Alpha)

A built-in plugin for the desktop app on macOS and Windows; off by default (on Linux it says so once per session and stays idle). While Super Productivity is in the background, it checks which app and window are in front every 10 seconds. If they point at one open task for 90 seconds, it suggests tracking that task the next time you switch back to Super Productivity, unless another task's window has taken over or you have not used that window for 10 minutes. A task points at a window when:

• one of your rules (text in app name or window title = exact task title) matches and exactly one open task has that title, or
• the window title contains an issue key like PROJ-123 or #123 that appears in the title of exactly one open task.

It only suggests; it never starts or stops tracking on its own. Window titles stay in memory and are never stored or logged.

On macOS, reading the active app needs the Automation permission for System Events, and reading window titles also needs Accessibility. Both apply to the whole Super Productivity app, not only this plugin, and stay granted until you revoke them under System Settings → Privacy & Security. macOS asks for Automation on first use, but not for Accessibility: add Super Productivity under Privacy & Security → Accessibility yourself. Without it, only rules that match the app name work.

On Windows, the check runs a hidden PowerShell script that compiles a small helper into your temp folder. Some security software flags this pattern; if the plugin reports that it cannot read the active window, check your security software's log. It shows that message once per session, when you switch back to Super Productivity, and keeps retrying in the background.

Disable or Remove a Plugin

• Turn off the plugin's toggle to disable it and revoke its native execution consent.
• Use Remove to uninstall an uploaded plugin.
• If suspicious behavior continues, restart the app after disabling or removing the plugin.

To build a plugin of your own, use Build one with AI under Install Plugin (also in Help → Build your own plugin), follow the plugin guide link, or see 2.15-Develop-a-Plugin.

Related

• 2.15-Develop-a-Plugin — Build a plugin
• 3.01-API — Plugin API reference
• 3.05-Web-App-vs-Desktop — Platform differences
• 3.06-User-Data — Data and permissions