bamboo-plugin 2026.7.15

Local plugin bundles (manifest, install provenance, installer skeleton) for the Bamboo agent framework
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79

//! Error type shared by manifest validation, provenance I/O, and the
//! installer trait.

/// Result alias used throughout this crate.
pub type PluginResult<T> = Result<T, PluginError>;

#[derive(Debug, thiserror::Error)]
pub enum PluginError {
    /// `plugin.json` failed structural validation (see
    /// [`crate::manifest::PluginManifest::validate`]) — includes bad ids,
    /// bad semver shape, path-traversal attempts, duplicate ids, etc.
    #[error("invalid plugin manifest: {0}")]
    InvalidManifest(String),

    /// No installed plugin with this id (uninstall/lookup).
    #[error("plugin not found: {0}")]
    NotFound(String),

    /// A plugin with this id is already installed and `install` was called
    /// with [`crate::installer::InstallDisposition::FailIfInstalled`] (the
    /// `bamboo plugin install` verb). Re-run as an upgrade
    /// (`bamboo plugin update` / [`crate::installer::InstallDisposition::Upgrade`])
    /// to replace it in place.
    #[error("plugin already installed: {0} (use `update` to upgrade in place)")]
    AlreadyInstalled(String),

    /// A capability the plugin declares collides with an existing entry in a
    /// shared store that is NOT owned by this plugin (a user's own entry, or
    /// another plugin's). For MCP servers and workflows the install REFUSES
    /// rather than clobbering — an MCP server id / workflow filename is
    /// referenced elsewhere, so silently overwriting (and later deleting on
    /// uninstall) would destroy the user's entry. `kind` is a short label
    /// such as `"mcp server"` or `"workflow"`.
    #[error(
        "{kind} '{name}' already exists and is not owned by plugin '{plugin_id}'; \
         refusing to overwrite — rename the conflicting entry or the plugin's, then retry"
    )]
    Conflict {
        kind: &'static str,
        name: String,
        plugin_id: String,
    },

    /// The manifest's `platforms` gate excludes the current OS.
    #[error("plugin '{plugin_id}' does not support platform '{platform}'")]
    UnsupportedPlatform { plugin_id: String, platform: String },

    /// A step this foundation crate deliberately leaves for a later agent
    /// (capability-registration wiring — see `PLUGIN_PLAN.md`). Returned
    /// instead of panicking so a partially-stacked branch fails a request
    /// cleanly rather than crashing the process.
    #[error("not yet implemented: {0}")]
    NotImplemented(String),

    /// A capability failed to register/deregister against `AppState` for a
    /// reason OTHER than an ownership conflict (e.g. `config.json` couldn't
    /// be persisted, a network fetch during source-staging failed). Kept
    /// distinct from [`Self::Conflict`] (a deliberate REFUSAL, not a
    /// failure) so callers/HTTP status mapping can tell "your plugin
    /// collides with something" apart from "something broke while trying to
    /// register/fetch it".
    #[error("plugin registration failed: {0}")]
    Registration(String),

    /// A downloaded artifact's sha256 did not match the manifest's declared
    /// hash. Checked BEFORE unpacking (supply-chain: a URL-installed plugin
    /// ships a binary that will be executed) — never surfaced as a generic
    /// `Registration`/`InvalidManifest` error so callers can distinguish "the
    /// author's manifest is malformed" from "the bytes served at that URL do
    /// not match what the manifest promised".
    #[error("artifact verification failed: {0}")]
    ArtifactVerificationFailed(String),

    #[error("io error: {0}")]
    Io(#[from] std::io::Error),

    #[error("json error: {0}")]
    Json(#[from] serde_json::Error),
}