Extend the office without modifying it
A plugin contributes validated data — providers, models, skills, routing rules, tools, role templates, pipelines or panels. This site serves the catalog a dev3d host installs from, and every entry carries a bundle URL plus the sha256 the host verifies before it runs anything.
3 plugins published
Sorted by popular
Office echo
dev3d.office-echo
A minimal code plugin: registers one tool employees can call, and logs run lifecycles. It exists to prove the code path and to be copied.
Local coder
dev3d.local-coder
Registers a whole provider: a local OpenAI-compatible model server, its endpoint and the model it serves. The keyless loopback base URL is what tells the offic…
Cost guard
dev3d.cost-guard
Keeps the cheap work cheap: routes intake, summarising and research to the least expensive capable model, adds a small local model to the catalog for it to aim…
Just published
The eight things a plugin may contribute
A manifest's contributes object has exactly eight keys. Everything a plugin adds to the office arrives through one of them, and all of it is validated data rather than code — the one exception is toolNames, which only a code plugin may use.
| Key | What it reaches |
|---|---|
providers | A whole provider: adapter kind, base URL, and the name of the environment variable holding the key. |
models | Models merged into the registry catalog, so the router can pick them. |
skills | Skill documents a floor can enable like any other. |
roleTemplates | Role templates offered in the hire form alongside the floor’s own roles. |
pipelines | Pipeline definitions offered to every floor. |
routingRules | Scores that reorder the candidates the router already considers, scoped by task class. |
uiPanels | Panels rendered by the host from data, in a declared placement. |
toolNames | Code plugins only: tools registered, namespaced to the plugin and grantable per role. |
Two counts are easy to confuse with that eight. Ten permissions may be declared — models, providers, tools, routing, skills, agents, pipelines, settings, ui and events — and they are a consent record, not a runtime gate. settings is a top-level manifest field, not a ninth contribution key.
Use this marketplace
A dev3d instance is pointed at one catalog URL. It fetches the document, lists the entries, downloads the bundle it selects and verifies its sha256 before anything is installed.
Catalog URL
This document is live and generated on request: a plugin appears as soon as it is published. It is served with Access-Control-Allow-Origin: * so a host may fetch it from anywhere.
Register it on a running host
curl -X POST localhost:8787/api/plugins/sources -H 'content-type: application/json' -d '{"label":"dev3d.net","url":"https://dev3d.net/marketplace/catalog.json"}'Installing is off by default, and that is deliberate.
DEV3D_ALLOW_PLUGIN_INSTALL is false until an operator turns it on. Installing a plugin runs code inside the orchestrator process with the orchestrator's authority — the declared permission list is a consent record you read before installing, not a runtime sandbox that constrains it afterwards.