Where plugins run
entrypoints controls where a plugin can be used:
"entrypoints": { "conversation": true, "task": true, "automation": false }
In a chat: /
Type / in a new chat and pick a plugin. You can choose:
- personal plugins enabled on this computer;
- organization plugins that your company has released, that you can see, that are bound, and whose current version you've installed.
| Rule | Detail |
|---|---|
| Per turn | Up to 3 plugins |
| Version | Fixed per message turn. Queuing, switching chats or a later upgrade doesn't change a turn already sent |
| Checks | For organization plugins, the Hub re-checks organization, audience, trust, binding and your install. The client's choice can't bypass authorization |
| Project plugins | Only in the one project they apply to, or an explicit project context. Ambiguity across projects is blocked |
| What the chat shows | Only name, version and scope. Never binding configuration, secret references or package paths |
Using a plugin in a chat applies its method, quality criteria and AI node instructions to that chat. It does not run scripts, approvals, merges or deployment.
When the company switches the bound version, the catalog shows that an upgrade is available. It doesn't silently replace the version you accepted. After you confirm, the new version applies to later turns.
As a task
When the work needs several agents, models per node, evidence checkpoints, retries or deployment, create a task and choose the workflow.
- In a chat, type
/issue(or/task) and choose the built-in issue form. After you confirm the draft, the issue is linked to that chat; the description, acceptance criteria and attachments are sent as task turns. - Opening a task from your to-do list or AI workspace opens the chat it's linked to. It doesn't create another chat or start execution just by viewing.
- Tasks you add and work dispatched to a chat share one queue. The next item is sent only after the previous one fully finishes; waiting for an approval doesn't count as finished.
Personal plugins are only for trying out in chats on this computer. To run the full workflow from a task, upload it as an organization candidate, then review and bind it (Publish to your organization).
In automations
With entrypoints.automation set to true, people's automation schedules can call the version.
- A schedule stores only the approved binding ID and the plugin's ordinary inputs. Secrets are not stored in the schedule; they are injected from the binding's secret references when each node runs.
- A local automation creates a normal chat and sends the task content, inputs and locked plugin snapshot as one turn.
- Organization workflow bindings and remote dispatch still run as controlled tasks.
- If the plugin is disabled, access is revoked, a required input is missing or conditions aren't met, the schedule fails with a readable reason. It never silently falls back to a plain agent run.