Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Tools and trust: plugins that need plugins and programs, and trusting a plugin

Open
  • Is something wrong?
#336 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
8/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
nodejs, zig
Domain
developer-experience, tooling

Research direction

This is a tracking issue for a design plan, so start by reading plans/TOOLS_AND_TRUST_PLAN.md in the fizzyedit/plans repository. The checklist names core.darwin_spawn, settings.zon, the app/ tools manager and the tools/ registry directory as the areas each step touches. Work happens in the numbered sub-PRs, not here, so a newcomer should pick one step only after the maintainers confirm its scope.

Written by the indexing model from the issue text.

Description

The plan is plans/TOOLS_AND_TRUST_PLAN.md in fizzyedit/plans. Three mechanisms, kept apart:

  • Plugin to plugin: "works with", never "requires". A plugin names the plugins it works best
    with, and why, in its identity manifest. The store offers them together; a missing partner is
    never a load failure.
  • Tools: programs fizzy manages for plugins (zls, zig, Node, npm packages, agent
    binaries, fizzy-mcp). Specs are data in the registry; plugins ask through an SDK service; every
    tool is configurable in Settings > Tools (system, managed, or a path the person names), and
    nothing installs without asking.
  • Trust. Installing a plugin for the first time asks the person to trust it, saying it runs as
    native code with their permissions and that they are trusting its author. Trust, bound to the
    plugin's source, lets its updates install automatically; a change of source asks again.

Each step is its own PR saying Part of #<this issue>:

  • 1. core.darwin_spawn takes extra environment variables; one spawn helper for tools
  • 2. Trust: the dialog, the record in settings.zon, auto-update gated by trust, the source-change hold, plugins from outside the store
  • 3. The tools manager (app/) and the SDK tools service (moves the fingerprint)
  • 4. Settings > Tools, and the tool consent dialog
  • 5. tools/ in the registry (fizzyedit/plugins), exported with the catalog
  • 6. First consumers: zls for the zig plugin; the chat's agent picker (Codex, then Node and npm agents); fizzy-mcp
  • 7. works_with in the manifest, shown and offered by the store

🤖 Generated with Claude Code

Dominant language
Zig
Stars
1.5k
Forks
40
Avg merge
5h 35m
Merged PRs (30d)
151

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from fizzyedit/fizzy

All issues in fizzyedit/fizzy

Similar issues

More DevTools issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.