Table of Contents
🌏 中文版
The previous article brought external MCP capabilities into ToolExecutor. Repository-local extension introduces another cluster of terms: skill, hook, and plugin. Rivumi loads them together, but they do not share the same authority.
A skill changes guidance, not capability
Rivumi discovers skills in .rivumi/skills/*.md. Each file must be regular, non-symlink UTF-8 Markdown with only name and description frontmatter. File count, individual size, and total rendered context are bounded. Explicit selection uses exact names; unknown and duplicate names are errors.
Rendered content is labeled repository-local guidance below system, developer, permission, and tool-safety rules. The native loop injects it into initial context. An external runner receives a resolved bundle and skill-resolution.json. A skill can teach a workflow, but it cannot manufacture a tool or relax permission policy.
A hook is an opt-in blocking gate
.rivumi/hooks.json can run exact argv commands around approval requests, tools, and compaction. Rivumi bounds timeout, argv, output, and environment, then sends the event payload on stdin. Project hooks are disabled unless the operator sets RIVUMI_ENABLE_PROJECT_HOOKS=1.
Hooks are deny-only. allow means that a hook adds no denial; it cannot bypass the permission layer. A timeout, nonzero exit, malformed output, or runner exception fails closed. A pre-tool denial prevents execution. A post-tool denial records a problem after the action and cannot reverse its side effects.
There is a separate host boundary. Hook commands run with the source repository as cwd. Opting in therefore trusts the command itself. Deny-only semantics constrain its lifecycle decision, not the command's own ability to edit files or produce other host side effects.
A plugin is a local package, not a marketplace
Plugin manifests live in .rivumi/plugins/*.json and may list description, discovery metadata, skills, and hooks. Referenced skill paths must remain inside the repository and cannot use symlinks or path escape. A plugin skill receives the <plugin>.<skill> namespace, while plugin hooks follow project hooks.
rivumi plugin install accepts a local manifest path and copies the manifest and skill files into the project. It rejects a duplicate name unless overwrite is explicit. Loading the JSON manifest does not execute plugin code.
skill markdown -> bounded prompt guidance
hook argv -> opt-in, deny-only lifecycle gate
plugin JSON -> local packaging for skills + hooksThe reviewed implementation has no remote registry, signature verification, dependency solver, lockfile, update or uninstall flow, arbitrary executable plugin payload, or MCP-server packaging. “Local package format” is more accurate than “plugin marketplace.”
The three layers solve different problems: skills explain how to work, hooks add lifecycle vetoes, and plugins package and discover both. Keeping their authority separate avoids treating installed Markdown as execution permission. The next article follows work into isolated child agents while modification authority remains with the parent.
References
Loading...