rmyndharis/OpenWA v0.6.0

on GitHub

The plugin platform release: untrusted plugins now run sandboxed, and you can install and uninstall them from the dashboard. One breaking change for plugin authors (the sandbox context), so this is a minor bump.

Added

• Install and uninstall plugins from the dashboard. Upload a plugin packaged as a .zip (POST /api/plugins/install) and remove it (DELETE /api/plugins/:id). The Plugins page is redesigned into a status rail — the active engine + library version, enabled/installed counts, and the live list of active plugins — alongside a catalog with an Install button and a per-plugin Uninstall. Uploaded packages are validated (manifest, safe id, zip-slip + size guards), only extension plugins are installable (engines and other tiers stay built-in), and built-ins cannot be uninstalled.

Changed

• ⚠️ Breaking (plugin authors): plugins loaded from the plugins/ directory now run sandboxed in an isolated worker thread instead of in-process. Their context is curated to messages, engine, storage, logger, config, pluginId, and registerHook, with capability calls permission-checked on the host — a sandboxed plugin can no longer reach the host hookManager directly or share host objects. Bundled/built-in plugins (engines, auto-reply, translation) are unaffected and still run in-process. See docs/23-plugin-sandboxing.md for the trust model and the boundary's limits.
• Engines are now single-active: enabling an engine other than the configured engine.type is rejected (switch engines in settings, then restart). The dashboard shows the active engine as Active and the others as Available, fixing the state where two engines could appear active at once.
• Calmer plugin cards — the loud gradient, type-colored card headers are replaced with clean cards and a subtle type-tinted icon.

Fixed

• Plugins page: the "Active" state and the Enable/Activate actions were all the same green and hard to tell apart. Actions are now a solid green button and the current state a neutral chip. (#417)
• The dashboard reports each plugin's real built-in status (previously only the WhatsApp Web.js engine was flagged built-in).
• The appearance/theme popover no longer spills outside the sidebar onto the page. (#424)