Every plugin Crook can offer.
Built from source by CI, published as one static file, read by the same code the terminal decides with. Search by what a plugin does, where it draws, or what it asks to be allowed.
There is no server.
The terminal fetches this one JSON file and, when somebody presses Install, one .wasm. It sends no account, no machine id and no list of what is installed. Offline, Crook shows the copy it already has.
https://github.com/theguriev/crook-plugins/releases/download/index/index.jsonA pull request contains no binaries. The job that runs a stranger's build has a read-only token and nothing to publish with.
Id, version, ABI, capabilities, icon and previews are read out of the built artifact by Crook's own reader.
sha256 catches a truncated download or a moved URL. It is not a signature and nothing here calls it one.
yanked = "why" stops a version being offered and tells anybody running it what happened. The file stays put.