This repository hosts community Mini App packages for MiniMax Code. One task dominates: add or
update one package at plugins/<github-username>/<plugin-id>/.
- New package: copy
examples/hello-miniapp/toplugins/<you>/<plugin-id>/, then replacename,displayName,description,author,exampleQueries, the<title>, the README, and the LICENSE holder. Update: open the existing package. Readdocs/package-contract.mdbefore editing any manifest. - Read
docs/runtime.mdbefore editingminiapp/node/*. Readdocs/security.mdbefore the Node code reads or writes files, spawns processes, or makes network requests. - Write
README.md(English;README.zh-CN.mdoptional): what it does, how to install and open it, and the headings## Tested environmentand## Data & access(files read/written, network hosts, spawned processes, where state is stored). - Add one row to the table in both root READMEs.
- Run
npm run check. Done when it reports no errors and every warning is either fixed or explained in the PR description.
context.dataDiris your private state directory, created and owned by the Host. Store durable state there and treat its location as opaque. Reading Host files has no supported API; a plugin that does so must state in its README which files, how it locates them, and that this relies on unspecified layout.- stdout and stdin belong to the Host. Log through
context.logger. - The Node entry is ESM with a named export
start(context). Resolvestartonly after the listener accepts connections oncontext.listen. Return{ dispose };disposecloses everything the entry started: server, timers, child processes, streams, file handles. - Bind only
context.listen.host/context.listen.port. Servesurface.pathplus your own routes. - A Mini App package is a MiniMax Plugin. Skills, MCP servers, hooks, host bindings, MCP endpoints,
and
hostConnectorAccessmay all be declared;npm run checkvalidates their shape only, and the Host validates them at install time. This repository documents the Mini App payload; treatcontext.hostConnectorand those capabilities as outside its scope. - The runtime payload is exactly
miniapp/clientandminiapp/node. Keep tests and docs outsideminiapp/. Vendor third-party code inside the payload;node_modulesis never committed. - Paths are portable: ASCII, no symlinks, no
...npm run checkenforces the full rule set. - Secrets stay in the Node process: never in HTML, Client JavaScript, logs, or error responses.
- Plugin ID = directory name =
plugin.json.name, unique across the repository.
Maintainers gate on three things: manifests pass npm run check; the README describes real
behaviour (files, network, processes, tested environment); the package cannot damage Host or user
data. Everything else is a suggestion.
docs/package-contract.md— layout, the three manifests, portable paths, limitsdocs/runtime.md—start(context),dispose, logger, lifecycledocs/security.md— process boundary, state, writing outsidedataDir, spawning, networkexamples/hello-miniapp/— the copyable starting pointCONTRIBUTING.md— fork, pull request, and license steps for people