Installing
The install paths, what each one verifies, and where files land.
The CLI
senclaw skill install <scope>/<name>
senclaw app install <scope>/<name>
senclaw plugin install <scope>/<name>
senclaw workflow install <scope>/<name>This is the path that verifies. The CLI fetches the package document, resolves a version, downloads the artifact, recomputes its SHA-512, checks the registry signature against a pinned public key, and refuses the install if either fails. Nothing is written to disk before both checks pass, and nothing executes during install — there are no install scripts to run.
The
senclawCLI is not released yet. The commands above are what package pages show and what the registry is built around, but today the working paths are the web UI, the HTTP API, and the interoperability endpoint below.
Pin an exact version with <scope>/<name>@1.2.3. A yanked version still resolves by exact pin — it is excluded from ranges, not deleted — so a lockfile that names one keeps working.
Where things land
| Kind | Path |
|---|---|
skill | ~/.senclaw/managed/skills |
app | wherever the platform installer puts it |
plugin | ~/.senclaw/managed/plugins |
workflow | ~/senclaw/workflows |
Other clients
SenClaw is not the only agent that installs plugins, so the registry also serves a plain plugin index at /marketplace.json for clients that speak that format. Any of them can point at it and install what is listed.
The trade-off, stated plainly: that index carries the source repository of each plugin, so a client using it fetches from the repository, not from SenClaw. Those bytes never pass through the checksum and signature checks, and SenClaw cannot vouch for them. Both routes stay supported — the package page says which one you are on rather than implying SenClaw verified something it never served.
Apps
Download from the package page. Every artifact row shows its platform, format and signing status.
Unsigned executables require sign-in to download and are never offered to the auto-updater. That is not a paywall: unsigned binaries served publicly from a new domain get flagged as malware by browser safe-browsing, which takes the whole registry down with them. Sign and notarize (macOS) or Authenticode-sign (Windows) and the build serves publicly.
Apps that ship an updater keep themselves current — see HTTP API for the Tauri and electron-updater endpoints.
Private packages
A private package is visible only to its owner, its maintainers, and the emails on its access list. To everyone else — including the API — it returns 404 rather than 403, because whether it exists is itself something it should not leak.