# AGENTS.md for plugins

This file applies to `plugins/`.

## Plugin Boundary

Plugins are game management plugins. Do not model unrelated billing, cloud sales, host provider behavior, or independent plugin backend services here.

## Structure Rules

Manifests, schemas, SDK contracts, example plugins, and test fixtures must live in dedicated directories. Do not bury action schemas or bridge types inside UI page code.

## Security Rules

Plugins must never receive raw AI provider keys, run credentials, raw host paths, or direct storage endpoints. Use platform-mediated bridge calls for jobs, logs, files, artifacts, and AI.

## Local Development

Local plugin development should exercise real platform-run flows through dev registration instead of bypassing platform authorization.