ADOS EXTENSION SYSTEMShipping

One manifest, two halves, a signed archive

The plugin platform behind every ADOS extension. A single manifest ships a signed Python agent plugin and a sandboxed Mission Control panel. Capability permissions gate both halves.
Browse extensionsRead the SDK docs
1
Manifest, both halves
2
SDKs: Python and TypeScript
Signed
.adosplug archives
Sandbox
Capability-gated

How it works

From one manifest to two halves

A plugin declares an agent half, a GCS half, or both in a single manifest. The platform installs each half into its own sandbox and wires them together.

Manifest to sandboxes
manifest.yamlone declaration
Agent pluginPython, subprocess sandbox
Capability permissionsRuns on the companion
GCS paneliframe, capability tokens
Named UI slotsRuns in Mission Control
The agent half runs Python in a subprocess sandbox. The GCS half runs in a sandboxed iframe mounted into a named UI slot. Both are gated by the capabilities the manifest requests.

Agent half

Python plugins on the companion computer

The agent half runs as a Python subprocess in its own sandbox. It requests capabilities up front, and the host only grants what the operator approves. Plugins read telemetry, drive hardware, and add on-vehicle behavior without touching the core.

  • ✓Subprocess-per-plugin isolation
  • ✓Explicit, per-capability permissions
  • ✓Hardware, sensor, and behavior plugins
Agent plugin · sandbox

GCS half

Sandboxed panels in Mission Control

The GCS half loads in a sandboxed iframe and mounts into a named UI slot. It talks to the host over a message channel with capability tokens, so a panel can only reach what it was granted. Custom tabs, overlays, and controls slot in with no host fork.

  • ✓Sandboxed iframe, no host access by default
  • ✓Capability tokens per message
  • ✓Named UI slots for tabs and overlays
GCS panel · UI slots

Trust

Signed, sandboxed, permissioned

An extension is a signed archive. Both halves run sandboxed, and every capability is granted explicitly at install.

Security model
Archive
.adosplug, signed
Agent sandbox
Subprocess + capabilities
GCS sandbox
iframe + tokens
Permissions
Explicit, per-capability
SDKs
Python + TypeScript
manifest.yaml
name: battery-health
version: 0.1.0
agent:
  entrypoint: plugin.py
  permissions: [telemetry.read]
gcs:
  slot: node.detail.tab
  permissions: [ui.tab]

Related

Build and browse

Extensions
The open-source plugin registryLearn more →
PluginsShipping
Python plugins for hardware, sensors, and on-vehicle behaviorLearn more →
PluginsShipping
Custom panels and overlays in sandboxed iframesLearn more →

Build an extension

Both halves ship from one manifest and one signed archive. Browse the open-source registry to see it in action.

Browse the registry
Get Early Access