mohManual

Manual/Going further

Extensions

Chapter 13 · 2 min read

An extension is a small package that gives moh a new ability — a command, a panel next to the conversation, a check on what moh does, access to something outside your project. Extensions can make moh more careful; they can never make it less.

Add one

$ moh extension add @scope/name          # from npm
$ moh extension add github:owner/repo     # from a GitHub release
$ moh extension list
$ moh extension remove <name>

Adding only copies the package — it never runs it and never authorises it. You can also drop an extension file into ~/.moh/extensions/, or a project can list one in its moh.json. Inside moh, /extensions shows what is loaded and what each one asked for.

Every extension comes with a manifest: a short list of what it needs. The first time it would load, moh asks you — before running a single line of it:

extension
Enable extensions/pr-panel?
sha256 9f2c…e41a · no sandbox: it runs inside moh
It may:
· reach api.github.com
· read ./reports
· use the saved credential github-token (it never sees its value)
y enable n leave it off
  • Your answer is tied to the exact file. Edit the extension or its manifest and moh asks again — and if the change asks for more, the question shows exactly what was added.
  • A project cannot enable anything by itself: a moh.json entry is only a proposal until you say yes on your machine.
  • Where nobody can answer (scripts, CI), an extension you never approved is simply not loaded.

What an extension can do

can
  • refuse an action, or ask you about it (yes/no only)
  • add commands, panels and overlays — drawn by moh itself
  • use the specific paths, sites, tools or saved credentials you approved
  • add a note to what the AI is told, visibly logged
can't
  • grant a permission you did not allow
  • read the value of a saved credential
  • get anything its manifest didn't declare
  • stop a conversation when it breaks — failures are shown and moh carries on

No sandbox

An extension is code running inside moh, with your user's access to the computer. The consent question exists for this reason: approve extensions you trust, as you would any program you install.

Saved credentials for extensions are managed with moh secret; they live in your system's keychain where available.

Written for moh 0.61. Inside moh, ctrl+h opens the built-in manual for your exact version.