Plugins & Marketplace
Extend Pomavo with installable plugins that add widgets and integrations through a sandboxed SDK.
Overview
Plugins extend Pomavo with new functionality without changing the core application. They are installed per organization from a marketplace, run in a sandboxed iframe, and communicate with Pomavo through a typed SDK. The GitHub integration is itself a plugin built on this system.
The Marketplace
Browse available plugins, see what each one does, and install the ones your organization needs. Installation is per organization, so each tenant chooses its own set of plugins. You can uninstall a plugin at any time to remove its widgets and revoke its access.
Open the marketplace
Find the marketplace in your organization settings and browse the available plugins.
Install a plugin
Install adds the plugin to your organization and registers any widgets it provides.
Use its widgets
Installed plugins surface their UI in the places they target, for example, a panel on the ticket detail page.
Uninstall when done
Uninstalling removes the plugin's widgets and access from your organization.
Widgets and the Iframe Sandbox
A plugin's UI runs inside a sandboxed iframe, isolated from the host application. This means a plugin cannot directly read the page or your session, it can only do what the SDK explicitly allows. Widgets can be placed in designated extension points, such as a section of the ticket detail view.
Because plugins are sandboxed, installing one cannot compromise the rest of Pomavo. The plugin only sees the context the host chooses to pass it.
The Plugin SDK
Plugins are built against a typed SDK that mediates all communication between the sandboxed widget and the host. Through the SDK a plugin can receive context, such as the current ticket, request data, and respond to host events, over a structured message channel rather than direct DOM or network access to Pomavo.
Security Model
- Sandboxed: plugin code runs in an isolated iframe and cannot touch the host's DOM or session.
- Explicit context: plugins only receive the data the host passes through the SDK.
- Per-organization installation: a plugin is only active for organizations that install it, and uninstalling fully revokes it.