Runtime packages teach the daemon a new agent CLI. Workflow plugins are owner tooling that runs as you, over the public CLI and SDK. They are separate on purpose: a workflow plugin never extends the daemon.
Each package is a signed, content-addressed archive installed per host. Official packages come from the signed runtime catalog that ships with each release. Any other agent CLI can be added as a runtime package with a TOML runtime and detection manifest, without recompiling pohunek.
| Runtime | Status | Note |
|---|---|---|
| Codex | Shipped | official runtime package |
| Claude Code | Shipped | official runtime package |
| Hermes | Shipped | official runtime package |
| Pi | Shipped | official runtime package |
| shell | Shipped | the only built-in runtime |
| OpenCode 2.x | Planned | planned, zajca/pohunek#227 |
pohunek plugin list pohunek plugin install ./acme-pi-1.0.0.tar.zst --sha256 sha256:<64 hex> pohunek plugin inspect acme.pi pohunek plugin update acme.pi ./acme-pi-1.1.0.tar.zst --sha256 sha256:<64 hex> --yes pohunek plugin doctor
A workflow plugin declares named actions as argv arrays, plus optional periodic jobs, long-running services and event reactions. It is pinned by the digest you approve. The install step prints every argv before anything is created.
schema = 1 [plugin] id = "acme.work" version = "1.2.0" description = "Work overview" [actions.overview] argv = ["bin/work", "overview"] args = "passthrough" timeout_ms = 30000 [jobs.poll] argv = ["bin/work", "poll"] every_s = 300
pohunek workflow install work.tar.zst --sha256 <digest> # review, nothing installed pohunek workflow install work.tar.zst --sha256 <digest> --yes # install, enabled pohunek workflow list [--json] pohunek workflow run [--json] acme.work overview --since 1d pohunek workflow disable acme.work
A workflow plugin that answers who has to act next on every open work item, joining Linear, GitHub and pohunek sessions. It ships a terminal interface, a rofi and sway launcher and a web control center.
Both kinds of plugin run with your account's full authority, the same owner trust boundary as any script you run. The digest proves which bytes you approved. It does not confine them. Install only plugins whose source you trust, and read the argv the consent step prints.
pohunek