Plugin Extensions (`.curdt` & `.curdl`)

CURD v0.7.1 supports two signed plugin package formats, allowing you to extend the local workflow or the agentic backend seamlessly.

.curdl: Language ecosystem packages
.curdt: Native tool packages

Both are packaged as signed JSON archives and installed through CURD’s plugin control-plane tools (plugin_language and plugin_tool).

`.curdl` Language Packages

Language packages extend CURD’s understanding of source code, letting it parse, navigate, and link symbols across entirely new languages.

A .curdl package provides:

File-extension to language mapping
Native grammar library loading (via Tree-sitter)
Optional semantic query bundles
Build system, LSP, and debug adapter metadata

Build-System Metadata

Language plugins can dynamically influence what CURD considers valid build configurations. If a workspace contains files matching a .curdl plugin’s declared extensions, CURD will automatically surface the plugin-derived build system in curd init workspace analysis.

For example, if an acme language plugin declares build_system = "acme-build", CURD can automatically select that adapter when it sees *.acme files in your repository.

Installing Language Packages

Language packages are installed using the plugin_language CLI tool:


curd run plugin_language add /path/to/lang.curdl

The payload is securely unpacked into .curd/plugins/lang/<package_id>/.

`.curdt` Native Tool Packages

Tool packages extend CURD with signed sandboxed sidecar tools. This allows you to give AI agents access to specialized binaries without breaking the security sandbox.

Tools are:

Installed under .curd/plugins/tool/<package_id>/
Invoked as highly-restricted subprocesses
Required to speak json_stdio_v1
Automatically surfaced in MCP tool listings with their manifest documentation

Tool Runtime Contract

The tool executable is tightly constrained:

It must read exactly one JSON object from stdin and emit exactly one JSON object on stdout.
CURD enforces entrypoint path confinement, subprocess sandboxing, timeout limits, and output-size limits.

Native .curdt tools cannot shadow reserved native tool names (like read, edit, search), ensuring core stability.

Installing Tool Packages

Tool packages are installed via the plugin_tool CLI tool:


curd run plugin_tool add /path/to/tool.curdt

Creating & Packaging Plugins

Plugins are packed into signed JSON archives using the curd-plugin-pack utility. The packaging process reads a manifest.json describing the plugin, hashes the payload files, computes an ED25519 signature using your private key, and produces the final .curdl or .curdt artifact.

1. Language Plugin Schema (`.curdl`)

A language plugin manifest.json defines file extensions and links the Tree-sitter grammar binary.


{
  "manifest": {
    "schema_version": 1,
    "package_id": "acme-language-pack",
    "version": "0.1.0",
    "kind": "language",
    "description": "Signed CURD language ecosystem package",
    "tool": null,
    "language": {
      "language_id": "acme",
      "extensions": ["acme"],
      "grammar_library_path": "lib/tree-sitter-acme.dylib",
      "grammar_symbol": "tree_sitter_acme",
      "query_path": "queries/acme.scm",
      "build_system": "acme-build"
    }
  }
}

(When packing, the CLI automatically handles file hashing and base64 payloads).

2. Tool Plugin Schema (`.curdt`)

A tool plugin manifest.json defines the executable entrypoint and the exact API schema the tool exposes to AI agents.


{
  "manifest": {
    "schema_version": 1,
    "package_id": "acme-proprietary-toolkit",
    "version": "0.1.0",
    "kind": "tool",
    "description": "Signed proprietary CURD tool package",
    "tool": {
      "tool_name": "acme_tool",
      "executable_path": "bin/acme-tool",
      "protocol": "json_stdio_v1",
      "agent_usage": "Send a JSON object on stdin. Return exactly one JSON object on stdout.",
      "description": "Acme deployment tool exposed to CURD.",
      "parameters": [
        {
          "name": "environment",
          "kind": "string",
          "description": "Deployment environment identifier.",
          "required": true
        }
      ]
    },
    "language": null
  }
}

3. Running the Packager

Once your manifest and files (e.g., in a payload/ directory) are ready, generate the signed archive:


# Generate a signing key (if you don't have one)
# Pack a Language Plugin
cargo run -q -p curd-core --bin curd-plugin-pack -- \
  --manifest manifest.json \
  --payload-root payload/ \
  --out demo.curdl \
  --private-key-file signing.key
 
# Pack a Tool Plugin
cargo run -q -p curd-core --bin curd-plugin-pack -- \
  --manifest manifest.json \
  --payload-root payload/ \
  --out demo.curdt \
  --private-key-file signing.key

Note: Plugin trust (plugin_trust), installation, and removal are human-only policy actions and cannot be invoked autonomously by AI agents.

Plugin Extensions (.curdt & .curdl)

.curdl Language Packages