# Manage plugins

Canonical: https://hypaware.ai/docs/cli-reference/manage-plugins

```text
hyp plugin <subcommand> [args...]
```

Use `hyp plugin --help` to list plugin operations:

```sh
hyp plugin --help
```

## `hyp plugin install`

```text
hyp plugin install <source> [--ref <ref>] [--path <subdir>] [--yes]
```

Installs a plugin from a recognized name, Git source, or local directory and
updates the plugin lock. For remote code, HypAware fetches and validates the
manifest, then shows the source, resolved revision, permissions, and warnings
before confirmation. Non-interactive remote installation requires `--yes`.
Pin a commit with `--ref` when the source has no fragment. `--path` is reserved
but isn't currently supported for Git subdirectories.

```sh
hyp plugin install github:example/hypaware-plugin-widget --ref COMMIT_SHA
```

Replace `COMMIT_SHA` with a reviewed commit. Installing code authorizes it to
run during plugin activation, so don't approve an unreviewed source.

## `hyp plugin list`

```text
hyp plugin list [--json]
```

Lists active bundled plugins and installed plugins with source and state.

```sh
hyp plugin list --json
```

## `hyp plugin info`

```text
hyp plugin info <plugin>
```

Prints version, source, and lock details for one installed plugin, including
its update state when a check has run. An install under a name this package
bundles also gets a `shadowed:` line: boot selects the bundled copy, so that
install never runs, and the line names the `hyp plugin remove` that clears it.
Answers for a bundled plugin too: those have no install record, so it prints
the version and root directory from the manifest instead. A name that is
neither installed nor bundled exits 1.

```sh
hyp plugin info @example/hypaware-plugin-widget
hyp plugin info @hypaware/claude
```

## `hyp plugin outdated`

```text
hyp plugin outdated [--json]
```

Lists installed plugins whose cached update metadata reports a newer revision.
It doesn't install an update.

```sh
hyp plugin outdated --json
```

## `hyp plugin update`

```text
hyp plugin update [plugin] [--yes]
```

With a plugin name, fetches, validates, confirms, and installs that plugin's
new revision. It applies the same remote-code trust gate as install. Without a
plugin name, it refreshes update metadata and doesn't install code.

```sh
hyp plugin update @example/hypaware-plugin-widget
```

## `hyp plugin remove`

```text
hyp plugin remove <plugin>
```

Removes installed plugin code and its lock entry. It doesn't edit the active
configuration, so validate or reconfigure afterward if the configuration still
names the plugin.

```sh
hyp plugin remove @example/hypaware-plugin-widget
```