Plugins

Locksmith vault providers are standalone Go binaries that implement a small gRPC interface (VaultProviderService). Two kinds of plugins exist:

Built-in - shipped inside the locksmith binary as a per-platform zip. Currently gopass (Linux + macOS), keychain (macOS only), and 1password (Linux + macOS). Their version is locked to the locksmith version that built them; there is no separate plugin release cycle, no network resolution, no version drift. See architecture.md.
Custom - third-party plugins. Drop a locksmith-plugin-<type> binary into ~/.config/locksmith/plugins/ and the discovery logic picks it up. Compatibility (platform + version range) is reported via vault health. See authoring.md and compatibility.md.

In this directory

architecture.md - how built-in plugins are bundled, extracted, and updated.
authoring.md - SDK quickstart and discovery rules.
compatibility.md - Info(), version range, platform, and compat_warnings in vault health.