Plugin permissions

Plugin permissions

ProLeak decides what a plugin may do from the game you are in:

• In official games (matchmade, against bots, custom lobbies), a plugin watches the game and shows things: it reads events and the game state, builds UI, plays sounds and answers chat commands.
• In local games, a plugin may also act for the player, change cosmetics and reach the game's classes directly.

Each call that needs more than watching checks the game first, and a refused call raises NotAllowedHere.

Contents

• Server kinds
• Capabilities
• Cosmetics
• A policy boundary

Server kinds

proleak.server.kind names the game you are in:

Kind	Decided by
menu	No game server connection.
official_ranked	A matchmade queue: Normal, Casual, CasualNoob, Classic, ClassicNoob, ClassicSortaNoob, Arcade, QuickMatch, Challenge.
official_casual	Games against bots, custom lobbies, practice, sandbox and PvE.
local	A direct connection to a host whose welcome carries a build id starting with proleak-local:.
unknown	Anything else, including the time between connecting and the server's welcome.

ProLeak decides again on every welcome from a game server and resets to unknown on every disconnect. A queue type it does not know is unknown.

Capabilities

Capability	Allows	menu	official, unknown	local
observe	Events, editing incoming messages and game events, UI, sounds, the plugin's own music, sounds, map decorations and effects, reading the game	yes	yes	yes
actions	Editing or cancelling net.out.* and this player's purchases, send mode, signals, pings and emotes, actions.*, chat.send(text), camera moves, advanced.patch	no	no	yes
cosmetics.modify	Editing cosmetic fields and messages	no	no	yes
raw.access	advanced.type	no	no	yes

Chat commands and the curated chat events can be edited and cancelled everywhere, so commands work in official games too.

Cosmetics

Skins, avatars, monuments and other paid or earned looks are cosmetic. The music, sounds, map decorations and effects of proleak.cosmetics are none of those: they change only what this player hears and sees, and units keep their own sounds and effects. src/ProLeak.Core/Net/cosmetics.yml lists the cosmetic messages, fields and game types. Outside local servers those fields are read-only and those messages cannot be edited or cancelled. Events marks every cosmetic event and field.

A policy boundary

ProLeak's API refuses what these permissions refuse. Plugins share the game's process, so Python's ctypes or a separate BepInEx plugin can still reach the game's memory. Plugin modules cannot import clr or Python.Runtime directly, and the approved plugin list refuses plugins that work around the permissions.

---

Previous: Settings | Next: Troubleshooting