CLI: install, remove and list registry plugins (emdash plugin install <publisher>/<slug>)

[joeblew999]

The gap. A registry plugin can be installed only from the admin's Install button. Neither CLI has a command for it: emdash has no plugin command, and emdash-plugin (search, info, init, validate, bundle, publish) stops at finding one. So a site cannot be set up with its plugins from a script, an agent or CI, and "the same plugins on every environment" has to be clicked through each time.

What exists already. The admin's install is two requests any holder of an admin API token can make:

• POST /_emdash/api/admin/plugins/registry/verify with { did, slug } — the site reads the publisher's signed records and answers with the version, capabilities, public routes and MCP tools;
• POST /_emdash/api/admin/plugins/registry/install with the same, plus the acknowledged… fields echoing what verify returned.

Beside them: …/registry/[id]/update, …/registry/[id]/uninstall, and GET /_emdash/api/admin/plugins. The publisher's DID comes from the registry aggregator's resolvePackage.

The idea. Three commands on the emdash CLI, over those routes, with the same --url, token and header handling as content and schema:

emdash plugin list
emdash plugin install <publisher>/<slug>[@version] [--yes]
emdash plugin remove  <publisher>/<slug>

install would print what the consent dialog shows — capabilities, allowed hosts, public routes, MCP tools and which are destructive — and ask, with --yes for scripts. A version would let a project hold a plugin to the release it has read: today the latest is what installs.

Two things we met on the way that a CLI would want too:

• there is no request that lists what an installed registry plugin declared (its public routes, its capabilities: GET /_emdash/api/admin/plugins gives "capabilities": [] and "hasAdminPages": false for one that has both), so a tool cannot check a plugin it did not install itself;
• create-emdash --sandboxed-plugins writes the Worker Loader binding but no sandboxRunner in astro.config.mjs, so a site made with it still cannot run a registry plugin, and there is no command to switch the sandbox on later.

Why we ask. We wrap EmDash's CLIs in mise tasks (emdash-run) and had to write about 500 lines of script to do this through the admin routes, which your own comments call experimental. We would rather delete it. Seen with EmDash 1.2.0 and @emdash-cms/plugin-cli 0.13.3, on Cloudflare and Node sites.

Written up with Claude Code and checked by running it.