Plugins are added to Spirefy from the marketplace, either inside the app or from the command line. This is how installation works.
From the command line
spirefy pull downloads a plugin and verifies its signature in one step:
spirefy pull openapi-importer
Plugin identifiers are flat and lowercase, like openapi-importer, not scoped paths. By default pull fetches the latest version; pass --version to pin one, and -o to choose where the package lands.
What happens on install
A downloaded plugin is a single .zp package that holds everything it needs: the compiled WebAssembly, its WIT interfaces, any resources, and its signature. Spirefy verifies the signature before the package is unpacked, so nothing untrusted runs. You can run the same check yourself at any time:
spirefy verify openapi-importer-1.0.0.zp --strict
Inside the app
In the app, the Plugin Manager is where you add a plugin and turn it on. Loaded plugins can be saved as a profile and switched in place, so you keep a lean set for one task and a fuller set for another. See the desktop app for profiles.