Parse a `plugin.toml` file into a `PluginManifest`.

Scan a single plugin subdirectory.

Spawn the reactor thread. Returns once the thread has created its node, services, and WaitSet (or propagates the startup error).

Add a MITRE ATT&CK technique observation.

Cargo features baked into the prebuilt `malboxd` release binaries (the release workflow builds with default features).

Convert a non-null `*const c_char` config field to a leaked `&'static str`. Sets the last FFI error and returns `Err(())` on failure (null pointer or

List all machines.

The plugin's unique identifier (typically the crate name).

Asynchronously wait for the next entry. Returns `None` when the bus is closed **and** empty.

Scan the entire plugin directory. Invalid manifests are logged and skipped.

Get the Allocate capability. This is always available since all providers must implement Allocate.

Add a syntax-highlighted code block.

Insert an in-memory payload. Writes it to a new temp file in the stash directory and returns the handle.

Push a log entry into the global bus. Returns silently if the bus has not been set (e.g. when running as a host plugin).

Non-blocking receive of a pending task request.

Send a response, automatically chunking payloads that exceed the IPC buffer capacity. Retries on transient `OutOfMemory` (buffer backpressure) with a

Inline definitions after both classes are complete

Register a sibling [`PluginResult`](crate::result::PluginResult) as an artifact.

Add a highlighted callout box with a severity level.

Cast an opaque `MalboxContext*` back to a Rust `Context` reference. # Safety The caller must guarantee that `ptr` is a valid `*const Context`.

Set a human-friendly plugin name for the frontend (e.g. `"YARA Scanner"`).

Fetch all snapshots for a machine, ordered by creation time.

Append labels to the verdict. Can be called before or after [`verdict`](Self::verdict) - labels are merged at [`build`](Self::build) time.

Get a reference to the database pool.

Convert a Rust `Event` to its C-ABI representation. For `PluginResultAvailable`, the returned `OwnedCEvent` owns the string data that `event.source`

Set a short summary shown at the top of the report.

Consume the builder and return all accumulated results.

Non-blocking receive.

Set the verdict. `score` is optional (pass `None` when the plugin has no numeric score). Can be called before or after [`labels`](Self::labels).

Wake up the plugin, indicating which channel has data.

Fold a set of plugin reports into a cross-plugin aggregate. Consumes the reports so each row's `indicators`/`ttps` JSONB is moved out and parsed once

Release all temporaries created for the current callback invocation. The runtime **must** call this after every plugin callback returns.

Mark the bus as closed and wake all waiters.

Cast an opaque `MalboxContext*` back to a Rust `Context` reference. # Safety `ptr` must have been created from a `&Context` in `ffi_callbacks.rs` and

Destroy a VM by its provider-side ID.

Add a horizontal divider.