Features that are safe for Plugin API access

This is dynamic, I’ll add more stuff when I’ve thought about it a bit more, this only includes currently locked services, and their impact usable by developers (also some other non-service stuff that is specifically intended for Studio)

AssetService

DeserializeInstances is safe, rest of the APIs are probably reflected correctly.

CalloutService

For the time being, this cant be public because the APIs are a little too internal for the time being.

CollaboratorsService

This is a service without any methods, however the Collaborator instance under it is 100% safe for plugins to use, if the APIs are changed to be read-only

CommandService

???

DataModelSession/MultipleDocumentInterfaceInstance

Not as useful now since standalone support was removed.

DebuggerManager

Yes, the fact this isn’t developer usable right now is interesting, considering its LocalUserSecurity, same for the modern debugger APIs that the new debugging plugins use (but dont know the service or instances that it uses)

DraftsService

The APIs under here that read data are safe, maybe not the features to commit or revert script changes

LocalStorageService

Obsolete by plugin settings, not needed.

PermissionsService

Unsafe currently, if write permissions were granted, plugins can give themselves permissions causing privilage escalation (not good). Read permissions are safe.

PlguinAction

Contains a property called DefaultShortcut that is useful, but may cause breakage with other plugins, currently not safe.

PublishService

Obsolete by plugin:SaveSelectedToRoblox() and also unsafe as there is no confirmation window.

QWidgetPluginGui

Most of the features under here are safe except for the ability to block input from other parts of the application

StudioAssetService

Most functionality is unsafe, except for SerializeInstances which is, and would be useful for external tooling. The events may also be useful for lifecycle signals, however, unsure of the safety of these

StudioService

Feel like what is safe already has been reflected for the most part, no changes here needed

StudioPublishService

Unsure of the safety of this, seems new

TemporaryScriptService

This is non-useful in Lua, but it would be insane to have some instance that would allow the rendering of code views in PluginGuis (maybe a portal GUI instance?)