One possible way is:

1. wrap compiled js in a closure

2. export to the global namespace only what is specified explicitly in plugin.json.
   E.g. add .exports field.

   {
     "exports": ["foo.bar", "foo.baz"]
   }

This way, if plugin requires some lib for it's internal workings it should add it as a project.clj dependency. If plugin relies on some "global service" provided by other plugin, it should add that plugin as a plugin.json dependency.

May be do something else, but otherwise it's a delay-action bomb.