v0.10.0 — Network origins, binary fetch and secrets

Requires Agent Code ≥ 0.1.3, the first supporting version. The README and JSDoc refer to it as "Agent Code ≥ the first supporting version". Older hosts refuse a manifest that requests net.origins.

Feature-detect api.secrets. It is optional (secrets?) on every API-v2 context. Older v2 hosts do not provide it, and a secrets-only extension requests no new permission, so an older host still loads it. Check if (context.api.secrets) before use, and never fall back to api.storage for a credential.

• net.origins permission + manifest networkOrigins (API v2):
  • 1–4 exact HTTPS origins that net.fetch may reach;
  • the install and update consent dialog lists them;
  • no wildcards, paths, IP literals, localhost, .local or trailing dots.
• net.fetch:
  • responseType: 'text' | 'base64' in the init;
  • bodyEncoding: 'text' | 'base64' in the result;
  • hosts older than Agent Code ≥ the first supporting version ignore responseType, so check bodyEncoding.
• Transport attestation contract exported for services: TRANSPORT_ATTESTATION_HEADER (x-agent-code-transport) and TRANSPORT_ATTESTATION (service / lan), with the rules for when a service may trust it.
• api.secrets (get, set, delete) on views and runtimes, API v2, no permission:
  • values are encrypted with the OS keychain and scoped to the extension id;
  • they are deleted on uninstall.
• Documented:
  • NetFetchInit names the verb httpMethod (older hosts read method);
  • the fixed timeouts: 10 s for private addresses, 15 s for declared origins;
  • the body and response caps;
  • runtimes and views receive the same net.fetch responses (the runtime channel admits a result up to the 256 KiB cap after base64);
  • invalid view arguments now reject with Invalid arguments for <method>. instead of leaving the promise pending;

v0.9.0 — Extension services and scoped network capabilities

• contributes.services declarations (API v2)
• service.run / service.transport / net.listen / net.connect permissions
• api.services (start/stop/status/invoke/expose) on runtime and view contexts
• api.net.fetch brokered private-address fetch (literal private IPs only in v1)
• defineService + runService child-side service contract over process.parentPort

Requires an Agent Code host implementing the matching capabilities (Juliusolsson05/agent-code#1112).

v0.8.0 — API v2 runtimes and views

Types and build helpers for the Agent Code extension platform API v2. Extensions now get one background runtime that owns commands and shared state, plus separate sandboxed views that attach and detach independently.

Install

The SDK is distributed from GitHub, not npm. Its built dist/ is committed.

npm i -D github:Juliusolsson05/agent-code-extension-api#v0.8.0

It requires an Agent Code build that includes the extension platform (Juliusolsson05/agent-code#577).

What's new since v0.3.0

• Runtimes and views: defineRuntime and defineView helpers, host-issued view identities, bounded JSON requests and published view state, and explicit activation events (onStartupFinished, onCommand:<id>, onView:<id>).
• Build preset: extensionViteConfig({ entries }) builds independent runtime and view modules, and the single-entry v1 build still works.
  • It pins the production JSX transform, so a build run with NODE_ENV=development no longer ships a view that crashes with jsxDEV is not a function.
  • The package exports now include a default condition, so a vite.config.ts in a CommonJS package can load the SDK.
• Themes: declarative, namespaced themes built from the Agent Code appearance-token vocabulary.
• Project files: files.readText and files.writeText for runtimes and views.
  • Reads need the fs.read permission, and writes need fs.write.
  • Paths are relative to a live session's project.
  • Writes are create-only unless you pass the version from your last read.
• Notifications: notifications.show(message) needs the notifications.show permission. It posts a short toast attributed to your extension, even when no view is open.

API v1 extensions keep working unchanged. See the README for the full contract and limits.

v0.2.0 — Tier-1 observe

Adds capability-gated Tier-1 observe: api.workspace / api.sessions / api.panes (observe + subscribe), the snapshot types, and extension.id. Syncs the ABI mirror with the app runtime. Tier-0 unchanged.