Manifest

Manifest

The only required file is manifest.json. Host API 1 is required in this repo. If host_api is higher than the running Ordryn build, load fails.

Required identity

Field	Required	Notes
id	yes	Must match the folder name. Pattern ^[a-z][a-z0-9-]{1,32}$ (2–33 characters, starts with a letter).
name	yes	Display name in Admin and project settings.
version	yes	Opaque string shown in the UI (semver is conventional, not enforced).
host_api	yes	Integer. Use 1.
description	no	Shown under the name. Max 400 characters.

Optional identity

Field	Notes
author	Display name. Max 80 characters.
homepage	http or https URL. Max 200 characters.
license	Short SPDX-style label. Max 64 characters.
icon	Relative image path in the folder (no .., no leading /). File must exist. Served at GET /api/v2/extensions/{id}/icon.

Optional blocks

Field	Purpose
fields	Array of custom task field definitions. See Custom fields.
hooks	Array of { "on": "<event>", "label": "…" }. No duplicate on values. See Hooks.
delivery	Outbound notification transport. Required for hook extensions. See Delivery.
settings	Admin / project / member configuration form. See Settings and controls.
templates	Map of hook name → message string. Keys must be known hook names. See Hooks.
controls	Panel actions such as send_test, rotate_signing, sample_json, rotate_callback. See Settings and controls.
ui	Relative path to an HTML panel. See Sandboxed UI.
permissions	Callback token scopes. See Callbacks and inbound.
actions	Extra inbound webhook verbs. See Callbacks and inbound.

Load rules

• Scan happens at startup only. Restart after adding or editing files.
• Directories whose names start with . are ignored.
• One invalid folder fails that extension only; others still load.
• Duplicate id values disable both copies.
• Failed extensions cannot be configured in Admin.

Log lines look like extensions: loaded <id> or extensions: failed ….

ui

ui is an optional relative path inside the extension folder (no .., no leading /). If set, the file must exist or load fails.

Host API 1 serves that HTML as a sandboxed project panel. Project members see it in an iframe (sandbox without allow-same-origin). Sibling files next to the HTML are available under /api/v2/projects/{id}/extensions/{id}/ui/…. Do not put secrets in the panel.

See Sandboxed UI and the callback-bot example ("ui": "panel.html").