PAB-53: declare trusted extension capabilities

[pablopunk]

This pull request shifts Nevermind’s extension security model from runtime permission enforcement to a trust‑based review system. Extensions now declare capabilities (instead of permissions) purely for user review—once a user enables an extension, it has full local access without API restrictions.

Key changes:

• User‑controlled enablement: A new extension manager tracks which extensions are enabled. Extensions only load if explicitly enabled, giving the user control over what runs.
• Staged drafts for AI‑generated extensions: The write_extension tool now creates a draft file that must be manually reviewed and enabled in Extensions, rather than automatically installing and loading the code.
• Review‑focused capability declarations: The manifest field capabilities replaces the legacy permissions. The host performs static analysis of the extension source to validate declarations, but no longer enforces them at runtime. Enabled extensions have unrestricted local access.
• Removal of runtime checks: Functions that previously checked permissions before exposing API surfaces (AI, files, clipboard, system shell, etc.) now grant full access unconditionally. Capability declarations serve only as an intent signal for the user.
• Backward compatibility: Legacy permissions are still recognized as capabilities when the modern field is absent, ensuring existing extensions work with the new review language.

Overall, the change makes extensions more powerful while putting the user in charge of trusting and activating them.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nvm	Ready	Preview, Comment	Jul 17, 2026 10:30pm

[kody-ai]

Kody Review Complete

Great news! 🎉
No issues were found that match your current review configurations.

Keep up the excellent work! 🚀

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.

• Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	❌
Security	✅
Business Logic	❌

Access your configuration settings here.

​