sx v2.1.0

sx 2.1 — extensions

sx 2.1 makes the desktop app extensible. Extensions are small plugins
that add dashboard widgets, publish checks, editor commands, and whole
new views to the app — installed from a shared marketplace in one
click, or published to your own library like any other asset. Yesterday
2.0 gave your team a library; 2.1 lets you shape the app around it.

🧩 Extensions

Settings → Extensions is the new home for everything pluggable.
Extensions belong to a library: installing one shares it with everyone
who uses that library, while turning it on stays each person's own
choice. Enabling shows a plain-language list of exactly what the
extension can access — read your assets, add widgets, connect to a
named host — and re-prompts whenever an update changes that list.
Disabling removes everything it added, immediately.

Extensions ride the normal asset pipeline (type = "app-plugin"), so
publishing, versioning, team scoping, pinning, and the audit trail all
work exactly like a skill — updates can never sneak past review the way
they can in other plugin ecosystems. Org admins can restrict or disable
third-party extensions vault-wide with an [app-plugins] allowlist in
the manifest.

Six built-ins ship in the box and run through the same machinery:
Publish Doctor (pre-publish checks), Templates, Importer, and the three
dashboard widgets (adoption, top assets, leaderboard).

🛍️ The extensions marketplace

Settings → Extensions → Browse marketplace… opens a shared
repository of extensions — search, check the permission chips, Install.
Updates surface in the same list with per-extension and update-all
buttons. The default marketplace ships with fifteen extensions,
including:

• Claude Assist — ask your library questions and get answers that
  cite (and open) your assets, critique the draft you have open as a
  prompt, or turn a description into a skill draft. Uses your own
  Anthropic API key, stored in your OS keychain, talking only to
  api.anthropic.com.
• Review Rota — every asset gets a review due date that adapts to
  how heavily it's used, reviews rotate fairly across the team, and
  verdicts are shared with everyone. Publishing resets the clock.
• Library Grid & Board — bulk-edit metadata in a grid; move drafts
  through a pipeline board that warns when something publishes early.
• Asset Query — pin live query tables over your assets and usage to
  the dashboard, Dataview-style.
• Plus related-assets, activity heatmap, library stats, weekly team
  digest, style linter, table tidy, draft refactor, metric charts, smart
  templates, recent assets, and asset relations.

The marketplace is just another sx vault
(sleuth-io/sx-extensions)
— point the app at your own repository to run a private one.

🔌 Build your own

An extension is a folder with a manifest and one ES module — no build
step until you want one. The versioned SxAPI (1.5.0) gives you
dashboard widgets, sidebar panels, asset tabs, full-page views, palette
commands, publish-time warnings, editor text operations, draft
creation, metadata revisions, per-extension secrets in the OS keychain,
host-scoped network access, and team-shared state stored in the vault.
Start with the authoring guide; publish
with sx add ./my-extension.

Also in 2.1

• ⌘K command palette — every app action, plus whatever your
  extensions add.
• Full-text search — the main search box now searches inside asset
  content, ranked and excerpted, not just names and descriptions.
• skills.new extensions — cloud libraries store extensions and the
  org policy server-side (rolling out; the app detects support
  automatically).
• Git and local libraries now infer asset descriptions from frontmatter,
  so nothing shows "No description yet" when the file already says it.
• Dashboard widgets label their time windows, and hovering the adoption
  donut names the people in each group.

Trust model, briefly

Extensions run inside the app behind a permission-gated API: no
filesystem, no Node, and no network beyond hosts an extension declares
— each one is its own consent line. Treat publishing an extension to a
shared library like giving someone commit access, because within your
org that's what it is. The full model is in the
authoring guide.

Changelog

• 121b792 Approve app extensions spec with amendments
• 393f296 Bump actions/checkout from 6 to 7
• a83dbcf Extensions P1: host, API, palette, built-ins
• 083085b Fix spec consistency findings from review
• 3408308 Record P1 loader spike results in spec
• 3354a3e SK-623: API 1.3.0 — main views, draft ops, metadata
• 1bbb114 SK-623: Add extension update buttons
• d74d9c5 SK-623: Add extensions marketplace
• 672f85a SK-623: Align spec table; fix palette memo
• f66c7b7 SK-623: Allowlist examples use third-party ids
• 7ffd2f6 SK-623: Anchor options flyout to the viewport
• 2ed3838 SK-623: Cap modal height; fix snapshot gate
• 0b73fcc SK-623: Cap tooltip width; unshadow chart scale
• e522221 SK-623: Content search in core; install enables
• 70760f7 SK-623: Dashboard windows labeled; header cleanup
• 1cfd61b SK-623: Deterministic description fallback order
• 2977923 SK-623: Editor API for extensions (1.2.0)
• d8258a9 SK-623: Extensions P2 — consent, policy, intent
• 8703aa1 SK-623: Extensions P3 + P2 review fixes
• 2cdceaa SK-623: Extensions P4 — third-party distribution
• c1842d8 SK-623: Extensions feedback round
• 23cce2d SK-623: Fall back to frontmatter descriptions
• dc88a30 SK-623: Fix P1 review findings
• 93abced SK-623: Fix P4 + feedback review findings
• 4fdf0f1 SK-623: Fix content-search review findings
• cea2180 SK-623: Fix import grouping in plugin_shared
• c0f7aa7 SK-623: Fix marketplace review findings
• 24731c6 SK-623: Fix widget-split review findings
• fbedd9e SK-623: Fold manifest writer into shared helper
• bc0fe82 SK-623: Forced catalog reload skips stale fetch
• bcb5e17 SK-623: Hide app-plugin drafts; fix 0 badge
• a1f58ef SK-623: Indent header conditional JSX
• 1e9901b SK-623: Make the command palette discoverable
• cbf9560 SK-623: Menu flyout, refresh, widget extensions
• fc9d15b SK-623: Move Tools to sidebar bottom with summary
• 9ce4613 SK-623: One atomic-write helper in utils
• 763c996 SK-623: One shared-doc contract and sentinel
• 681a49e SK-623: Per-library extension sync and sleuth gate
• a19256d SK-623: Precompile matchers; add search tests
• 2d71618 SK-623: Release notes for 2.1.0
• b1754d1 SK-623: Scope allowlist; per-plugin slot ids
• 466c880 SK-623: Scrub Library Dashboard references
• e40a19e SK-623: Secrets and net:host permissions (1.4.0)
• f2975c9 SK-623: Serialize sync and enable; fail closed
• bb95ce5 SK-623: Share update catalog; add Tools section
• 2f4fd6a SK-623: Shared storage (1.5.0); review fixes
• a6bf5b4 SK-623: Shared storage on skills.new vaults
• b880ae5 SK-623: Size options flyout from measured height
• 8890c60 SK-623: Skip app-plugin only on schema rejection
• eedb816 SK-623: Slim the palette chip to just the keys
• 84c96a1 SK-623: Standard menu order; chip skips debounce
• d20f9c6 SK-623: Trigger CI for P1 commits
• bc2a785 SK-623: Truncate descriptions on rune boundaries
• ca46902 SK-623: Truncate widget errors by code point
• 896719b SK-623: Use existing WriteFileAtomic helper
• 39cfe90 SK-623: Validate shared doc before sleuth save
• 71dd9be SK-623: Widget errors name their cause
• 98fef60 SK-623: Widget tooltip fixes
• 49160ab SK-623: Write shared extension doc atomically
• 80d9429 SK-623: skills.new extension support (P5 client)
• 3091127 SK-623: sx.app.currentUser for team extensions
• 46cd8c3 SK-623: teams.list degrades on teamless vaults
• 6645411 SK-623: teams.list for extensions; 1.2.0 docs