Sx

sx 2.1 — extensions

sx 2.1 makes the desktop app extensible. Extensions are small plugins
that add dashboard widgets, publish checks, editor commands, and whole
new views to the app — installed from a shared marketplace in one
click, or published to your own library like any other asset. Yesterday
2.0 gave your team a library; 2.1 lets you shape the app around it.

🧩 Extensions

Settings → Extensions is the new home for everything pluggable.
Extensions belong to a library: installing one shares it with everyone
who uses that library, while turning it on stays each person's own
choice. Enabling shows a plain-language list of exactly what the
extension can access — read your assets, add widgets, connect to a
named host — and re-prompts whenever an update changes that list.
Disabling removes everything it added, immediately.

Extensions ride the normal asset pipeline (type = "app-plugin"), so
publishing, versioning, team scoping, pinning, and the audit trail all
work exactly like a skill — updates can never sneak past review the way
they can in other plugin ecosystems. Org admins can restrict or disable
third-party extensions vault-wide with an [app-plugins] allowlist in
the manifest.

Six built-ins ship in the box and run through the same machinery:
Publish Doctor (pre-publish checks), Templates, Importer, and the three
dashboard widgets (adoption, top assets, leaderboard).

🛍️ The extensions marketplace

Settings → Extensions → Browse marketplace… opens a shared
repository of extensions — search, check the permission chips, Install.
Updates surface in the same list with per-extension and update-all
buttons. The default marketplace ships with fifteen extensions,
including:

• Claude Assist — ask your library questions and get answers that
  cite (and open) your assets, critique the draft you have open as a
  prompt, or turn a description into a skill draft. Uses your own
  Anthropic API key, stored in your OS keychain, talking only to
  api.anthropic.com.
• Review Rota — every asset gets a review due date that adapts to
  how heavily it's used, reviews rotate fairly across the team, and
  verdicts are shared with everyone. Publishing resets the clock.
• Library Grid & Board — bulk-edit metadata in a grid; move drafts
  through a pipeline board that warns when something publishes early.
• Asset Query — pin live query tables over your assets and usage to
  the dashboard, Dataview-style.
• Plus related-assets, activity heatmap, library stats, weekly team
  digest, style linter, table tidy, draft refactor, metric charts, smart
  templates, recent assets, and asset relations.

The marketplace is just another sx vault
(sleuth-io/sx-extensions)
— point the app at your own repository to run a private one.

🔌 Build your own

An extension is a folder with a manifest and one ES module — no build
step until you want one. The versioned SxAPI (1.5.0) gives you
dashboard widgets, sidebar panels, asset tabs, full-page views, palette
commands, publish-time warnings, editor text operations, draft
creation, metadata revisions, per-extension secrets in the OS keychain,
host-scoped network access, and team-shared state stored in the vault.
Start with the authoring guide; publish
with sx add ./my-extension.

Also in 2.1

• ⌘K command palette — every app action, plus whatever your
  extensions add.
• Full-text search — the main search box now searches inside asset
  content, ranked and excerpted, not just names and descriptions.
• skills.new extensions — cloud libraries store extensions and the
  org policy server-side (rolling out; the app detects support
  automatically).
• Git and local libraries now infer asset descriptions from frontmatter,
  so nothing shows "No description yet" when the file already says it.
• Dashboard widgets label their time windows, and hovering the adoption
  donut names the people in each group.

Trust model, briefly

Extensions run inside the app behind a permission-gated API: no
filesystem, no Node, and no network beyond hosts an extension declares
— each one is its own consent line. Treat publishing an extension to a
shared library like giving someone commit access, because within your
org that's what it is. The full model is in the
authoring guide.

Changelog

• 121b792f9ddd76f9fbee415db0f5cbda771e2196 Approve app extensions spec with amendments
• 393f2967d3092c1de5445c2e3b4bc7a775ef209f Bump actions/checkout from 6 to 7
• a83dbcfa5b27c9066f33a6516d02635f63957134 Extensions P1: host, API, palette, built-ins
• 083085ba417189bf2076e615445a6361345b1862 Fix spec consistency findings from review
• 3408308e7541771bf37668ffd9ff6c0e227920fe Record P1 loader spike results in spec
• 3354a3ecc6a23f1e5d20e9403cd283d6b841843c SK-623: API 1.3.0 — main views, draft ops, metadata
• 1bbb114dc286b30fdad57edeaed97118f1180d27 SK-623: Add extension update buttons
• d74d9c5efea89ab022c8eca27c7a68ec18bd19d7 SK-623: Add extensions marketplace
• 672f85a2b311864f1cdefd830d4eec18cebc827d SK-623: Align spec table; fix palette memo
• f66c7b7d2ee64a97dfec40e6093d567e9dc56b93 SK-623: Allowlist examples use third-party ids
• 7ffd2f606ddc1dff19ecea5716e15a825e80cde9 SK-623: Anchor options flyout to the viewport
• 2ed38386bf4e5012647dd3bf9f8b3e6b4f604bfc SK-623: Cap modal height; fix snapshot gate
• 0b73fcc7d9a708a26f6788349b139a4127d41254 SK-623: Cap tooltip width; unshadow chart scale
• e52222119edccd8b7f6be2725c5f594e6ddffa13 SK-623: Content search in core; install enables
• 70760f7e36d1456ffc3c0020e8cab6172d5f1cbe SK-623: Dashboard windows labeled; header cleanup
• 1cfd61b13fbe026ee0f4f6ce938546bd1da48fbe SK-623: Deterministic description fallback order
• 29779230d0adc720ef420e99da9b5ea150fe7154 SK-623: Editor API for extensions (1.2.0)
• d8258a9ba53ed97ef829439b944c568ddde53db0 SK-623: Extensions P2 — consent, policy, intent
• 8703aa19bf3c1894e9ab6e0832b521934dddca0c SK-623: Extensions P3 + P2 review fixes
• 2cdceaa207cfc3ab608979469859aba29c1782ec SK-623: Extensions P4 — third-party distribution
• c1842d852fc4a85242a895b9b5fdb269c67bffac SK-623: Extensions feedback round
• 23cce2df04038c42890f6fa08c1588edb7517377 SK-623: Fall back to frontmatter descriptions
• dc88a300abb7cfdf649ed9aab9a2dea0f1199f00 SK-623: Fix P1 review findings
• 93abced6c806e045ccb9246db00b28183cd1fcf2 SK-623: Fix P4 + feedback review findings
• 4fdf0f1b9850114ccb2d4de10385551e40c9d1f0 SK-623: Fix content-search review findings
• cea2180751baab7d60638ff0d8cedd29115ab614 SK-623: Fix import grouping in plugin_shared
• c0f7aa77cb5009413d43499fa05d477491f00721 SK-623: Fix marketplace review findings
• 24731c66cd0362812fed5274dde78860f2e064d2 SK-623: Fix widget-split review findings
• fbedd9ee29cc23050f2b6cf025f707718bca35cc SK-623: Fold manifest writer into shared helper
• bc0fe82fc25c660307e99d4e38a64f68340742eb SK-623: Forced catalog reload skips stale fetch
• bcb5e1752e79464f439454af33fd1bbf64236aa0 SK-623: Hide app-plugin drafts; fix 0 badge
• a1f58efc684b81eb6852b375ed7b578306075840 SK-623: Indent header conditional JSX
• 1e9901be6994196d50cf0eb09b92efefde44361b SK-623: Make the command palette discoverable
• cbf956099ca267a5601eb3c37c64751adacc815f SK-623: Menu flyout, refresh, widget extensions
• fc9d15b40a56ffc3b07b80b6437d144f3d8d520f SK-623: Move Tools to sidebar bottom with summary
• 9ce46130f7db528114a6d49b4aa8d1f72da64437 SK-623: One atomic-write helper in utils
• 763c9960c813ae5eef071179798787f3c44de70d SK-623: One shared-doc contract and sentinel
• 681a49eb45bf98b389232f3d2d841e78a99889c7 SK-623: Per-library extension sync and sleuth gate
• a19256d5ae28c78402f3ddb8d0ca39c63f9d13c0 SK-623: Precompile matchers; add search tests
• 2d716182e38db37c5660d022d2d8e9e218324863 SK-623: Release notes for 2.1.0
• b1754d1e6ceb3750ed3ffab008df1b1b3e0cf75a SK-623: Scope allowlist; per-plugin slot ids
• 466c88031420900f53605bd27fe22db3d6e2f6ed SK-623: Scrub Library Dashboard references
• e40a19e033762364e304a516e7cd7746629c9435 SK-623: Secrets and net:host permissions (1.4.0)
• f2975c91d7b01e5a1d2fdf8a508619246e3fa745 SK-623: Serialize sync and enable; fail closed
• bb95ce52b61541247e35dc51544c5dd8eddf0673 SK-623: Share update catalog; add Tools section
• 2f4fd6a9375cb0e14dd7be7dbb30293480d73579 SK-623: Shared storage (1.5.0); review fixes
• a6bf5b4532d062668da4d3c307ead38dc5b00bf5 SK-623: Shared storage on skills.new vaults
• b880ae56846d5c69477f915f38d9d42fefbe6579 SK-623: Size options flyout from measured height
• 8890c60058d384e4562a5ab91ade561132f72ab7 SK-623: Skip app-plugin only on schema rejection
• eedb8163568effb4bd970f242e805e5c62269d52 SK-623: Slim the palette chip to just the keys
• 84c96a14eb34e3c107c5339351b6f80e1b46d41e SK-623: Standard menu order; chip skips debounce
• d20f9c6e281af8f1263bc96bc04a4961560815b9 SK-623: Trigger CI for P1 commits
• bc2a785f545b815a3b6e88568eecefb20986ae04 SK-623: Truncate descriptions on rune boundaries
• ca46902a2084df0b137bc611d55d0424da3468bf SK-623: Truncate widget errors by code point
• 896719b96df9ccd3f170e84303a746e9df012f4b SK-623: Use existing WriteFileAtomic helper
• 39cfe90ca18b651f9a824af513cab72ff6d30dbf SK-623: Validate shared doc before sleuth save
• 71dd9bef6e0098d63b2a691b5f813145867c2692 SK-623: Widget errors name their cause
• 98fef6010df29301afc425e309dc283be3d6d8f9 SK-623: Widget tooltip fixes
• 49160abfbd0bc3d9e0ec8a19f35db2f2ee9bc67a SK-623: Write shared extension doc atomically
• 80d9429fd5d402945bf735a20beb6cbe01514314 SK-623: skills.new extension support (P5 client)
• 30911277d0f6a9a68c2bd0bfa177c1db152d100c SK-623: sx.app.currentUser for team extensions
• 46cd8c31f05fcb43ade11a7963e7fad7a9459302 SK-623: teams.list degrades on teamless vaults
• 6645411b726a574bed27b6698cfda97b7fe0f741 SK-623: teams.list for extensions; 1.2.0 docs