@intentic/extension-manifest 1.223.0 → 1.224.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentic/extension-manifest",
-  "version": "1.223.0",
+  "version": "1.224.0",
   "description": "What an intentic extension DECLARES — the intentic-extension.json schema and the sandbox-route allowlist rule",
   "license": "MIT",
   "type": "module",
@@ -34,7 +34,7 @@
   "dependencies": {
     "tslib": "2.8.1",
     "zod": "4.4.3",
-    "@intentic/base": "1.223.0"
+    "@intentic/base": "1.224.0"
   },
   "devDependencies": {
     "@types/node": "24.13.2",

package/src/bundle.ts

@@ -1,8 +1,8 @@
-/* WHAT A PUBLISHED BUNDLE MAY IMPORT — the loader's side of the manifest contract, stated where both sides can
+/* WHAT A PUBLISHED BUNDLE MAY IMPORT, the loader's side of the manifest contract, stated where both sides can
  * read it. The host fetches an extension's entry bytes and imports them from a blob: URL, which has two hard
  * consequences: a relative import resolves against a blob: URL that was never created (a 404 for a file that
  * exists on disk), and a bare specifier resolves only if the shell's import map publishes it. Both failures are
- * invisible to the author — their own workspace loads the directory live — and fatal for every installer.
+ * invisible to the author, their own workspace loads the directory live, and fatal for every installer.
  *
  * It lives HERE, beside the manifest schema, because two independent judges have to agree on it: the daemon's
  * readiness check (before an author publishes) and the registry scanner (re-deriving the same answer cold, at
@@ -14,7 +14,7 @@
 export const HOST_PUBLISHED_SPECIFIERS = ["vue", "@intentic/extension-api", "@intentic/extension-ui", "@tanstack/vue-query"] as const;
 
 // Every specifier a single-file ESM bundle names: static imports, re-exports, bare side-effect imports, and
-// dynamic import(). A bundle is one file by contract, so a regex over its text is the right instrument — there
+// dynamic import(). A bundle is one file by contract, so a regex over its text is the right instrument, there
 // is no module graph to walk.
 export const bundleSpecifiers = (source: string): string[] => [
     ...new Set([

package/src/contribution-point.ts

@@ -1,17 +1,17 @@
 import type { z } from "zod";
 
-/* A CONTRIBUTION POINT, DEFINED ONCE — its key, its shape, and the sentence that explains it to the person
+/* A CONTRIBUTION POINT, DEFINED ONCE, its key, its shape, and the sentence that explains it to the person
  * writing the manifest, in one object.
  *
  * The three used to live apart, and only two of them lived anywhere at all. The key and the shape sat in one
  * file that every feature had to edit to add anything, in two places (the schema, then the key on `contributes`);
- * the explanation sat in a `//` comment above it, where the extension author — the only reader it was written
- * for — could never see it. So the manifest was a thing you wrote by copying another extension's and guessing,
+ * the explanation sat in a `//` comment above it, where the extension author, the only reader it was written
+ * for, could never see it. So the manifest was a thing you wrote by copying another extension's and guessing,
  * with a misspelt contribution point dropped in silence rather than named.
  *
  * Binding the description to the schema is what changes that: it rides `z.describe`, so it reaches the generated
  * authoring schema (json-schema.ts) and comes back as hover text in the author's editor. The prose that is for
- * MAINTAINERS — why a point exists, what it replaced, what it deliberately does not do — stays a comment in the
+ * MAINTAINERS, why a point exists, what it replaced, what it deliberately does not do, stays a comment in the
  * point's own file, because it is not what someone filling in a field needs to read. */
 export interface ContributionPoint<Name extends string = string, Schema extends z.ZodType = z.ZodType> {
     // The key under `contributes` in intentic-extension.json.
@@ -20,7 +20,7 @@ export interface ContributionPoint<Name extends string = string, Schema extends
      * them, and what the host does with it. It lands verbatim in editor hover text, so a paragraph of rationale
      * here is a paragraph in a tooltip. */
     readonly description: string;
-    // The value shape under that key — an array for a point that takes many entries, the entry itself for a
+    // The value shape under that key, an array for a point that takes many entries, the entry itself for a
     // point that takes one. `contributes` makes every one of them optional; a point is never required.
     readonly schema: Schema;
 }

package/src/json-schema.ts

@@ -1,12 +1,12 @@
 import { z } from "zod";
 import { ExtensionManifestSchema } from "./manifest.js";
 
-/* THE AUTHORING SCHEMA — what an editor reads to help someone write `intentic-extension.json`.
+/* THE AUTHORING SCHEMA, what an editor reads to help someone write `intentic-extension.json`.
  *
  * A manifest was previously written by copying another extension's and guessing. Nothing told the author what a
  * field meant, because every explanation lived in a `//` comment in this package; and nothing told them when
  * they got one wrong, because zod STRIPS unknown keys at every level rather than refusing them. A misspelt
- * `viewers` was not an error — it was a viewer that never appeared, discovered at install, with the manifest
+ * `viewers` was not an error, it was a viewer that never appeared, discovered at install, with the manifest
  * parsing perfectly.
  *
  * So: the same points, emitted as JSON Schema, with the descriptions that ride each one (contribution-point.ts)
@@ -15,7 +15,7 @@ import { ExtensionManifestSchema } from "./manifest.js";
  *
  * STRICT HERE, LENIENT AT RUNTIME, and the asymmetry is the point. Authoring is where an unknown key is a typo
  * and should be shouted about. Runtime is where an unknown key is a manifest written for a NEWER host, which an
- * older daemon must go on installing with the point it doesn't understand ignored — refusing it outright would
+ * older daemon must go on installing with the point it doesn't understand ignored, refusing it outright would
  * make every addition to this list a breaking change. */
 
 // Where the published copy answers, so `$schema` in a manifest resolves for an author who has installed nothing.
@@ -23,7 +23,7 @@ export const MANIFEST_SCHEMA_URL = "https://intentic.dev/intentic-extension.sche
 
 /* `additionalProperties: false` on every object node, so a key nothing declares is flagged where it is typed.
  *
- * Skips a node that already carries `additionalProperties` — that is a `z.record`, whose whole shape is "any key,
+ * Skips a node that already carries `additionalProperties`, that is a `z.record`, whose whole shape is "any key,
  * this value" (a cli capability's `env`), and pinning it closed would reject every entry it exists to accept. */
 const closeToUnknownKeys = (node: unknown): void => {
     if (Array.isArray(node)) {
@@ -44,7 +44,7 @@ const closeToUnknownKeys = (node: unknown): void => {
     }
 };
 
-/* The manifest schema as JSON Schema. `io: "input"` because this describes what an author WRITES — the shape
+/* The manifest schema as JSON Schema. `io: "input"` because this describes what an author WRITES, the shape
  * going in, before any refinement or default has been applied to it. */
 export const manifestJsonSchema = (): Record<string, unknown> => {
     const schema = z.toJSONSchema(ExtensionManifestSchema, { unrepresentable: "any", io: "input" }) as Record<string, unknown>;
@@ -58,5 +58,5 @@ export const manifestJsonSchema = (): Record<string, unknown> => {
 };
 
 // The committed file's exact bytes, so the generator and the check that guards it cannot disagree about
-// formatting — four spaces and a trailing newline, the repo's shape for a committed generated document.
+// formatting, four spaces and a trailing newline, the repo's shape for a committed generated document.
 export const serializeManifestJsonSchema = (schema: Record<string, unknown>): string => `${JSON.stringify(schema, undefined, 4)}\n`;

package/src/manifest.ts

@@ -3,25 +3,25 @@ import { MARK_FIELDS } from "./mark.js";
 import { contributesSchema } from "./points/index.js";
 
 /* The extension manifest: `intentic-extension.json` at the extension repo root (deliberately NOT inside
- * .claude-plugin/ — that directory is Claude Code's namespace with its own semantics). The manifest is the
+ * .claude-plugin/, that directory is Claude Code's namespace with its own semantics). The manifest is the
  * approval surface: the install dialog shows exactly these declared contributions before the owner confirms,
  * and the host refuses runtime registrations (views, commands) whose ids the approved manifest never declared.
  *
- * This file is the ENVELOPE only — who the extension is, which host it needs, what code it ships, how far it
+ * This file is the ENVELOPE only, who the extension is, which host it needs, what code it ships, how far it
  * may reach. What it may CONTRIBUTE is one file per contribution point under points/, assembled here; see
  * contribution-point.ts for why the description travels with the schema instead of sitting in a comment. */
 
 export const ExtensionManifestSchema = z.object({
-    /* The authoring schema this manifest is written against — editors read it and give the author completion,
+    /* The authoring schema this manifest is written against, editors read it and give the author completion,
      * hover text and a red squiggle on a misspelt key. Declared so it survives the parse rather than being
      * silently stripped, which is what would otherwise happen to the one field an author is most likely to add
      * by hand. Nothing at runtime reads it. */
     $schema: z.string().optional().describe("The authoring schema, for editor completion and validation. Nothing at runtime reads it."),
     publisher: z.string().regex(/^[a-z0-9][a-z0-9-]*$/),
     name: z.string().regex(/^[a-z0-9][a-z0-9-]*$/),
-    // The extension's own semver — display/identity only; the installed code identity is the pinned commit sha.
+    // The extension's own semver, display/identity only; the installed code identity is the pinned commit sha.
     version: z.string().min(1).describe("Your own semver — display and identity only. The installed code's identity is the pinned commit sha."),
-    /* The section this extension sits under in the Sandbox hub's Extensions tab — a grouping by what it is FOR,
+    /* The section this extension sits under in the Sandbox hub's Extensions tab, a grouping by what it is FOR,
      * declared because it cannot be derived. Nine of the first-party extensions contribute a rail tile, so a
      * grouping read off `contributes` puts more than half the list in one section and says nothing about any of
      * them. Deliberately a loose string, exactly like a connector's `catalog.category`: the vocabulary belongs
@@ -34,13 +34,13 @@ export const ExtensionManifestSchema = z.object({
         .describe(
             "Which section of the Extensions tab this sits under — a grouping by what it is FOR, which cannot be derived from what it contributes. A section this app has never heard of lands in “Other” rather than failing to install.",
         ),
-    /* What the extension is drawn as wherever it is LISTED rather than used — the Extensions tab, a registry
+    /* What the extension is drawn as wherever it is LISTED rather than used, the Extensions tab, a registry
      * being browsed, the gallery. Deliberately here and not on a view: `Activation.icon` is the glyph of one
      * rail tile, it only exists once the extension's code has activated in this browser, and nine of the
      * first-party extensions register no view at all. An extension that is switched off, daemon-only, or not
      * yet installed still has to look like something. See MARK_FIELDS. */
     ...MARK_FIELDS,
-    // Semver range over the host's extension API version (extensionApiVersion) — checked before activation.
+    // Semver range over the host's extension API version (extensionApiVersion), checked before activation.
     engines: z
         .object({ intentic: z.string().min(1) })
         .describe("A semver range over the host's extension API version, checked before your code is activated."),
@@ -54,7 +54,7 @@ export const ExtensionManifestSchema = z.object({
         .describe(
             "Repo-relative path of your prebuilt single-file ESM bundle, built with `vue` and `@intentic/extension-api` as externals. Absent ⇒ an extension with no UI.",
         ),
-    /* Repo-relative path of the prebuilt single-file node ESM SERVER bundle — the extension's BACKEND half,
+    /* Repo-relative path of the prebuilt single-file node ESM SERVER bundle, the extension's BACKEND half,
      * exporting `activateServer(api, context)`. Loaded by the daemon's backend host (a separate supervised
      * process, so a toggle or a live edit is a host restart rather than a daemon death) and served under the
      * extension's own route namespace `/x/<id>/…`, which the daemon proxies. Self-contained by construction:
@@ -68,12 +68,12 @@ export const ExtensionManifestSchema = z.object({
         .describe(
             "Repo-relative path of your prebuilt single-file node ESM server bundle, exporting `activateServer`. Served under your own route namespace, which the daemon proxies. Nothing is provided at runtime but node builtins, so bundle everything else in. Absent ⇒ no backend.",
         ),
-    // Declared reach, both halves in one grammar — "<METHOD> <path-glob>" where `*` matches one path segment
-    // (e.g. "GET /panels", "POST /panels/*/start") — so the install dialog, the gate and the usage ledger read
+    // Declared reach, both halves in one grammar, "<METHOD> <path-glob>" where `*` matches one path segment
+    // (e.g. "GET /panels", "POST /panels/*/start"), so the install dialog, the gate and the usage ledger read
     // one vocabulary.
-    //   sandbox — the daemon routes the UI half may call through api.sandbox (the host refuses undeclared
+    //   sandbox, the daemon routes the UI half may call through api.sandbox (the host refuses undeclared
     //             ones). An extension's OWN namespace `/x/<its id>/…` needs no entry: its backend is its own.
-    //   daemon  — the daemon routes the SERVER half may call through api.daemon, enforced by the daemon's
+    //   daemon , the daemon routes the SERVER half may call through api.daemon, enforced by the daemon's
     //             extension-token grant. Separate from `sandbox` because the halves run as different
     //             principals: the UI acts with the owner's session, the backend with a minted per-extension
     //             token, and a grant to one must never quietly widen the other.
@@ -99,6 +99,6 @@ export const ExtensionManifestSchema = z.object({
 });
 export type ExtensionManifest = z.infer<typeof ExtensionManifestSchema>;
 
-// The extension's identity everywhere (capability entries, /ext routes, settings namespaces) — derived, never
+// The extension's identity everywhere (capability entries, /ext routes, settings namespaces), derived, never
 // declared, so it can't contradict the publisher/name the install dialog showed.
 export const extensionIdOf = (manifest: Pick<ExtensionManifest, "publisher" | "name">): string => `${manifest.publisher}.${manifest.name}`;

package/src/mark.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 
-/* HOW SOMETHING LOOKS BEFORE ANY OF ITS CODE RUNS — the mark a capability card and an extension are drawn
+/* HOW SOMETHING LOOKS BEFORE ANY OF ITS CODE RUNS, the mark a capability card and an extension are drawn
  * with, in ONE shape because one component draws both (<BrandMark>) and a second copy of these two fields is a
  * second answer to what happens when a slug 404s.
  *
@@ -8,7 +8,7 @@ import { z } from "zod";
  * author controls completely, and the only one that can make a grid of unfamiliar names look like a shelf of
  * distinct products rather than a column of identical glyphs. `logo` is a simple-icons slug fetched from a
  * CDN: exactly right for a card standing in for somebody else's product (GitHub, Postgres, Slack), useless
- * for the many things that have no brand in that set, and unreachable in an offline sandbox — so it can never
+ * for the many things that have no brand in that set, and unreachable in an offline sandbox, so it can never
  * be the only tier. `icon` is a name from the host's own bundled vocabulary, which ships in the image, follows
  * the theme and costs no request; it is what carries a first-party extension that has not been drawn yet. What
  * declares none of them is drawn as its initials, so no row is ever blank and no author is obliged to have a
@@ -16,15 +16,15 @@ import { z } from "zod";
  *
  * ART BEATS A BRAND SLUG because they answer different questions. A slug says "this is Slack"; art says "this
  * is mine". An extension that stands in for somebody else's product should declare the slug and no art, and
- * one that is its own thing should declare art — but where both arrive, the author's own drawing is the more
+ * one that is its own thing should declare art, but where both arrive, the author's own drawing is the more
  * specific claim and wins.
  *
  * Artwork that will not parse, a slug that fails to load and an icon name this build has never heard of all
- * fall to the tier BELOW rather than to a hole — the rule the rail already applies to Activation.icon, here for
+ * fall to the tier BELOW rather than to a hole, the rule the rail already applies to Activation.icon, here for
  * the surfaces that must draw an extension whose code is not running: one that is switched off, one that is
  * daemon-only, one being read about in a registry before it is installed at all. */
 
-/* Big enough for a drawn mark, far too small for a traced photograph — which is the line being drawn. This
+/* Big enough for a drawn mark, far too small for a traced photograph, which is the line being drawn. This
  * string rides every registry row and every manifest read, so it is a budget as much as a limit: at 4 KB the
  * whole official registry's artwork costs less than one screenshot, and an author who needs more than that is
  * shipping a raster they should be shipping as a brand slug or not at all. */
@@ -33,18 +33,18 @@ const ART_MAX_BYTES = 4096;
 export const MARK_FIELDS = {
     /* THE SVG DOCUMENT ITSELF, not a URL and not base64.
      *
-     * A URL would put a stranger's server in the render path of a page listing extensions — a fetch that
+     * A URL would put a stranger's server in the render path of a page listing extensions, a fetch that
      * tracks who is browsing what, breaks in an offline sandbox, and 404s long after the row was approved:
      * the three failures the `logo` tier already documents, with none of its excuse. Inline costs one string
      * and always draws.
      *
      * Kept as READABLE TEXT rather than a data URI because of who reads it. The registry's curated file is
      * reviewed by a human before anything is published, and `<rect fill="#5B4FE9"/><circle .../>` can be read
-     * in a diff, while base64 is a wall nobody checks — an opaque blob in the one file whose entire purpose is
+     * in a diff, while base64 is a wall nobody checks, an opaque blob in the one file whose entire purpose is
      * to be checked. The renderer does its own encoding at the point of use.
      *
      * It is drawn INERT (an <img>, never inline in the document), so a hostile registry row cannot script the
-     * page it is listed on — see <BrandMark>, which owns that guarantee and the sniff test that enforces it. */
+     * page it is listed on, see <BrandMark>, which owns that guarantee and the sniff test that enforces it. */
     art: z
         .string()
         .max(ART_MAX_BYTES)

package/src/permissions.ts

@@ -1,6 +1,6 @@
 /* The sandbox-route permission model. An extension declares in its manifest exactly which daemon routes it may
  * reach through `api.sandbox.request/json`, as "<METHOD> <path-glob>" strings where `*` matches exactly one path
- * segment. The host matches every call against these and refuses an undeclared route — so an extension's backend
+ * segment. The host matches every call against these and refuses an undeclared route, so an extension's backend
  * reach is explicit, diffable, and reviewable rather than an ambient client to the whole daemon. */
 
 const escapeRegExp = (literal: string): string => literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");

package/src/points/agent.ts

@@ -2,7 +2,7 @@ import { z } from "zod";
 import type { ContributionPoint } from "../contribution-point.js";
 
 // "This checkout is ALSO a Claude Code plugin": the daemon hands the directory to the Agent SDK's plugin
-// loader, which reads skills/agents/hooks/commands/.mcp.json each turn — the daemon never parses plugin
+// loader, which reads skills/agents/hooks/commands/.mcp.json each turn, the daemon never parses plugin
 // internals.
 export const AgentContributionSchema = z.object({
     path: z.string().optional().describe("Relative to the extension checkout. Absent ⇒ the checkout root."),

package/src/points/automation-templates.ts

@@ -1,12 +1,12 @@
 import { z } from "zod";
 import type { ContributionPoint } from "../contribution-point.js";
 
-/* A STARTING POINT in the automation composer — a trigger, a prompt written for that trigger's payload, and
+/* A STARTING POINT in the automation composer, a trigger, a prompt written for that trigger's payload, and
  * whatever guard or hold makes it safe to leave on. Pure prefill: creating one makes an ordinary automation and
  * the daemon knows nothing about templates afterwards.
  *
  * IT LIVES WITH THE AREA THAT KNOWS THE SERVICE, which is the point of it being a contribution at all. The
- * automation surface used to carry every one of these — Komodo's, Sentry's, Stripe's, CI's, the chore book's —
+ * automation surface used to carry every one of these. Komodo's, Sentry's, Stripe's, CI's, the chore book's,
  * so a pack that gained something worth reacting to could not say so without an edit to a surface it has
  * nothing to do with. A template declared here appears when the pack is installed and its capability connected,
  * and disappears with it.
@@ -14,7 +14,7 @@ import type { ContributionPoint } from "../contribution-point.js";
  * The daemon validates each one against the real trigger schema when it builds the catalogue and drops what
  * does not parse, so a template can never offer a trigger that `upsert` would refuse. */
 export const AutomationTemplateContributionSchema = z.object({
-    // Prefills the automation name, and is what "does one of these exist already" is asked by — so it must be
+    // Prefills the automation name, and is what "does one of these exist already" is asked by, so it must be
     // spelled as an automation id, not as prose.
     id: z
         .string()
@@ -23,7 +23,7 @@ export const AutomationTemplateContributionSchema = z.object({
     title: z.string().min(1),
     logo: z.string().min(1).optional().describe("A simple-icons slug for the card."),
     icon: z.string().min(1).optional().describe("A name from the host's icon set, drawn when no simple-icons slug fits."),
-    // Capability providers that make this template WORK — any one connected is enough (fixing CI rides github
+    // Capability providers that make this template WORK, any one connected is enough (fixing CI rides github
     // or gitlab). Omitted ⇒ nothing to connect, always offered.
     requires: z
         .array(z.string().min(1))

package/src/points/bin.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import type { ContributionPoint } from "../contribution-point.js";
 
-// A checkout-relative directory of executables the daemon prepends to the AGENT's PATH each turn — how an
+// A checkout-relative directory of executables the daemon prepends to the AGENT's PATH each turn, how an
 // extension ships a command-line tool for the agent (the CLI-tools path). The files ARE the approved code (they
 // ride the sha-pinned checkout); the daemon only adds the dir to PATH.
 export const binPoint = {

package/src/points/capabilities.ts

@@ -13,7 +13,7 @@ export const CapabilityFieldSchema = z.object({
     secret: z.boolean().optional().describe("Mask it, and never echo it back."),
     optional: z.boolean().optional(),
     multiline: z.boolean().optional(),
-    // An OPT-IN EXTRA rather than a decision — rendered as a switch, carried as the "on"/"off" the config
+    // An OPT-IN EXTRA rather than a decision, rendered as a switch, carried as the "on"/"off" the config
     // schemas already speak (the vpn's pfs/aggressive precedent). A two-option Segmented can express the same
     // value, and reads wrong for this: it presents a choice the user must make to proceed, sized like the
     // required fields around it. Something the capability works fine without wants the control that is quiet
@@ -34,7 +34,7 @@ export const CapabilityFieldSchema = z.object({
         .describe(
             "A line under this control, for what the label alone cannot say — a host requirement, when a value takes effect. The card's own `hint` speaks for the whole card; this one is bound to the field it qualifies.",
         ),
-    /* This field's value only takes effect after the sandbox is REBUILT — it rides the environment overlay
+    /* This field's value only takes effect after the sandbox is REBUILT, it rides the environment overlay
      * rather than something the daemon can act on now. Rendered as a chip beside the label.
      *
      * The one fact a user needs before touching a control, and the one the form cannot infer: two switches
@@ -52,12 +52,12 @@ export const CapabilityFieldSchema = z.object({
         .array(z.object({ value: z.string(), label: z.string() }))
         .optional()
         .describe("Turns the field into a select."),
-    /* Gates this field on the answers already given — the SSH credential that only applies to the auth mode
+    /* Gates this field on the answers already given, the SSH credential that only applies to the auth mode
      * chosen, the gateway fields that belong to one VPN provider. A `when` condition (@intentic/base/when)
      * evaluated against the form's live values, so it re-reads as the user toggles.
      *
      * Refused at parse when it does not parse. A card is data an extension ships, and a condition nobody can
-     * evaluate is not a field that is always shown or always hidden — it is a card whose author believes it
+     * evaluate is not a field that is always shown or always hidden, it is a card whose author believes it
      * asks something it never asks. Failing the manifest names the card; failing at render names nothing. */
     when: z
         .string()
@@ -66,7 +66,7 @@ export const CapabilityFieldSchema = z.object({
         .describe(
             "Only show this field while a condition over the answers already given holds — `auth == 'key'`, `provider in ['ipsec', 'fortinet']`, `!advanced`. Supports `&&`, `||`, `!`, comparisons and `in`.",
         ),
-    // A fixed value baked into the config rather than asked for — how a card pins a discriminator
+    // A fixed value baked into the config rather than asked for, how a card pins a discriminator
     // (platform="reddit", provider="stripe"). Rendered as nothing; sent as itself.
     value: z
         .string()
@@ -74,9 +74,9 @@ export const CapabilityFieldSchema = z.object({
         .describe(
             'A fixed value baked into the config rather than asked for — how a card pins its discriminator (platform="reddit", provider="stripe"). Renders as nothing.',
         ),
-    /* This field holds a TOTP seed — the base32 key (or otpauth:// URI) a service shows when enrolling an
+    /* This field holds a TOTP seed, the base32 key (or otpauth:// URI) a service shows when enrolling an
      * authenticator app. Declare it WITH `secret: true`: the seed is a durable second factor, so it is never
-     * echoed and, unlike an ordinary secret, never enters the agent's environment either — the daemon mints the
+     * echoed and, unlike an ordinary secret, never enters the agent's environment either, the daemon mints the
      * six-digit codes on demand (`otp <name>` / GET /capabilities/<id>/otp) and only those cross, each dead
      * within its period. A cli entry whose env references a totp field therefore fails to parse (see below). */
     totp: z
@@ -88,7 +88,7 @@ export const CapabilityFieldSchema = z.object({
 });
 export type CapabilityField = z.infer<typeof CapabilityFieldSchema>;
 
-/* WHETHER A FIELD IS IN PLAY, given what has been answered so far — and the only place that decides it.
+/* WHETHER A FIELD IS IN PLAY, given what has been answered so far, and the only place that decides it.
  *
  * Two tiers ask this question about the same card. The web's form asks it to decide what to draw and what to
  * validate; the daemon asks it at install to decide which fields it may demand. They used to answer it with
@@ -98,7 +98,7 @@ export type CapabilityField = z.infer<typeof CapabilityFieldSchema>;
  * report about one card rather than as a broken rule.
  *
  * It lives beside the schema for the reason the description does: this is a fact about the shape, and the two
- * consumers are in different packages. Parsed per call rather than cached — a card has a handful of fields,
+ * consumers are in different packages. Parsed per call rather than cached, a card has a handful of fields,
  * this runs on a keystroke at worst, and a cache keyed by manifest strings is a map that outlives every
  * extension that ever declared one. */
 export const fieldApplies = (field: CapabilityField, values: Readonly<Record<string, unknown>>): boolean =>
@@ -109,7 +109,7 @@ export const fieldApplies = (field: CapabilityField, values: Readonly<Record<str
 const CatalogSchema = z.object({
     name: z.string().min(1),
     ...MARK_FIELDS,
-    // ONE LINE — aim for 60 characters or fewer. The grid clamps this at two lines and a card sits beside two
+    // ONE LINE, aim for 60 characters or fewer. The grid clamps this at two lines and a card sits beside two
     // others in a pane the index column has already taken 16rem out of, so a paragraph here is a paragraph the
     // reader gets truncated. Everything longer belongs in `hint`, which the config form prints in full and the
     // catalog's search reads. Not capped in the schema: an extension published before this rule should still
@@ -121,7 +121,7 @@ const CatalogSchema = z.object({
             "ONE LINE — aim for 60 characters or fewer. The grid clamps it at two lines in a narrow pane, so a paragraph here is a paragraph the reader gets truncated. Everything longer belongs in `hint`.",
         ),
     category: z.string().min(1),
-    // The paragraph. Shown under the add-form, and searched from the catalog — so the words that identify this
+    // The paragraph. Shown under the add-form, and searched from the catalog, so the words that identify this
     // card to someone hunting for it ("webauthn", "socket mode") belong here even when the tile can't show them.
     hint: z
         .string()
@@ -151,24 +151,24 @@ const contributionBase = {
     fields: z.array(CapabilityFieldSchema),
 };
 
-/* A CAPABILITY CARD AS DATA. The catalog is the extensible layer; the HANDLERS are core — so an entry names one
+/* A CAPABILITY CARD AS DATA. The catalog is the extensible layer; the HANDLERS are core, so an entry names one
  * of the kinds whose daemon-side machinery is fully generic over its data, and the machinery stays put. The
  * kinds NOT listed here are the ones whose card is one-to-one with a handler that owns real privilege (`docker`
  * bakes --privileged, `vpn` bakes NET_ADMIN, `extension` installs extensions, `devops` scaffolds repos): their
  * cards live in the platform catalog because separating card from handler would split one concept in two, and
  * because a manifest that could name them would be a manifest that grants itself privilege. That restriction is
- * this discriminated union, not a comment — a manifest naming any other kind fails to parse.
+ * this discriminated union, not a comment, a manifest naming any other kind fails to parse.
  *
  * `${id}` in a cli/host skill file is substituted with the instance name at apply time (so a host pack's tool
  * names read `mcp__my-laptop__run_command`), and, for `cli`, each `$ENVVAR` becomes its per-instance suffixed
- * name. A BROWSER pack's skill renders once per SITE rather than per instance — its seams are `${accounts}`
+ * name. A BROWSER pack's skill renders once per SITE rather than per instance, its seams are `${accounts}`
  * (the roster of connected accounts), `${tools}` (the core driving/connecting note) and `${site}` (the host,
  * for the generic card whose text can name no site of its own); `${id}` and per-field substitution do not
  * apply there (capabilities/account-skills.ts in the sandbox daemon). */
 export const CapabilityContributionSchema = z
     .discriminatedUnion("kind", [
         // A CLI tool the AGENT gets, authenticated: the env vars its shell receives (value templates over the
-        // fields — `${field}` substitutes, `${field:uri}` percent-encodes), a SKILL.md cheatsheet, and an optional
+        // fields, `${field}` substitutes, `${field:uri}` percent-encodes), a SKILL.md cheatsheet, and an optional
         // image fragment holding the client binary (psql, mysql, whisper).
         z.object({
             ...contributionBase,
@@ -191,18 +191,18 @@ export const CapabilityContributionSchema = z
         }),
         /* A site the agent acts on AS THE OWNER, through the shared logged-in Chromium. `loginUrl` is what the
          * sign-in window opens; the profile it persists is the credential. `homeUrl` is where that same profile
-         * opens once it HAS one — the owner's own hands on the connected browser, which a login page is the wrong
+         * opens once it HAS one, the owner's own hands on the connected browser, which a login page is the wrong
          * place to start (signed in, it only redirects). Two fields because for some platforms the login lives on
          * another site entirely (YouTube signs in at accounts.google.com), so one cannot be derived from the other.
          * No `env` and no `fragment`: the browser itself is core (one Chromium install serves every platform),
-         * only the identity is per-entry. A card never declares the account's username/password either — those are
+         * only the identity is per-entry. A card never declares the account's username/password either, those are
          * CORE form fields on every browser card (the catalog appends them; the daemon's add validation accepts
          * them), because which box a login form wants filled is the same fact on every site.
          *
          * BOTH URLs ARE OPTIONAL, so that one card can be the GENERIC one: a site card pins them (Reddit knows
          * where Reddit signs in), and the generic "browser session" card asks for them on its form instead, which
-         * is what lets a user connect a site nobody shipped a card for. A card must do one or the other — pin a
-         * URL or declare a field that supplies it — and the daemon's apply says so on the form when neither does,
+         * is what lets a user connect a site nobody shipped a card for. A card must do one or the other, pin a
+         * URL or declare a field that supplies it, and the daemon's apply says so on the form when neither does,
          * because the alternative is a sign-in window that opens on nothing. */
         z.object({
             ...contributionBase,
@@ -226,7 +226,7 @@ export const CapabilityContributionSchema = z
                     "Checkout-relative SKILL.md teaching the agent this site's actions — rendered once per site, all its connected accounts on one roster (`${accounts}`), the core tool note at `${tools}`.",
                 ),
         }),
-        // An operating system a connected computer can run — the skill pack that teaches the agent THAT machine's
+        // An operating system a connected computer can run, the skill pack that teaches the agent THAT machine's
         // shell. The enrollment, the socket and the scope enforcement are core; only the pack varies.
         z.object({
             ...contributionBase,
@@ -234,13 +234,13 @@ export const CapabilityContributionSchema = z
             skill: z.string().min(1).describe("Checkout-relative SKILL.md teaching the agent that machine's shell."),
         }),
         /* A PRESET over a core kind: no payload at all, just a named card whose `fields` carry the defaults. What an
-         * ACP agent needs is a command, so "OpenCode" is entirely a name, a logo and a filled-in form — which is
+         * ACP agent needs is a command, so "OpenCode" is entirely a name, a logo and a filled-in form, which is
          * exactly what a catalog row is. */
         z.object({ ...contributionBase, kind: z.literal("agent") }),
     ])
     .superRefine((spec, ctx) => {
         // The totp flag's one invariant, enforced where the manifest is parsed rather than trusted to authors: a
-        // seed the daemon mints codes from must never ride the env into the agent's shell — that would hand the
+        // seed the daemon mints codes from must never ride the env into the agent's shell, that would hand the
         // agent the second factor itself instead of one expiring code at a time.
         if (spec.kind !== "cli") {
             return;
@@ -255,15 +255,15 @@ export const CapabilityContributionSchema = z
         }
     });
 export type CapabilityContribution = z.infer<typeof CapabilityContributionSchema>;
-// The arms carrying a per-instance SKILL.md — the daemon templates and installs these identically.
+// The arms carrying a per-instance SKILL.md, the daemon templates and installs these identically.
 export type SkillContribution = Extract<CapabilityContribution, { skill: string }>;
 
 /* The config key a kind's cards PIN to their own id, so a stored capability can be traced back to the card that
- * made it — the daemon resolves the entry's handler data through it, and the web tells one card's instances from
+ * made it, the daemon resolves the entry's handler data through it, and the web tells one card's instances from
  * another's. `agent` has none on purpose: its cards are presets over one config shape, differing only in their
  * defaults, so every agent instance belongs to every agent card equally.
  *
- * Here, beside the schema, because it is a fact about the contribution shape — the daemon, the catalog and the
+ * Here, beside the schema, because it is a fact about the contribution shape, the daemon, the catalog and the
  * web all need it, and three copies of it is three chances for a card's instances to go missing. `satisfies`
  * rather than a lookup table so a new arm above is a compile error until this answers for it. */
 const DISCRIMINATOR = { cli: "provider", browser: "platform", host: "platform", agent: undefined } satisfies Record<

package/src/points/commands.ts

@@ -9,7 +9,7 @@ export const CommandContributionSchema = z.object({
     icon: z.string().optional().describe("A name from the host's icon set, drawn beside the title."),
     // An optional global keyboard shortcut, in the host's chord notation (`Mod`/`Ctrl`/`Shift`/`Alt` + key, e.g.
     // "Mod+Shift+K"; `Mod` = ⌘ on Apple, Ctrl elsewhere). It is DECLARED here so it rides the install dialog's
-    // approval surface — a global shortcut is consequential, so like title/icon the manifest value is authoritative
+    // approval surface, a global shortcut is consequential, so like title/icon the manifest value is authoritative
     // and the host binds only what was approved. Whitespace-free; an unparseable chord simply never fires.
     keybinding: z
         .string()
@@ -18,12 +18,12 @@ export const CommandContributionSchema = z.object({
         .describe(
             'A global keyboard shortcut, e.g. "Mod+Shift+K" — `Mod` is ⌘ on Apple and Ctrl elsewhere. Declared here because a global shortcut is consequential: the owner approves it at install, and the host binds only what was approved.',
         ),
-    /* When the KEYBINDING applies — a condition over the shell's context keys (`tabSurface == 'chat'`,
+    /* When the KEYBINDING applies, a condition over the shell's context keys (`tabSurface == 'chat'`,
      * `!editableTarget`; see @intentic/base/when). The palette ignores it: a command is always runnable by
      * name, and what a condition decides is whether the chord is claimed from whatever else would have had it.
      *
      * Declared here because it could not be declared anywhere. The shell's own commands used to gate on a
-     * JavaScript predicate, which an extension has no way to ship — so every extension command took its chord
+     * JavaScript predicate, which an extension has no way to ship, so every extension command took its chord
      * globally, from every surface, including terminals where a bare key belongs to the program on the other
      * end. A condition an extension can write is what makes a contributed shortcut safe to grant. */
     when: z

package/src/points/documents.ts

@@ -2,11 +2,11 @@ import { z } from "zod";
 import type { ContributionPoint } from "../contribution-point.js";
 
 /* A per-directory document family the extension may register at runtime (api.documents.register): the provider
- * marks the directory rows it can explain in the Workspace tree, and the host opens its component as a tab —
+ * marks the directory rows it can explain in the Workspace tree, and the host opens its component as a tab,
  * see DocumentProviderRegistration.
  *
  * Only the id and the label are declared, deliberately. The consequential part of a viewer is which FILES it
- * takes over, and of a command its global shortcut — both are decided in the manifest because the owner must see
+ * takes over, and of a command its global shortcut, both are decided in the manifest because the owner must see
  * them. A document provider takes nothing over: it adds an icon to rows it has something for, and every one of
  * those rows is evidence the owner can see for themselves. So the manifest gates WHETHER the extension may mark
  * up the tree at all, and the per-row wording stays with the provider, which is the only thing that knows what

package/src/points/files.ts

@@ -1,24 +1,24 @@
 import { z } from "zod";
 import type { ContributionPoint } from "../contribution-point.js";
 
-/* WHICH WORKSPACE FILE MAKES THIS EXTENSION'S VIEW STALE — the extension's half of the core's
+/* WHICH WORKSPACE FILE MAKES THIS EXTENSION'S VIEW STALE, the extension's half of the core's
  * WORKSPACE_STATE_FILES table (@intentic/sandbox-contract), in the same two fields so the browser can union them
  * without translating.
  *
  * An intentic workspace is file-first: the agent edits /work with its own file tools, out of band from every
  * HTTP route, and the daemon's filesystem watcher is the ONLY thing that can tell a browser its view went stale.
- * Before this contribution point existed an extension had no way into that push, so every one of them polled —
+ * Before this contribution point existed an extension had no way into that push, so every one of them polled,
  * and the core's table had to hardcode `automations`/`automation-approvals`, query keys owned by an extension,
  * because the extension itself couldn't declare them. Declaring is now the extension's job and unioning is the
  * host's.
  *
  * It rides the manifest rather than a runtime api.workspace.onDidChangeFiles for two reasons: the owner sees at
- * install which of their files an extension reads, and there is nothing imperative left to get wrong — no
+ * install which of their files an extension reads, and there is nothing imperative left to get wrong, no
  * subscribe, no unsubscribe, no listener that quietly stops firing. */
 export const FileContributionSchema = z.object({
-    /* Workspace-root-relative, forward-slash — the space the watcher's changed paths arrive in. Matched by
+    /* Workspace-root-relative, forward-slash, the space the watcher's changed paths arrive in. Matched by
      * PREFIX, so one entry covers an exact file (`.intentic/config/automations.json`), a directory (`.intentic/config/drafts/`
-     * — keep the trailing slash so it cannot match a sibling file) or a name family (`.intentic/environment.`).
+     *, keep the trailing slash so it cannot match a sibling file) or a name family (`.intentic/environment.`).
      * Deliberately not a glob: prefix is the whole matching rule on both sides of this union. */
     path: z
         .string()
@@ -29,14 +29,14 @@ export const FileContributionSchema = z.object({
         .describe(
             "Workspace-root-relative, forward-slash, matched by prefix — so one entry covers an exact file (`.intentic/config/automations.json`), a directory (`.intentic/config/drafts/`, with the trailing slash so it cannot match a sibling file) or a name family (`.intentic/environment.`). Not a glob.",
         ),
-    /* The browser query keys those contents feed — the first element of the extension's own
+    /* The browser query keys those contents feed, the first element of the extension's own
      * `api.sandbox.key(...)` keys, which is what makes them match (the sandbox id is a SUFFIX). Empty is not
      * allowed: a path that makes nothing stale is a declaration with no effect, and saying so at install beats
      * discovering it as a view that never refreshes.
      *
      * Keep the paths as narrow as the view actually needs. A broad prefix costs every connected browser a
      * refetch per matching write, and a write-heavy path (an index, a transcript, a log) turns that into a
-     * request storm — the reason the core table leaves the daemon's own machine state off the push entirely. */
+     * request storm, the reason the core table leaves the daemon's own machine state off the push entirely. */
     invalidates: z
         .array(z.string().min(1))
         .min(1)

package/src/points/index.ts

@@ -30,14 +30,14 @@ export * from "./views.js";
 
 /* EVERYTHING A MANIFEST MAY DECLARE. `contributes` is assembled from this list (manifest.ts), the authoring
  * JSON Schema is generated from it (json-schema.ts), and the SDK's surface guard reads the point names back out
- * of it — so the three cannot disagree about what this build supports.
+ * of it, so the three cannot disagree about what this build supports.
  *
  * Collected explicitly rather than by a module-load side effect, because two readers need the answer to be the
  * same every time it is asked: the wire contract's lock file, which is a committed document a diff has to be
  * able to guard, and the generated schema, which is committed too. A registry that filled itself as modules
  * happened to load would make both of those depend on import order.
  *
- * Adding a point is a file in this directory and a line here — points.test.ts fails when a file appears without
+ * Adding a point is a file in this directory and a line here, points.test.ts fails when a file appears without
  * the line, so the pair cannot come apart. */
 export const CONTRIBUTION_POINTS = [
     viewsPoint,
@@ -56,13 +56,13 @@ export const CONTRIBUTION_POINTS = [
 ] as const satisfies readonly ContributionPoint[];
 
 // The `contributes` shape those points assemble to: each point's key, its schema, optional. A mapped type
-// rather than a widened record so `manifest.contributes.views` keeps its exact type at every call site — the
+// rather than a widened record so `manifest.contributes.views` keeps its exact type at every call site, the
 // whole point of the schema being typed at all.
 type ContributesShape = {
     [Point in (typeof CONTRIBUTION_POINTS)[number] as Point["name"]]: z.ZodOptional<Point["schema"]>;
 };
 
-/* The `contributes` object, assembled rather than hand-written — which is what makes adding a point a file plus
+/* The `contributes` object, assembled rather than hand-written, which is what makes adding a point a file plus
  * a line above, instead of an edit to a schema thirteen unrelated features share.
  *
  * Each point's description rides `z.describe` onto its own key, so it survives into the generated authoring

package/src/points/listener.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import type { ContributionPoint } from "../contribution-point.js";
 
-// One narrowing field the generic automation editor draws for a source — a channel, a branch. `hint` is the
+// One narrowing field the generic automation editor draws for a source, a channel, a branch. `hint` is the
 // sentence under the input, for a filter whose empty case is easy to get wrong.
 const TriggerFieldContributionSchema = z.object({
     label: z.string().min(1),
@@ -15,12 +15,12 @@ const TriggerFieldContributionSchema = z.object({
  * the provider extension is what lets a newly installed listener become configurable without a matching app
  * release.
  *
- * The daemon serves a provider-scoped control surface — GET /listeners/<provider>/state to reconcile, POST
+ * The daemon serves a provider-scoped control surface. GET /listeners/<provider>/state to reconcile, POST
  * …/dispatch to wake an automation (optionally holding a turn-stream), …/failure + …/status to report. The
  * daemon holds no provider connection itself.
  *
  * WHAT DISPATCHES IT IS OPEN. A gateway process (contributes.processes) is the usual answer and the one the
- * reconcile feed is shaped for — it holds a live connection the daemon must not. But an extension BACKEND can
+ * reconcile feed is shaped for, it holds a live connection the daemon must not. But an extension BACKEND can
  * dispatch through the same route by declaring the dispatch path in `permissions.daemon`, which is
  * how an area that learns things on its own schedule (an estate poller noticing a container died) contributes
  * a trigger without running a gateway at all. Declaring this with neither is legal and inert: the source is
@@ -55,7 +55,7 @@ export const ListenerContributionSchema = z.object({
                     "Only for a source whose message events distinguish being addressed. Absent ⇒ the editor offers no mention-only filter, rather than inventing semantics you did not promise.",
                 ),
             channel: TriggerFieldContributionSchema.describe("The primary narrowing filter — a channel, a room, a repo."),
-            // A SECOND narrowing axis, for a source whose events carry one — a pipeline's git ref, so a trigger can
+            // A SECOND narrowing axis, for a source whose events carry one, a pipeline's git ref, so a trigger can
             // say "the branch that ships" rather than "every agent's every failure". Absent ⇒ the editor offers
             // only the channel filter.
             branchField: TriggerFieldContributionSchema.optional().describe(

package/src/points/viewers.ts

@@ -2,7 +2,7 @@ import { z } from "zod";
 import type { ContributionPoint } from "../contribution-point.js";
 
 /* A custom file viewer the extension may register at runtime (api.viewers.register): the host resolves an open
- * file to this viewer by extension, gets its content, and renders the registered component with it — the host
+ * file to this viewer by extension, gets its content, and renders the registered component with it, the host
  * keeps the fetch + open-file lifecycle and the daemon credentials; the extension only renders. This is the
  * non-sidebar contribution point. */
 export const ViewerContributionSchema = z.object({
@@ -12,12 +12,12 @@ export const ViewerContributionSchema = z.object({
         .min(1)
         .describe('Bare file extensions, no dot — e.g. ["docx", "xlsx"].'),
     /* `fetch` is how much of the file the host puts in the extension's hands, and it is a real choice:
-     *   text — decoded utf8 (`text` prop). For a format that IS text: svg, a subtitle track, a notebook.
-     *   blob — the whole file in memory (`blob` prop). For a format that must be parsed end to end before any of
+     *   text, decoded utf8 (`text` prop). For a format that IS text: svg, a subtitle track, a notebook.
+     *   blob, the whole file in memory (`blob` prop). For a format that must be parsed end to end before any of
      *          it can be shown: a .docx, a spreadsheet. Bounded by the daemon's raw-read cap.
-     *   url  — a streaming URL the component points an element at (`src` prop), never the bytes. For anything
+     *   url , a streaming URL the component points an element at (`src` prop), never the bytes. For anything
      *          RANGE-READ rather than parsed: audio and video, where the file may be gigabytes and the player
-     *          wants the header, the index and the seconds around the playhead — not the file. The host mints
+     *          wants the header, the index and the seconds around the playhead, not the file. The host mints
      *          the credential on that URL and keeps it out of the extension.
      */
     fetch: z

package/src/powers-diff.ts

@@ -2,18 +2,18 @@ import type { ExtensionManifest } from "./manifest.js";
 
 /* WHAT AN UPDATE ASKS FOR, MECHANICALLY. The install dialog renders a manifest's contributions once; an update
  * is judged on what sits BETWEEN two manifests, and "read both and compare" is exactly the job a person will
- * skip on the fifth update. So each manifest is folded to a set of POWERS — the consequential facts an owner
+ * skip on the fifth update. So each manifest is folded to a set of POWERS, the consequential facts an owner
  * approved: which daemon routes it may call, which processes the daemon runs for it, what lands on the agent's
- * PATH, what may interrupt from another screen — each under a stable key (the identity compared) with a plain
+ * PATH, what may interrupt from another screen, each under a stable key (the identity compared) with a plain
  * sentence (what the reader sees). The diff is set arithmetic over the keys.
  *
  * Deliberately NOT here: plain settings (a new knob is config surface, not reach), display marks, category,
- * version. A power's INTERNALS moving (a process's command line, a fragment's contents) keeps its key — the
+ * version. A power's INTERNALS moving (a process's command line, a fragment's contents) keeps its key, the
  * code changed, which is what the sha pin and the agent diff-read answer for; this diff answers only "did the
  * set of things I approved grow". An empty `added` is what makes an update one click. */
 
 export interface PowersDiff {
-    // Powers the new manifest declares that the installed one didn't — the reason an update re-asks.
+    // Powers the new manifest declares that the installed one didn't, the reason an update re-asks.
     readonly added: string[];
     readonly removed: string[];
     readonly unchanged: string[];
@@ -81,7 +81,7 @@ const powersOf = (manifest: ExtensionManifest): Map<string, string> => {
 };
 
 // `before` absent covers a first install: everything the manifest declares is `added`, which is exactly what
-// the install dialog already renders — one vocabulary for both moments.
+// the install dialog already renders, one vocabulary for both moments.
 export const diffPowers = (before: ExtensionManifest | undefined, after: ExtensionManifest): PowersDiff => {
     const from = before === undefined ? new Map<string, string>() : powersOf(before);
     const to = powersOf(after);