UI Contributions
Plugins declare UI contributions in their manifest. The Desktop host validates
them, orders them deterministically and renders only entries from an enabled
plugin with an active ui.contribute grant. Disabling a plugin or revoking the
grant removes its entries without leaving routes or commands behind.
Declarative categories
- workspace destinations, each with a safe absolute route;
- detail tabs and context actions for
track,album,artistorplaylist; - command-palette commands and settings sections;
- metadata enrichment providers, which also need
metadata.propose; - host-scheduled background jobs, which also need
jobs.schedule.
Every contribution has a stable id and title. Workspace routes must be local,
absolute and free of traversal, query, fragment or escaped-path forms. Commands,
track context actions and track detail tabs additionally require a
targetWorkspaceRoute published by the same plugin. The host handles them as
safe navigation, never as executable callbacks or plugin-provided entity
payloads. The host deduplicates conflicting IDs deterministically rather than
allowing a plugin to override another plugin's UI.
Community runtime boundary
Community bundles provide a bounded JSON descriptor. Its SHA-256 must match
the value in the installed bundle; descriptor reading has a size limit and
timeout. The runtime parses data, filters it against live grants, and publishes
only the allowed contributions. The Desktop shell renders host-owned workspace,
settings, command, detail-tab and action surfaces from that data. It does not execute the
bundle's worker, ui or other artifact. Executable third-party UI and worker
support are future work requiring a separately published sandbox contract.