Publish your plug-in
On this page (7)
The publishing portal is open to invited organizations first. Any organization can verify its domain, upload and run the checks; submitting waits for an invitation.
The portal is kanboombo://publish, in the app and on the web. Walk these steps yourself, or let your agent walk most of them; a reviewer may ask for changes, and you upload again.
Ask to be invited
Once you have named your domain, the portal offers Ask to be invited: say in a line what you will publish. Your agent can ask, with no password or token:
The answer is the same whether or not the domain is known; nothing is mailed until you are invited; one request per domain is open at a time, five a day per address. The invitation belongs to the domain.
1. Your organization and domain
You publish as an organization, which readers see as the publisher, through an owner or admin with a verified email. Verify its domain with the portal's token, as a DNS record or a file:
An IP address, a name with no dot, a shared host (github.io, vercel.app) and a domain another organization verified are refused. It is checked every 30 days; after a failed check you have 14 days, told by email, before it lapses, and published plug-ins keep running without the verified mark. Unverified, you can upload and check, not submit. Accept the Developer Agreement once, and again before your next submission after a new version is posted.
2. Upload the ZIP
Upload what pack makes: your folder under its id, with .kanboombo-pack.json (contract, id, version, digest, each file's path, size and SHA-256, the tool's version), without node_modules/, .git/, .DS_Store or earlier packs.
No path in the ZIP becomes a path on Kanboombo's disk. Over a quota nothing is stored; the same bytes twice are one version. A new version must be greater than every one you published, the same version with other code is refused, and the same code with a new listing is a listing-only version, its code approval standing.
3. Read the checks
At upload, in seconds, nothing runs: the archive; the manifest (contract 1, an id not reserved or taken, at most 24 runs a day, a terms link, no IP address as a source); what an update may not change; a code scan (outside or undeclared imports, dynamic imports, network APIs, eval, new Function, minified code); fixtures and listing. Then the locked room runs your fixtures twice (same output), each broken source (it must fail), your example days, your real sources once, and each listing link. Every problem has a code in Submission errors; Copy issues copies them in check's words.
4. Submit, and a person reviews it
Add your review information. Submit is refused, with each reason, until it is complete with every attestation, the current agreement is accepted, and your domain is verified and invited.
A person at host.kanboombo.com reads the checks, the manifest, every changed file, your example days as the locked room drew them, your listing and review information, then approves exactly that (a change since refuses it), requests changes or rejects, with a reason and a note. You and your owners and admins hear by email and in the portal. A reviewer from your organization does not approve yours when someone else can.
5. Publish
An approved version waits for you, or publishes itself if you said so before submitting. It is live within 15 minutes, and readers move to it at its next run (Updates). Any organization may upload and check within the quotas; a verified one may reserve an id; only a verified, invited one may submit and publish.
With your agent
Any agent that runs commands can upload, read the checks, fill in review information and submit, without your password (Use your agent). You approve it once, by a code, for one organization, and choose whether it may also publish.
Five things stay yours, and the agent's token is refused for each: verifying the domain, accepting the agreement, approving the agent, retiring a plug-in and, unless you allow it, pressing Publish.
login shows a code, the agent's name (--name changes it) and an address, kanboombo://publish/agents?code=…. Open it as an owner or admin, choose the organization, leave It may also publish off or turn it on, and Approve. The code lasts 10 minutes, and login run again within them waits for it; --server names another Kanboombo API (https, or this machine). Approve only a code your own agent just showed you: one someone sends you asks for your organization's name on their plug-in, so Deny it.
status says when the locked room is done and what is next, in the portal's words. With no version named, these act on the last upload from the folder you are in, or else from this machine. AGENTS.md tells the agent to ask you before --attest. publish stops with AGENT_MAY_NOT_PUBLISH unless you allowed it; if you did, unpublish <id> and relist <id> work too. retire answers AGENT_FORBIDDEN: retiring is for good, so you do it in the portal.
The token reaches only the portal's routes, for that organization, while you are its owner or admin: the steps above, withdrawing and re-running checks, and reading reports, never who sent them. It can never name a domain, ask to be invited or revoke agents, and every upload records the agent's name. Shown once, kept by Kanboombo only as a hash, it lives in ~/.config/kanboombo/plugin-token.json, readable only by you, and stops at logout, at Revoke under Agents in the portal, at a new login on that machine, or when its approver stops being owner or admin.