kanboombo-plugin.mjs
On this page (23)
One file holding the Server's checker, the words for every problem and the app's day-drawing code. Its first lines name each file it was built from, with its SHA-256, and its licence, MIT-0. This page is version 1.5.0.
node kanboombo-plugin.mjs help <command> prints any command's usage.
Commands
init
Start a plug-in in a new folder named <id>: a manifest, a fetcher and fixtures that pass check before you change a line.
check
Check a plug-in as the Server will: the manifest, its imports, a run of fetch.mjs on fixtures/sources/ with no network, every record, fixtures/records.jsonl and each fixtures/runs/<case>. Prints the digest an approval covers.
preview
Show the rows your fixture puts on each day, worked out by the code the app draws them with.
probe
Download the real sources once (https, declared hosts only) and run fetch.mjs on them. It reaches the real source; it is never part of a check.
pack
Check the plug-in, then write the ZIP the publishing portal takes, with .kanboombo-pack.json inside. Refuses unless check passes. The same files give the same bytes.
digest
Print the digest an approval covers: SHA-256 over the plug-in's code, without fixtures, listing, README, AGENTS.md or CLAUDE.md.
login
Ask to publish for an organization. It prints a code and an address, and waits while a person who owns or runs the organization approves the code in kanboombo://publish. Approved, it keeps the token in ~/.config/kanboombo/plugin-token.json, readable only by you. Run again within 10 minutes, it waits for the same code.
logout
Revoke this agent's token and delete it from this machine.
upload
Check and pack the plug-in, then upload it to your organization in the publishing portal. Prints the version, its status and what the upload checks found, in the portal's words. The Server then runs it in its locked room.
status
Show where a version stands: its status, its issues, what the Server's checks found and what to do next. <version> is a version id, or a plug-in's folder or id for the last version uploaded from here. Default: the plug-in in the folder you are in, or else your last upload.
review
Fill in a version's review information from a file: example days, the cases that must show nothing or fail, each source's terms and release notes.
submit
Submit a version for review by a person at Kanboombo. Refused, with each reason, until the Server's checks passed, the review information is complete, the five statements are made, and your organization is verified, invited and has accepted the current Developer Agreement.
publish
Publish a version Kanboombo approved. Only an agent approved with publishing allowed may; otherwise a person presses Publish in kanboombo://publish.
unpublish
Take a published plug-in out of the Plug-in Store: nobody new can install it, it keeps running for readers who have it, and they see it is no longer listed. <plug-in> is its id or its folder; default: the folder you are in. Only an agent approved with publishing allowed may.
relist
Put a plug-in you unpublished back in the Plug-in Store. Never one Kanboombo took down or took off the shelf, and never one that is retired. Only an agent approved with publishing allowed may.
retire
Retiring is for good: its runs stop, readers keep the records it wrote, and its id is never used again. So only a person retires, in kanboombo://publish, typing the id; the API refuses an agent, and this says where the person does it.
help
Show every command, or one command's options.
Exit codes
Where it runs your code
check, preview, pack and init run fetch.mjs on your machine, as you, on your fixtures, behind a guard: a seat belt, not a sandbox.
On your own days
Turn on Developer Mode in Settings and choose a folder under A plug-in folder on your days: before any review, its section shows "On this Mac · not published", with Run again, What check found, Open the folder and Publish… in its "…" menu. Kanboombo runs preview --json on it, with its own Node:
Nothing is stored and nothing leaves your Mac: the local audience.
What reaches Kanboombo, and what it keeps
Only probe and preview --live (your sources) and the publishing commands, login to publish, use the network. Those talk only to the API login was given, send your token nowhere else and follow no redirect (With your agent). login keeps its token in plugin-token.json and upload the last version per plug-in in plugins/<id>.json, in ~/.config/kanboombo/, readable only by you; KANBOOMBO_PLUGIN_HOME moves it (one per agent on a shared machine), and logout revokes and deletes the token. KANBOOMBO_PLUGIN_NOW, an ISO time, is the moment init writes into fixtures/context.json; these docs set 2026-09-30T19:30:00.000Z.
Versions
- •1.5.0. check --json: one object, each finding with its code, fix and docs link.
- •1.4.0. check counts the runs/<case> it passed; pack warns about init's README; init keeps acronyms (US).
- •1.3.0. preview --json, which your Mac draws your own days from; preview --live, on today's real sources; a fetcher in a folder reached through a link (/tmp on a Mac) may read its own files.
- •1.2.0. unpublish, relist, and retire, which says where a person retires a plug-in, since only a person may; codes PLG-LISTING-* and PLG-RETIRE-CONFIRM.
- •1.1.0. Publish with your agent: login, logout, upload, status, review, submit and publish. init also writes AGENTS.md and CLAUDE.md.
- •1.0.0. init, check, preview, probe, pack, digest and help. Reading outside the folder fails with PLG-RUN-READ-OUTSIDE.
Contract 1's own changes are in the manifest.