1
Read the extension contract
Start with the Extension API v2
to understand manifests, contributions, capability boundaries, and lifecycle rules.
2
Build a minimal package
Add one contribution at a time and request only the permissions needed for
that behavior. Do not depend on an undocumented hosted API.
3
Validate before publishing
Use the package CLI and conformance suite supplied with the desktop project
before distributing a package.
Safety boundary
- Extensions have no ambient clipboard, file-system, or network access.
- Network destinations and external navigation require declaration and local consent.
- A changed package checksum requires another permission review.
- Credentials and grants do not synchronize between devices.
Browse extension source
Review first-party package examples and their manifests.