0.43.0 · Extension Ecosystem · Kandown changelog

Added

Complete extension engine and CLI. Kandown now discovers global and project-local extensions, validates manifests and compatibility, enforces permissions and trust, isolates failures, contributes fields, commands, gates and sync handlers, and stores extension task data under plugins.<id>.*.
Web extension runtime. Managed moves now pass through the authoritative Node dependency and extension gates. Both task editors render typed extension fields, cards display computed badges, and collapsible web panels run behind per-panel error boundaries with persistent quarantine.
Community extension store and gallery. Settings can browse, install, enable and disable extensions, including installation from a pasted GitHub URL. kandown.dev now provides searchable extension listings and detail pages.
Reference extension bundles. Burndown, Labels and Webhook Sync demonstrate fields, badges, panels, gates, commands and sync contributions in Node and project-local standalone browser modes.
Website presentation components. The marketing site gained CurvedInput newsletter capture, GradualBlur page treatment and refined npm and Reddit links.
One-command local quality gate. pnpm verify now runs typechecking, the complete test suite, production builds, codemap and changelog drift checks, plus a scoped whitespace check.

Repository-controlled extension trust. Project source can no longer commit trust, enablement or quarantine state that authorizes itself. Node stores that state outside the repository, while standalone approval is bound to the local project and extension source fingerprint.
Extension runtime consistency. Restricted-mode changes invalidate cached hosts, managed moves serialize per project, stale editor responses are guarded, nested extension frontmatter round-trips, and failed extension contributions remain isolated from the board.
Website extension builds and documentation routes. Registry generation prefers the current local source instead of stale CDN data, and missing docs routes are restored with route coverage.
Post-commit graph refresh race. Detached Graphify updates now disable optional Git locks so an immediate follow-up commit cannot be blocked by a stale .git/index.lock.

Agent workflow guidance. AGENTS.md now maps mirrored task editors, store actions and local API adapters before agents start editing. Reviewer feedback remains subordinate to explicit project-owner decisions and recorded task scope.
Extension documentation. The architecture, security model, authoring guide, standalone behavior and publishing workflow are documented end to end.