Yuvomi

Added

• Third-party modules can declare capabilities in module.json for dashboard widgets, household permissions (ext:<module-id>), and API token scopes - the same surfaces core modules use, without changing core application code.

• The dashboard dynamically loads third-party widget entry points (renderWidget) from protected module assets, with per-widget error isolation and an optional generic options dialog driven by optionsSchema.

• Third-party modules can ship UI translations in locales/{locale}.json with manifest i18n.defaultLocale, labelKey / titleKey, and the same 24 core languages as Yuvomi.

• OpenAPI now documents extension module capabilities and module i18n metadata.

• Every page behind the app shell is now held to one page composition contract (#929). Layout primitives (.app-page--*, page-measure, the bleed section), the --layout-* width tokens and the page-layout.js helpers arrive together with an audit that enforces them. The audit derives its scope from router.js rather than from a list: a route with requiresAuth: false renders without navigation and is outside the contract, everything else is inside it, and a page added tomorrow is covered the day it gets a route. Three pages that predate the contract are named in the guard, and a second test fails if that list grows, so migrating a page is a deletion rather than a table somebody has to keep honest. The first draft marked one reference page in the production markup instead; that attribute shipped to every visitor and said nothing about the other thirty pages, so the guarantee moved into the guard. The spec lives at docs/PAGE-COMPOSITION.md. Two reviews on the way in found what the first cut had left undone: an extension module’s page.composition and page.width were checked on the server and shown in the admin list but never applied to the page, so data looked exactly like reading; now the router mounts the module in the declared root (the container a module’s render() receives is that root, and context.page says which). The reference page had lost the gap between its header and its body, and its measured header wrapped the title in a rail that hid the module seal and the docked title; notes was declared a reading page while its masonry ran the full width beside a 720px header, and is now full. Three of the new guards were green without seeing anything: the breakpoint check let the spec’s own forbidden example through, the negative-margin check did not know calc(-1 * ...), and the inline-width check read the whole style attribute instead of the value. Each of them now has a counter-proof. A second round found the header formula for a tab bar still subtracting the reading width by name, so the housekeeping header (a data page) stopped 240px before its cards; it now subtracts the measure of its own page, and pages without one (full, split) set that measure to 100% rather than none, because none inside a calc() does not degrade, it invalidates. The split grid sat on the page root, where the helper’s header and body would have become its two cells; it sits on the body now, and full/split roots built by the helper take the shell height so a body can scroll on its own. Subscriptions was declared reading while its analytics grid and list never met the measure - only the KPI band did, and the page acquired a width jump; it is full until its sections follow one measure, and split-expenses, a header over a two-column layout, is split. The reach proof of the audit could not catch the failure it was written for: with a dead router expression the scope did not shrink to nothing but widened to every page, login included, and every lower bound stayed green; the expression now has to have read the standalone routes before the file walk is allowed to add anything. A third round found the helpers escaping only attribute values: id, className and attribute keys went into the markup raw, and these helpers are the API an extension is told to build its page with, so a per-record id was the expected way to hit it; every attribute value now goes through the shared esc(). A fourth round showed that esc() is the wrong tool for an attribute key: it knows & < > " ' and not the space or = that end a name outside the quotes, so a key with either in it became three attributes, one of them live, while the new guard stayed green with its quote-based payload. Keys are now validated against an attribute-name pattern and an invalid one throws like an unknown mode does; the guard tokenizes the opening tag the way a browser does instead of reading the string. A fifth round caught the split grid measuring the viewport: beside the expanded sidebar a 1024px screen leaves the page about 804px, and a master rail allowed 720px of that left the detail rail a few pixels wide on common laptops; the split root is a container now, the grid switches on the page’s own width like the expenses split already did, and the master rail never takes more than half. A sixth round found the header helper still building a rail box for measured without narrow, the one combination the spec still offered: a real element, not a display: contents shim, and it put the title one level below the toolbar where the large-title rules and the collapsing header look for a direct child. No page used it. The option, the element and its rules are gone, every option combination renders the slots as direct children, and a guard fails on either class name anywhere under public/. A seventh round found the schedule page declared data (960px) under a header that runs full width: nothing showed the measure except the primitives that happen to consume it, so the KPI band of the statistics ended at 960 while the filter card and the result cards beside it did not (on main nothing was capped). Schedule and documents, the two pages with that shape, declare full and cap nothing, which is what they looked like before; the page’s own rows inside its full-width cards follow suit and no longer stop at the reading width. A guard reads the measure consumers from the stylesheets and fails on any measured page whose header does not narrow but whose markup contains one of them. The budget reports panel had declared itself a dashboard inside the reading budget page, which set the measure of its subtree to 1200px while the shared header and every other tab end at 720px; it declares the mode of the page it lives in, and a guard holds the two budget panels to that. A split body now carries the page gutter like the measured modes (its rails started at x=0, left of the title), the manifest fields page.navigation and page.responsive fall back to standard like composition and width do instead of passing a typo through, and the worked example in the spec no longer draws the rail element that the helper had stopped emitting.

• A third-party module now declares which manifest format it is written in (manifestVersion), and Yuvomi refuses one it cannot read instead of reading it in part. The extension surface from #919 - widgets, ext:<module-id> permissions, an API prefix, a locale chain - is a promise made to code nobody here can see: modules/ is gitignored, modules arrive at runtime. Without a format number, renaming a field later would have been a silent break, where the module still loads, the field is gone, and the household notices a widget that stopped doing anything.

  Omitting the field means 1, so manifests written before it keep working. A manifest declaring a higher version is rejected outright, and the error names both numbers, because loading it halfway would silently ignore fields it considers essential.

  New optional fields never require a bump; the number moves only when one is removed or renamed, and then the older format stays readable. A guard drives a manifest carrying every promised field through the real normaliser, so dropping one turns the suite red rather than turning somebody’s widget blank.

Changed

• GET /api/v1/modules includes normalized capabilities and i18n metadata (widgets, permission module metadata, API prefix, available locale files) for each installed extension module.
• Dashboard widgets, navigation, route guards, and admin permissions merge extension entries at runtime from enabled modules, so third-party widget ids (<module-id>:<widget-id>) and ext:<module-id> permission keys behave like core modules.
• API token and MCP scope pickers include extension modules from the live permissions catalog instead of a fixed core-only list.
• Extension capabilities.api.prefix must be exactly /api/extensions/<module-id> - any other prefix, including a core path such as /api/tasks, is rejected so an installed module cannot take over a core token scope.
• Extension UI labels resolve through a locale fallback chain (UI language, module default, en, de, then static manifest labels) in navigation, Settings, permissions admin, and the dashboard widget chrome.
• CONTRIBUTING.md says who cleans up a stale PR: it follows from the cause, not from who has time. main moves faster than a review cycle. Mechanical fallout of that - rebases, CHANGELOG collisions, the version line, sw.js, migration numbering - is the maintainer’s; decisions inside the feature stay with its author. Two promises follow: rebase once, after the review, and an open architecture question never blocks a PR (#621 died waiting on one).

Fixed

• A failed GET /modules no longer wipes the household’s extension widget layout. A network hiccup, a server restart, or the /api/ rate limit used to empty the in-memory module list; the next dashboard save then persisted a config with every ext tile gone. On recovery the widget came back as a newcomer: default size, default position, options lost. A failed fetch now keeps the previous list, and stored <module-id>:<widget-id> entries survive normalize even while the module is disabled or the catalog is empty.

• The extension permission catalog is scanned before the server accepts requests. Starting the scan inside the app.listen callback left a window where stored ext:<module-id> → none rows were dropped and the deny-list treated a missing key as allow.

• Extension locale lookup no longer throws for module ids that collide with Object.prototype. constructor (and toString) pass the module-id regex; looking them up on a plain {} store made t() throw instead of returning the key.

• The empty options dialog for a third-party widget no longer quotes the task-categories copy. It has its own string.

• An allowScripts pin no longer points at a version that is not installed. The field names every package allowed to run install scripts, with an exact version, because the permission applies to the reviewed build rather than to the name. Dependabot raises the dependency and the lockfile but never touches that field - it does not know about it - so after every bump the pin referred to a version that had been replaced. Nothing broke visibly, which is exactly why nobody noticed: a permission pointing nowhere looks like one that holds. A guard now compares each pin against the lockfile, so the next bump turns the suite red instead of leaving a dead pin behind.