Build with what you know.

1Start with web files

Create a local project containing the files below. Open index.html in your own browser to preview the starter. This website never executes packages. Compatible Prism builds run explicitly reviewed web packages in a sandbox.

my-extension/
  agentic-extension.json
  index.html
  styles.css
  main.js
  icon.svg
  README.md
  CHANGELOG.md
  LICENSE

The complete, minimal starter source is shown here. Copy each file into your own repository; no build framework is required.

<!doctype html>
<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Hello World</title><link rel="stylesheet" href="styles.css"><script src="main.js" defer></script></head>
<body><main><h1>Hello, builder.</h1><p>A little tool starts here.</p><button id="greet" type="button">Say hello</button><p id="message" role="status"></p></main></body></html>

body { font: 1rem/1.6 system-ui, sans-serif; margin: 3rem; color: #17213b; background: #f5f8ff; }
main { max-width: 36rem; margin: auto; }
button { font: inherit; padding: .6rem 1rem; border: 0; border-radius: .4rem; color: white; background: #0757f9; cursor: pointer; }
button:focus-visible { outline: 3px solid #17213b; outline-offset: 3px; }

document.querySelector('#greet').addEventListener('click', () => {
    document.querySelector('#message').textContent = 'Hello from your extension!';
});

# Hello World

A small, offline HTML/CSS/JavaScript starter.

## Local preview

Open index.html in your own browser to try the greeting button. The source uses ordinary DOM APIs; it has no Agentic Prism host API, filesystem access or remote dependencies.

## Compatibility

This package follows the current Agentic Prism schemaVersion 1 metadata shape. Agentic Prism currently registers application-owned built-ins only and does not run uploaded HTML/CSS/JS/SVG. Runtime execution, command dispatch and isolated community-package installation are future host work. Manifest contributions describe intended UI, not a currently callable runtime API.

## Publishing

Replace github-12345 in the manifest with your authenticated publisher namespace. Commit all source files into a public personal GitHub repository. Enable GitHub release immutability. ZIP these files at the archive root as extension.zip; attach it to a draft GitHub release before publishing tag v1.0.0. Import owner/repository into The Extension Market, review your catalog draft, then publish it.

## Maintenance

Use your repository issue tracker. Record changes in CHANGELOG.md, increment the manifest version and publish a matching immutable GitHub release. The website does not execute source or independently verify skills or security.

# Changelog

## 1.0.0

Initial offline greeting example and package metadata.

<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64"><rect width="64" height="64" rx="14" fill="#0757f9"/><path d="M24 20 12 32l12 12m16-24 12 12-12 12" fill="none" stroke="white" stroke-width="5"/></svg>

MIT License

Copyright (c) 2026 Garth

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

2Describe your extension

Sign in to see your immutable publisher namespace, such as github-12345. Replace it in both publisher and id below. Names use lowercase letters, numbers and hyphens. Versions are stable major.minor.patch numbers. The release tag must match the version, optionally prefixed by v.

{
    "schemaVersion": 1,
    "id": "github-12345.hello-world",
    "publisher": "github-12345",
    "name": "hello-world",
    "displayName": "Hello World",
    "description": "A small starter for learning the extension package format.",
    "version": "1.0.0",
    "compatibility": {
        "agenticTeamUi": ">=0.1.0"
    },
    "runtime": "web",
    "entry": {
        "html": "index.html",
        "styles": "styles.css",
        "script": "main.js"
    },
    "activationEvents": [
        "onCommand:hello-world.greet"
    ],
    "contributes": {
        "commands": [
            {
                "id": "hello-world.greet",
                "title": "Hello World: Greet"
            }
        ],
        "panels": [
            {
                "id": "hello-world.panel",
                "title": "Hello World"
            }
        ],
        "statusItems": []
    },
    "permissions": [
        "ui.commands",
        "ui.panels"
    ],
    "categories": [
        "Education",
        "Starter"
    ],
    "keywords": [
        "hello",
        "starter"
    ],
    "icon": "icon.svg",
    "license": "LICENSE",
    "readme": "README.md",
    "changelog": "CHANGELOG.md",
    "operatingSystems": [
        "windows",
        "macos",
        "linux"
    ],
    "dependencies": []
}

compatibility.agenticTeamUi accepts an exact numeric version or a single >=, ^ or ~ range. This is your compatibility declaration, not an executed compatibility test. Only ui.commands, ui.panels and ui.status declarations are supported; dependencies must be empty. Contributions record intended UI and do not invoke host code.

Optional pages and sidebar shortcuts

Add an optional pages list inside contributes. Omit it to contribute no pages. Each page has exactly these fields:

{"id":"workspace","title":"My tools","icon":"wrench","entrypoint":"hello-world.main","shortcut":true}

Entrypoint must match a panel ID in this same manifest and requires ui.panels. URLs, paths, host routes and other extensions’ panels are rejected. Shortcut true offers the page in both sidebar pickers; false keeps it out. Prism generates navigation from extension/page IDs. Installation, activation, review and user permissions determine availability. This declaration grants no native access. Private repositories require selected-repository read access configured securely in your creator dashboard.

3Release on GitHub

1. Commit your source to a public or private personal repository owned by the GitHub account you use here. Organization ownership will need a future GitHub App integration.
2. In the repository’s Settings → General → Releases, enable release immutability.
3. Create extension.zip with the manifest and source files directly at the ZIP root. Exclude Git history, credentials, dependencies, build caches and this ZIP itself.
4. Create a draft GitHub release tagged v1.0.0. Attach extension.zip, then publish the release. Immutability locks the tag and asset contents once published.
5. Import owner/repository in your creator dashboard. Choose a tag or leave it empty for GitHub’s latest stable release.

Validation temporarily downloads the asset, checks its SHA-256 and bounded package structure, reads documentation, then deletes the temporary archive. Only catalog metadata, README/changelog text and download totals remain here. Do not upload files to this marketplace. GitHub stores the release asset. Its automatically generated source-code archive is separate: it is not the validated extension.zip release asset. The catalog verifies and serves downloads. Private packages require the signed-in owner. Repeat verified full package responses count as downloads.

4Publish & maintain

Review the imported catalog draft in your dashboard. Public repositories can be published for discovery; private repositories remain owner-only, including metadata and downloads. Draft describes catalog state independently of repository privacy.

For an update, change source and changelog, increment the manifest version, and publish a new matching immutable GitHub release. “Check GitHub for updates” imports the latest. Optional automatic publication lets future accepted latest releases appear after scheduled checks; otherwise they remain drafts. The initial catalog supports ten repositories per creator and fifty recorded versions per repository.

Withdrawing hides a catalog version and disables its catalog download route. The GitHub release remains under your control; copies already downloaded cannot be recalled. Withdrawn versions are not republished automatically. Publish a new version to replace them. Keep support and maintenance status current.

Creator profiles are opt-in. Minimal GitHub attribution remains attached to published packages even if your full creator profile is nonpublic. Optional Developer Market contribution consent is a separate preference; its authenticated cross-service connection is not activated yet.

Catalog interface for Agentic Prism

GET /api/v1/extensions returns published catalog metadata with pagination and an optional ?q= search. GET /api/v1/extensions/{id}/versions/{version} returns one published version. Drafts and withdrawn versions return 404.

The response includes the original manifest, numeric publisher/repository/release/asset IDs, GitHub URL, SHA-256, byte count, check time, maintenance and availability. Clients must verify the downloaded digest and size and evaluate manifest compatibility themselves. A non-available or stale result has no download URL. Discovery does not grant installation or execution trust. Agentic Prism must keep its privileged page isolated from community code.

Scheduled checks are conservative and subject to GitHub’s shared rate limits. Missing, private, renamed, deleted or changed upstream releases become unavailable when observed. Transient failures and rate limiting are shown separately. Last-check timestamps are observations, not a real-time availability guarantee; checks older than 24 hours are stale.