Extend
How extension packages are planned to add tools, skills, hooks and connectors to Hypervibe without adding authority, and what is still open for package authors.
On this page
An extension package adds tools, skills, hooks, connectors, evaluators or design systems to Hypervibe. This page explains what a package may bring, how it is checked and activated, and why installing one grants no permission.
A package brings capability, never authority #
A package is a signed, versioned bundle of contributions, pinned by digest. It brings no scheduler, credential store, policy store or message bus of its own. Every contribution enters through the capability registry, the one list of packages, skills, tools and hooks kept by the Hypervibe service, the platform's system of record.
Each kind of contribution has exactly one host, the component that runs or applies it and records a receipt of its use. A package cannot add a kind of its own, and it never adds a model to Throttle's capability catalogue, which refuses any model it does not list.
| Contribution | Host | What it may do |
|---|---|---|
| Tools | Hypervibe's tool adapters | Offer an action with a stable name, typed arguments and a declared effect class |
| Skills | Rocket! | Add reviewed text to an agent's context, by digest and within a size budget |
| Hooks | Rocket! | Return a decision on an event, such as a tool call, never an effect |
| Connectors | Hypervibe's connector adapters, beside the tool adapters | Bind an outside service, with one owner for each synced field |
| Evaluators | Reactor, which runs them as jobs | Check work; a verdict alone promotes nothing |
| Design systems | Hypervibe service | Style artifacts in an isolated preview, never Hypervibe's own interface |
Activation is reviewed and happens in one step #
Automation may stage and qualify a package; a person activates anything new or wider.
- Verify. The signature, the digests and the revocation list are checked.
- Resolve. Dependencies are resolved, and a name collision is refused.
- Stage. Files are stored by digest and no code runs: there is no post-install script.
- Qualify. Each host checks its contributions, and nothing is offered before that check passes. A new network host, credential, hook, tool server or connector, a looser isolation mode or a changed tool definition forces a fresh review, so an update never widens itself.
- Activate. The capability registry changes in one atomic step, and a crash leaves the previous revision in force.
Running work stays on the revision it started with. Removal drains running work and deletes only generated files that still match their receipt, so your edits are kept. Installed, enabled, authorized, healthy, selected and used are separate facts, shown apart.
Grants are checked where the effect happens #
Installing or enabling a package grants nothing; only a grant authorizes. Each action declares one effect class from a closed list, such as read, send or external write, and an action nobody has classified needs a grant and a person's confirmation. An approval binds to the exact effect, and the grant is checked again when it runs.
Package policies can deny or ask, never allow, and a failing security hook blocks the call. Skills, hooks and tool servers found in a repository stay inert until a person enables them for one workspace. On Just me, one person on one machine, adding a package you chose also authorizes it, with an undo. In a team, the policy owner approves a package for others.
Connectors act under the caller's grant #
Connectors bind outside services. The Hypervibe service keeps their records and policy, Hypervibe's connector adapters run them, and a package supplies the manifest and contributions. Throttle holds every connector credential and lends a short lease to the one process that needs it. Each synced field has one owner, and a close in an outside tracker never counts as acceptance. Without a grant, a connector action stays visible and disabled, with the reason. A mention, such as @gh:, is a typed reference you pick in a composer, never an action.
| Package | Planned contents | Standing |
|---|---|---|
| GitHub | Pull requests, reviews, checks, issues and rulesets; repository policy files; @gh: mentions | Planned |
Drive, Gmail and Calendar tools, where Gmail sends only drafts; @gmail, @drive and @calendar mentions | Planned | |
| Linear | Actions, skills and @lin: mentions over a mirror with explicit field ownership | Planned |
| Beyond Work | Author, Author Sandbox, Beyond Work's command-line client and its runner, behind one adapter | Planned |
Beyond Work is an outside platform that keeps its own authority over its tenants, branches and versions. Its tools receive leased credentials only, an operation the platform marks for a person waits for one, and a pass in its sandbox never grants publication.
Package code runs contained, never as a loaded library #
There is no binary plugin interface, and no arbitrary library is loaded into a Hypervibe process. A contribution runs in one of four modes, in this order of preference.
| Mode | What runs | Boundary |
|---|---|---|
| Declarative | Data only | Nothing executes |
| Isolated process | A separate program | No shell, a clean environment, allow-listed writes, network only through a broker, resource limits |
| First-party module | Built-in or first-party code | The same release only |
| Remote endpoint | An outside service | Only through a connector's broker |
If containment is not available, activation fails, with no bypass. Script and WebAssembly tiers are Unavailable until a recorded decision, backed by shown demand, admits each one.
MCP, a tool protocol that agent clients such as Claude Code and Codex speak, is only an edge adapter. Hypervibe is planned to generate MCP servers, hosted by Lanes, that offer those clients only granted actions, and a change to an imported server's tool list quarantines the affected actions until a person approves them again.
No package interface is a public contract yet #
Package authors will write one manifest format, hypervibe.extension/1, defined by a JSON Schema whose sections are still proposals. A manifest names the minimum host contract it needs, and a mismatch is negotiated or refused with a typed reason. Each action's exposure is common (in default tool sets and help), advanced (found by search or explicit choice) or internal, the default, which never becomes a command, an agent tool or an MCP tool.
Signing and visibility of first-party packages, and licensing of the Beyond Work package, are open decisions. A public package index and third-party packages are deferred.
Where to go next #
- Hypervibe platform for the capability registry, grants and connectors.
- Rocket! for how skills, tools and approvals reach an agent.
- Throttle for credential custody and leases.
- Reactor for evaluators and verification jobs.
- Standings for what Planned and Unavailable mean.