manifest.json (schema version 1)

Every package has a manifest.json at its root. The same validator runs in Shellaro (before install and load) and in the CLI (shellaro ext validate / build).

{
  "schemaVersion": 1,
  "id": "acme.k8s-tools",
  "name": "K8s Tools",
  "publisher": "Acme",
  "version": "1.2.0",
  "type": "extension",
  "description": "Pods and logs for the active server.",
  "category": "Containers & Kubernetes",
  "tags": ["kubernetes", "kubectl"],
  "engines": { "shellaro": ">=0.7.0 <0.8.0" },
  "apiVersion": 1,
  "main": "dist/extension.js",
  "icon": "assets/icon.png",
  "permissions": ["ui.sidebar", "ui.commands", "remote.exec"],
  "activationEvents": ["onView:pods"],
  "contributes": {
    "commands": [{ "id": "refresh", "title": "Refresh Pods", "description": "Read pods again" }],
    "views": [{ "id": "pods", "title": "Pods", "icon": "boxes" }]
  },
  "license": "MIT",
  "homepage": "https://example.com",
  "repository": "https://example.com/acme/k8s-tools"
}

Field	Required	Rules
`schemaVersion`	yes	`1`. A higher number is refused with "update Shellaro".
`id`	yes	`publisher.name`: lowercase letters, digits and dashes, dot-separated, at most 64 characters. Never changes between versions.
`name`	yes	At most 60 characters.
`publisher`	yes	Shown on cards and in the review.
`version`	yes	Semantic version (`1.2.0`, `1.3.0-beta.1`).
`type`	yes	`extension`, `commandPack` or `labPack`.
`description`	yes	Cards show about 300 characters.
`category`	yes	One of: Containers & Kubernetes, Cloud, Infrastructure, Automation & Configuration, Databases, Networking, Monitoring & Observability, Security, Development, AI, Labs & Learning, Themes & UI, Other.
`tags`	yes	Up to 12 lowercase words (`a-z0-9-`).
`engines.shellaro`	yes	Version range of Shellaro: `>=0.7.0`, `>=0.7.0 <0.8.0`, `^0.7.0`, `~0.7.1`, `0.7.x`, `*`, and alternatives with `	`. A package outside the range is shown as incompatible and not installed.
`apiVersion`	extensions	Extension API version the code uses: `1`.
`main`	extensions	The bundled CommonJS file, usually `dist/extension.js`.
`pack`	commandPack	Usually `pack.json` (format).
`lab`	labPack	Usually `lab.json` (format).
`icon`	no	PNG, SVG, JPEG, GIF or WebP inside the package (up to 512 KB). Read and checked by 0.7; Marketplace cards in 0.7 still show an icon for the package type.
`permissions`	yes	List from permissions. Unknown names refuse the package. Command and Lab Packs must use `[]`.
`network.hosts`	with `network`	Every host the extension contacts: `api.example.com` or `*.example.com`.
`activationEvents`	no	`onStartup`, `onCommand:<id>`, `onView:<id>`. Contributed commands and views activate the extension anyway; add `onStartup` only when it must react to events from the start.
`contributes.commands`	no	`{ id, title, description? }`. Needs `ui.commands`. Shown in the palette as "<name>: <title>".
`contributes.views`	no	`{ id, title, icon? }`. Needs `ui.sidebar`. Shown as an icon tab in the sidebar.
`license`, `homepage`, `repository`	no	Links must be `https://`.
`screenshots`	no	Paths inside the package (kept for compatibility; use `gallery`).
`gallery`	no	Up to 8 `{ "path": "assets/demo.mp4", "caption": "..." }`: screenshots (PNG, JPEG, WebP, GIF, up to 2 MB) and short videos (MP4 H.264 or WebM, up to 10 MB), shown above the README on the Marketplace page. Optional, but a picture of the extension at work helps people decide.

Unknown fields are allowed and reported as warnings, so newer tools can add optional fields without breaking older Shellaro versions.

Icon names for views and tree items: box, boxes, server, layers, network, database, cloud, file-text, scroll-text, terminal, play, refresh, restart, trash, circle, activity, list, folder, git-branch, shield, cpu, hard-drive, globe, package, puzzle, container, ship, wrench, info, warning, check, x, link, search, clock, key-round, zap.