Supported extension model
Panel extensions are signed unprivileged API clients, not in-process PHP plugins or arbitrary root hooks. The extension manifest, publisher root, complete package inventory, supported Panel/API version and native licence admission are verified before launch. A signature grants no host operation or extra API scope.
Broker request and response
The child uses the protected runner's bounded broker protocol. A request carries version: 1, positive id, one allowed tool, optional object_id, after and limit. A response carries version, matching ID, HTTP-like status, optional JSON body and safe code. Maximum request bytes are 4096, maximum reply bytes 1 MiB and maximum requests 128. Limits are 0/default50 through100; object IDs are 32 lowercase hexadecimal characters.
| Tool | Scope | Target |
|---|---|---|
resources.list |
resources:read |
Authorized resource inventory. |
websites.list |
resources:read |
Authorized website inventory. |
websites.get |
resources:read |
One owned/permitted website. |
operations.list |
operations:read |
Authorized task list. |
operations.get |
operations:read |
One permitted task. |
operations.events |
operations:read |
One task's paginated event history. |
Operation cursors are canonical nonnegative decimal; website-list cursors are valid IDs. Unsupported tools, extra object IDs on a list, pagination on a detail and unsupported scopes fail closed. The broker selects fixed local HTTPS routes with TLS1.3, a pinned expected certificate and loopback dial address; child code cannot choose remote URLs or receive the API credential.
Events and hooks
The operation-events API and audit trail are read-only evidence under current authorization. This source does not provide an arbitrary administrator webhook URL, a custom event subscription/dispatch registry, before/after hosting hooks, PHP hook files or writable event injection for extensions. Read/poll the supported event route within its bounds. A menu or future module name is not a hook contract.
Short-lived extension credential
The authenticated issuer requires full fresh local session, eligible licence and a request binding manifest_sha256, extension_id, exact scopes and expires_minutes 1–15. The credential stays with the broker. Expiry, local admission and premium rights are rechecked; there is no long-lived child token or direct privileged agent socket.
Test and qualify
Test valid tools, unauthorized resources, expired/revoked credential, wrong manifest/digest, unknown tool, oversized input, request-count limit and unavailable authority in an isolated environment. Real native sandbox, publisher/recovery and installed service acceptance remain separate. This is not a billing provisioning hook, registrar integration or browser root package installer.