Publish an extension

Public official publishing is closed until production readiness gates pass. A configured self-hosted development registry can exercise the flow independently.

1. Sign in to the registry publisher dashboard with GitHub.
2. Read and explicitly accept its publisher terms; create a namespace matching the manifest publisher. Namespace membership does not prove verified ownership.
3. Build, validate, pack, and inspect the .tabsext archive locally. The archive limit is 25 MiB.
4. Select or drag the package into the publisher upload area. Its identity is read from the validated manifest; the server checks membership.
5. Follow its scan and review status. Uploaded bytes stay private. Every version needs manual exact-digest approval.
6. Approval awaiting signing is not publication. Only approved versions in signed registry targets become publicly available.

Choose a tool name

Your display name is the title people see, such as Simulators. It can be shared by multiple tools. The stable package ID pairs your publisher namespace and package name, such as studio.simulators. A namespace can represent a studio or team; it does not have to be your GitHub username.

On the Publish page, select your namespace, enter a display name and package name, then choose Check package name. This checks every recorded version in your namespace, including unpublished submissions. An existing package name is for releasing another version of that same tool. Use Explore similar tools to search published listings across publishers.

Copy the suggested publisher, name and displayName fields into tabs-extension.json before building your archive. The name check does not reserve a name or modify an uploaded package; the validated archive remains the source of its identity.

CLI publishing

Create a namespace-scoped publish token in your dashboard. Store it in your terminal environment or CI secret store, never in source, URLs, or shell history commands containing the secret. Tokens expire after 30 days and can be revoked. Run these commands from your initialized extension project so publish can read its desktop target from .tabsext.json; when running elsewhere, add --tabs-version with your bundle’s desktop testing version.

tabsext registry --registry https://your-registry.example
tabsext publish my-publisher.my-tool-0.1.0.tabsext --registry https://your-registry.example
tabsext status my-publisher my-tool 0.1.0 --registry https://your-registry.example
tabsext status my-publisher my-tool 0.1.0 --registry https://your-registry.example --watch

Set TABS_EXCHANGE_TOKEN through your environment's secret mechanism before publish/status. Website and CLI submit to the same API. A token cannot bypass namespace checks, scans, reviewer approval, or signing.

Watching checks every five seconds and stops at rejection, revocation, or signed publication. Approval alone remains pending. The default watch deadline is 15 minutes; use --watch-timeout with 1–3600 seconds to change it. Ctrl+C cancels without changing the submission. A deadline is not rejection: reconnect with status later. With --json --watch, each change is one JSON line.

The registry hosts package objects; authors do not need their own download server. Disclose external services, data use, support/privacy links, and external charges. Closed-source submissions are allowed; Tabs has no marketplace checkout. Review is not a security guarantee.