Add url mode extensions for Discord, Atlassian, Slack and CRMs

extensions/cate.confluence/README.md

@@ -0,0 +1,24 @@
+# cate.confluence
+
+Confluence as a canvas panel — your team's docs, pinned next to your code.
+
+## What it does
+
+- Points a panel straight at `https://home.atlassian.com/` using the manifest's `url` mode: no assets to build, no server process, no proxy.
+- Runs in the extension's own persistent session partition (`persist:ext-cate.confluence`), so signing in once sticks across restarts and your Atlassian cookies are isolated from browser panels and from every other extension.
+- Works where an iframe embed would not: the panel is a top-level browsing context, so Atlassian's `X-Frame-Options` / `frame-ancestors` headers don't block it.
+
+## Your tenant
+
+Confluence is tenant-hosted — your wiki lives at `https://<your-site>.atlassian.net/wiki`, which a shipped manifest can't know. So the panel opens **Atlassian Home**, the tenant-agnostic launcher: sign in once and it lists the sites and apps you have access to, and you click through to your own Confluence.
+
+To pin your own tenant directly, sideload a copy of this extension with `url` edited to e.g. `https://your-site.atlassian.net/wiki/home`.
+
+## Scopes
+
+None. A `url` extension gets no `cateHost` bridge and no `cate.*` API — a remote origin can't prove an extension identity, so Cate attaches no preload to it (see `docs/extensions.md` → Security Hygiene). Atlassian is a third party; it should not be able to reach into the workspace.
+
+## Notes
+
+- Sign-in via "Continue with Google/Microsoft/Apple" is pushed to the system browser by Cate's OAuth handling; use email/password inside the panel.
+- There is nothing to build. `build.sh` ships the directory as-is (manifest + this README).

extensions/cate.confluence/manifest.json

@@ -0,0 +1,18 @@
+{
+  "id": "cate.confluence",
+  "name": "Confluence",
+  "version": "1.0.0",
+  "description": "Confluence as a canvas panel. Points a panel at Atlassian Home in the extension's own persistent session, so you stay signed in across restarts and can keep your team's docs next to your code.",
+  "url": "https://home.atlassian.com/",
+  "panels": [
+    {
+      "id": "app",
+      "label": "Confluence",
+      "icon": "<svg viewBox=\"0 0 16 16\" xmlns=\"http://www.w3.org/2000/svg\"><path d=\"M3 1.5h5.5L13 6v8.5H3z\" fill=\"none\" stroke=\"currentColor\" stroke-linejoin=\"round\"/><path d=\"M8.5 1.5V6H13\" fill=\"none\" stroke=\"currentColor\" stroke-linejoin=\"round\"/><path d=\"M5.3 8.2h5.4M5.3 10.4h5.4M5.3 12.1h3.2\" fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\"/></svg>",
+      "defaultSize": {
+        "width": 1040,
+        "height": 800
+      }
+    }
+  ]
+}

extensions/cate.discord/README.md

@@ -0,0 +1,18 @@
+# cate.discord
+
+Discord as a canvas panel — the Discord web app, pinned next to your code.
+
+## What it does
+
+- Points a panel straight at `https://discord.com/app` using the manifest's `url` mode: no assets to build, no server process, no proxy.
+- Runs in the extension's own persistent session partition (`persist:ext-cate.discord`), so signing in once sticks across restarts and your Discord cookies are isolated from browser panels and from every other extension.
+- Works where an iframe embed would not: the panel is a top-level browsing context, so Discord's `X-Frame-Options` / `frame-ancestors` headers don't block it.
+
+## Scopes
+
+None. A `url` extension gets no `cateHost` bridge and no `cate.*` API — a remote origin can't prove an extension identity, so Cate attaches no preload to it (see `docs/extensions.md` → Security Hygiene). Discord itself is a third party; it should not be able to reach into the workspace.
+
+## Notes
+
+- Sign-in via "Continue with Google/Apple" is pushed to the system browser by Cate's OAuth handling; use email/password or QR sign-in inside the panel.
+- There is nothing to build. `build.sh` ships the directory as-is (manifest + this README).

extensions/cate.discord/manifest.json

@@ -0,0 +1,18 @@
+{
+  "id": "cate.discord",
+  "name": "Discord",
+  "version": "1.0.0",
+  "description": "Discord as a canvas panel. Points a panel at the Discord web app in the extension's own persistent session, so you stay signed in across restarts and can keep a chat next to your code.",
+  "url": "https://discord.com/app",
+  "panels": [
+    {
+      "id": "app",
+      "label": "Discord",
+      "icon": "<svg viewBox=\"0 0 16 16\" xmlns=\"http://www.w3.org/2000/svg\"><path d=\"M6 3.2C4.6 3.4 3.3 3.9 2.6 4.4 1.6 6 1.1 8.2 1.3 11.1c1 .8 2.1 1.3 3.2 1.6l.7-1.1\" fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/><path d=\"M10 3.2c1.4.2 2.7.7 3.4 1.2 1 1.6 1.5 3.8 1.3 6.7-1 .8-2.1 1.3-3.2 1.6l-.7-1.1\" fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/><path d=\"M4.3 10.6c2.3 1 5.1 1 7.4 0\" fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\"/><circle cx=\"6\" cy=\"8.2\" r=\"1\" fill=\"currentColor\"/><circle cx=\"10\" cy=\"8.2\" r=\"1\" fill=\"currentColor\"/></svg>",
+      "defaultSize": {
+        "width": 980,
+        "height": 720
+      }
+    }
+  ]
+}

extensions/cate.dynamics365/README.md

@@ -0,0 +1,24 @@
+# cate.dynamics365
+
+Microsoft Dynamics 365 as a canvas panel — your CRM, pinned next to your code.
+
+## What it does
+
+- Points a panel straight at `https://www.office.com/apps` using the manifest's `url` mode: no assets to build, no server process, no proxy.
+- Runs in the extension's own persistent session partition (`persist:ext-cate.dynamics365`), so signing in once sticks across restarts and your Microsoft cookies are isolated from browser panels and from every other extension.
+- Works where an iframe embed would not: the panel is a top-level browsing context, so Microsoft's `X-Frame-Options` / `frame-ancestors` headers don't block it.
+
+## Your environment
+
+Dynamics 365 is environment-hosted — your apps live at `https://<your-org>.crm.dynamics.com` (or `.crm4`, `.crm11`, … for your region), which a shipped manifest can't know. Microsoft **retired `home.dynamics.com` in 2021**; the documented replacement is the Microsoft 365 app launcher, which lists the Dynamics 365 apps you're licensed for and clicks through to your own environment.
+
+To pin your environment directly, sideload a copy with `url` edited to e.g. `https://your-org.crm.dynamics.com/main.aspx?appid=<app-guid>`.
+
+## Scopes
+
+None. A `url` extension gets no `cateHost` bridge and no `cate.*` API — a remote origin can't prove an extension identity, so Cate attaches no preload to it (see `docs/extensions.md` → Security Hygiene). Microsoft is a third party; it should not be able to reach into the workspace.
+
+## Notes
+
+- Microsoft sign-in runs on `login.microsoftonline.com`, which Cate treats as an OAuth host and pushes to the system browser. Expect to complete first-time sign-in there; if the panel does not pick the session up, sideload a copy pinned at your own `*.crm.dynamics.com` URL.
+- There is nothing to build. `build.sh` ships the directory as-is (manifest + this README).

extensions/cate.dynamics365/manifest.json

@@ -0,0 +1,18 @@
+{
+  "id": "cate.dynamics365",
+  "name": "Microsoft Dynamics 365",
+  "version": "1.0.0",
+  "description": "Dynamics 365 as a canvas panel. Points a panel at the Microsoft 365 app launcher in the extension's own persistent session, so you stay signed in across restarts and can keep your CRM next to your code.",
+  "url": "https://www.office.com/apps",
+  "panels": [
+    {
+      "id": "app",
+      "label": "Dynamics 365",
+      "icon": "<svg viewBox=\"0 0 16 16\" xmlns=\"http://www.w3.org/2000/svg\"><rect x=\"2\" y=\"2\" width=\"5\" height=\"5\" rx=\"1\" fill=\"none\" stroke=\"currentColor\" stroke-linejoin=\"round\"/><rect x=\"9\" y=\"2\" width=\"5\" height=\"5\" rx=\"1\" fill=\"none\" stroke=\"currentColor\" stroke-linejoin=\"round\"/><rect x=\"2\" y=\"9\" width=\"5\" height=\"5\" rx=\"1\" fill=\"none\" stroke=\"currentColor\" stroke-linejoin=\"round\"/><rect x=\"9\" y=\"9\" width=\"5\" height=\"5\" rx=\"1\" fill=\"none\" stroke=\"currentColor\" stroke-linejoin=\"round\"/></svg>",
+      "defaultSize": {
+        "width": 1100,
+        "height": 760
+      }
+    }
+  ]
+}

extensions/cate.hubspot/README.md

@@ -0,0 +1,24 @@
+# cate.hubspot
+
+HubSpot as a canvas panel — your pipeline, pinned next to your code.
+
+## What it does
+
+- Points a panel straight at `https://app.hubspot.com/` using the manifest's `url` mode: no assets to build, no server process, no proxy.
+- Runs in the extension's own persistent session partition (`persist:ext-cate.hubspot`), so signing in once sticks across restarts and your HubSpot cookies are isolated from browser panels and from every other extension.
+- Works where an iframe embed would not: the panel is a top-level browsing context, so HubSpot's `X-Frame-Options` / `frame-ancestors` headers don't block it.
+
+## Your portal
+
+HubSpot is portal-scoped, but `app.hubspot.com` is portal-agnostic: it redirects to sign-in when you're signed out and to `app.hubspot.com/<app>/<portal-id>/...` for your own portal once you're in. Nothing to edit for the common case.
+
+To land somewhere specific, sideload a copy with `url` edited to e.g. `https://app.hubspot.com/contacts/1234567/objects/0-3/views/all/board` (your portal id).
+
+## Scopes
+
+None. A `url` extension gets no `cateHost` bridge and no `cate.*` API — a remote origin can't prove an extension identity, so Cate attaches no preload to it (see `docs/extensions.md` → Security Hygiene). HubSpot is a third party; it should not be able to reach into the workspace.
+
+## Notes
+
+- Sign-in via "Continue with Google/Microsoft/Apple" is pushed to the system browser by Cate's OAuth handling; use email/password inside the panel.
+- There is nothing to build. `build.sh` ships the directory as-is (manifest + this README).

extensions/cate.hubspot/manifest.json

@@ -0,0 +1,18 @@
+{
+  "id": "cate.hubspot",
+  "name": "HubSpot",
+  "version": "1.0.0",
+  "description": "HubSpot as a canvas panel. Points a panel at the HubSpot web app in the extension's own persistent session, so you stay signed in across restarts and can keep your pipeline next to your code.",
+  "url": "https://app.hubspot.com/",
+  "panels": [
+    {
+      "id": "app",
+      "label": "HubSpot",
+      "icon": "<svg viewBox=\"0 0 16 16\" xmlns=\"http://www.w3.org/2000/svg\"><path d=\"M1.8 2.5h12.4L9.4 8.2v5L6.6 14.2V8.2z\" fill=\"none\" stroke=\"currentColor\" stroke-linejoin=\"round\"/><path d=\"M4.2 5.3h7.6\" fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\"/></svg>",
+      "defaultSize": {
+        "width": 1100,
+        "height": 760
+      }
+    }
+  ]
+}

extensions/cate.jira/README.md

@@ -0,0 +1,24 @@
+# cate.jira
+
+Jira as a canvas panel — your board, pinned next to your code.
+
+## What it does
+
+- Points a panel straight at `https://home.atlassian.com/` using the manifest's `url` mode: no assets to build, no server process, no proxy.
+- Runs in the extension's own persistent session partition (`persist:ext-cate.jira`), so signing in once sticks across restarts and your Atlassian cookies are isolated from browser panels and from every other extension.
+- Works where an iframe embed would not: the panel is a top-level browsing context, so Atlassian's `X-Frame-Options` / `frame-ancestors` headers don't block it.
+
+## Your tenant
+
+Jira is tenant-hosted — your board lives at `https://<your-site>.atlassian.net`, which a shipped manifest can't know. So the panel opens **Atlassian Home**, the tenant-agnostic launcher: sign in once and it lists the sites and apps you have access to, and you click through to your own Jira. (Atlassian consolidated its per-product landing pages into this hub; the older `start.atlassian.com` / `team.atlassian.com` URLs redirect here.)
+
+To pin your own tenant directly, sideload a copy of this extension with `url` edited to e.g. `https://your-site.atlassian.net/jira/software/projects/ABC/boards/1`.
+
+## Scopes
+
+None. A `url` extension gets no `cateHost` bridge and no `cate.*` API — a remote origin can't prove an extension identity, so Cate attaches no preload to it (see `docs/extensions.md` → Security Hygiene). Atlassian is a third party; it should not be able to reach into the workspace.
+
+## Notes
+
+- Sign-in via "Continue with Google/Microsoft/Apple" is pushed to the system browser by Cate's OAuth handling; use email/password inside the panel.
+- There is nothing to build. `build.sh` ships the directory as-is (manifest + this README).

extensions/cate.jira/manifest.json

@@ -0,0 +1,18 @@
+{
+  "id": "cate.jira",
+  "name": "Jira",
+  "version": "1.0.0",
+  "description": "Jira as a canvas panel. Points a panel at Atlassian Home in the extension's own persistent session, so you stay signed in across restarts and can keep your board next to your code.",
+  "url": "https://home.atlassian.com/",
+  "panels": [
+    {
+      "id": "app",
+      "label": "Jira",
+      "icon": "<svg viewBox=\"0 0 16 16\" xmlns=\"http://www.w3.org/2000/svg\"><rect x=\"1.5\" y=\"2.5\" width=\"13\" height=\"11\" rx=\"1.5\" fill=\"none\" stroke=\"currentColor\" stroke-linejoin=\"round\"/><path d=\"M5.8 2.5v11M10.2 2.5v11\" fill=\"none\" stroke=\"currentColor\"/><path d=\"M3 5.2h1.4M7.3 5.2h1.4M11.6 5.2H13M3 7.6h1.4M7.3 7.6h1.4\" fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\"/></svg>",
+      "defaultSize": {
+        "width": 1100,
+        "height": 760
+      }
+    }
+  ]
+}

extensions/cate.pipedrive/README.md

@@ -0,0 +1,24 @@
+# cate.pipedrive
+
+Pipedrive as a canvas panel — your deal pipeline, pinned next to your code.
+
+## What it does
+
+- Points a panel straight at `https://app.pipedrive.com/` using the manifest's `url` mode: no assets to build, no server process, no proxy.
+- Runs in the extension's own persistent session partition (`persist:ext-cate.pipedrive`), so signing in once sticks across restarts and your Pipedrive cookies are isolated from browser panels and from every other extension.
+- Works where an iframe embed would not: the panel is a top-level browsing context, so Pipedrive's `X-Frame-Options` / `frame-ancestors` headers don't block it.
+
+## Your company
+
+Pipedrive companies have their own `https://<company>.pipedrive.com` domain, but `app.pipedrive.com` is company-agnostic: it shows the login form when you're signed out and redirects to your own company's app once you're in. Nothing to edit for the common case.
+
+To pin your company directly, sideload a copy with `url` edited to e.g. `https://your-company.pipedrive.com/pipeline`.
+
+## Scopes
+
+None. A `url` extension gets no `cateHost` bridge and no `cate.*` API — a remote origin can't prove an extension identity, so Cate attaches no preload to it (see `docs/extensions.md` → Security Hygiene). Pipedrive is a third party; it should not be able to reach into the workspace.
+
+## Notes
+
+- Sign-in via "Google" or SSO is pushed to the system browser by Cate's OAuth handling; use email/password inside the panel.
+- There is nothing to build. `build.sh` ships the directory as-is (manifest + this README).

extensions/cate.pipedrive/manifest.json

@@ -0,0 +1,18 @@
+{
+  "id": "cate.pipedrive",
+  "name": "Pipedrive",
+  "version": "1.0.0",
+  "description": "Pipedrive as a canvas panel. Points a panel at the Pipedrive web app in the extension's own persistent session, so you stay signed in across restarts and can keep your deal pipeline next to your code.",
+  "url": "https://app.pipedrive.com/",
+  "panels": [
+    {
+      "id": "app",
+      "label": "Pipedrive",
+      "icon": "<svg viewBox=\"0 0 16 16\" xmlns=\"http://www.w3.org/2000/svg\"><path d=\"M1.5 3.5h5l2 4.5-2 4.5h-5l2-4.5z\" fill=\"none\" stroke=\"currentColor\" stroke-linejoin=\"round\"/><path d=\"M8.5 3.5h5l2 4.5-2 4.5h-5l2-4.5z\" fill=\"none\" stroke=\"currentColor\" stroke-linejoin=\"round\"/></svg>",
+      "defaultSize": {
+        "width": 1100,
+        "height": 760
+      }
+    }
+  ]
+}

extensions/cate.salesforce/README.md

@@ -0,0 +1,24 @@
+# cate.salesforce
+
+Salesforce as a canvas panel — your org, pinned next to your code.
+
+## What it does
+
+- Points a panel straight at `https://login.salesforce.com/` using the manifest's `url` mode: no assets to build, no server process, no proxy.
+- Runs in the extension's own persistent session partition (`persist:ext-cate.salesforce`), so signing in once sticks across restarts and your Salesforce cookies are isolated from browser panels and from every other extension.
+- Works where an iframe embed would not: the panel is a top-level browsing context, so Salesforce's `X-Frame-Options` / `frame-ancestors` headers don't block it.
+
+## Your org
+
+Salesforce is instance-hosted — your org lives at something like `https://your-org.lightning.force.com`, which a shipped manifest can't know. So the panel opens `login.salesforce.com`, the tenant-agnostic gateway: sign in (or use "Use Custom Domain" if your org enforces My Domain) and Salesforce redirects you to your own instance.
+
+To pin your org directly, sideload a copy with `url` edited to e.g. `https://your-org.lightning.force.com/lightning/page/home`.
+
+## Scopes
+
+None. A `url` extension gets no `cateHost` bridge and no `cate.*` API — a remote origin can't prove an extension identity, so Cate attaches no preload to it (see `docs/extensions.md` → Security Hygiene). Salesforce is a third party; it should not be able to reach into the workspace.
+
+## Notes
+
+- SSO that hands off to Google/Microsoft/Apple is pushed to the system browser by Cate's OAuth handling; use username/password (with MFA) inside the panel.
+- There is nothing to build. `build.sh` ships the directory as-is (manifest + this README).

extensions/cate.salesforce/manifest.json

@@ -0,0 +1,18 @@
+{
+  "id": "cate.salesforce",
+  "name": "Salesforce",
+  "version": "1.0.0",
+  "description": "Salesforce as a canvas panel. Points a panel at the Salesforce login gateway in the extension's own persistent session, so you stay signed in across restarts and can keep your org next to your code.",
+  "url": "https://login.salesforce.com/",
+  "panels": [
+    {
+      "id": "app",
+      "label": "Salesforce",
+      "icon": "<svg viewBox=\"0 0 16 16\" xmlns=\"http://www.w3.org/2000/svg\"><rect x=\"1.5\" y=\"3\" width=\"13\" height=\"10\" rx=\"1.5\" fill=\"none\" stroke=\"currentColor\" stroke-linejoin=\"round\"/><circle cx=\"5.6\" cy=\"7.2\" r=\"1.6\" fill=\"none\" stroke=\"currentColor\"/><path d=\"M3.2 11.1c.4-1.1 1.3-1.7 2.4-1.7s2 .6 2.4 1.7\" fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\"/><path d=\"M10.2 6.4h2.4M10.2 8.6h2.4\" fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\"/></svg>",
+      "defaultSize": {
+        "width": 1100,
+        "height": 760
+      }
+    }
+  ]
+}

extensions/cate.slack/README.md

@@ -0,0 +1,24 @@
+# cate.slack
+
+Slack as a canvas panel — a channel, pinned next to your code.
+
+## What it does
+
+- Points a panel straight at `https://app.slack.com/client` using the manifest's `url` mode: no assets to build, no server process, no proxy.
+- Runs in the extension's own persistent session partition (`persist:ext-cate.slack`), so signing in once sticks across restarts and your Slack cookies are isolated from browser panels and from every other extension.
+- Works where an iframe embed would not: the panel is a top-level browsing context, so Slack's `X-Frame-Options` / `frame-ancestors` headers don't block it.
+
+## Your workspace
+
+Slack is workspace-hosted, but `app.slack.com/client` is workspace-agnostic: it redirects to whichever workspace you're signed into (and to the workspace picker / sign-in when you're not). Nothing to edit for the common case.
+
+To pin one workspace directly, sideload a copy with `url` edited to e.g. `https://app.slack.com/client/T01234567` (your team id), or `https://your-workspace.slack.com/`.
+
+## Scopes
+
+None. A `url` extension gets no `cateHost` bridge and no `cate.*` API — a remote origin can't prove an extension identity, so Cate attaches no preload to it (see `docs/extensions.md` → Security Hygiene). Slack is a third party; it should not be able to reach into the workspace.
+
+## Notes
+
+- Sign-in via "Continue with Google/Apple" is pushed to the system browser by Cate's OAuth handling; use email/magic-link or password sign-in inside the panel.
+- There is nothing to build. `build.sh` ships the directory as-is (manifest + this README).