Start here

What apps can't do yet

Apps are new. Today an app is a set of pages, told who's looking. Here's what that leaves out, so nothing surprises you.

• Your server reaches the workspace only for an action. An action's request carries a short-lived key to your app's data, and to report events. Otherwise your server can't read or write the workspace, or report events on its own; keep what it needs on your own servers, keyed by ids from verified tokens.
• No access to the workspace's content. Your app can't read or write messages, files or tasks, and it isn't told who else is in a space.
• Agents use your app through its actions. They read the data you allow and run your actions (asking first when they change something), but they can't change your data directly or see your tab.
• No live updates. Changes to your app's data aren't pushed to other people's open tabs.
• Your app isn't told what happens in the workspace. Your events can start a space's triggers, and its workflows can use your actions, but your app isn't told about new messages, tasks or files.
• No accounts or credentials. There's no way to connect a person's or a workspace's account (Google, GitHub) to your app through the workspace.
• No permissions to ask for. Every app is told the same things.
• No automatic updates. An admin checks for updates to your manifest by hand. See Installing and updating.
• No directory. Admins install apps from your manifest's address, which you give them.
• The SDK isn't on npm yet. It's in the Tabs & Spaces repository, at packages/sdk. tands new copies a built copy into your app; or speak the frame protocol directly. It's a few messages.