manifest.json

Every field of a widget’s manifest.

manifest.json says what a widget is and what it may touch. The desktop app checks it when it loads a widget, and the gallery checks it on upload.

JSON

{
  "id": "gpu-ring",
  "name": "GPU ring",
  "description": "GPU load as a ring, with the last minute below it",
  "version": "1.0.0",
  "author": "your-github-login",
  "license": "MIT",
  "repository": "https://github.com/your-github-login/gpu-ring",
  "categories": ["system"],
  "minAppVersion": "0.5.0",
  "sizes": ["small", "medium"],
  "permissions": {
    "sources": ["gpu"],
    "actions": [],
    "local": [],
    "network": [],
    "secrets": []
  },
  "config": []
}

Fields

Field	Required	What it is
`id`	Yes	Lowercase-kebab-case, at most 64 characters. Unique in the gallery; some, like `pc-stats` and `clock`, are reserved.
`name`	Yes	At most 48 characters.
`description`	No	At most 280 characters. The gallery's one-line summary.
`version`	Yes	Semver, such as `1.0.0`. Each upload has to be higher than the last.
`author`	Yes	Your GitHub login.
`license`	Yes	An SPDX id of an OSI-approved license.
`repository`	No	Where the source lives.
`categories`	Yes	Any of `system`, `dev`, `productivity`, `media`, `finance`, `weather`, `fun`, `other`.
`minAppVersion`	Yes	The oldest ShiftPane the widget works with.
`refreshSeconds`	No	Seconds between collector runs, 1 to 86,400. Leave it out for widgets with no collector.
`sizes`	Yes	One or more of `small`, `medium`, `large`.
`permissions`	No	What it may touch. See Permissions.
`config`	No	Settings the user fills in. See below.

Permissions

Field	Holds
`sources`	System sources it reads
`actions`	Actions its buttons fire
`local`	Apps on this PC or network, as `host:port`
`network`	Internet hosts its collector may fetch: a hostname such as `api.github.com`, or one leading wildcard such as `*.example.com`
`secrets`	Names in `UPPER_SNAKE_CASE`, such as `GITHUB_TOKEN`

Config fields

Each has a key (camelCase), a label, an optional help and required, and a type:

Type	Extra fields
`string`	`default`
`number`	`default`, `min`, `max`
`boolean`	`default`
`location`	City search; saves JSON text containing `label`, `latitude`, `longitude`, `timezone`
`datetime`	Date and optional time; saves an ISO timestamp with an explicit offset
`select`	`options` (a list of `value` and `label`), `default`

Keys have to be unique within a widget.

location and datetime require ShiftPane 0.6.0. Location search uses Open-Meteo and requires geocoding-api.open-meteo.com in permissions.network. The user must select a result. Date-only targets mean midnight at the start of that day in the PC timezone. The saved offset fixes the instant; timezone changes do not move it. Invalid local times are rejected; repeated times choose the earlier occurrence.