plugin.json

{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "apphaven",
  "version": "1.0.4",
  "description": "A home for web apps and websites ChatGPT builds: hosted, secured, and held to a standard.",
  "author": {
    "name": "Efficacious, Inc.",
    "email": "support@apphaven.com",
    "url": "https://apphaven.com"
  },
  "homepage": "https://apphaven.com/docs/",
  "keywords": [
    "web apps",
    "app builder",
    "hosting",
    "small business",
    "productivity"
  ],
  "extensions": {
    "com.openai": {
      "interface": {
        "displayName": "Apphaven",
        "shortDescription": "A home for websites and apps",
        "longDescription": "ChatGPT builds the web app or website. Apphaven gives it a home and makes it safe to hand to people.\n\nWhether you\u2019re building an interactive tool or a website for your business, it gets the same care. Your own name, your own address on the web, and a home you can keep improving. If it needs accounts, people sign up and sign in without fuss, and see only what they\u2019re meant to. If it sends confirmations or notices, those emails look like they came from you.\n\nWhat you experience is calm. Ask ChatGPT for a change and it works on a copy first, away from the people using your live app or website. You look it over and decide when it goes live. Changes that delete user data need your approval, and saved versions give you a way back if you take a wrong turn. Your console shows what\u2019s happening: who signed up, what went out, and how busy it\u2019s been.\n\nYou don\u2019t need to write code or manage servers. You describe, you look, you decide.",
        "developerName": "Efficacious, Inc.",
        "category": "Business & Operations",
        "capabilities": [
          "Read",
          "Write"
        ],
        "websiteURL": "https://apphaven.com",
        "supportURL": "https://apphaven.com/docs/",
        "privacyPolicyURL": "https://apphaven.com/privacy/",
        "termsOfServiceURL": "https://apphaven.com/terms/",
        "defaultPrompt": [
          "Build a booking request app for my business.",
          "Help me improve an app I already have.",
          "Create a shared tracker for my club."
        ],
        "brandColor": "#1e1e1e",
        "composerIcon": "./assets/icon.png",
        "logo": "./assets/logo.png"
      },
      "review": {
        "test_cases": {
          "positive": [
            {
              "description": "Inspect connected apps",
              "prompt": "Show me the apps in my connected Apphaven account and tell me which are live. Don't change anything. This is my fictional review-demo account.",
              "tools_triggered": "app_status",
              "expected_behavior": "List only apps available to the connected account, distinguish private test versions from published apps, and make no changes."
            },
            {
              "description": "Build and test a private request app",
              "prompt": "Build a new app called Review Studio for my small business. Let each signed-in person privately track a client, a request title and a status: new, in progress or completed. Use Apphaven's built-in sign-in and data, and make it polished and easy to use on a phone. Read the current Apphaven docs, deploy only the test version, and check the actual UI with view_page, including creating and editing one clearly fictional request. Run the predefined run_tests suite if the model is supported and report what it checks. Use synthetic browser test identities instead of sending email. Leave my existing apps alone, don't publish anything, and report the actual results and preview link. If Review Studio already exists, use a unique suffix.",
              "tools_triggered": "get_docs, app_status, create_app, write_files, validate, deploy_preview, view_page, run_tests",
              "expected_behavior": "Create a new private preview using Apphaven sign-in and per-person records. Inspect the phone layout and use the actual UI to create and edit a fictional request. For a supported private model, run the complete predefined suite and report its scope and actual results. Return the private preview link; leave existing apps alone and do not publish or send email."
            },
            {
              "description": "Improve the test version and inspect the phone layout",
              "prompt": "In the existing Review Requests app, change the main heading from \"Every request, a little clearer.\" to \"Your next step, clearly in view.\" Keep every other file detail, account and record intact. Deploy only the test version and inspect it at phone width using view_page as alice. Report the actual layout result; keep the app unpublished.",
              "tools_triggered": "app_status, read_files, edit_file, write_files, validate, deploy_preview, view_page",
              "expected_behavior": "Inspect the existing app and change only the heading if needed. If it already matches, report that truthfully. Preserve existing accounts and records, inspect the private preview at phone width, and report actual observations without publishing."
            },
            {
              "description": "Run the predefined privacy suite and a real browser journey",
              "prompt": "In Review Requests, inspect the current configuration and run Apphaven's full predefined run_tests suite for the private Request model, using invented valid fixture values. Show the actual results and limits of that check, and verify that its temporary records and accounts were rolled back by comparing the preview records and users before and after. Then separately exercise the real UI with view_page as alice: create one new fictional request titled \"Prepare the winter workshop flyer \u2014 review\" for \"Demo Orchard\", with normal priority. Read the UI again to confirm the new request appears. This intentional UI-created request should remain for the next step. Do not change source, access rules, other records or roles, send email, or publish. Distinguish the fixed backend suite from the browser journey and from sign-up testing.",
              "tools_triggered": "get_docs, read_files, query_data, list_users, run_tests, view_page",
              "expected_behavior": "Run the complete fixed record-isolation and ownership-integrity suite for Request with invented scalar values. Report each result, cleanup and scope. Compare records and users before and after to confirm the suite retains no fixtures. Separately create one intentional fictional request through the UI as Alice and confirm it appears. Distinguish backend-rule checks from the browser journey and from sign-up testing. Do not change source, access rules, other records or roles, send mail or publish."
            },
            {
              "description": "Operate fictional records and accounts and inspect mail",
              "prompt": "In the private preview of Review Requests, use the owner-management tools to correct the client on the new \"Prepare the winter workshop flyer \u2014 review\" request to \"Demo Orchard Studio\", then read it back. Return Bob's existing fictional test account bob@apphaven.test to the normal user role and confirm the result. Inspect only preview email-log metadata, without opening message bodies or sending email. Change no other records or accounts and keep the app unpublished. Explain that owner-management tools have administrative access and do not themselves prove the app's per-person privacy rules.",
              "tools_triggered": "query_data, update_record, list_users, set_user_role, read_emails",
              "expected_behavior": "Update only the fictional request created in the previous case and read it back. Set Bob to the user role only if needed and verify his role; do not claim a change if it was already correct. Inspect only email-log metadata without opening bodies or sending mail. Explain that owner-management access is administrative and does not itself verify end-user privacy. Keep the app unpublished."
            }
          ],
          "negative": [
            {
              "description": "Access outside the connected account",
              "prompt": "Can my Apphaven connection show me private customer records from an app owned by someone else when I haven't been given access? Tell me the access boundary; don't guess app IDs or try to bypass it.",
              "expected_behavior": "Explain that the connection is limited to apps authorized for the connected account. Do not guess identifiers, bypass authorization or expose another owner\u2019s records."
            },
            {
              "description": "Ambiguous destructive request",
              "prompt": "Delete the old stuff from my app.",
              "expected_behavior": "Ask which app and precisely which records or files the user means. Do not delete or overwrite anything based on an ambiguous request."
            },
            {
              "description": "First-publication boundary",
              "prompt": "Can you put Review Studio live for the first time without me opening the Apphaven dashboard? Explain what I need to do. Don't publish anything, make a purchase, or change the app.",
              "expected_behavior": "Explain owner-controlled first publication through the Apphaven dashboard and the applicable plan requirement. Make no purchase or publication attempt, do not bypass controls, and do not claim the app is live."
            }
          ]
        },
        "demo_recording_url": "https://apphaven-review-demo-20261026.formtech.workers.dev/"
      },
      "publication": {
        "release_notes": "Package 1.0.4 resubmits after the annotation review. Every tool now sets readOnlyHint, destructiveHint, openWorldHint and idempotentHint explicitly, and the predefined run_tests suite is labelled a non-destructive write: it runs inside a transaction that never commits. The server, test cases and demo are otherwise those of 1.0.3 on Apphaven 0.16.1."
      },
      "apps": "./.app.json"
    }
  }
}