Extensions and Apps have access to similar system resources.
The only difference is that Apps have access to more stuff than Extensions.
Apps can draw to the Canvas for example, while Extensions cannot.
However, as for creating side panels, adding widgets, etc. Extensions have access to those.
An App can have many Extensions and an Extension can be appropriate for many Apps.
For an extension to access App's resources, an App must expose RPC interface along with permission types that guard that interface.
Extensions with the necessary permissions can call relevant RPCs and register hooks.
// ...
const perm = new Permission('read_list');
registerRpc("readWorkflow", readWorkflow, perm);
registerHook("worklfowUpatedEvent", perm);
Objects returned by RPCs and Hooks are protected. Implementation is unclear yet.
An extension can then do the following.
// ...
App.call("readWorkflow");
App.registerHook("worklfowUpatedEvent", (data) => {
// ...
});