evi
Blog

Product·Evi team·

Introducing the plugin store

Browse, install and update plugins and themes without leaving Discord. Every file is checked before it touches your machine.

Until now, adding a plugin to Evi meant finding a folder and dropping files into it. That’s fine if you write plugins. It’s not how anyone else wants to spend their evening. As of Evi 0.2, the store lives right in the Plugins tab.

Browse, install, done

Every plugin gets its own page: what it does, screenshots, its changelog, a link to its source and, most importantly, what it can access. Browse by category, sort by name, stars or what was updated most recently, and hit install. Most plugins start right away, no restart, no reload.

Themes work the same way, in the Themes tab. Install one and it’s applied the moment it lands.

What’s in it on day one

The store starts with Evi’s own plugins and a first theme. More are on the way.

Fast Lists
Servers, messages and members far out of view skip rendering work.
Smooth Typing
Halves the worst frame drops while typing.
Clear URLs
Strips tracking parameters like utm_source from links you send.
Message Logger
Keeps deleted messages and edit history in the chat, in memory only.
Quick Actions
Copy links, raw text and IDs, search images and translate from the message menu.
Silent Typing
Others don’t see “is typing…”.
Experiments
Unlocks Discord’s Experiments and developer tabs.
No TrackNative
Blocks Discord’s analytics requests before they leave your machine.
GPU Zero-CopyNative
Turns on Chromium’s zero-copy GPU uploads.
Midnight
A theme: true black for OLED screens, Discord’s accents kept.
The launch lineup. The two marked Native need more access than the rest, more on that below.

Checked before it’s installed

The store is a single list, the registry, served from evi.rest. For every file of every plugin, it lists a fingerprint: a SHA-256 hash of exactly what the author published.

When you install something, Evi does it in a strict order:

1 · Download
Into memory, https only
manifest.json
index.js
native.js
2 · Verify
SHA-256 against the registry
4be1…09a2
e07c…5d31
91fa…c4e8
3 · Install
Staged, then moved in with one rename
plugins/no-track/
Nothing is written to disk until every file has been downloaded and matched. Hashes shortened for the diagram.
  1. 1

    Download everything first

    Every file is fetched into memory, over https only. A download that redirects away from https fails the install.
  2. 2

    Check every fingerprint

    Each file is hashed and compared with the registry. The plugin’s manifest is also checked against its store entry, so a plugin can’t quietly claim more access than the store says it has.
  3. 3

    Move it in, all at once

    The files are staged next to your plugins and moved into place with a single rename. An update swaps the old version out the same way, and puts it back if anything goes wrong.

If a single byte is off, you’ll see which file it was, and nothing is installed:

Install failed

index.js doesn't match the registry (sha256 3f9a02c41e7b…, expected 8d17e6b0c2aa…).
Nothing was installed.

Three kinds of access

Not everything in the store can do the same things, and each page tells you plainly which kind you’re looking at.

Theme
Looks only
A stylesheet. It changes how Discord looks and can’t run code.
Plugin
Runs inside Discord only
Runs in Discord’s page like Discord’s own code. It can change what Discord shows, but not your files.
Native plugin
Full access to your computer
Runs in Discord’s main process. It can read and change files, start programs and use your network. Evi asks first.

Native plugins are the ones to think about. They run outside the browser sandbox, like any app you install. Evi won’t install one without asking, in plain words:

No Track runs with full access to your computer
Native plugins run code in Discord’s main process, outside the browser sandbox. They can read and change your files, start programs and use your network like any app you install. Only continue if you trust its author.
CancelInstall with full access
The confirmation before installing a plugin with full access.

Updates, without the surprises

When updates are out, the Plugins tab says how many, with an Update all button. Turn on Update automatically and Evi checks shortly after Discord starts and every six hours after that, installs what’s new and tells you what changed.

A new version may do more than the one you agreed to. So native plugins always wait for your OK.

That goes for Update all as well: you can update everything, or only the rest.

Only what the store installed

Everything the store installs carries a small marker with the hash of each file. Plugins you added by hand don’t have one, and the store leaves them alone: it won’t overwrite, update or remove them. They show up as installed outside the store, and stay yours.

Stars

Like something? Star it. It’s one star per Evi install, tied to a random ID that says nothing about you or your machine. You can sort the store by the most starred.

What’s next

Right now the store carries Evi’s own plugins and themes. If you’ve built something for Evi, come say hi on GitHub.

Next post

How Evi makes sure you’re never locked out