Local plugins

Install and find a plugin

1. Open Settings → Plugins. You can also choose File → Manage Plugins or search for Manage Plugins in the command palette; each opens the same manager.
2. Choose a local .varveplugin file. Review its package identity, requested access, and checksum.
3. Grant required access and choose Install and enable, or install disabled and decide later.
4. Use its command in the manager, or find a declared contextual panel in the Properties Inspector when a layer is selected.

The manager shows package thumbnails with their alternative text and a short description when supplied. Search matches plugin names, publisher labels, commands, descriptions, IDs, and status. Pin frequently used packages, filter All, Pinned, or Needs attention, and choose A–Z or recently installed ordering. Counts describe the full local inventory; the manager does not rely on an online catalog.

The publisher name is supplied by the file itself. A checksum shows which bytes were installed; it does not authenticate the publisher. A design file cannot install or activate a plugin for you. Installed packages and their grants stay in the local profile and remain available to manage offline.

Access, previews, and recovery

Read the current selection provides a bounded snapshot of selected layer names, kinds, lock state, and a few style counts. Change the open document permits a reviewed rename proposal to be applied. Neither permission grants file, network, clipboard, native command, or whole-document access.

Use Stop to terminate a running command. Revoking access, disabling, updating, or removing a plugin invalidates pending results. If a plugin fails, its diagnostic stays in the manager until you choose Retry. A preview becomes stale when the document or selection changes; run it again before applying. The manager also retains disabled and incompatible installations with the recovery actions that apply.

Safe mode pauses plugin commands and Inspector sections while keeping the manager available for inspection, removal, and recovery. Continuing past the safe-mode startup screen does not restore plugins or change their saved enabled preferences.

Removing the package removes its commands and panels. Names already applied remain ordinary editable Varve artwork and can be saved or exported without the plugin. Undo committed edits while their document history is available. Plugin packages and permission grants stay in the local application profile, not in shared design files.

Build the two examples

The repository contains Selection Style Readiness and Number Selected Layers source, manifests, and a package builder. With Rust's wasm32-unknown-unknown target installed, run node examples/plugins/build.mjs from the repository root. The builder performs a real WebAssembly ABI smoke test and writes local packages in examples/plugins/dist/. Install those files through the manager; installation itself never runs Cargo, npm scripts, or a package setup command.

A v1 package contains manifest.json and module.wasm, with optional thumbnail.png. Manifests may add a plain-text description and thumbnail: { "path": "thumbnail.png", "alt": "..." }; the image must be static PNG no larger than 256 KiB or 512×512 pixels. No SVG, animation, remote image, or arbitrary package asset is accepted. The manifest uses schemaVersion: 1, apiVersion: 1, and entry: "module.wasm"; every command requires declared selection.read, and rename commands also require declared document.write. Guest code imports only env.memory and exports alloc, run, and result_len. Input and output are bounded UTF-8 JSON. The examples use the typed varve-plugin-sdk Rust crate. Run node --experimental-strip-types scripts/plugins/validate.mjs <file.varveplugin> for a static package check before installation. Consult the API and threat-model contract before building a package. Updates require selecting a higher-version local package and reviewing access again; same-version replacement, folder watching, a remote catalog, and automatic update feed are unsupported.

Current limits

Supported commands are selected-layer analysis and undoable renaming. Arbitrary HTML panels, custom nodes, background listeners, external network calls, local files, private plugin storage, native binaries, and a dependency resolver are not in API v1. Wasm linear memory has a fixed ceiling; browser and operating-system overhead are not covered by that limit. Browser automation checks the user workflow; packaged desktop WebView testing on every operating system remains separate validation work.