Interface
Buttons in the composer, actions on a message, context menu items, header buttons, hotkeys, your own settings page, side panels, and CSS for the whole app.
Plugins
Make NeyLivo yours.
Extend NeyLivo with plugins distributed as a single .neylivo file. Write one in an afternoon, send it to a friend in a chat, and it installs from the message.
Why this exists
Most messengers let you pick a theme. NeyLivo lets you change what the app does. If you want a button in the composer that rolls dice, a panel that shows your team’s deploy status, a slash command that talks to a language model, a game that lives in a window inside the app, or a bot that greets people in your server — you write it yourself instead of asking somebody to add it.
A plugin is not a package with a build step and a manifest folder. It is one JavaScript file with a comment at the top:
/**
* @name Night mode
* @id nightmode
* @version 1.0.0
* @author you
* @description Highlights messages and adds a command
* @permissions ui, css, commands, messages.write
*/
function onLoad(neylivo) {
neylivo.css('.msg { border-left: 2px solid hotpink }')
neylivo.ui.addComposerButton({
key: 'wave', icon: 'flame', tooltip: 'Wave',
onClick: () => neylivo.messages.send('o/'),
})
neylivo.commands.register('hello', 'Say hello', args =>
neylivo.messages.send('Hello, ' + (args || 'world') + '!'))
}One file, sent like any other file
Install a plugin from a file in Settings → Plugins, or receive one in a conversation: the message shows a card with the name, author, version and the full list of permissions the plugin is asking for, and an Install button. There is also a built-in catalogue, and personal transfer codes if you want to hand a plugin to one specific person.
There is an editor inside the app, so you can write, run and fix a plugin without leaving NeyLivo, and a workshop for plugins that need a 3D scene.
What a plugin can do
Around ninety API methods, grouped by what they touch. All of them go through one dispatcher that checks permissions on every call.
Messages
Read the open channel, send messages, add reactions, delete, intercept a message before it is sent or before it is rendered, and hook file uploads — for example to strip location data from photos.
Windows and pages
Open a real window inside NeyLivo with your own HTML: a full DOM with WebGL, WebGPU, WebAssembly, audio and unthrottled animation. Frameless and transparent windows are supported; the plugin can move them and knows when the user moves them.
Storage and data
Key-value storage on the device, a small local database with tables and queries, and asset storage for files the plugin ships or downloads.
Network
HTTP requests, streaming responses and WebSocket connections — restricted to the domains the plugin declared.
Music
Read what is playing, control playback, read the library and add tracks to the queue.
Commands and notifications
Slash commands with named and typed arguments, toasts, dialogs, confirmations and prompts.
Between plugins
Plugins can register services and call each other, so one can build on another instead of duplicating it.
Background and input
Timers that keep running while you use the app, and gamepad input.
Built with permissions in mind
Everything above is only reachable if the plugin declared it, and you agreed at install time.
Isolation is the browser’s, not ours
Plugin code runs in a Web Worker. A worker has no DOM, no cookies and no access to the page, so a plugin cannot read your session, cannot draw a fake login window and cannot reach into the interface. Plugins with their own page get an <iframe sandbox="allow-scripts"> without allow-same-origin — a unique opaque origin, with its own DOM but no access to NeyLivo’s document or storage.
These are boundaries enforced by the browser, not checks in our code that a clever plugin could argue with.
23 permissions, in plain language
The install screen shows exactly what the plugin asked for, worded for a person and not for a developer: “Send messages on your behalf”, “See messages in the open channel”, “Reach the internet (only the listed sites)”, “Change the appearance of the app”. You can turn a plugin off or remove it at any time.
Network is an allowlist
A plugin declares its domains in the header. Only https: and wss: are allowed, Cookie is never allowed, and a plugin can never make requests to NeyLivo itself or its backend — it cannot turn your own session against the app. A plugin may ask for access to any site, and if it does, the install screen says so in red.
What the sandbox does not do
A plugin cannot escape the browser. It absolutely can do what you allowed it to do. If you granted “send messages on your behalf”, it can send messages as you, whenever it likes — there are no rate limits, by design. The app says this before you install, because the real protection here is your judgement about who wrote the plugin, not a quota.
Install plugins you trust, from people you trust, and turn off anything that starts behaving oddly.
Start writing
The plugin format, the full API and the permission list are documented in the repository. The fastest way in is the editor inside the app: Settings → Plugins → Create.
Opens the plugin guide in the repository — the same text the in-app guide shows.