Permissions

A plugin with a script does only what the user allowed. It lists what it needs in plugin.toml, notesy asks before it first runs, and every call it makes is checked against the answer.

#When notesy asks

The first time a plugin with a script loads, notesy shows what it asks for and waits: its script doesn't run until the user says yes. A plugin that only adds looks (themes, icons, syntax, colors, languages) runs nothing, so nothing is asked.

The prompt lists each permission and every site it can reach, and warns when a plugin can read what's yours and has a way to send it off: the network, opening links (a page's address can carry what it read), or sharing with other plugins.

#What each one lets it do

The ones in bold are shown in red when notesy asks.

Permission What it lets a plugin do
notes.read Read your notes and their properties
notes.write Create, change, rename and delete notes
files.read Read the other files in your vault, like images and PDFs
files.write Add, change and delete the other files in your vault
editor Read and change the note you're editing, and where the caret is
keys Know when you press and let go of keys, not which ones (key.down, key.up). When you type can still say something of what you type, so a plugin with it and the network is warned about.
keys.which Know which keys you press in notesy, letters and all: what you type, as you type it. Asked for with keys, it adds which key it was (key.key) and which modifiers are held. Only what's typed in notesy's own window, never another program's, and never while a secret's typed: a passphrase, or a field a plugin says is secret. Shown in red, and a plugin with it and the network is warned about.
commands Add commands to the palette, with shortcuts, and run notesy's
templates Add functions your templates can call
ui Add panels, tabs, status bar items, settings pages, right-click menu items, hover card parts and dialogs
clipboard.read Read what you copy
clipboard.write Put things on your clipboard
notify Show notices
sound Play sounds: those named in [[sounds]], and those its script makes (notesy::sound)
files.pick Read the files and folders you pick for it, from anywhere on this computer: notesy's own picker opens each time it asks (files::pick), and it reads what you picked and nothing else
files.save Save files on this computer, where you pick: notesy's save dialog opens each time (files::save)
keys.take Take what you type in the editor before notesy does, while it says it is, to act on it itself (editor::take_keys): a vim mode's keys. With keys and keys.which, which it hears them by. Shortcuts with Ctrl or Cmd still reach notesy
links.open Open web pages in your browser
accounts Sign you in to your accounts on the sites it names
plugins.share Share what it chooses with the plugins that ask to hear it

Three more come from other parts of plugin.toml, never listed by hand:

Permission Asked for by
net Naming sites in [net]: it can connect to those, and only those
ipc Naming sockets in [ipc]: it can talk to those programs on this computer, and no others
markdown Naming languages in [contributes] blocks: it draws those blocks in your notes
plugins.hear Naming plugins in [plugins] hears: it hears what they share

#The network

A plugin reaches only the sites in its [net], through notesy's own fetch (notesy::net). *.example.org means that site's subdomains, not the site itself. Plain http goes only to this computer and the local network, named as such. An account's token goes only to that service's own sites, never to another the plugin names.

#Hearing other plugins

A plugin that hears another is approved against what that one could do at the time. When a plugin it hears is later allowed more, it stops until the user approves it again, seeing what changed.

#Updates

An update that asks for nothing new runs as before. One that asks for more, a permission or a site, waits for a yes to what's new, and the prompt shows only that.

#Changing your mind

Settings, Plugins has each plugin, what it may do, the sites it reached, and its log. Turning one off stops it; turning it back on asks for everything again. Removing it can keep its data or delete it too. What was allowed is kept in plugins/grants.toml.

#In a script

A script gets only the modules its permissions cover: one that uses a module it wasn't given doesn't compile. Scripts lists which module needs which.

Every page