How Plugins Work

If a theme is arrangement, a plugin is capability. When a site needs something new — a word counter, an SEO panel, a custom block — a plugin provides it.

The split that keeps you safe

Most themes are data — you can install one from a stranger without a second thought — and the rare theme that carries its own code is clearly marked before you install it (see How Themes Work for the tiers). Plugins are where capability lives, and code plugins are trusted, not sandboxed: add one only on purpose, from someone you trust.

• A plugin lists the content fields it adds and which of three permissions it asks for: read content, extend content, or attach a hook. Tovu's plugin API only hands it those. That's a contract, not a wall — a code plugin can still reach past the API.

• Through the plugin API, a plugin adds its own data to a post without touching the database itself. Core applies any schema change on its behalf, and tracks the attempt so a crash mid-write can be recovered instead of left half-done.

• Tovu checks the manifest before a plugin can be enabled. One that fails stays off.

Plugins come in three tiers. Code plugins today are Tier 3: full access to your machine, so only install ones you trust. See the tiers.

Installing one

Installing a plugin is a filesystem operation today: you place its package in the site's plugins directory, where it goes through the same checks as a built-in — the same id rules, the same permission vocabulary. From there, the admin's Plugins screen turns it on or off per workspace, immediately, no restart. What a plugin can reach never depends on which theme is active — the two systems are independent by design.

Plugins power it; themes arrange it.