Add new plugin: Discord Voice

[raycursive]

Plugin

• Id: raycursive/discord-voice
• New plugin
• Update to an existing plugin (version bumped in plugin.toml)

What it does

Discord Voice adds a bar widget, panel, and background bridge for monitoring and controlling a local Discord desktop voice session from Noctalia. It exposes the active server and channel, connection latency, speaking state, participant volume, mute/deafen/hang-up controls, input volume, and recent or favorite channel shortcuts.

The bridge uses Discord's local RPC interface and requests only the rpc, rpc.voice.read, and rpc.voice.write scopes.

External dependencies

• python3 3.10 or newer runs the local Discord RPC bridge and its command client.
• discord is the local Discord desktop client. The configured executable may be spawned to launch Discord or open a channel deep link.
• The bridge connects to Discord over local Unix sockets. Authorization exchanges the Discord code with https://streamkit.discord.com/overlay/token, and participant avatars may be downloaded from https://cdn.discordapp.com. No downloaded content is executed.
• The bridge writes token.json and channels.json under Noctalia's state directory, caches participant avatars under the XDG cache directory, and creates a per-user control socket under the runtime directory with a /tmp fallback. The README documents permissions and locations.

Testing

• Enabled the plugin from a local path source on Niri and verified that the bridge service starts.

• Opened the panel from the bar widget and with noctalia msg panel-toggle raycursive/discord-voice:panel.

• Verified disconnected and connected panel states, compact participant rows, mute/deafen/hang-up controls, speaking indicators, and participant volume sliders.

• Exercised the refresh and dump service IPC events, stable-ID favorite/unfavorite/join dispatch, and private state-file permissions.

• Ran the repository manifest validator and noctalia plugins lint discord-voice with zero errors or warnings.

• Tested on Niri

• Tested on Hyprland

• Tested on Sway

• Tested on another compositor:

• Noctalia version tested against: v5.0.0 (5.0.0_beta.8-1-dirty)

• Plugin API level: 9

Screenshots / Videos

The thumbnail was produced with the official generator using an AI-assisted, layout-faithful rendering based on the live Niri panel capture.

Checklist

• The directory name matches the part of id after the / in plugin.toml exactly.
• It ships plugin.toml, README.md, thumbnail.webp, and translations/en.json.
• README.md follows the
  README template, documents
  every entry id and dependency, and includes exact panel IPC commands and launcher prefixes where applicable.
• I created thumbnail.webp with the thumbnail generator.
• version follows semver and is bumped in this PR; plugin_api is the oldest API level this plugin requires.
• Every non-English translation in this PR uses a locale supported by Noctalia core, and I can read, write, and
  understand that language well enough to review and maintain it (no unreviewed machine/LLM translations).
• I did not edit catalog.toml; CI generates it.
• This PR touches exactly one plugin directory.

Code review attestation

Plugins run as trusted, unsandboxed Luau in the user's session. Confirm:

• The code is readable and not obfuscated, minified, or generated.
• It does not download and execute remote code.
• Every network call, filesystem write, and spawned process is something the description above accounts for.
• I have the right to publish this code under the license declared in plugin.toml.

[pyrox0]

did you just copy this PR body from another pr lol

[raycursive]

did you just copy this PR body from another pr lol

ahh lol thanks for the reminder

[ItsLemmy]

1. blocking - discord-voice/discord_bridge.py:268
   discord-voice/discord_bridge.py:300
   discord-voice/discord_bridge.py:781

The bridge searches the shared /tmp directory for discord-ipc-* sockets and connects to the first existing candidate
without verifying the socket owner or peer credentials. It then loads the persisted access token and sends
AUTHENTICATE to that endpoint.

A different local user can pre-bind /tmp/discord-ipc-0, emulate Discord's READY response, and receive the token when
no earlier trusted socket is available. This exposes credentials granting rpc.voice.read and rpc.voice.write access.
Verify the connected peer UID or socket ownership before sending the token, and reject shared-directory endpoints
that cannot be authenticated.