Build a plugin.
Teach Revive a new job.

// main.js: plain, readable JavaScript (no eval, no minified blobs).
revive.on("check", ({ files }) => {
  const photo = files && files[0];
  if (!photo) return revive.notch.done("Drop a product photo first", false);

  revive.notch.progress("Looking at the photo", 20);
  let product;
  try {
    product = revive.ai.vision(photo, "Name the product in this photo as a shop would list it.").text.trim();
  } catch (e) {
    return revive.notch.done("Couldn't look at the photo", false);
  }

  revive.notch.progress("Checking the price", 60);
  const key = revive.secrets.get("shop_key"); // null until the person adds their key
  if (!key) return revive.notch.done("Add your Example Shop key first", false);
  let r;
  try {
    r = revive.net.fetch("https://api.example-shop.com/v1/search?q=" + encodeURIComponent(product), {
      headers: { Authorization: "Bearer " + key },
    });
  } catch (e) {
    return revive.notch.done("Couldn't reach Example Shop", false);
  }
  const item = r.json && r.json.items && r.json.items[0];
  if (!item) return revive.notch.done("No price found for " + product, false);

  revive.notch.done("Found a price", true);
  revive.card({
    title: product,
    subtitle: "Found at Example Shop just now · prices change",
    rows: [{ label: "Example Shop", value: item.price, url: item.url }],
    buttons: [{ label: "Copy name", copy: product }],
  });
  return { product, price: item.price };
});

:: Run one hook of an unpacked plugin folder on real files
revive --headless plugin-test <dir> <hook> [files]
revive --headless plugin-test .\price-check check .\photo.jpg

:: Lint the code and manifest, then pack it
revive --headless plugin-pack <dir> <out.reviveplugin>
revive --headless plugin-pack .\price-check price-check.reviveplugin

Packed files you make yourself are unsigned: Revive only installs them with developer mode on, clearly marked. The store signs the reviewed version.

What Revive enforces

What developers must follow

1. Ask for the least. List only the sites, AI and permissions the plugin uses. The packer warns about permissions the code never uses; the store rejects them.
2. Say plainly what leaves the PC. data_use names what is sent and where: "Sends the photo you drop to Google Lens (via SerpApi) to find the product." No vague words like "may share data with partners".
3. No tracking. No analytics, fingerprinting, ad SDKs or calls home that the person didn't ask for. A plugin's network use must be its feature.
4. No keys in code, ever. Use secrets. If your service needs a shared key, run your own small server and list it in permissions.net.
5. Readable code. Ship bundled but not obfuscated JavaScript. No eval, no new Function, no encoded blobs. The store reviews the exact code it signs.
6. Honest results. Show where every result came from (a link on the card) and when. Never say "guaranteed", "best", "virus-free" or "speeds up your PC" unless it's measured and true. Prices change: say "found at … just now".
7. Respect sites' terms. Use official APIs. No scraping sites that forbid it, no bypassing logins, captchas or paywalls.
8. Fail politely. Catch errors and finish with revive.notch.done("Couldn't …", false). Never loop on retries.
9. Small and quick. A run should usually finish in seconds. Show progress with revive.notch.progress if it takes longer.
10. People's data is theirs. Don't keep dropped files or results beyond what the feature needs. Don't send personal data (names, emails, files) anywhere data_use doesn't name.
11. Paid plugins are fair. A clear price, no dark patterns, cancelling as easy as buying, and the plugin keeps working for what was paid.