--- title: A Day-Old Plugin Didn't Touch My House Audio Until It Passed Four Gates description: "How I vetted a day-old community plugin that adds live Twitch channels to Music Assistant: read it, test it, sandbox it, then a backed-up swap." image: https://willcurran.com/hubfs/will-curran-brand/day-old-plugin-four-gates-featured.png --- [Skip to content](https://willcurran.com/blog/day-old-plugin-four-gates#main) [Will Curran](https://willcurran.com/) [Home](https://willcurran.com/) [Portfolio](https://willcurran.com/portfolio) [Press](https://willcurran.com/media) [Blog](https://willcurran.com/blog) [Favorites](https://willcurran.com/favorites) [Speaking](https://willcurran.com/speaking) [Consulting](https://willcurran.com/consult) [Hire Will](https://willcurran.com/hire) [Writing](https://willcurran.com/blog) Music — A Day-Old Plugin Didn't Touch My House Audio Until It Passed Four Gates [Subscribe](https://willcurran.com/blog/subscribe) Music # A Day-Old Plugin Didn't Touch My House Audio Until It Passed Four Gates To play live Twitch channels I follow in Music Assistant, I had to trust a stranger's day-old plugin and a custom build of the whole server. It went through a read-through, tests on my exact version, a sandbox with the real speakers off, and a backed-up swap, and the only thing ... ![](https://willcurran.com/hs-fs/hubfs/will-curran-brand/will-curran-avatar.jpg?width=44&height=44&name=will-curran-avatar.jpg) Will Curran Oct 25, 2026 · 5 min read On this page ![An abstract dark graphic: a small orange block passes through four vertical gates in a row toward a speaker shape, next to the title A day-old plugin didn't touch my house audio until it passed four gates.](https://willcurran.com/hs-fs/hubfs/will-curran-brand/day-old-plugin-four-gates-featured.png?width=1600&height=900&name=day-old-plugin-four-gates-featured.png) I wanted Music Assistant to play the live Twitch channels I follow, as radio stations anywhere in the house. Music Assistant had no Twitch source of its own. A community plugin for it existed, but it was one day old, written by someone I don't know. The plugin went through four gates before it got near the house audio: a read-through, a test run on my exact server version, a sandbox with the real speakers switched off, and a backed-up swap with the old server kept for rollback. When the swap was done, the only thing it had broken was an old bookmark. ## There was no plugin folder I hoped to drop the plugin into a folder. The Music Assistant version I ran only loaded music sources that ship inside its own image, and the plugin's own README said it couldn't run inside the Home Assistant add-on for that reason. Adding one small source meant building my own copy of the whole server. I didn't want to touch the main Music Assistant code at all, so everything around the custom build had to be careful. ## Gate 1: read all of it before any of it runs The plugin was about 25 KB of Python across 6 files. I had my coding assistant read every line before anything ran. ## Gate 2: test it on the exact version I run The plugin was built against the release just before the one I ran. I moved it up to my version and ran its tests, linting, formatting and type checks inside that exact Music Assistant image, with the checking tools pinned to the versions Music Assistant itself uses. All 11 existing tests passed. Then I added the one feature I wanted, tests first: live followed channels would show up as stations in Music Assistant's Radio tab and drop off when they went offline. If Twitch couldn't be reached, the list would be left alone instead of being wiped. That added 6 tests, and all 17 passed. ## Gate 3: a sandbox with the real speakers switched off Tests don't show how code behaves next to everything else. The next stop was a throwaway copy of Music Assistant, with the house's real speakers switched off inside it, so the test copy couldn't compete with the real server for them. In the sandbox the plugin loaded, the Radio tab listed 2 live channels I follow, and one of them played through Music Assistant's normal pipeline for about a minute on a muted browser player, with no stream errors. ## Gate 4: back up, swap, keep the old one parked The custom build went in as a local Home Assistant add-on: the official Music Assistant image with the plugin added. Before the swap I took a full backup. Then I started the new add-on and stopped the official one, which stayed installed and set to manual start so it could come back in one step. Home Assistant's Music Assistant integration found the new server on its own, and the entity IDs didn't change. Music Assistant was down for about a minute. ![Diagram of four gates in a row between a community plugin and the house audio. Gate 1, read: 6 files, about 25 KB of Python, read before anything ran. Gate 2, test on my version: 11 existing tests passed, 6 added, 17 passed. Gate 3, sandbox: real speakers switched off, about a minute of playback on a muted player. Gate 4, backup and swap: full backup first, old server stopped and kept for rollback, about 1 minute of downtime.](https://willcurran.com/hs-fs/hubfs/will-curran-brand/day-old-plugin-four-gates-four-gates.png?width=1440&height=906&name=day-old-plugin-four-gates-four-gates.png) On the real server the plugin loaded. Later the Radio tab held just the one channel still live, and the two that had gone offline had dropped off on their own. ## The one thing that broke was a bookmark After the swap, an old bookmark to the official add-on got opened. That tried to start the old server, which crashed straight away because the new one already held its ports. The new server kept running. Two copies of the same server had sat one click apart. The fix was to hide the old add-on's sidebar entry, so nobody could start it by accident. ## The parts that were not free - **Updates stopped being one click.** From then on, every Music Assistant release meant moving the build to the new version, re-running the plugin's tests, and rebuilding. I accepted that on purpose. - **The sandbox test was small.** The only playback test was about a minute on a muted player. ## Before you add a stranger's plugin - **Test on your version, not theirs.** Pin the checking tools to the same versions the host project uses. - **Switch off real outputs in the sandbox.** A test copy that can grab your speakers isn't a sandbox. - **Park the old version, then hide it.** Rollback should be one step. Starting it by accident shouldn't be. ## Build it yourself A vetting checklist for bringing an unreviewed community plugin into a self-hosted server you depend on: 1. **Read it.** Every file. Note what it connects to, what access it asks for, and what it logs. 2. **Pin and test it.** Lock to the commit you read, build on the same image you run, and run its tests, linting and type checks there with the host project's tool versions. 3. **Sandbox it.** Run a throwaway copy with real outputs disabled, and watch it do the real job end to end. 4. **Back up and swap.** Take a full backup, install the new build next to the old one, stop the old one and set it to manual start. 5. **Hide the old entry.** Keep it for rollback, but make it hard to start by mistake. Give this to your AII want to add an unreviewed community plugin to \[self-hosted server\] running as \[add-on or container\] at version \[version\]. Before anything runs, read every file and report what it connects to, what access it requests, and what it writes to logs. Then help me build my own image on top of the exact official image I run, with the plugin pinned to the commit we reviewed, and run its tests, linting, formatting and type checks inside that image using the host project's own tool versions. Next, set up a throwaway test instance with every real output device disabled, and give me a checklist to confirm the plugin does its job end to end there. Finally, write a cutover plan: full backup, install the new build next to the official one, stop the official one and set it to manual start, hide its shortcut, and list the steps to roll back and to rebuild on each upstream release. If you have a rule for when a stranger's plugin earns a place on your server, I'd like to hear it. Filed under [Music](https://willcurran.com/blog/tag/music) ![](https://willcurran.com/hs-fs/hubfs/will-curran-brand/will-curran-avatar.jpg?width=64&height=64&name=will-curran-avatar.jpg) Will Curran I spent sixteen years building one company, and I have been in the event industry since 2007. These days I write about the technology I actually use — trucks, radios, home infrastructure, and the tools that survive past the first invoice. [All posts by Will →](https://willcurran.com/blog/author/will-curran) Get the next one by email One email per post. No digest, no sponsors. [← Previous My Doorbell Can't Interrupt Spotify, So It Asks Who Owns the Music](https://willcurran.com/blog/my-doorbell-asks-who-owns-the-music) ## Related reading [Music My Chat Bot Called a House Set Drum and Bass 6 min read](https://willcurran.com/blog/chat-bot-called-a-house-set-drum-and-bass) [Music When the Stream Got Stuck on Song 1: Seeing Layered Mixes 7 min read](https://willcurran.com/blog/layered-mixes) [Music How I Pick the Best Live Sets for a Playlist 6 min read](https://willcurran.com/blog/best-live-sets-playlist) [Will Curran](https://willcurran.com/) [LinkedIn — 29,339+ followers](https://www.linkedin.com/in/willcurran) [GitHub](https://github.com/rancur) [YouTube](https://www.youtube.com/channel/UCJgscc27l4fpkWx1SeK05xg/) [Spotify](https://open.spotify.com/user/rancur) [SoundCloud DJ mixes](https://www.soundcloud.com/thewillsee) [Twitch](https://www.twitch.tv/thewillsee) [Last.fm](https://www.last.fm/user/default) [Trakt — movies & TV](https://trakt.tv/users/willcurran) [Goodreads](https://www.goodreads.com/user/show/55302838-will-curran) [Will See Music](https://www.thewillsee.com) [Arizona Meshtastic](https://azmsh.net) [Electric Forest Meshtastic](https://efmesh.com) © 2026 Will Curran — All rights reserved. [RSS](https://willcurran.com/blog/rss.xml) [Back to top](https://willcurran.com/blog/day-old-plugin-four-gates#main) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Will Curran", "url" : "https://willcurran.com/blog/author/will-curran" }, "dateModified" : "2026-10-25T16:00:00.516Z", "datePublished" : "2026-10-25T16:00:00.000Z", "headline" : "A Day-Old Plugin Didn't Touch My House Audio Until It Passed Four Gates", "image" : [ "https://willcurran.com/hubfs/will-curran-brand/day-old-plugin-four-gates-featured.png" ], "mainEntityOfPage" : { "@id" : "https://willcurran.com/blog/day-old-plugin-four-gates", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://willcurran.com/hubfs/image-1.png" }, "name" : "Will Curran LLC" } } ```