BrowserShell requests permissions to expose browser capabilities as shell commands. No permission is used for background tracking or data exfiltration.

Tip
Chrome Web Store reviewers: see the complete Q&A for every permission — Chrome Web Store permissions.

Host permissions

<all_urls>

WhyThe Quake-style overlay must appear on any page. Page commands (links, click, fill, read) inject scripts into the active tab.
Triggered byPressing ` to open overlay; running any page/* command
Not used forSilent modification, tracking, or data upload

API permissions

tabs + activeTab

List, switch, pin, discard, and navigate tabs.

Commands: tabs, tab, go, open, reload, back, forward, close, title, pin, unpin, discard, domain, mute, find

sessions

Restore closed windows and tabs.

Commands: recent, session, global hotkey X, workspace load

bookmarks

Read and modify bookmarks.

Commands: bookmarks, bookmark

history

Search and delete browsing history.

Commands: history, forget (optional history component)

downloads

List, open, and reveal downloaded files.

Commands: downloads

cookies

Read cookies for inspection and deletion.

Commands: cookies, siteinfo, forget

browsingData

Clear cache, storage, and site data.

Commands: forget, siteinfo

contentSettings

Inspect per-site permission settings.

Commands: permissions

management

List and manage installed extensions.

Commands: extensions

scripting

Inject scripts for DOM interaction on the active tab.

Commands: links, link, inputs, input, click, fill, press, pick, read, shot, images, image, meta, seek, scroll, zoom, volume, audible, tech, reqs, frames, viewport, jsonld, perf, and related dev commands

storage

Persist configuration, aliases, history, transcript, notes, and audit log locally.

Commands: config, alias, export, source, and all commands (history persistence)

notifications

Show desktop notifications.

Commands: notify

system.display

Read monitor work areas for accurate window positioning.

Commands: layout, split, window position, workspace (geometry restore)


Data storage

All stored data remains in chrome.storage.local on your device. See Privacy Policy.

Minimizing risk

  • Use forget --dry-run before destructive privacy commands
  • Review siteinfo before clearing site data
  • Build from source and inspect dist/manifest.json if auditing
  • Uninstall the extension to revoke all permissions