Permissions¶
What the manifest asks for, and why. The source of truth is apps/extension/wxt.config.ts; the rationale comes from docs/PERMISSIONS.md.
| Permission | What it is used for |
|---|---|
storage |
Settings, progress, and session state (storage.local, storage.session, read-only storage.managed) |
unlimitedStorage |
The IndexedDB content store, including uploaded assets, can exceed the default quota |
sidePanel |
The authoring studio |
scripting |
The service worker injects the player, picker and frame agent on demand, and registers the content script for granted origins. All injected files are bundled with the extension; no remote code |
alarms |
See the note below |
identity |
Reserved for single sign-on in step two. Unused in the local-only MVP |
Optional host permissions https://*/*, http://localhost/*, http://127.0.0.1/* |
Requested per site, from a user gesture. Nothing runs on a site that was not granted |
http://localhost/* (dev flavour only) |
End-to-end tests against fixture apps |
The store build has no always-on host access. The content script is a small gate (about 2 kB) that asks the service worker to inject the player only when the page URL matches a published item for the current application.
alarms: documented purpose and actual use differ
docs/PERMISSIONS.md lists alarms as "Periodic manifest refresh". In the code, the service worker creates a 5-minute alarm named guidepost-manifest-refresh on install, but no onAlarm listener exists, so the alarm does nothing today. The permission is kept for the planned remote store, where a manifest refresh will matter. Remove the permission if you want the smallest possible manifest before then. This is a decision for the maintainer.
Commands¶
Two keyboard commands are declared (picker-start, picker-pause). They need no permission. The service worker handles them and acts only in author mode on a granted site; see shortcuts.
What the extension does not request¶
No tabs, webRequest, cookies, history or declarativeNetRequest. No <all_urls> in the store build. Messages to the extension use runtime messaging, and every handler checks the sender.
Gotchas¶
- Granting
https://*/*is a per-site choice. The extension asks for a single origin at a time (permissions.requestwith that origin), not the whole wildcard. - Revoking a site in Options removes the permission and the content script registration for it.
- A managed build declares its approved origins in
host_permissions, which shows as site access in the browser's extension details. See managed build. - Browsers display a warning when a package requests broad host access. The store build avoids this by holding no host permissions at install.