Nephele Wisp · Permissions Justification

API permissions

nativeMessaging

Why required. Wisp's entire purpose is to relay upload requests between the Nephele Workshop desktop application and the browser. The standard channel for desktop ↔ extension IPC in Chromium is Native Messaging. Without this permission, Wisp cannot receive any work from the desktop app.

Scope. Wisp connects only to the registered Native Messaging Host named com.arisfusion.nephele_wisp. The host's manifest is installed by Nephele Workshop's installer and points at the nephele.exe --nmh binary. Wisp does not connect to any other native host.

storage

Why required. Wisp persists a single value: a randomly-generated per-profile ID (wp_<uuid>) that is sent to the desktop app on handshake so it can recognize repeat connections from the same browser profile.

Scope. Only chrome.storage.local is used, and only for that one key (wisp_profile_id). No user content is stored.

debugger

Why required. Wisp drives upload forms by synthesizing input events through the Chrome DevTools Protocol (CDP). This is the only documented Chromium mechanism that produces input events platforms recognize as user-driven, while remaining clearly user-initiated: Chrome displays a persistent yellow “Nephele Wisp started debugging this browser” notification bar on every tab Wisp attaches to.

Two specific automation problems require debugger and have no alternative:

1. File upload from the local file system. Some platforms (e.g. bilibili) prefer the File System Access API and need Page.addScriptToEvaluateOnNewDocument to fall back to a traditional <input type="file">, plus DOM.setFileInputFiles to deliver the file path. The standard chrome.scripting API runs after page load — too late for FSA-detection bundles.
2. Trusted-input gates. Some Vue/React components only accept actions from a real mouse path (move-then-click with intermediate mouseMoved events). chrome.scripting programmatic clicks fail these gates; CDP Input.dispatchMouseEvent succeeds because the browser treats it as a real input event.

Scope. Wisp attaches the debugger ONLY to tabs it has opened itself (via chrome.tabs.create({url: 'about:blank'})), never to a user-active tab. The debugger is detached on every cleanup path. The debugger permission is gated on a deliberate user action in the desktop app — Wisp never attaches without a request originating from the desktop app.

tabs

Why required. chrome.tabs.create opens the automation tab; chrome.tabs.remove closes it on cleanup paths where the user does not need the draft tab to remain.

Scope. Wisp only creates and removes tabs that it created itself. It does not enumerate, query, or modify other tabs.

alarms

Why required. MV3 service workers are suspended after ~30s idle, which would drop the Native Messaging connection to the desktop app. Wisp registers a 30-second chrome.alarms keepalive: each tick re-wakes the worker and resets the idle timer. setInterval cannot survive worker recycling; alarms persist and re-wake it.

Scope. The alarm only fires the keepalive heartbeat. It performs no DOM work and initiates no uploads or reads — those always require an explicit request from the desktop app.

contextMenus

Why required. Adds a “Save to Nephele” right-click entry (on an image, link, selection, or the page) plus an optional keyboard shortcut, so you can clip a reference into your library in one action. Clicking it sends the picked item to the desktop app, which fetches it full-resolution and saves it; the menu itself does nothing else.

Host permissions: <all_urls>

Why broad access is required. Wisp acts in your own logged-in session on whatever site you are working with — publishing, reading, and collecting/clipping references. Reference-image bytes live on per-platform CDN domains (i.pximg.net, i.pinimg.com, pbs.twimg.com, …) distinct from the site's own domain, so even an enumerated site list would silently fail to fetch the actual images; a fixed allow-list breaks on the next site or CDN you visit. Comparable reference / clipper tools (e.g. Eagle) request <all_urls> for exactly this reason.

Why this is safe — behaviour, not scope, is the real constraint. Broad access is bounded by hard, repository-verifiable behavioural limits (see “What Wisp will not do” below):

• No background or scheduled activity. Every read / clip / form-fill happens only in response to an action you just initiated in the desktop app, or a context-menu / keyboard clip you invoked. Wisp never crawls.
• Visible. chrome.debugger shows Chrome's persistent “Nephele Wisp started debugging this browser” bar; Wisp attaches only to tabs it opened.
• No final writes without you. Publish / send always stops for manual confirmation; Wisp never clicks the final button.
• Data stays local. Read data returns only to the local Nephele desktop app — never to a server of ours. No telemetry, no remote code.

The local asset / ingest channel runs on 127.0.0.1 (one-time tokens, 5-minute expiry, loopback-bound), covered by <all_urls>.

Single purpose

Per the Chrome Web Store program policy, this extension has a single purpose:

Act as the browser-side half of the Nephele Workshop desktop app: carry out the requests it sends in your own logged-in browser session — filling upload forms (and stopping at “draft ready” for manual review), reading your own creator stats, reading pages, and collecting or clipping reference images — and return the results to the desktop app. The extension does nothing on its own; every action originates from the desktop app or a clip you explicitly invoked.

What Wisp will not do

These are non-goals enforced by the protocol:

• Wisp never clicks the final publish/send button on any platform. All flows stop at “draft saved”; the user reviews the filled form in the browser and publishes manually.
• No auto-liking, following, commenting, captcha-bypass, or multi-account orchestration.
• No covert or background collection — every page Wisp reads is for a request the user just initiated, the data goes only to the local desktop app, and Wisp never reads pages on a schedule or in the background.
• No auto-dismiss of platform agreement / ToS / paywall modals. If Wisp encounters an unexpected blocking dialog, it bails with ACTION_REQUIRED and leaves the tab open for the user to handle.

Source

The extension is open-source (MIT) at github.com/CreatorAris/nephele-wisp. The wire protocol between extension and desktop is published at docs/PROTOCOL.md.

See also: Privacy Policy.