[MohamedBassem]

Move <all_urls> from host_permissions to optional_host_permissions so it isn't requested at install time. The permission is now requested via chrome.permissions.request() when the user enables client-side crawling in the extension settings, and removed when they disable it. The settings toggle and the capture path both gate on whether the permission is actually granted.

Fixes #2782

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2847ad7e-45be-450f-8665-07a047f32d67

📥 Commits

Reviewing files that changed from the base of the PR and between 1c7872c and 3a52c55.

📒 Files selected for processing (4)

• apps/browser-extension/manifest.json
• apps/browser-extension/src/OptionsPage.tsx
• apps/browser-extension/src/SavePage.tsx
• apps/browser-extension/src/utils/permissions.ts

---

Walkthrough

The PR converts the browser extension's host permission from required to optional, allowing users to grant URL access on-demand. A new permissions utility wraps Chrome APIs; OptionsPage manages permission state with a toggle that prompts users; SavePage gates single-file page capture on current permission status.

Changes

Optional Host Permissions for Client-Side Crawling

Layer / File(s)	Summary
Permission Utilities apps/browser-extension/src/utils/permissions.ts	New module exports HOST_PERMISSIONS constant and three Promise-based helpers: hasHostPermission(), requestHostPermission(), and removeHostPermission() wrapping Chrome permissions APIs.
Manifest Declaration apps/browser-extension/manifest.json	Manifest replaces required host_permissions: ["<all_urls>"] with optional_host_permissions: ["<all_urls>"].
OptionsPage Permission Management apps/browser-extension/src/OptionsPage.tsx	Imports permission helpers; adds hostPermissionGranted state checked on mount; derives clientSideCrawlingEnabled from both permission state and settings.useSingleFile; rewires the "Client-side crawling" toggle to request permission when enabling or revoke when disabling.
SavePage Permission Check apps/browser-extension/src/SavePage.tsx	Imports hasHostPermission() and adds runtime permission check to the single-file crawl condition in saveBookmark(), gating capture and upload on current permission state.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• karakeep-app/karakeep#2197: Both PRs modify the browser-extension's single-file client-side capture flow (manifest host permissions plus OptionsPage/SavePage behavior), with the main PR adding runtime optional host-permission handling on top of the feature introduced in the retrieved PR.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description lacks required template sections including testing details, screenshots, and the completion checklist.	Complete the PR template by adding test procedures, verification steps, and confirming all checklist items are addressed.
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: moving host permission from required to optional and requesting it at runtime for client-side crawling.
Linked Issues check	✅ Passed	The code changes directly address issue #2782 by moving host permissions to optional and only requesting them when the user enables client-side crawling.
Out of Scope Changes check	✅ Passed	All changes focus on implementing runtime permission handling for client-side crawling and are directly related to resolving the linked issue.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

• Generate code and open pull requests
• Plan features and break down work
• Investigate incidents and troubleshoot customer tickets together
• Automate recurring tasks and respond to alerts with triggers
• Summarize progress and report instantly

Built for teams:

• Shared memory across your entire org—no repeating context
• Per-thread sandboxes to safely plan and execute work
• Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[greptile-apps]

Greptile Summary

This PR moves the <all_urls> host permission from required to optional in the browser extension, so it is no longer requested at install time. The permission is now requested via chrome.permissions.request() only when the user enables client-side crawling, and revoked when they disable it.

• manifest.json moves <all_urls> to optional_host_permissions; a new permissions.ts module wraps the three Chrome permission APIs.
• OptionsPage.tsx adds a hostPermissionGranted state (checked on mount) and derives clientSideCrawlingEnabled from both the stored setting and the actual runtime grant, correctly gating the toggle and its "Include images" sub-option.
• SavePage.tsx adds an inline hasHostPermission() guard so client-side crawling is skipped if the permission was revoked outside the extension UI since the page opened.

Confidence Score: 4/5

Safe to merge; the runtime permission gating in both OptionsPage and SavePage is correct, but existing users who had client-side crawling enabled will silently lose the feature on update with no in-app explanation.

Chrome revokes <all_urls> for existing users when it moves from required to optional on extension update. Any user who had useSingleFile: true stored will find the switch showing as OFF after updating, with no migration, notification, or cleanup of the stale setting. The core logic changes are otherwise well-implemented.

manifest.json and OptionsPage.tsx — the interaction between the stored useSingleFile setting and the now-optional permission needs a migration story for existing users.

Important Files Changed

Filename	Overview
apps/browser-extension/manifest.json	Moves <all_urls> from host_permissions to optional_host_permissions; existing users will have this permission silently revoked on update with no migration path.
apps/browser-extension/src/utils/permissions.ts	New helper module wrapping chrome.permissions.contains/request/remove for <all_urls> — clean and straightforward.
apps/browser-extension/src/OptionsPage.tsx	Adds hostPermissionGranted state checked on mount; computes clientSideCrawlingEnabled correctly and gates the UI toggle and its sub-option on the actual runtime permission.
apps/browser-extension/src/SavePage.tsx	Adds a hasHostPermission() guard inside the async saveBookmark condition so client-side crawling is skipped if the permission was revoked outside the extension UI.

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
apps/browser-extension/manifest.json:48
**Silent feature regression for existing users**

When the extension updates, Chrome revokes `<all_urls>` for any user who previously had it as a required permission, because it is no longer declared in `host_permissions`. Users who had `useSingleFile: true` stored in settings will find that client-side crawling silently stops working after the update — the `OptionsPage` will show the switch as OFF (because `clientSideCrawlingEnabled = settings.useSingleFile && hostPermissionGranted = true && false`), but their stored `useSingleFile: true` value is never cleaned up or explained. Consider adding startup migration logic in `usePluginSettings` (or a one-time prompt in `OptionsPage`) that detects `useSingleFile: true` with the permission absent and either clears the setting or re-requests the permission with user guidance.

_{Reviews (1): Last reviewed commit: "feat(browser-extension): request host pe..." | Re-trigger Greptile}

[greptile-apps]

Silent feature regression for existing users

When the extension updates, Chrome revokes <all_urls> for any user who previously had it as a required permission, because it is no longer declared in host_permissions. Users who had useSingleFile: true stored in settings will find that client-side crawling silently stops working after the update — the OptionsPage will show the switch as OFF (because clientSideCrawlingEnabled = settings.useSingleFile && hostPermissionGranted = true && false), but their stored useSingleFile: true value is never cleaned up or explained. Consider adding startup migration logic in usePluginSettings (or a one-time prompt in OptionsPage) that detects useSingleFile: true with the permission absent and either clears the setting or re-requests the permission with user guidance.

Prompt To Fix With AI

This is a comment left during a code review.
Path: apps/browser-extension/manifest.json
Line: 48

Comment:
**Silent feature regression for existing users**

When the extension updates, Chrome revokes `<all_urls>` for any user who previously had it as a required permission, because it is no longer declared in `host_permissions`. Users who had `useSingleFile: true` stored in settings will find that client-side crawling silently stops working after the update — the `OptionsPage` will show the switch as OFF (because `clientSideCrawlingEnabled = settings.useSingleFile && hostPermissionGranted = true && false`), but their stored `useSingleFile: true` value is never cleaned up or explained. Consider adding startup migration logic in `usePluginSettings` (or a one-time prompt in `OptionsPage`) that detects `useSingleFile: true` with the permission absent and either clears the setting or re-requests the permission with user guidance.

How can I resolve this? If you propose a fix, please make it concise.