Verify Wirelet’s permissions yourself

An extension’s manifest says what it may do, and your browser enforces it. Here is how to get Wirelet’s, what to read in it, and how to see that it makes no network request.

1. Get the package

From the public releases

Each version’s Chrome and Edge packages are published in the releases of the Wirelet/feedback repository, with their SHA-256 checksums (SHA256SUMS.txt) and a release report. Download wirelet-1.0.2-chrome.zip (or -edge.zip) and SHA256SUMS.txt from version 1.0.2, then compare the checksum:

shasum -a 256 wirelet-1.0.2-chrome.zip

On Windows, in PowerShell: Get-FileHash wirelet-1.0.2-chrome.zip.

From your browser

The installed files are in your browser profile, in Extensions/<ID>/<version>/. Wirelet’s ID is bljgefhnlagohdjnogbdnomlidbkbkem in Chrome and eakjkekgdahclbmojnbiilneemmkgjeh in Edge. To find your profile folder, open chrome://version (or edge://version) and read “Profile path”.

The store adds a few entries of its own to what it serves, such as update_url in the manifest and a _metadata folder.

2. Read manifest.json

unzip -p wirelet-1.0.2-chrome.zip manifest.json

In version 1.0.2, you find:

"permissions": [
  "declarativeNetRequestWithHostAccess",
  "storage",
  "alarms",
  "activeTab"
],
"optional_host_permissions": ["<all_urls>"],
"content_security_policy": {
  "extension_pages": "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'none'; form-action 'none'; connect-src 'none'"
}

What is absent matters too: no host_permissions, no content_scripts, no scripting permission. And the code makes no request:

unzip -p wirelet-1.0.2-chrome.zip '*.js' | grep -c "fetch("

prints 0.

3. Watch the network

1. Open Wirelet’s settings and press F12 (Option+Command+I on a Mac) to open the developer tools, then the Network tab.
2. Use Wirelet: create a profile, switch it on, import a file. Only Wirelet’s own files appear (chrome-extension://…), nothing from the internet.
3. For the background script, open chrome://extensions (or edge://extensions), turn on developer mode, click Wirelet’s “service worker” link and open its Network tab.
4. An attempt to connect would be blocked by the policy, and the Console would show a Content Security Policy error.

The requests your pages make are the pages’ own: your browser applies Wirelet’s header rules to them.