Remote Tab Opener

What It Is

Remote Tab Opener is a local browser extension that lets a trusted page you control orchestrate real tabs through a safe bridge. Your page emits requests; the extension enforces an allow-list, targets a specific tab using tabKey or tabId, then executes predefined actions inside that tab.

How It Works (3 steps)

1. Your page sends a request using window.postMessage() (or a small helper like ask() that adds requestId + timeout).
2. The extension validates it (origin/host allow-list, HTTPS rules, optional LAN/localhost flags) and routes it to the targeted tab (tabKey or tabId).
3. The action runs either in the background (tab control like openTab, navigate, focusTab, closeTab, getUrl) or inside the tab via a content script (safe DOM automation via a command envelope).

This does not bypass SOP: actions only run in tabs on domains you explicitly allow.

• See full working examples
• Read the documentation / SDK

Key Features

• Multi-tab orchestration using tabKey (name tabs like "auth", "monitor", "sales").
• Tab control: open, navigate, focus, close, read URL/title.
• Safe DOM automation on allow-listed hosts (type, click, submit, wait, extract bounded text/HTML).
• Local-first: no server, no proxy, no cloud relay.
• Explicit allow-list + optional LAN/localhost opt-in for intranet tooling.
• Favorites management in the extension popup.

Capabilities at a Glance

Real-World Flows — without the overhead

A minimal flow (tab control + DOM commands)

<script type="module">
const RTO_PAGE_ORIGIN = "rto-page";
const RTO_EXT_ORIGIN  = "rto-extension";

function makeId(){ return "rto_" + Math.random().toString(16).slice(2) + "_" + Date.now(); }

// Tab actions handled by background:
const TAB_ACTIONS = new Set(["openTab","navigate","focusTab","closeTab","getUrl","waitForNavigation","listTabs","adoptTab","releaseTab","screenshot"]);

// DOM actions go through { type:"command", action, payload }:
const DOM_ACTIONS = new Set([
  "setValue","typeText","pressKey","click","submit","submitForm",
  "waitFor","waitForSelector","getText","getHtml","getAttr","getValue",
  "highlight","setChecked","selectOption","selectSetValue"
]);

function ask(action, args = {}, opts = {}) {
  const requestId = makeId();
  const timeoutMs = Number(opts.timeoutMs || 8000);

  const isDom = DOM_ACTIONS.has(action);
  const isTab = TAB_ACTIONS.has(action);
  const isDetect = (action === "detect");

  const msg = isDetect
    ? { origin: RTO_PAGE_ORIGIN, type: "detect", requestId }
    : isDom
      ? { origin: RTO_PAGE_ORIGIN, type: "command", action, payload: args, requestId, tabKey: args.tabKey, tabId: args.tabId }
      : { origin: RTO_PAGE_ORIGIN, type: action, ...args, requestId };

  const expectedType = isDetect ? "detectResult"
    : (isDom ? (action + "Result") : (action + "Result"));

  return new Promise((resolve) => {
    const t = setTimeout(() => done({ ok:false, error:{ code:"TIMEOUT", message:"No response within timeout" } }), timeoutMs);

    function done(out){
      clearTimeout(t);
      window.removeEventListener("message", onMsg);
      resolve(out);
    }

    function normalizeError(e){
      if (!e) return { code:"ACTION_FAILED", message:"Unknown error" };
      if (typeof e === "string") return { code:e, message:e };
      const code = e.code || e.error || e.name || "ACTION_FAILED";
      const message = e.message || e.msg || String(code);
      return { code, message };
    }

    function onMsg(ev){
      const d = ev && ev.data ? ev.data : null;
      if (!d || typeof d !== "object") return;
      if (d.origin !== RTO_EXT_ORIGIN) return;
      if (d.requestId !== requestId) return;
      if (d.type !== expectedType) return;

      if (d.ok === true) done({ ok:true, data:d.data || d });
      else done({ ok:false, error: normalizeError(d.error || d) });
    }

    window.addEventListener("message", onMsg);
    window.postMessage(msg, "*");
  });
}

(async () => {
  const det = await ask("detect", {}, { timeoutMs: 1200 });
  if (!det.ok) { console.warn("RTO not detected. Install the extension and reload."); return; }

  // 1) Open a named tab
  const opened = await ask("openTab", { url:"https://example.org/login", tabKey:"auth", focus:true });
  if (!opened.ok) { console.warn("openTab failed:", opened.error); return; }

  // 2) DOM automation (never hardcode real credentials in examples)
  await ask("setValue", { tabKey:"auth", selector:"#email", value:"user@example.org" });
  await ask("setValue", { tabKey:"auth", selector:"#password", value:"example-password" });
  await ask("click",    { tabKey:"auth", selector:"form button[type=submit]" });

  // 3) Read tab state
  const st = await ask("getUrl", { tabKey:"auth" });
  console.log("Auth tab:", st.ok ? st.data : st.error);
})();
</script>

See the live E2E demonstration examples now.

Security by design

• Runs locally in your browser — no backend required.
• Works only on domains you authorize (allow-list).
• LAN/localhost require explicit opt-in in the popup and must be present in the allow-list.
• Predefined actions executed by the extension’s content script (no arbitrary code).
• Respects browser security rules (no SOP bypass; clean messaging).

See the LAN/localhost page and full notes in the official documentation.

Browser Limits — What RTO Solves

Remote Tab Opener does not break browser security. It uses the extension layer to provide capabilities that ordinary pages don’t have, while still respecting SOP and user consent.

Hard Guarantees

• No SOP bypass. Actions run only with explicit host permission (allow-list).
• No data collection. No remote servers required.
• Local-only. All logic lives in the browser (background/content + postMessage).
• User control. You choose which domains are controllable in the popup.

Quick Snippets (copy & run)

Open a named tab + wait + click (modern contract)

<script type="module">
  // Minimal: you can copy the ask() helper from the E2E section above.
  // Then:
  const det = await ask("detect", {}, { timeoutMs: 1200 });
  if (!det.ok) return;

  await ask("openTab", { url:"https://example.org/", tabKey:"demo", focus:true });
  await ask("waitForSelector", { tabKey:"demo", selector:"main a[href]" }, { timeoutMs: 12000 });
  await ask("click", { tabKey:"demo", selector:"main a[href]" });
</script>

Handle the allow-list error cleanly

const r = await ask("openTab", { url:"https://not-allowed.example", tabKey:"x" });
if (!r.ok && r.error && r.error.code === "DOMAIN_NOT_ALLOWED") {
  alert("Domain not allowed. Add it in the extension popup Allow-list, then retry.");
}

Tip: add your admin origin + target hosts in the allow-list. For intranet/localhost, enable the popup flags and keep hosts in the allow-list.

Use Cases

FAQ (short)

Does this bypass the Same-Origin Policy? No. The extension executes actions inside the target tab with explicit host permissions.

Do I need a server or proxy? No. Everything is local in the browser.

Is any data collected? No. The extension declares no data collection.

Where do I configure allowed domains? In the extension popup (allow-list). For LAN/localhost, enable the dedicated flags too.

How do I control 2 tabs? Use tabKey (e.g. "sales", "monitor") or a tabId from listTabs. Pass tabKey/tabId on each action.

Changelog (short)

• v7.11.5: current Firefox MV3 release line — multi-tab orchestration via tabKey, modern command DOM actions, strong allow-list + optional LAN/localhost opt-in.

Docs & Links

🟩 Install on AMO	Firefox Add-ons listing, stable builds. Install now ✅ The plugin is installed.
📘 Official Documentation and SDK	Concepts, security notes, APIs, setup (multi-tabs & LAN). Read docs
🧪 Examples	Full working examples step by step and source code. Browse examples
❓ FAQ	Common questions. View FAQ
🔒 Privacy & Permissions	Data & scopes. Privacy notes
🤖 Ask the Assistant (ChatGPT)	Interactive help to generate your scripts and debug errors. Open assistant

Competitors