Remote Tab Opener Manager

Remote Tab Opener Manager is a local-first browser extension that lets a web page act as a controller for a dedicated browser tab through a visible, user-controlled extension bridge. It is designed for controlled browser workflows where a dashboard, administration page, developer tool, or compatible web application needs to open, reuse, navigate, refresh, focus, inspect, or close a separate target tab. Controller pages do not need to be placed on an allow-list. Instead, privileged actions are restricted to target domains that the user has explicitly authorized. All actions run locally inside the browser. No backend, proxy, remote relay, tracking service, or RTO account is required. What the extension can do • Open a dedicated target tab or reuse an existing one • Navigate, refresh, focus, or close the managed tab • Read basic target-tab metadata such as URL and title • Read supported visible page content on authorized targets • Fill ordinary visible editable form fields when authorized • Perform predefined DOM actions on authorized target pages • Display clearly marked RTO status and authorization overlays • Detect the installed extension from compatible controller pages • Expose a restricted inter-extension API for recognized official RTO add-ons Target-domain authorization When a controller requests an operation on a target domain that has not yet been authorized, RTO blocks the privileged operation and displays a clearly marked authorization panel. The user can explicitly choose: • Refuse • Allow access to this domain Authorization requires a genuine user action. Once a target domain has been approved, it remains in the local RTO allow-list and does not require repeated approval for normal subsequent operations. The controller page itself cannot approve its own request by sending an API command. Safety boundaries • Password fields are not read or written • Hidden fields are not read or written • File upload fields are not controlled • Sensitive fields are protected • Normal website text, links, button labels, and page titles are not modified • RTO overlays are clearly identified as extension UI • Target operations remain limited to authorized domains • The current target URL is revalidated before privileged operations • If a controlled tab redirects to a non-authorized domain, privileged access is blocked • Websites can publish an RTO Lock policy to restrict or disable supported RTO interactions • Unknown external extensions are rejected by the RTO Trust Policy • Recognized RTO add-ons cannot bypass normal RTO authorization rules • Local file:// pages are not controlled as target tabs How it works • A controller page sends a predefined request through the local RTO bridge • RTO validates the requested operation • If the target domain is not authorized, RTO asks the user for approval • The extension remains the authority that authorizes and executes browser actions • The target page is handled as a dedicated managed tab • Before privileged actions, RTO checks the current target URL and authorization state again • Redirecting to another non-authorized domain blocks further privileged actions • Official RTO add-ons may request actions, but RTO Original remains the final execution authority Privacy and security • Local-first operation • No backend • No proxy • No tracking • No cookie access • No arbitrary remote code execution • No eval() or dynamically downloaded executable scripts • No native messaging • No webRequest interception • Only predefined extension actions are exposed • Public controller pages do not receive internal allow-list administration APIs • Requests are restricted by target-domain authorization, browser permissions, domain lock, RTO Lock, capability checks, and applicable site policies • The external add-on API validates the calling extension before accepting supported requests Typical use cases • Admin dashboards controlling a dedicated working tab • Internal web tools coordinating a controller page and target page • Browser-based testing and supervision workflows • Developer tools requiring explicit and visible browser-side tab control • Content-management workflows using a dedicated target tab • Official RTO add-ons requesting actions without bypassing RTO security controls Remote Tab Opener Manager is intended for technical users, developers, and controlled browser workflows that require transparent, local, user-authorized tab supervision. Version 8.6.0 Version 8.6.0 strengthens RTO's target-domain security and authorization experience. It adds automatic authorization prompts for previously unauthorized target domains, a clearer persistent approval panel, stricter separation between public controller APIs and internal administration functions, and revalidation of the target URL before privileged actions. A controlled tab that redirects from an authorized domain to a non-authorized domain can no longer retain privileged access. No new browser permissions are introduced in version 8.6.0.