Brotab extension (debugging, or mourning)

[mcint]

Brotab Extension Fails to Connect via NativeMessagingHosts on macOS

Description of the issue: Brotab extension cannot establish NativeMessaging connection despite proper configuration and path corrections for macOS.

Issue Summary

The brotab extension consistently fails with “Access to the specified native messaging host is forbidden” error, even after:

• Moving configuration from incorrect Linux paths (~/.config/...) to correct macOS paths (~/Library/Application Support/...)
• Adding both Chrome store and unpacked extension IDs to allowed_origins
• Confirming the extension works in Firefox with the same setup

Environment Details

System: macOS Sequoia 15.5 (24F74) / Darwin 24.5.0
Brave Version: 1.80.122 Chromium: 138.0.7204.157 (Official Build) (arm64)
Extension: brotab (manifest v2)
CLI Tool: brotab from PyPI

Configuration Status

NativeMessagingHosts config location: ~/Library/Application Support/BraveSoftware/Brave-Browser/NativeMessagingHosts/brotab_mediator.json

{
  "name": "brotab_mediator",
  "description": "This mediator exposes interface over TCP to control browser's tabs",
  "path": "/Users/steward/.local/bin/bt_mediator",
  "type": "stdio",
  "allowed_extensions": [ "brotab_mediator@example.org" ],
  "allowed_origins": [
    "chrome-extension://mhpeahbikehnfkfnmopaigggliclhmnc/", # chrome store ext id
    "chrome-extension://knldjmfmopnpolahpmmgbagdohdnhkik/" # unpacked hash id
  ]
}

Extension manifest (unpacked): Extension ID knldjmfmopnpolahpmmgbagdohdnhkik with proper nativeMessaging permissions.

Error Details

Console error: “Reason: Access to the specified native messaging host is forbidden”
Context: _generated_background_page.html at background.js:636
Trigger: Occurs during chrome.runtime.connectNative(NATIVE_APP_NAME) call

Steps to Reproduce

1. Install brotab CLI tool: uv tool install brotab or pip install brotab
2. Run brotab install (creates config in wrong Linux paths)
3. Fix paths for macOS:
   • Create: ~/Library/Application Support/BraveSoftware/Brave-Browser/NativeMessagingHosts/
   • Move: config file from ~/.config/BraveSoftware/... to correct macOS location (see edit history for Details-hidden list of commands)
   • Optional: Create symlink for future installs
4. Load brotab extension in Brave (either from store or unpacked)
5. Observe connection failure in extension console

Expected vs Actual Results

Expected: Extension connects to native messaging host, brotab list shows Brave tabs
Actual: Extension fails to connect, shows “forbidden” error, no tabs accessible via CLI

Additional Context

• Firefox works perfectly with identical configuration
• Chrome worked initially with unpacked extension but stopped after browser restart (even with mv2 legacy flag enabled)
• Extension fails in both store-installed and unpacked modes
• Binary path /Users/steward/.local/bin/bt_mediator exists and is executable

Questions

1. Does Brave have additional sandbox/security restrictions beyond standard Chromium NativeMessaging?
2. Are there macOS-specific permissions or quarantine issues affecting NativeMessaging in Brave?
3. Does the unpacked extension ID requirement differ from Chrome’s behavior?

How can this issue be reproduced? Follow the steps above on macOS with Brave browser and the brotab extension/CLI tool combination.

I had Claude re-write my long answer for ease of flow — distilling & deduplicating from the initial debug log.

[gramwilliam]

Brotab extension helps manage browser tabs easily debugging fixes issues mourning means its no longer supported.

[mcint]

@mcint

Error Details

Console error: “Reason: Access to the specified native messaging host is forbidden”
Context: _generated_background_page.html at background.js:636
Trigger: Occurs during chrome.runtime.connectNative(NATIVE_APP_NAME) call

After updating the NativeMessagingHosts/brotab_mediator.json to include in the allowed-origins, chrome_extension://[unpacked-hash-id],

• In Chrome the extension works, appears as a client and lists tabs. After updating the file, reloading, clearing errors.

At one point:

• In Brave, the extension does not work. The same forbidden error appears after updating the manifest, clearing errors, & reloading the extension.

I found success, the extension still works. I’m side loading it.

• Brave and possibly some other browsers has chosen to keep supporting manifest V2.
• For NativeMessagingHosts (NMH) to correctly enable, even for Dev mode side, loaded extensions, The extension ID must be in the NMH allowed-origins list.
• When reloading a Dave mode side loaded extension, the refresh button in extensions view, does not cause a NMH permissions recheck. Instead side, loaded extensions need to be unloaded and re-added, “Load unpacked”.