How to trigger Safari App Extension with a keyboard shortcut without a content script and Accessibility permissions?

I have a Safari App Extension which allows users to switch between last open tabs with a shortcut option+tab in the same way it's possible to switch between last open apps with command+tab.

Here is how i do it:

I inject a content script on all websites which has the only thing – key listener for option+tab presses. When a user presses option+tab, that keyboard listener detects it and sends a message to the Safari Handler. Then Safari Handler sends a message to the containing app and it shows a panel with last open tabs. This approach has a problem: it shows a message to a user in settings: "Can read sensitive info from web pages, including passwords..."

Which is bad, because in reality i don't read passwords.

If i remove SFSafariContentScript key in the Safari App Extension target's Info.plist, then this message about reading sensitive data disappears, but then i loose the ability to open the tabs panel.

How can I open my app window with a shortcut without frightening a user?

It's possible to listen to global key presses, but that would require a user to grant the app permissions of Accessibility (Privacy & Security) in macOS system settings, which also sounds shady.

I know an app which does not require an Accessibility permission: https://apps.apple.com/ua/app/tabback-lite/id6469582909 and at the same time it does not tell a user about reading sensitive data in the extension settings.

Here is my app: https://apps.apple.com/ua/app/tab-finder/id6741719894 It's open-source: https://github.com/kopyl/safari-tab-switcher

So far I figured out:

  • You can trigger a shortcut if you have a Safari Web Extension from background.js by adding a shortcut to manifest.json
"commands": {
    "open-main-app": {
      "suggested_key": {
        "default": "Alt+K"
      },
      "description": "Open Main App"
    }
  }

But you can't set option+tab as a shortcut.

  • Tab Back Lite's manifest.json but it does not have a shortcut in it. It only has nativeMessaging permission and a background script.

I ended up using HotKey

Example:

import SwiftUI
import HotKey

struct ContentView: View {
    let hotKey = HotKey(key: .tab , modifiers: [.option])
    
    var body: some View {
        VStack {}
        .onAppear {
            hotKey.keyDownHandler = buttonHandler
        }
    }
    
    func buttonHandler() {
        /* ... */
    }
}

But I'm still curious in how it can send the shortcuts without Accessibility permission.

How to trigger Safari App Extension with a keyboard shortcut without a content script and Accessibility permissions?
 
 
Q