In the Dashboard

The Dashboard's Editor keeps drafts separate from installed revisions, previews a draft on a page you choose, imports from a file, a paste or an HTTPS URL, checks imported toolbars for updates by hand, and drafts toolbars with the local model. See the Dashboard.

Chrome 138+ needs Allow User Scripts on Bundleware's details page for your own toolbars. No extension can turn it on itself; the Dashboard asks when you install or preview without it, and notices when you come back. The bundled toolbars run without it. Firefox runs the bundled toolbars only. See Chrome's userScripts documentation.

Installed scripts run in their own USER_SCRIPT worlds with scoped ports. The worker authenticates each toolbar revision against the tab, document and site rules, and the host validates every operation and sanitizes SVG. A separate execution world is not a DOM confidentiality boundary: scripts can read and change the page.

Arbitrary Tampermonkey / GM_* scripts are not supported. Scripts written for earlier drafts of this API are covered in API 1 (retired).