diff --git a/AGENTS.md b/AGENTS.md
index 29c09b8..660b8da 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -40,7 +40,7 @@ Use `.env.local` for local secrets. Keep `.env.local` and any real token-bearing
 - `scripts/generate-local-context.mjs` generates `public/local-context.json` from `/Users/Tabitha/.openclaw/workspace_Father` before builds.
 - `public/local-context.json` is a committed fallback snapshot so CI builds can still produce a self-contained `dist/` if the local workspace root is unavailable.
 - `npm run build` runs `scripts/verify-dist.mjs` after Vite to ensure the generated output has the required extension files.
-- Host permissions include ordinary `http`/`https` pages for screenshot capture plus the Gitea host derived from `VITE_GITEA_BASE_URL`. Rebuild after changing the base URL.
+- Host permissions include `<all_urls>` for Chrome visible-tab screenshot capture plus the Gitea host derived from `VITE_GITEA_BASE_URL`. Rebuild after changing the base URL.
 - Runtime API calls are centralized in `src/api.ts`.
 - Side panel state is centralized in the vanilla Zustand store at `src/store.ts`.
 - The extension opens as a Chrome side panel. It is not a draggable in-page window.
@@ -49,7 +49,7 @@ Use `.env.local` for local secrets. Keep `.env.local` and any real token-bearing
 - URLs can be deleted from the URLs list. User-added URLs are removed from storage; generated known URLs are hidden through the stored deleted-base list.
 - Add Issue is enabled only when the active tab's base URL is already in the URLs list and has a linked Gitea repo. The issue form must show the target repo, capture visible-tab screenshots, accept Gitea-friendly file attachments, and include `Chrome profile: Silma` in created issue bodies.
 - If the Ready checkbox is checked, create the issue first, upload screenshots/files as issue assets second, and apply the `ready` label last.
-- The extension requests `activeTab` and `http`/`https` host permissions so screenshots can be captured from the current Chrome tab even after the side panel has stayed open across tab changes.
+- The extension requests `activeTab` and `<all_urls>` host permission so screenshots can be captured from the current Chrome tab even after the side panel has stayed open across tab changes.
 
 ## Chrome Extension Management
 
diff --git a/docs/extension-management.md b/docs/extension-management.md
index b506b78..922130e 100644
--- a/docs/extension-management.md
+++ b/docs/extension-management.md
@@ -39,7 +39,7 @@ Required variables:
 
 - Add Issue is enabled only when the active tab's base URL is already in the URLs list and that URL is linked to a Gitea repo.
 - The Add Issue view must show the Gitea repo that will receive the issue.
-- Screenshot capture uses Chrome's visible-tab capture API and requires the extension's `activeTab` permission plus ordinary `http`/`https` host permissions so capture still works after the side panel remains open across tab changes.
+- Screenshot capture uses Chrome's visible-tab capture API and requires the extension's `activeTab` permission plus `<all_urls>` host permission so capture still works after the side panel remains open across tab changes.
 - Captured screenshots should appear immediately in Add Issue as thumbnail rows.
 - Created issue bodies must include `Chrome profile: Silma`.
 - When Ready is checked, create the issue, upload screenshots/files as Gitea issue assets, then apply the `ready` label last.
diff --git a/manifest.llm.json b/manifest.llm.json
index c57e910..b704000 100644
--- a/manifest.llm.json
+++ b/manifest.llm.json
@@ -79,8 +79,7 @@
     "tabs"
   ],
   "extension_host_permissions": [
-    "http://*/*",
-    "https://*/*",
+    "<all_urls>",
     "Gitea host derived from VITE_GITEA_BASE_URL"
   ],
   "commands": {
diff --git a/vite.config.ts b/vite.config.ts
index 61cdc57..39511b7 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -18,7 +18,7 @@ function loadExtensionEnv(mode: string): NodeJS.ProcessEnv {
 }
 
 function getGiteaHostPermissions(baseUrl?: string): string[] {
-  const permissions = ["http://*/*", "https://*/*"];
+  const permissions = ["<all_urls>"];
 
   if (!baseUrl?.trim()) {
     return permissions;