Userscripts

Nexion's built-in browser supports Greasemonkey and Tampermonkey-compatible userscripts. Write JavaScript that runs automatically on matching web pages to customize your browsing experience: hide elements, add features, or modify page behavior.

Location

Place your userscript .js files in ~/.nexion/Userscripts/. Nexion discovers and loads all scripts in this directory on startup. To pick up new scripts without restarting, use the refresh button in Preferences.

Format

Userscripts follow the standard Greasemonkey metadata block format. Here is a complete example:

// ==UserScript==
// @name         My Custom Script
// @namespace    https://example.com
// @version      1.0
// @description  Customize the appearance of example.com
// @match        *://*.example.com/*
// @run-at       document-end
// @grant        none
// ==/UserScript==

(function() {
    'use strict';

    // Hide the sidebar
    var sidebar = document.querySelector('.sidebar');
    if (sidebar) {
        sidebar.style.display = 'none';
    }

    // Add custom styles
    var style = document.createElement('style');
    style.textContent = `
        body { max-width: 900px; margin: 0 auto; }
        .ad-banner { display: none !important; }
    `;
    document.head.appendChild(style);
})();

Supported Directives

The following directives are parsed and used by Nexion:

Directive	Description
`@name`	The display name of the script. Parsed and shown in the UI.
`@version`	Version number. Parsed and displayed alongside the name.
`@match`	URL pattern(s) determining which pages the script runs on. Parsed and used for injection matching.

The following directives are included for compatibility with Greasemonkey/Tampermonkey but are not actively parsed by Nexion: @namespace, @description, @run-at, @grant, @require. You can include them in your scripts for portability with other userscript managers.

URL Matching Patterns

The @match directive uses URL patterns with wildcards. Examples:

Pattern	Matches
`://.example.com/*`	All pages on example.com and its subdomains, any protocol
`://github.com/`	All pages on github.com
`://www.google./search*`	Google search pages across all TLDs (google.com, google.co.uk, etc.)

Security Scanning

Nexion performs security analysis on all userscripts before injection. Scripts are checked for potentially dangerous patterns:

Blocked Patterns

Scripts containing these patterns are rejected and will not be injected:

•Dynamic code execution: String-to-code functions and runtime code generation constructs
•DOM document writing: Direct document stream writing methods
•Crypto mining: Detection of cryptocurrency mining patterns

Warning Patterns

Scripts with these patterns trigger warnings but are still allowed to run:

•Cookie access via the document cookie API
•Browser storage access (localStorage, sessionStorage)
•Combinations of keyboard listeners and network requests (potential keylogger pattern)

All userscripts are wrapped in a strict-mode IIFE (Immediately Invoked Function Expression) before injection to prevent global scope pollution.

Plugins vs Userscripts

Plugins and userscripts serve different purposes. Here is how they compare:

	Plugins	Userscripts
Runtime	JavaScriptCore (native)	WebKit (browser page context)
Purpose	Extend the Nexion workspace	Modify web pages in the browser
API Access	Full `nexion.*` API (filesystem, terminal, process, etc.)	Standard Web APIs (DOM, fetch, etc.)
Location	`~/.nexion/Plugins/`	`~/.nexion/Userscripts/`
Format	`.nexionplugin` bundle with manifest	Single `.js` file with metadata block
Scope	Entire workspace (all tabs, panels)	Specific web pages matching URL patterns

Per-Site Custom CSS/JS

In addition to userscripts, you can add custom CSS and JavaScript for the current page's domain directly from the toolbar. The domain is detected automatically: just write your CSS or JS and save. This is useful for quick, one-off customizations without creating a full userscript file.