What is Connect+

A desktop browser built for control, automation, and privacy — with a capable AI sidebar, a native extension platform, and a download accelerator.

A desktop browser built for control, automation, and privacy — with an AI assistant that can actually do things, a native extension platform, and a built-in download accelerator.

Connect+ is a full desktop web browser (built on Electron) by arw-labs. It keeps the familiar browsing you expect and adds three things most browsers don't: a genuinely capable AI sidebar, a clean-slate native extension system (no Chrome-runtime baggage), and a class-leading download accelerator — all wrapped in a per-profile model where everything is isolated, and a capability-based security posture where no component can quietly grant itself more power than you gave it.

Who it's for

Power users who want real control — separate work/personal worlds, fast downloads, extensions, and settings that go deep instead of hiding.
People who want an AI that works inside the browser — not a chat box bolted on, but an assistant that can read the page, navigate, fill forms, pull data, watch a page's network calls, and run community plugins — on a permission model you hold.
Developers & the community — a first-class platform to build extensions and AI plugins (with typed SDKs, a CLI, and a store), not just consume them.
Privacy-minded people — profile isolation, built-in ad/tracker blocking, bring-your-own AI keys that stay on your device, synthetic camera/mic, and packages that are cryptographically verified before they run.

Core capabilities

Profiles — everything is isolated

Each profile is its own world: cookies and sessions, history, bookmarks, downloads, saved passwords, 2FA codes, extensions, themes, ad-block state, and AI permissions. A work profile's data is never a personal profile's business. Switching profiles switches the whole context, cleanly.

An assistant that operates the browser directly through a set of tools — read the page, extract structured data, navigate, click, type, manage tabs, search history and bookmarks, drive downloads, and observe the requests a page makes (to find its API). It's built around a few principles:

Bring your own provider. Any OpenAI-compatible endpoint; your API key is stored encrypted on your device and sent only to the provider you chose. Switch model or provider mid-conversation. MCP tools are supported client-side.
You hold the permissions. Tools are grouped and switchable per profile. Risky abilities (running scripts in a page, capturing the page, reading cookies) are off by default and unlock only per-profile, scoped to the sites you name, confirmed at the moment they'd run.
It can never widen its own reach. Web-page text is treated as untrusted input; the assistant is structurally blocked from changing its own permissions.

AI plugins — extend what the assistant can do

Community (or your own) JavaScript adds new tools the assistant can use — call an online service, transform data, automate a page. A plugin is a small folder; the assistant loads its tools on demand and runs them in an isolated worker that can reach only what the plugin declared and you approved:

api.fetch is limited to the exact hosts the plugin lists; anything else is refused.
api.secret exposes only the secrets you filled in, encrypted at rest, never shown to the model.
Authoring is first-class: the @arw/ai-plugin SDK (typed manifest + api), an aip CLI to validate and test locally, and signed .aip packages you can publish to the store and install with one click.

Native extensions (the `connect.*` platform)

A from-scratch extension system — Chrome's API is used only as a design checklist, not a runtime. Extensions get a clean, capability-gated surface: storage, scripting, network rules / DNR, context menus, toolbar actions, side panels, alarms, idle, messaging/ports, tabs & windows, i18n, commands, and more. Every extension runs in its own session, every capability is enforced at one gate, and packages are signed and re-verified on install — no silent permission creep, no chrome.* legacy.

Accelerated downloads

A built-in, IDM-class multipart download accelerator — on by default, toggle-able per profile or globally:

Splits a large download into parts across parallel connections and reassembles a byte-identical file.
Adapts to the server: it opens connections gently and ramps up when the host keeps pace; if the host caps or rate-limits connections (common on speed-test/CDN hosts), it falls back to a single steady connection instead of failing.
Resumable across interruptions, with a live IDM-style block view showing each part's progress.

Personalization

Custom themes (a full set of light/dark color tokens with an in-app editor), multi-language UI (English, French, Spanish), and system-font support.

Privacy & devices

Built-in ad and tracker blocking (EasyList/uBO filter lists, per profile), synthetic camera/microphone so sites can be given a virtual device instead of your real hardware, per-session/per-site certificate decisions kept in memory only, and sensible defaults that don't leak between profiles.

Everyday browser essentials

Session restore, full keyboard shortcuts, tab drag-reorder, DevTools (F12), HTTP auth, clear network-error and certificate pages, saved passwords, TOTP 2FA codes, favorites, history, and an omnibox with search.

What makes it different

	Connect+	A typical Chromium browser
AI	Built-in assistant that operates the browser + a plugin ecosystem, on a per-profile permission model	A chat panel, or an extension bolted on
Extensions	Native `connect.*` platform — clean capability model, signed & re-verified, per-session isolation	Chrome extensions with the `chrome.*` legacy surface
Downloads	Adaptive multipart accelerator built in, robust to hostile/rate-limiting servers	Single-stream; accelerators are third-party add-ons
Isolation	Everything is per-profile — including AI permissions and extension grants	Profiles exist, but many things bleed together
Security	Capability-injection throughout; the AI can't escalate; packages verified before they run	Varies; extension permission models are coarse
AI keys	Bring your own; stored locally, sent only to your provider	Usually a vendor's model and telemetry
Platform	One store for extensions · AI plugins · themes, with typed SDKs and a real trust model	Separate, uneven ecosystems

Security model (the throughline)

Connect+ is built on capability injection: a component receives a narrow object that is its permissions, rather than being trusted to police itself.

The AI can never widen its own permissions. Because its input includes attacker controlled web-page text, the surfaces that change permissions are blocked from every tool it can call.
Plugins get only their declared api — a specific host allowlist for fetch, only the secrets you entered — enforced in the main process, not on the plugin's honor.
Packages are cryptographically signed (Ed25519) and re-verified by the desktop on install — the store is only distribution, never the trust root. Tampered, unsigned, or key-rotated packages are refused. Root-signed → first-party; author signed → signed.
Secrets and passwords are encrypted at rest (OS-backed), never logged, never sent to the AI.
Risky abilities are opt-in, scoped, and confirmed — nothing dangerous happens without an explicit, site-scoped grant.

The Connect ecosystem (connect.arw-labs.com)

A single hub for the platform:

Extensions — browse, install with one click ("Add to Connect"), auto-update.
AI plugins — the same, for assistant plugins; authored with @arw/ai-plugin.
Themes — shareable color themes with live previews.
Docs — comprehensive documentation: the app's capabilities, how to create AI plugins (and the SDK/CLI reference), how to create extensions (and the full Connect API reference), and how to build themes.

Everything installs through the same verified pipeline and per-profile consent flow, so adding to Connect+ is one click and still fully under your control.

Platform

Cross-platform desktop (Windows, macOS, Linux) built on Electron and TypeScript, with a Next.js-powered UI and a native main-process core. Extensions and AI plugins run in isolated sessions/workers; the store and docs are served from the web.

Connect+ — your browser, your rules, with an AI that earns its access.