Harden extension for Chrome Web Store launch

[eimexdev]

Summary

• split the project into a Chrome Web Store-safe build and a separately packaged Advanced GitHub build without changing the product name
• reduce Store permissions from <all_urls> plus framing/scripting capabilities to exact provider origins and contextMenus, storage, and alarms
• add explicit data-transfer consent, an in-extension privacy notice, clear-data controls, Store submission copy, reviewer instructions, and release checklists
• make ChatGPT and T3 prompt delivery resilient through acknowledged existing-tab reuse, native short T3 query URLs, in-memory long-prompt handoff, five-minute expiry alarms, and tab-close cleanup
• retain Advanced Sidechat with extension-initiated subframe-only header rules and frame-scoped T3 compatibility injection; none of that machinery ships in the Store ZIP
• add deterministic build, validation, test, and packaging commands for both artifacts

Why

The unpacked manifest requested broad page access and shipped response-header modification plus a MAIN-world T3 bridge in the same artifact. That created avoidable Chrome Web Store permission, privacy, remote-behavior, and upcoming AI-safeguard policy risk. This change isolates those capabilities from the Store submission while preserving normal-tab feature parity for ChatGPT and T3.

Validation

• npm run check
  • both variants build
  • launch invariants and script parsing pass
  • 5 unit tests pass
  • both ZIPs pass integrity checks
• Playwright fresh-profile testing covered onboarding/consent, popup/options persistence, ChatGPT new and existing tabs, short and long T3 prompts, session cleanup, clear-data disablement, exact Advanced DNR matching, and T3 Sidechat frame isolation
• two independent adversarial reviews covered code standards/security/lifecycle and product-spec/Store-policy completeness; all high-confidence code findings were fixed and re-reviewed

Detailed evidence: docs/TEST_REPORT.md.

Before Web Store submission

• choose and apply the final name (intentionally unchanged here)
• host docs/PRIVACY.md at a stable public HTTPS URL
• create Store screenshots/promotional artwork and complete the dashboard/account metadata
• repeat signed-in/configured-conversation, upgrade, keyboard, and extension-error checks described in docs/RELEASE_CHECKLIST.md

This is a draft because those release-owner and authenticated-provider checks cannot be completed solely from the repository.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 0bc16e5a-ce88-4eae-9b79-a6e3a3413e21

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/store-launch-readiness

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}