Skip to content

Harden extension for Chrome Web Store launch #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
eimexdev wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

Harden extension for Chrome Web Store launch #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
980b571
Harden extension for store launch
eimexdev Jul 16, 2026
4d69ca6
Address launch review findings
eimexdev Jul 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,7 @@
dist/
output/
.playwright-cli/
_metadata/generated_indexed_rulesets/
output/playwright/sidechat-debug/
*.pem
*.crx
.DS_Store
140 changes: 48 additions & 92 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,119 +1,75 @@
# RightClickGPT

RightClickGPT is a Chrome extension for sending selected webpage text to ChatGPT or t3.chat from the right-click menu. You can keep multiple prompt presets, choose where each prompt opens, and optionally reuse an existing chat tab or conversation.
RightClickGPT is an independent Chrome extension for sending selected webpage text to ChatGPT or t3.chat from the right-click menu. It is not affiliated with, endorsed by, or produced by OpenAI or t3.chat.

## Features

- Right-click context menu for selected text.
- ChatGPT and t3.chat provider support.
- Multiple named prompt presets with custom prompt formats.
- Collapsed preset editor with chevrons, per-preset enable toggles, and delete confirmation.
- Global default behavior for opening prompts in a new tab or in Chrome's side panel.
- Per-preset behavior overrides: Default, New tab, or Sidechat.
- Optional conversation URL or legacy chat ID for sending prompts to a specific conversation.
- Optional reuse of an existing ChatGPT or t3.chat tab.
- Sidechat panel with embedded chat, reload control, and an "Open tab" fallback.
- Popup and full options page for configuration.
- Autosaved settings stored in Chrome local extension storage.
- Prompt URL support for fresh chats, with content-script automation for existing tabs, configured conversations, long ChatGPT prompts, and submission fallback.
- t3.chat session bridge for smoother prompt submission in t3.chat.

## Installation

1. Clone or download this repository.
2. Open Chrome and go to `chrome://extensions/`.
3. Turn on **Developer mode**.
4. Click **Load unpacked**.
5. Select the `RightClickGPT` folder.
6. Pin RightClickGPT to the Chrome toolbar if you want quick access to the popup settings.
- Right-click delivery of selected text to ChatGPT or t3.chat.
- Multiple named prompt presets with enable toggles and per-preset behavior.
- New-chat, existing-tab, and configured-conversation delivery.
- First-use disclosure and affirmative consent before any prompt can be sent.
- Local-only preset and preference storage; no analytics, ads, tracking, or developer server.
- Least-privilege Store package with access limited to the supported provider domains.
- Separate Advanced GitHub package with experimental embedded side-panel support.

## Usage

### Send Selected Text

1. Select text on a webpage.
2. Right-click the selection.
3. Choose a RightClickGPT preset.
- If one enabled preset is available, it appears directly in the context menu.
- If multiple enabled presets are available, they appear under the provider menu, such as **Ask ChatGPT** or **Ask t3.chat**.
4. RightClickGPT formats the preset by replacing `<prompt>` with the selected text, then opens or updates the configured chat target.

### Configure Presets

Open the toolbar popup or the extension options page.

Click **Add preset** to create a new preset. New presets open expanded so you can name them and edit the prompt format immediately.
## Release variants

For each preset:
### Store

- Click the chevron to expand or collapse the preset details.
- Edit the preset name shown in the context menu.
- Write a prompt format that includes `<prompt>`.
- Choose a behavior:
- **Default** uses the global default behavior.
- **New tab** opens the prompt in a browser tab.
- **Sidechat** opens the prompt in Chrome's side panel.
- Use the on/off toggle to keep a preset without showing it in the context menu.
- Expand a preset and click the trash icon to delete it.
`dist/store` is the default and Chrome Web Store-targeted build. It includes the core context-menu, preset, ChatGPT, and t3.chat features. It does not include provider framing, response-header modification, or the T3 WebSocket session workaround.

Settings autosave shortly after changes. Enabled presets must have a name and include `<prompt>` to be usable.
### Advanced

### Choose a Provider
`dist/advanced` is for informed users who deliberately install the extension unpacked from GitHub. It adds the embedded side panel. The Advanced build narrowly removes CSP/X-Frame-Options only for provider subframes initiated by this extension and injects the T3 session workaround only into this extension's own embedded T3 frame.

Use **Chat provider** to choose where prompts are sent:
The Advanced build is not intended for Chrome Web Store submission. Provider changes, authentication challenges, and third-party cookie restrictions can still break embedded pages.

- **ChatGPT** sends prompts to `chatgpt.com`.
- **t3.chat (beta)** sends prompts to `t3.chat`.
## Build and validate

You may need to be signed in to the selected provider before prompts can submit successfully.
Requires Node.js 20 or later.

### Choose Opening Behavior
```sh
npm run check
```

Use **Default behavior** to choose what presets do when their behavior is set to **Default**:
This creates both unpacked variants in `dist/`, validates their manifests and package allowlists, and runs automated tests.

- **New tab** opens a provider tab.
- **Sidechat** opens Chrome's side panel and loads the provider inside it.
To install locally:

Each preset can override this default.
1. Open `chrome://extensions/`.
2. Enable **Developer mode**.
3. Choose **Load unpacked**.
4. Select `dist/store` for the launch-safe build or `dist/advanced` for the experimental build.
5. Review the disclosure that opens after installation and explicitly enable the extension.

### Reuse an Existing Chat Tab

Turn on **Use existing ChatGPT tab** or **Use existing t3.chat tab** to send prompts to the first matching open provider tab. If no matching tab exists, RightClickGPT opens the configured target instead.

### Send to a Specific Conversation

Use **Conversation URL** to target an existing conversation. You can enter:

- A full ChatGPT or t3.chat conversation URL.
- A legacy bare chat ID.
## Usage

Leave it blank to start a new chat each time.
1. Select text on a webpage.
2. Right-click the selection.
3. Choose a preset. The menu identifies the destination provider.
4. The extension formats the preset and sends it only after this explicit action.

### Use Sidechat
Use the toolbar popup or full options page to manage presets, provider, conversation target, existing-tab reuse, and—on the Advanced build only—side-panel behavior.

When a prompt uses **Sidechat**, RightClickGPT opens Chrome's side panel for the current tab and loads the prompt there.
For normal-length T3 prompts, the extension uses t3.chat's native new-chat query flow. Longer prompts, existing tabs, configured conversations, and ChatGPT use the provider composer automation.

The Sidechat panel includes:
## Privacy

- An embedded provider frame.
- A reload button.
- An **Open tab** link for opening the same prompt in a normal browser tab.
- A status message if Chrome cannot open the side panel for the current page.
Read the [privacy notice](docs/PRIVACY.md). Store publishers must host this notice at a stable public HTTPS URL and enter that URL in the Chrome Web Store Privacy tab.

## How Prompt Delivery Works
## Release documentation

For fresh chats, RightClickGPT builds provider URLs with the prompt in the `q` query parameter. For configured conversations, existing tabs, long ChatGPT prompts, or cases where the provider does not submit automatically, the extension injects `content.js` to fill and submit the provider composer.
- [Store listing and privacy answers](docs/STORE_SUBMISSION.md)
- [Release checklist](docs/RELEASE_CHECKLIST.md)

## Files
## Source map

- `manifest.json`: Chrome extension manifest, permissions, popup, options page, side panel, and content script registration.
- `background.js`: Context menu setup, preset filtering, prompt formatting, tab routing, side panel routing, and chat URL normalization.
- `options.html`: Full options page.
- `popup.html`: Toolbar popup settings UI.
- `options.js`: Settings UI behavior, preset editing, autosave, validation, provider selection, and conversation URL normalization.
- `content.js`: ChatGPT and t3.chat composer detection, prompt insertion, and submission fallback.
- `sidechat.html`: Chrome side panel UI.
- `sidechat.js`: Sidechat frame loading, reload handling, open-tab fallback, and status updates.
- `t3-bridge.js`: t3.chat WebSocket session patch used by the t3 integration.
- `rules/chatgpt-embed.json`: Header rules that allow supported chat providers to load in the side panel frame.
- `logo16.png`, `logo48.png`, `logo128.png`: Extension icons.
- `manifest.json`: least-privilege Store manifest.
- `manifests/advanced.json`: Advanced GitHub manifest.
- `background.js`: consent gating, context menus, provider routing, and Advanced frame-rule setup.
- `content.js`: provider composer insertion and submission.
- `onboarding.*`: prominent data disclosure and affirmative consent.
- `options.*` / `popup.html`: local settings UI.
- `sidechat.*`: Advanced-only embedded panel.
- `t3-frame-bootstrap.js` / `t3-bridge.js`: Advanced-only, frame-scoped T3 compatibility workaround.
- `scripts/`: deterministic build and validation scripts.
Loading