chrome-extension

A set of rules for building a Chrome browser extension with Manifest V3, the current extension format. It covers the extension's files, popup, page-content extraction, background service worker, URLs, and connection to the RoleMule backend.

In plain words
What is it for?
Use it when creating or changing the extension popup, extracting information from web pages, refreshing login tokens, generating icons, or switching between local and deployed RoleMule servers.
Why use it?
It keeps development and production connections separate and documents how the extension parts fit together. This reduces mistakes such as publishing with a local URL or duplicating backend connection details.

Cursor rule for Claude Code

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/eliornl/rolemule/chrome-extension
Clone the repo
git clone --depth 1 https://github.com/eliornl/rolemule

Made for: Claude Code.

Per session 0 Nothing until a file matches its globs; then the whole rule loads.
When invoked 4,049 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.04049
Opus 5 $0.00000 $0.02024
Sonnet 5 $0.00000 $0.00810
Haiku 4.5 $0.00000 $0.00405

Measured 2d ago against content hash 89ca8b9d33e1, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

chrome-extension scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/rules/chrome-extension.mdc · 243 lines

How it starts

The opening of the file, as written. The whole thing — 243 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Chrome Extension

Structure

extension/
├── manifest.json          # Manifest V3, version 2.0.0
├── popup/                 # popup.html, popup.css, popup.js
├── content/               # content.js (extraction), content.css
├── background/            # service-worker.js (token refresh every 55 min)
└── icons/                 # icon16/48/128.png (generated from app logo PNG)

Dev / Prod URL Toggle

Both popup.js and service-worker.js use a single flag to switch between local dev and production. Never hardcode PRODUCTION_URL as the active URL.

// ⚠️  BEFORE PUBLISHING: Set IS_DEV = false and fill in PRODUCTION_URL.
const IS_DEV = true;
const DEV_URL = 'http://localhost:8000';
const PRODUCTION_URL = 'https://your-rolemule-instance.com';
const BASE_URL = IS_DEV ? DEV_URL : PRODUCTION_URL;

const CONFIG = {
  API_BASE_URL: `${BASE_URL}/api/v1`,
  DASHBOARD_URL: `${BASE_URL}/dashboard`,
  APP_URL: BASE_URL,
  // ...
};

The URL can also be overridden at runtime via chrome.storage.local key jaa_api_url (useful during development):

chrome.storage.local.set({ jaa_api_url: 'http://localhost:8000/api/v1' })

Manifest (current)

  • version: 2.0.0
  • description: "One mule for every role. Analyze any job posting with AI, or match application forms to your profile."
  • short_name: RoleMule
  • default_title: RoleMule — One mule for every role.
  • http://localhost:8000/* is in host_permissions (required, not optional) so Chrome grants access automatically in dev

Icons

Icons (icon16.png, icon48.png, icon128.png) are generated from the app's logo PNG using Pillow:

cd /path/to/project && source venv/bin/activate
python3 -c "
from PIL import Image
src = 'path/to/logo.png'
img = Image.open(src).convert('RGBA')
for size in [16, 48, 128]:
    img.resize((size, size), Image.LANCZOS).save(f'extension/icons/icon{size}.png')
"

The popup (popup.html / popup.css) mirrors the main app's design system exactly:

  • Same CSS variables: --accent-gradient, --bg-primary/secondary/tertiary, --text-*, --border-color, etc.
  • Same font: Outfit from Google Fonts
  • Font Awesome 6 loaded from CDN (cdnjs.cloudflare.com) for all icons — no emoji
  • Header logo: mule mark (logo-icon img from extension/icons/icon48.png) + Role<span class="brand-accent">Mule</span> (Mule in var(--accent-primary))
  • No rounded outer corners — Chrome's native popup window clips them; do not add border-radius to html/body/.popup-container

Read the full file on GitHub · 243 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 243 lines · 0 tokens per session scan A 89ca8b9d33e1

Subscribe to this mod's changes

chrome-extension is a cursor rule published in the GitHub repository eliornl/rolemule (37 stars, last pushed 2d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 4,049 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.