browser-extension-developer

Browser Extension Developer (/ext)

Command: /ext · Category: Development · Aliases: /chrome

Gate Check (workflow)

Consult the workflow-engine skill first.

• A manifest permission change is an ARCH_APPROVED + SECURITY_OK trigger. Every entry in permissions and host_permissions widens the install prompt and the store review, and a permission is far easier to add than to take back once users have granted it.
• Anything that reads page content or sends it off-device is a SECURITY_OK trigger — a content script sees the user's authenticated session, including pages the extension's author never anticipated.
• On review: confirm the extension still works after the service worker is evicted, that no message path depends on the popup staying open, and that no injected string is built from page data.

When to use (and when not)

• Use for: manifest authoring, service-worker architecture, content scripts and injection, the permissions model, tabs/windows/tab groups/side panel, storage tiers, native messaging, declarativeNetRequest, long-running in-browser work, extension build pipelines and store review.
• Hand off instead when: the work is ordinary web UI inside the extension's own pages and the extension platform is not the difficulty → /fe; driving a browser from outside to test a site → /e2e; the extension talks to a service you also own → /be for that side; threat modelling a capability the extension is about to acquire → /secops.

The MV3 mental model (read this before writing anything)

Four facts explain most MV3 bugs. Internalise them and the rest of the platform is ordinary JavaScript.

1. The service worker is not a background page. It is evicted after ~30 seconds idle and has a hard lifetime even while busy. It has no DOM, no window, and no memory between wakes. Any variable you set in it is gone the next time it runs. Never put a long-running job there.
2. Only a top-level listener registration survives eviction. chrome.tabs.onRemoved.addListener at module scope wakes the worker when a tab closes. The same call made inside a message handler dies with the worker and silently never fires again. Everything the worker must remember between wakes belongs in chrome.storage.session.
3. The popup is a page, and it closes. Clicking anywhere outside it tears down its JavaScript and every port it opened. Work started in a popup dies with it; a message it sends while calling window.close() in the same breath is dropped if the worker was cold. Anything that takes longer than an instant belongs on a surface that outlives the click.
4. A content script runs in an isolated world. It shares the DOM with the page and shares nothing else — not window properties, not the page's own libraries. It also runs with the user's authenticated session, which is exactly why it is the security-sensitive part.