Skip to content

release: 3.2.0 Chrome Web Store readiness - #40

Merged
New1Direction merged 1 commit into
mainfrom
release/3.2.0-store-ready
Oct 13, 2026
Merged

New1Direction merged 1 commit into
mainfrom
release/3.2.0-store-ready

Conversation

@New1Direction

Copy link
Copy Markdown
Owner

Prepares RepoLens 3.2.0 as the first Chrome Web Store build.

Blockers fixed (found by loading the extension in Chrome 155):

  • Library page failed to load: src/library.js imported ./vendor/*.mjs (nonexistent since the move into src/).
  • share.html and whats-new.html used inline scripts blocked by the MV3 CSP (share card stuck on "Loading…", What's New blank below the hero); moved to src/share.js / src/whats-new.js.
  • Inline onsubmit on the Ask bar was blocked, so Enter reloaded the Library.
  • New high-severity advisories in root and MCP lockfiles would fail CI audits.

Permissions: dropped tabs, webNavigation, and unused claude.ai, grok.com, pypi.org/pypi hosts — no more "read your browsing history" install warning. Verified in Chrome that extension-page tab queries and the ChatGPT loopback callback via tabs.onUpdated still work without them.

Distribution:

  • npm run package → deterministic, validated dist/repolens-v3.2.0.zip (+ sha256). Validation rejects inline scripts/handlers, unresolved imports/page URLs, wrong icon sizes, dev files, manifest limits, version drift, and permissions without a store justification. It catches all of the bugs above on current main.
  • npm run check:release keeps manifest/package/lockfile/CHANGELOG/What's New/README/website versions in sync; CI runs both and uploads the zip; tag pushes attach it to a GitHub Release.
  • PRIVACY.md + /docs/privacy, docs/store/chrome-web-store.md (listing copy, single purpose, data disclosures, permission justifications, asset checklist), store icon + small promo tile.
  • Website: install buttons say "Install for Chrome" and lead to a rewritten install guide until CHROME_WEB_STORE_URL is set; new "Use from your agent" MCP page with a wmcp.sh pointer; footer version from release data.
  • Local Ollama 403 (origin check) now explains OLLAMA_ORIGINS=chrome-extension://*.

Checks: npm run verify (982 tests, lint, HTML, format, release consistency, package), root/MCP audits, MCP syntax, website lint + build.

https://ampcode.com/threads/T-01a135b8-65da-7511-9a0e-72a5ad5dff0f

Fix three extension pages that failed in a real MV3 load: the Library
imported vendor helpers from a nonexistent src/vendor/, and share.html and
whats-new.html ran inline scripts the extension CSP blocks (plus an inline
onsubmit on the Ask bar that let Enter reload the Library).

Drop the tabs and webNavigation permissions and the unused claude.ai,
grok.com, and pypi.org/pypi hosts. The ChatGPT loopback callback is read via
tabs.onUpdated with the existing localhost host permission, so the install
prompt no longer asks to read browsing history.

Add a deterministic, validated store package (npm run package), a release
consistency gate (npm run check:release), PRIVACY.md and a website privacy
page, a store submission kit with permission justifications and brand assets,
an honest config-driven install CTA, an agents (MCP) docs page with a wmcp.sh
pointer, a clear OLLAMA_ORIGINS fix for local Ollama 403s, and refreshed
lockfiles for new high-severity advisories. Cut 3.2.0 across manifest,
package, CHANGELOG, What's New, README, and the website.

Amp-Thread-ID: https://ampcode.com/threads/T-01a135b8-65da-7511-9a0e-72a5ad5dff0f
Co-authored-by: aisle9angel@gmail.com <aisle9angel@gmail.com>
@New1Direction
New1Direction merged commit 099e00e into main Oct 13, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants