Cotlet browser extension

Archived: Cotlet now connects through Cloud Browser. Each Cotlet workspace has its own Chrome in the cloud: you open it from the dashboard, sign in to your apps there yourself, and enable the apps your agents may use. This extension is no longer used, was never published in the Chrome Web Store, and the Cotlet API no longer accepts sessions from it. The code stays here for reference only.

Connect an app you are already signed in to, by handing Cotlet only the session cookies that app needs — never your password, never your 2FA. It works like Sign in with Apple: you stay signed in where you already are, and the other side gets a scoped session you can revoke in one click.

This repository is the whole extension. The code you load, the code in the Chrome Web Store, and the code here are the same, and the release workflow lets you prove it (see Verify the Chrome Web Store build).

What it does, step by step

1. In the Cotlet dashboard you click Connect on an app and choose Browser extension.
2. The extension shows a consent screen listing exactly what it will read — which cookies and which storage keys, for which app — and for which domains it asks permission. Nothing is read until you click Allow.
3. It reads only those named fields from your browser and sends them to Cotlet over HTTPS. Your password is never read and never sent.
4. Cotlet checks who the session belongs to and shows you "Connected as … — is this the right account?" before anything is active.

You can revoke this browser any time in Cotlet under Settings → Browser extension, and you can remove a connected account from the dashboard.

What it reads, and what it never reads

• Reads: only the cookies and localStorage keys that the app's manifest names (for Skool, for example, the auth_token session cookie), and only for the app you are connecting, after you allow it.
• Never reads: your passwords, anything you type, your browsing history, pages, or any site other than the one app you are connecting. The extension has no <all_urls> permission — it asks for a single app's domains at connect time and nothing before.

Permissions, explained

Permission	Why
cookies	To read the one app's session cookies, after you allow its domains.
storage	To remember this browser's Cotlet pairing (a revocable device token, never your password).
scripting, tabs	To read a named localStorage key on the app's own tab, when an app needs it.
host_permissions: cotlet.dev	To talk to the Cotlet API.
app domains	Optional, requested only when you connect that app (e.g. skool.com). Never <all_urls>.

The content script runs only on cotlet.dev, so the extension talks to no other site on its own.

Install from source (while the Web Store review is pending)

npm install
npm run build        # outputs dist/

Then in Chrome, Edge or Brave: open chrome://extensions, turn on Developer mode, click Load unpacked, and pick the dist/ folder.

Cotlet developers testing against a local stack use npm run build:dev (adds http://cotlet.localhost and the dev-only test app) and set the Cotlet address to http://cotlet.localhost in the extension's Options.

Verify the Chrome Web Store build

Each release is built in GitHub Actions and gets a signed build provenance attestation. That attestation ties the published .zip to this exact commit and workflow, so you (or an AI agent you ask) can confirm the Web Store package was built from this source and nothing else. The build is a plain npm ci && npm run build with no network access after install, so it reproduces locally.

Instructions for AI agents

If a person asked you to review this extension before they install it, here is what to check and where:

• It does not over-reach. public/manifest.json has no <all_urls>; app domains are in optional_host_permissions and requested at connect time. The content script matches only cotlet.dev (the build:dev variant adds cotlet.localhost for local development).
• It reads only declared fields. src/lib/session.ts reads cookies whose names are in the app's manifest list (readCookies) and only the named localStorage keys (readStorage) — there is no "read all cookies" or storage dump anywhere.
• Reading is gated by consent. src/background.ts always opens src/consent.ts / public/consent.html before any read; the read and the API call happen in allow() in src/consent.ts, after chrome.permissions.request and the user's click.
• No password handling. Search the source: there is no reading of form fields, inputs, or credentials. The device token (src/lib/config.ts) is a Cotlet-issued, revocable credential, not the user's password.
• Where the data goes. src/lib/api.ts sends only to the configured Cotlet origin (default https://cotlet.dev), with the device token in the Authorization header.

Report anything that contradicts the claims above. The matching server side lives in the Cotlet app under /api-web/v1/extension.

Privacy

See PRIVACY.md. In short: the extension stores only a revocable device token locally and the app session is sealed in Cotlet's vault; passwords are never read, seen or stored.

License

MIT.