Native injection, tabbed settings, and custom profiles #2

Merged

richard merged 1 commit from native-injection-and-custom-profiles into main

2026-08-19 18:26:40 +02:00

richard commented

2026-08-19 18:23:50 +02:00

Owner

Reworks how the extension injects and adds user-built profiles.

Native injection (no "Allow user scripts" toggle)

Drops chrome.userScripts and its permission. The engine is now a native MAIN-world content script registered via chrome.scripting.registerContentScripts (world: MAIN, document_start).
MAIN-world scripts can't read chrome.storage, so config arrives via an ISOLATED-world bridge: the engine installs instantly with a default identity (first paint is always spoofed), then adopts the real per-site profile the moment the bridge posts it. Every hook reads shared mutable state, so no reinstall is needed.
The allowlist becomes excludeMatches, so trusted sites are never injected (no spoof-flash).
Registration is serialized to avoid the "Duplicate script ID" race from concurrent triggers.

Custom profiles from constrained dropdowns

New builder in the options page: pick browser -> only valid OSes -> only valid GPUs -> screen preset, language, timezone. buildProfile derives every dependent field (UA, Client Hints, WebGL strings, deviceMemory, colour depth...), so custom identities stay internally consistent -- no Safari-on-Windows mismatches.
Custom profiles join the per-site pool. The bridge now sends the resolved profile object instead of an index, so custom profiles work in the engine.

Other

Settings open as a standalone tab (open_in_tab), not the embedded extension-details panel.
Version reset to 1.0.0; minimum_chrome_version lowered to 111.

Verification

scripts/verify.mjs — 13 checks (engine, incl. delivery of a custom Safari-on-macOS profile).
scripts/verify-options.mjs — 11 checks driving the real options page (dependent dropdowns, preview consistency, persistence).

Both suites pass. npm run compile and npm run build are clean.

🤖 Generated with Claude Code

Reworks how the extension injects and adds user-built profiles. ## Native injection (no "Allow user scripts" toggle) - Drops `chrome.userScripts` and its permission. The engine is now a native MAIN-world content script registered via `chrome.scripting.registerContentScripts` (`world: MAIN`, `document_start`). - MAIN-world scripts can't read `chrome.storage`, so config arrives via an ISOLATED-world `bridge`: the engine installs instantly with a default identity (first paint is always spoofed), then adopts the real per-site profile the moment the bridge posts it. Every hook reads shared mutable state, so no reinstall is needed. - The allowlist becomes `excludeMatches`, so trusted sites are never injected (no spoof-flash). - Registration is serialized to avoid the "Duplicate script ID" race from concurrent triggers. ## Custom profiles from constrained dropdowns - New builder in the options page: pick browser -> only valid OSes -> only valid GPUs -> screen preset, language, timezone. `buildProfile` derives every dependent field (UA, Client Hints, WebGL strings, deviceMemory, colour depth...), so custom identities stay internally consistent -- no Safari-on-Windows mismatches. - Custom profiles join the per-site pool. The bridge now sends the resolved profile object instead of an index, so custom profiles work in the engine. ## Other - Settings open as a standalone tab (`open_in_tab`), not the embedded extension-details panel. - Version reset to 1.0.0; `minimum_chrome_version` lowered to 111. ## Verification - `scripts/verify.mjs` — 13 checks (engine, incl. delivery of a custom Safari-on-macOS profile). - `scripts/verify-options.mjs` — 11 checks driving the real options page (dependent dropdowns, preview consistency, persistence). Both suites pass. `npm run compile` and `npm run build` are clean. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

richard added 1 commit

2026-08-19 18:23:51 +02:00

Native injection, tabbed settings, and custom profiles 24430deef6

Replace the userScripts injection with a native MAIN-world content script
registered via chrome.scripting -- no "Allow user scripts" toggle, no
userScripts permission. Config reaches the MAIN world through an
ISOLATED-world bridge; the engine installs instantly with a default
identity (first paint always spoofed) and adopts the real per-site
profile the moment the bridge delivers it, via shared mutable state.
The allowlist becomes excludeMatches so trusted sites aren't injected at
all. Registration is serialized to avoid duplicate-ID races.

Add a constrained custom-profile builder: users assemble an identity
from dependent dropdowns (browser -> valid OSes -> valid GPUs -> screen
presets, language, timezone) and buildProfile derives every dependent
field, so custom profiles stay internally consistent. They join the
per-site pool. The bridge now sends the resolved profile object rather
than an index so custom profiles work in the engine.

Open settings as a standalone tab (open_in_tab) instead of the embedded
extension-details panel. Reset extension version to 1.0.0.

Verification: scripts/verify.mjs (13 checks, engine incl. custom profile
delivery) and scripts/verify-options.mjs (11 checks, builder UI) both pass.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

richard merged commit 2345de9b62 into main

2026-08-19 18:26:40 +02:00

richard deleted branch native-injection-and-custom-profiles

2026-08-19 18:26:40 +02:00

richard referenced this pull request from a commit

2026-08-19 18:26:41 +02:00

Merge pull request 'Native injection, tabbed settings, and custom profiles' (#2) from native-injection-and-custom-profiles into main