[AUTO-003] Narrow "tabs" permission to "activeTab" #3

New issue

Closed

opened 2026-07-13 10:44:31 +00:00 by frank · 1 comment

frank commented

2026-07-13 10:44:31 +00:00

Owner

Task ID: AUTO-003
Priority: P2
Status: TODO

Priority: P2
Status: TODO

Goal: Drop the broader "tabs" permission from manifest.json in favor of "activeTab", which already covers the extension's one actual use.
Why it matters: manifest.json declares "tabs" alongside "activeTab", but the only chrome.tabs.* call in the codebase (popup/popup.js:101, chrome.tabs.query({ active: true, currentWindow: true })) only ever touches the active tab, opened via a qualifying user gesture (toolbar click or context-menu action) that already grants activeTab. "tabs" exposes url/title/pendingUrl for every open tab and is called out more prominently on Chrome's install/update consent screen — unnecessary permission surface for a personal extension. Flagged in docs/notes/2026-07-10-code-health-pass.md iteration 2.
Scope: Remove "tabs" from manifest.json permissions; verify the no-pending-payload popup path (toolbar-click open, no context-menu payload) still works under activeTab alone.
Expected files or areas: manifest.json, popup/popup.js.
Acceptance criteria: Extension loads with only "activeTab" (no "tabs"); opening the popup via toolbar click still correctly reads the active tab's title/url.
Validation: Reload unpacked extension, open popup via toolbar icon with no prior context-menu action, confirm title/url populate as before.
Risks or assumptions: Assumes activeTab is in fact granted for a toolbar-click-opened popup — confirm by testing rather than assuming, per the note that flagged this.
Notes: None.

Synced from .ai/AUTONOMOUS_PLAN.md by forge sync.

**Task ID:** AUTO-003 **Priority:** P2 **Status:** TODO --- Priority: P2 Status: TODO Goal: Drop the broader `"tabs"` permission from manifest.json in favor of `"activeTab"`, which already covers the extension's one actual use. Why it matters: manifest.json declares `"tabs"` alongside `"activeTab"`, but the only `chrome.tabs.*` call in the codebase (popup/popup.js:101, `chrome.tabs.query({ active: true, currentWindow: true })`) only ever touches the active tab, opened via a qualifying user gesture (toolbar click or context-menu action) that already grants `activeTab`. `"tabs"` exposes `url`/`title`/`pendingUrl` for every open tab and is called out more prominently on Chrome's install/update consent screen — unnecessary permission surface for a personal extension. Flagged in docs/notes/2026-07-10-code-health-pass.md iteration 2. Scope: Remove `"tabs"` from manifest.json permissions; verify the no-pending-payload popup path (toolbar-click open, no context-menu payload) still works under `activeTab` alone. Expected files or areas: manifest.json, popup/popup.js. Acceptance criteria: Extension loads with only `"activeTab"` (no `"tabs"`); opening the popup via toolbar click still correctly reads the active tab's title/url. Validation: Reload unpacked extension, open popup via toolbar icon with no prior context-menu action, confirm title/url populate as before. Risks or assumptions: Assumes `activeTab` is in fact granted for a toolbar-click-opened popup — confirm by testing rather than assuming, per the note that flagged this. Notes: None. *Synced from `.ai/AUTONOMOUS_PLAN.md` by `forge sync`.*