release: v1.3.2 — fix WXT manifest scope validation by hoangsvit · Pull Request #78 · ePlus-DEV/gmail-alias-toolkit

hoangsvit · 2026-07-23T04:19:42Z

Summary

Fix WXT manifest scope handling and validation for the inline helper content script.

Type of Change

Areas Touched

Testing

yarn compile
yarn test
yarn build
Production manifest verification
Loaded the extension locally and tested the changed flow
Tested light and dark mode, if UI changed
Checked translations, if user-facing text changed

Unit-test coverage added

The manifest validator now has regression coverage for:

exact development allowlist success;
Firefox MV2 host patterns stored in permissions;
broad development content-script matches such as *://*/*;
broad development host permissions;
literal <all_urls> rejection in development;
missing development allowlist entries;
valid Firefox-style production manifests;
unrelated content scripts not satisfying inline-helper validation;
missing generated inline helper;
missing manifest files;
missing production host coverage.

Screenshots or Recording

N/A — no UI changes.

Notes for Reviewers

Production validation targets only the generated inline helper entry (content-scripts/content.js) instead of flattening matches from every manifest content script. Development scope remains restricted to the configured allowlist. Tests import the validator constants directly to avoid fixture drift.

This commit fixes the style issues introduced in c34f7e8 according to the output from Prettier. Details: #77

…on-mode fix: restore inline popup in production builds

qodo-code-review · 2026-07-23T04:19:48Z

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

eplus-bot · 2026-07-23T04:19:52Z

Thank you for creating this pull request and helping make the project better.

We will review / merge it when we are online.

coderabbitai · 2026-07-23T04:20:08Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

The PR changes content-script URL scoping, applies mode-specific matches during manifest generation, adds manifest-scope validation for generated outputs, and runs the production check in CI for main and dev branch events.

Changes

Production manifest validation

Layer / File(s)	Summary
Build mode wiring `wxt.config.ts`, `entrypoints/content/index.ts`	URL constants and manifest generation now apply development or production content-script matches without the `__DEV_MODE__` compile-time define.
Manifest validator `scripts/verify-manifest-scope.mjs`	Discovers generated browser outputs and validates content-script matches, host permissions, URL patterns, and mode-specific scope rules.
Validator coverage and CI integration `tests/scripts/verify-manifest-scope.test.mjs`, `vitest.config.ts`, `.github/workflows/ci.yml`	Adds development and production fixture tests, enables `.mjs` test discovery, and runs production Chrome verification for `push` and `pull_request` events targeting `main` or `dev`.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant CIWorkflow
  participant ExtensionBuild
  participant ManifestVerifier
  participant OutputDirectory
  CIWorkflow->>ExtensionBuild: Build production extension
  ExtensionBuild->>OutputDirectory: Write manifest.json
  CIWorkflow->>ManifestVerifier: Verify production Chrome scope
  ManifestVerifier->>OutputDirectory: Read and validate manifests
  ManifestVerifier-->>CIWorkflow: Report success or set failure status

Possibly related PRs

ePlus-DEV/gmail-alias-toolkit#73: Modifies the same mode-based content-script and manifest URL-scoping logic.
ePlus-DEV/gmail-alias-toolkit#77: Relates to CI manifest-scope verification and production/development URL handling.

Suggested reviewers: eplus-bot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: fixing WXT manifest scope validation in v1.3.2.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch dev

_{Comment @coderabbitai help to get the list of available commands.}

deepsource-io · 2026-07-23T04:22:35Z

DeepSource Code Review

We reviewed changes in 89ce43f...e134d88 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade	Security Reliability Complexity Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Jul 23, 2026 4:21a.m.	Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

eplus-bot

Approved by @eplus-bot after all pull request checks passed.

CI run: https://github.com/ePlus-DEV/gmail-alias-toolkit/actions/runs/29979273011

eplus-bot · 2026-07-23T04:22:41Z

Approved by @eplus-bot after all pull request checks passed.

Approval refresh: #5
CI updated: 2026-07-23T13:39:40Z
CI attempt: #1
Approval workflow: #323.1

CI run: https://github.com/ePlus-DEV/gmail-alias-toolkit/actions/runs/30012127562

This commit fixes the style issues introduced in f314e5e according to the output from Prettier. Details: #79

coderabbitai

Actionable comments posted: 2

🧹 Nitpick comments (1)

wxt.config.ts (1)
14-14: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Document the newly added arrow callbacks.

vite, build:manifestGenerated, and the find/some predicates lack the required one-line JSDoc. Extract the predicates into documented helpers where needed.

As per coding guidelines, every function declaration, arrow function, and exported component must have at least a one-line JSDoc comment describing its purpose.

Also applies to: 46-52
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@wxt.config.ts` at line 14, Document every newly added callback in the
configuration, including the vite and build:manifestGenerated arrow callbacks
and the predicates used by find and some. Add one-line JSDoc descriptions
directly above callbacks where possible, and extract the find/some predicates
into named documented helpers when required; preserve their existing behavior.
Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/verify-manifest-scope.mjs`:
- Around line 79-102: Update the validation logic in verify-manifest-scope
around contentScriptMatches and grantedHosts to reject any URL pattern not
included in DEV_SITES. Preserve the existing checks for missing DEV_SITES
entries and literal ALL_URLS, while ensuring both sets contain only the
development allowlist so broad patterns such as *://*/* fail validation.
- Around line 114-124: Update the manifest scope validation before the
mode-specific calls to select only the generated inline helper content script
identified by the corresponding configuration entry in wxt.config.ts, and derive
contentScriptMatches from that script’s matches rather than flattening every
manifest.content_scripts entry. Preserve the existing grantedHosts construction
and validateDevelopmentScope/validateProductionScope flow.

---

Nitpick comments:
In `@wxt.config.ts`:
- Line 14: Document every newly added callback in the configuration, including
the vite and build:manifestGenerated arrow callbacks and the predicates used by
find and some. Add one-line JSDoc descriptions directly above callbacks where
possible, and extract the find/some predicates into named documented helpers
when required; preserve their existing behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 01f59d6e-1972-44a2-b695-4a28b08bc609

📥 Commits

Reviewing files that changed from the base of the PR and between e134d88 and c8b436b.

📒 Files selected for processing (4)

.github/workflows/ci.yml
entrypoints/content/index.ts
scripts/verify-manifest-scope.mjs
wxt.config.ts

🚧 Files skipped from review as they are similar to previous changes (1)

.github/workflows/ci.yml

eplus-bot

Approved by @eplus-bot after all pull request checks passed.

CI run: https://github.com/ePlus-DEV/gmail-alias-toolkit/actions/runs/29989378303

This commit fixes the style issues introduced in 64f1634 according to the output from Prettier. Details: #80

…owlist fix: restrict development manifest to allowlisted sites

eplus-bot

Approved by @eplus-bot after all pull request checks passed.

CI run: https://github.com/ePlus-DEV/gmail-alias-toolkit/actions/runs/30006049395

eplus-bot

Approved by @eplus-bot after all pull request checks passed.

CI run: https://github.com/ePlus-DEV/gmail-alias-toolkit/actions/runs/30006479333

This commit fixes the style issues introduced in 7ea4a2a according to the output from Prettier. Details: #78

This commit fixes the style issues introduced in 0c101d5 according to the output from Prettier. Details: #78

eplus-bot

Approved by @eplus-bot after all pull request checks passed.

CI run: https://github.com/ePlus-DEV/gmail-alias-toolkit/actions/runs/30012127562

hoangsvit · 2026-07-23T16:55:33Z

@eplus-bot review

eplus-bot

Approved by @eplus-bot after all checks passed for commit 37231c6c8660771936dfa87b4c4cc03a87c3a0ef.

eplus-bot · 2026-07-23T16:55:44Z

✅ eplus-bot reviewed and approved commit 37231c6c8660771936dfa87b4c4cc03a87c3a0ef.

hoangsvit and others added 8 commits July 21, 2026 09:34

Merge remote-tracking branch 'origin/main' into dev

213b444

Merge remote-tracking branch 'origin/main' into dev

5614201

fix: align inline helper with WXT environment

b353f92

test: verify production inline helper manifest

7f54aaf

ci: run checks for pull requests into dev

c34f7e8

style: format code with Prettier

9a00ad6

This commit fixes the style issues introduced in c34f7e8 according to the output from Prettier. Details: #77

fix: avoid console usage in manifest verifier

7a2c078

Merge pull request #77 from ePlus-DEV/agent/fix-inline-popup-producti…

e134d88

…on-mode fix: restore inline popup in production builds

eplus-bot added needs-review Pull request is ready for maintainer review build-ci Build, CI, release, or project configuration labels Jul 23, 2026

eplus-bot assigned hoangsvit Jul 23, 2026

eplus-bot self-requested a review July 23, 2026 04:19

eplus-bot previously approved these changes Jul 23, 2026

View reviewed changes

hoangsvit and others added 12 commits July 23, 2026 12:36

refactor: remove custom WXT development flag

4ed6cb5

chore: add one-time WXT environment cleanup

1a98dac

refactor: use WXT runtime environment directly

aff50e8

test: verify WXT manifest scope by mode

d19795e

test: verify WXT development and production scopes

874a63c

refactor: replace production-only manifest verifier

eb8212b

chore: no-op placeholder

d380e3c

chore: remove accidental placeholder

f314e5e

style: format code with Prettier

6604e91

This commit fixes the style issues introduced in f314e5e according to the output from Prettier. Details: #79

chore: align content script with WXT mode

ec7471e

fix: make one-time WXT mode replacement format-safe

bfff3c1

fix: align content script with WXT build mode

cc6a0cf

eplus-bot self-requested a review July 23, 2026 07:45

coderabbitai Bot reviewed Jul 23, 2026

View reviewed changes

Comment thread scripts/verify-manifest-scope.mjs

Comment thread scripts/verify-manifest-scope.mjs Outdated

eplus-bot previously approved these changes Jul 23, 2026

View reviewed changes

hoangsvit and others added 3 commits July 23, 2026 18:17

fix: reject unexpected development URL patterns

64f1634

style: format code with Prettier

cbf7e6d

This commit fixes the style issues introduced in 64f1634 according to the output from Prettier. Details: #80

Merge pull request #80 from ePlus-DEV/agent/restrict-dev-manifest-all…

6961b9e

…owlist fix: restrict development manifest to allowlisted sites

hoangsvit dismissed eplus-bot’s stale review via 6961b9e July 23, 2026 12:12

eplus-bot self-requested a review July 23, 2026 12:12

eplus-bot previously approved these changes Jul 23, 2026

View reviewed changes

hoangsvit changed the title ~~v1.3.2~~ release: v1.3.2 — fix WXT manifest scope validation Jul 23, 2026

fix: validate only inline helper manifest scope

291128c

hoangsvit dismissed eplus-bot’s stale review via 291128c July 23, 2026 12:18

eplus-bot self-requested a review July 23, 2026 12:18

eplus-bot previously approved these changes Jul 23, 2026

View reviewed changes

test: expose manifest validator for unit coverage

7ea4a2a

hoangsvit dismissed eplus-bot’s stale review via 7ea4a2a July 23, 2026 13:36

style: format code with Prettier

1410452

This commit fixes the style issues introduced in 7ea4a2a according to the output from Prettier. Details: #78

eplus-bot self-requested a review July 23, 2026 13:36

test: include Node manifest validator specs

cbc4b67

eplus-bot added the tests Test coverage or test tooling changes label Jul 23, 2026

hoangsvit and others added 2 commits July 23, 2026 20:37

test: cover manifest scope validation regressions

0c101d5

style: format code with Prettier

3a34dcd

This commit fixes the style issues introduced in 0c101d5 according to the output from Prettier. Details: #78

eplus-bot previously approved these changes Jul 23, 2026

View reviewed changes

test: share manifest scope constants with specs

ff42dbe

hoangsvit dismissed eplus-bot’s stale review via ff42dbe July 23, 2026 13:42

eplus-bot self-requested a review July 23, 2026 13:42

test: cover missing and valid production manifests

37231c6

eplus-bot approved these changes Jul 23, 2026

View reviewed changes

Uh oh!

Uh oh!

Conversation

hoangsvit commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Areas Touched

Testing

Unit-test coverage added

Screenshots or Recording

Notes for Reviewers

Uh oh!

qodo-code-review Bot commented Jul 23, 2026

Qodo reviews are paused for this user.

Uh oh!

eplus-bot commented Jul 23, 2026

Uh oh!

coderabbitai Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

deepsource-io Bot commented Jul 23, 2026

DeepSource Code Review

PR Report Card

Code Review Summary

Uh oh!

eplus-bot left a comment

Choose a reason for hiding this comment

Uh oh!

eplus-bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

eplus-bot left a comment

Choose a reason for hiding this comment

Uh oh!

eplus-bot left a comment

Choose a reason for hiding this comment

Uh oh!

eplus-bot left a comment

Choose a reason for hiding this comment

Uh oh!

eplus-bot left a comment

Choose a reason for hiding this comment

Uh oh!

hoangsvit commented Jul 23, 2026

Uh oh!

eplus-bot left a comment

Choose a reason for hiding this comment

Uh oh!

eplus-bot commented Jul 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

hoangsvit commented Jul 23, 2026 •

edited

Loading

coderabbitai Bot commented Jul 23, 2026 •

edited

Loading

eplus-bot commented Jul 23, 2026 •

edited

Loading