release: v1.3.2 — fix WXT manifest scope validation

.env.example

@@ -0,0 +1,30 @@
+# Extra Chrome match patterns for the inline helper in development builds.
+#
+# Required format: scheme://host/path
+# - Use *:// to match both HTTP and HTTPS.
+# - Use *. before a domain to include the root domain and its subdomains.
+# - End with /* to match every path on the site.
+# - Separate multiple patterns with commas or whitespace.
+#
+# Valid:
+#   *://*.w3schools.com/*
+#   https://example.com/*
+#   http://localhost/*
+#   http://127.0.0.1/*
+#
+# Invalid:
+#   https://www.w3schools.com/   (missing * after the final slash)
+#   www.w3schools.com            (missing scheme and path)
+WXT_INLINE_DEV_MATCHES=http://localhost/*,http://127.0.0.1/*,*://*.w3schools.com/*
+
+# Release build configuration for Chrome and Firefox extensions. These values are used by the build scripts to package and submit the extensions to their respective stores. Fill in the appropriate values for your extension.
+CHROME_EXTENSION_ID=
+CHROME_CLIENT_ID=
+CHROME_CLIENT_SECRET=
+CHROME_REFRESH_TOKEN=
+CHROME_PUBLISH_TARGET="default"
+CHROME_SKIP_SUBMIT_REVIEW=false
+FIREFOX_EXTENSION_ID=
+FIREFOX_JWT_ISSUER=
+FIREFOX_JWT_SECRET=
+FIREFOX_CHANNEL="listed"

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -71,7 +71,7 @@ body:
     id: extension-version
     attributes:
       label: Extension version
-      placeholder: "Example: v1.2.0"
+      placeholder: "Example: vX.Y.Z"
 
   - type: dropdown
     id: mode

.github/workflows/ci.yml

@@ -2,9 +2,9 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, dev]
   pull_request:
-    branches: [main]
+    branches: [main, dev]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -74,8 +74,11 @@ jobs:
       - name: Run tests
         run: yarn test
 
-      - name: Build extension
+      - name: Build production extension
         run: yarn build
 
+      - name: Verify production inline helper scope
+        run: node scripts/verify-manifest-scope.mjs production chrome
+
       - name: Build website
         run: yarn workspace gmail-alias-toolkit-web build

.github/workflows/deploy-pages.yml

@@ -24,6 +24,8 @@ jobs:
   build:
     name: Build website
     runs-on: ubuntu-latest
+    env:
+      GITHUB_TOKEN: ${{ github.token }}
 
     steps:
       - name: Checkout

.github/workflows/pr-preview.yml

@@ -26,7 +26,6 @@ jobs:
     name: Build preview site
     if: github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
-
     steps:
       - name: Checkout production site
         uses: actions/checkout@v7
@@ -53,6 +52,8 @@ jobs:
 
       - name: Build production site
         working-directory: main-site
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
         run: |
           yarn install --immutable --mode=skip-build
           yarn exec wxt prepare

CONTRIBUTING.md

@@ -45,6 +45,19 @@ Run the Firefox development build:
 yarn dev:firefox
 ```
 
+To test the inline helper on additional local or remote sites, copy
+`.env.example` to `.env.development.local` and set comma- or whitespace-separated
+match patterns:
+
+```dotenv
+WXT_INLINE_DEV_MATCHES=http://localhost/*,http://127.0.0.1/*,*://*.w3schools.com/*
+```
+
+These patterns are added to the default development sites. Restart the
+development server after changing the value. Each entry must use Chrome's
+`scheme://host/path` match-pattern format; use `*://*.example.com/*` for a
+domain and all its subdomains.
+
 ## Build
 
 Build for Chrome:

entrypoints/content/email-helper.css

@@ -263,11 +263,36 @@ input.gmail-alias-input-preview::placeholder {
   color: #2563eb;
 }
 
+.gmail-alias-popup-user-guide {
+  position: relative;
+  display: flex;
+  width: 28px;
+  height: 28px;
+  box-sizing: border-box;
+  align-items: center;
+  justify-content: center;
+  padding: 0;
+  border: 1px solid #bfdbfe;
+  border-radius: 7px;
+  background: #eff6ff;
+  color: #2563eb;
+  cursor: pointer;
+  text-decoration: none;
+}
+
+.gmail-alias-popup-user-guide:hover,
+.gmail-alias-popup-user-guide:focus-visible {
+  border-color: #93c5fd;
+  background: #dbeafe;
+  color: #1d4ed8;
+  outline: none;
+}
 .gmail-alias-popup-disable-site {
   position: relative;
   display: flex;
   width: 28px;
   height: 28px;
+  box-sizing: border-box;
   align-items: center;
   justify-content: center;
   padding: 0;
@@ -284,6 +309,7 @@ input.gmail-alias-input-preview::placeholder {
   color: #b91c1c;
 }
 
+.gmail-alias-popup-user-guide::after,
 .gmail-alias-popup-disable-site::after {
   position: absolute;
   z-index: 2;
@@ -310,6 +336,8 @@ input.gmail-alias-input-preview::placeholder {
   white-space: normal;
 }
 
+.gmail-alias-popup-user-guide:hover::after,
+.gmail-alias-popup-user-guide:focus-visible::after,
 .gmail-alias-popup-disable-site:hover::after,
 .gmail-alias-popup-disable-site:focus-visible::after {
   opacity: 1;

entrypoints/content/index.ts

@@ -5,6 +5,7 @@ import {
   parseDisabledInlineSites,
 } from "src/utils/inlineSiteSettings";
 import { t } from "../../lib/i18n";
+import { USER_GUIDE_URL } from "src/utils/externalLinks";
 import {
   getPreviousAliasForWebsite,
   generateSuggestionsForWebsite,
@@ -39,9 +40,31 @@ interface EmailInputElement extends HTMLInputElement {
 
 let inlineDisabledForCurrentSite = false;
 
+/** Resolves a usable website URL inside regular and about:blank/srcdoc frames. */
+function currentPageUrl(): string {
+  const ancestorOrigins = window.location.ancestorOrigins
+    ? Array.from(window.location.ancestorOrigins)
+    : [];
+  const candidates = [
+    window.location.href,
+    document.referrer,
+    ...ancestorOrigins.reverse(),
+  ];
+
+  return (
+    candidates.find((candidate) => normalizeHostname(candidate) !== null) ||
+    window.location.href
+  );
+}
+
 /** Gets the normalized hostname for the current site. */
-const currentSiteHostname = () =>
-  normalizeSiteHostname(window.location.hostname);
+function currentSiteHostname(): string {
+  try {
+    return normalizeSiteHostname(new URL(currentPageUrl()).hostname);
+  } catch {
+    return normalizeSiteHostname(window.location.hostname);
+  }
+}
 
 /** Removes all inline helper icons and popups from the page. */
 function removeInlineHelpers() {
@@ -120,7 +143,8 @@ function resolveActiveEmail(accountData: StoredAccountData): string {
 
 /** Fetch suggestion data for current page. */
 async function fetchSuggestions(): Promise<SuggestionData | null> {
-  const normalized = normalizeHostname(window.location.href);
+  const pageUrl = currentPageUrl();
+  const normalized = normalizeHostname(pageUrl);
   if (!normalized) return null;
 
   let email: string | null = null;
@@ -136,8 +160,8 @@ async function fetchSuggestions(): Promise<SuggestionData | null> {
   }
 
   const [previousResult, suggestionsResult] = await Promise.allSettled([
-    getPreviousAliasForWebsite(email, window.location.href),
-    generateSuggestionsForWebsite(email, window.location.href),
+    getPreviousAliasForWebsite(email, pageUrl),
+    generateSuggestionsForWebsite(email, pageUrl),
   ]);
 
   return {
@@ -217,12 +241,20 @@ function createPopup(
     nextPage: escapeHtml(t("nextPage")),
     disableInlineForSite: escapeHtml(t("disableInlineForSite")),
     extensionName: escapeHtml(t("extensionName")),
+    userGuide: escapeHtml(t("userGuide")),
     reportReview: escapeHtml(t("reportReview")),
   };
   popup.innerHTML = `
     <div class="gmail-alias-popup-header" style="display: flex; justify-content: space-between; align-items: center; padding: 12px 16px; border-bottom: 1px solid #e5e7eb; background: #f9fafb; border-radius: 8px 8px 0 0;">
       <span class="gmail-alias-popup-title" title="${safeWebsite}" style="font-weight: 600; font-size: 13px; color: #374151;">${labels.extensionName}</span>
       <div class="gmail-alias-popup-header-actions" style="display: flex; align-items: center; gap: 6px;">
+        <a class="gmail-alias-popup-user-guide" href="${USER_GUIDE_URL}" target="_blank" rel="noopener noreferrer" data-tooltip="${labels.userGuide}" aria-label="${labels.userGuide}">
+          <svg viewBox="0 0 24 24" width="16" height="16" aria-hidden="true" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+            <circle cx="12" cy="12" r="10" />
+            <path d="M9.1 9a3 3 0 1 1 5.83 1c0 2-3 2-3 4" />
+            <path d="M12 18h.01" />
+          </svg>
+        </a>
         <button class="gmail-alias-popup-disable-site" type="button" data-tooltip="${labels.disableInlineForSite}" aria-label="${labels.disableInlineForSite}">
           <svg viewBox="0 0 24 24" width="16" height="16" aria-hidden="true" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
             <path d="M2 12s3.5-6 10-6 10 6 10 6-3.5 6-10 6S2 12 2 12Z" />
@@ -1580,13 +1612,10 @@ function observeDOM() {
   return observer;
 }
 
-const DEV_SITES = ["*://*.miro.com/*", "*://selfh.st/*", "*://gumroad.com/*"];
-
-// @ts-expect-error __DEV_MODE__ injected by Vite at build time
-const contentScriptMatches = __DEV_MODE__ ? DEV_SITES : ["<all_urls>"];
-
 export default defineContentScript({
-  matches: contentScriptMatches,
+  matches: ["<all_urls>"],
+  // Keep the helper in the top document so third-party embedded frames
+  // cannot receive alias suggestions or extension UI.
   async main() {
     const disabledSitesResult = await browser.storage.local.get(
       INLINE_DISABLED_SITES_KEY,