Conversation
…anifest) Deep audit of the service worker found 4 real fixes after triaging 13 raw findings (the agent's rate-limiter persistence concerns relied on incorrect assumptions about per-tab SW spawning and JS concurrency — a single SW is shared across all tabs of an extension and check() is atomic in single-threaded JS). #1 Dead chrome.storage.local self-healing path removed `_BG_YT_CLIENT_VERSION_DEFAULT` was a `let` hydrated from chrome.storage.local on every SW wake, but a grep across src/ shows nothing ever WRITES that key. The "refreshed by maintenance alarm" comment was aspirational — the alarm only sends version- check against GitHub. The runtime override never triggered. Replaced let + hydration block with a plain const + the actual manual-bump workflow note (synced via check-bg-sync.js). Also eliminates the fire-and-forget storage race that fired on every SW spin-up. #2 FETCH_URL routes through fetchWithRetry Was using raw fetch with no 4xx-no-retry contract. A transient YouTube/InnerTube 5xx propagated straight to the content script while GOOGLE_TRANSLATE_BATCH had retries — the same inconsistency the v3.5.8 fix was supposed to eliminate. #3 handleVersionCheck routes through fetchWithRetry Anonymous GitHub API quota is 60/h per IP; with users converging on residential ranges, 403s are common. Previously a single attempt silently dropped them. fetchWithRetry's 4xx fail-fast still avoids pointless retries on 403/404. #4 api.github.com added to manifest host_permissions SW fetch to undeclared origins works in MV3 but CWS reviewers flag it. Explicit declaration matches what the code does. Also: scripts/check-bg-sync.js updated to match the renamed constant (was looking for _BG_YT_CLIENT_VERSION_DEFAULT). Findings deliberately skipped, with reasons: - Rate-limiter persistence across SW termination (agent: "two tabs spawn fresh SWs, doubling rate"). False — one SW per extension, shared across all tabs. - Parallel acquire() polling races (agent: "many may pass check() in same microtask"). False — JS is single-threaded; check() is synchronous and atomic. - Sender-tab.url validation. host_permissions already constrains content_script injection to skilljar.com. - Origin/Referer header spoofing on InnerTube. Required for the endpoint to work at all; documented. 336/336 tests pass. Lint, format, selectors, dicts, sync, glossary, validate, build:firefox, build:bundle all green. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Deep audit of `src/background/background.js` (351 lines, the service worker — only partially reviewed in earlier rounds). Triaged 13 raw findings; 4 real bugs, the rest were over-broad or based on incorrect assumptions about MV3 SW lifecycle / JS concurrency.
Also updated `scripts/check-bg-sync.js` to match the renamed constant.
Skipped findings (with reasons)
The agent surfaced more concerns; verified they don't hold:
Verification (local)
Test plan
🤖 Generated with Claude Code