# 001: Extension fails to load on certain pages

**Reporter:** cthegray
**Date:** 2026-03-03
**Priority:** high
**Status:** open
**Affects:** Browser extension (Chrome/Safari)

## Description

The uncloseai browser extension does not load at all on some pages. No UI appears, no sidebar, nothing.

## Reproduction

**Fails to load on:**
- reddit.com (any page)
- slashdot.org
- cnn.com (main/index page only)

**Works on:**
- cnn.com article pages (individual stories)

## Analysis

The pattern suggests Content Security Policy (CSP) or iframe sandboxing on these domains is blocking the extension from injecting. Reddit and Slashdot both use strict CSPs. CNN's main page likely has different CSP headers than article pages.

Possible causes:
- CSP `script-src` blocking inline or extension scripts
- CSP `frame-src` or `frame-ancestors` blocking extension iframe/overlay
- Shadow DOM or aggressive DOM manipulation interfering with injection
- Extension manifest permissions not covering these domains

## Root Cause

The browser-toys extension injects `<script src="https://uncloseai.com/uncloseai.js" type="module">` via DOM. Pages with strict CSP `script-src` directives block this because `https://uncloseai.com` is not in their allowlist.

## Fix

In the `uncloseai-browser-toys` repo, switch the content script from DOM script injection to `chrome.scripting.executeScript()` with the bundled IIFE (`uncloseai-bundle.js`). Extensions executing their own bundled code bypass page CSP entirely.

The bundle is ready: `make bundle-extension` produces `public/uncloseai-bundle.js` (1.6MB IIFE, CSP-safe, no ES modules, no CDN imports).

## Notes

Fix lives in the browser-toys repo, not this one. The bundle and architecture are ready here.
