engineering/uncloseai.com
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
uncloseai.com/docs/tickets/001-extension-fails-to-load.md

2.5 KiB
Raw Blame History

001: Extension fails to load on certain pages

Reporter: cthegray Date: 2026-03-03 Priority: high Status: fixed Affects: Browser extension (Chrome/Safari)

Description

The uncloseai browser extension does not load at all on some pages. No UI appears, no sidebar, nothing.

Reproduction

Fails to load on:

  • reddit.com (any page)
  • slashdot.org
  • cnn.com (main/index page only)

Works on:

  • cnn.com article pages (individual stories)

Analysis

The pattern suggests Content Security Policy (CSP) or iframe sandboxing on these domains is blocking the extension from injecting. Reddit and Slashdot both use strict CSPs. CNN's main page likely has different CSP headers than article pages.

Possible causes:

  • CSP script-src blocking inline or extension scripts
  • CSP frame-src or frame-ancestors blocking extension iframe/overlay
  • Shadow DOM or aggressive DOM manipulation interfering with injection
  • Extension manifest permissions not covering these domains

Root Cause

The browser-toys extension injects <script src="https://uncloseai.com/uncloseai.js" type="module"> via DOM. Pages with strict CSP script-src directives block this because https://uncloseai.com is not in their allowlist.

Fix

Implemented three-tier injection strategy in uncloseai-browser-toys:

  1. Strategy 1 (CSP-safe): Content script messages the background service worker, which calls chrome.scripting.executeScript({ world: "MAIN", files: ["uncloseai-bundle.js"] }). This injects directly into the page world via the browser engine, bypassing all page CSP restrictions. Requires "scripting" permission (added to Chrome and Safari MV3 manifests).

  2. Strategy 2 (script tag): Fallback for MV2 browsers (Firefox). Creates a <script> tag with src pointing to the extension-origin bundle. Works on most pages since browsers whitelist extension origins in CSP.

  3. Strategy 3 (CDN bootstrap): Last resort if extension resources fail. Inlines a bootstrap that loads from uncloseai.com/uncloseai.js.

Files changed in browser-toys:

  • shared/content.js: Rewrote injection to try background message first, then script tag, then CDN
  • shared/background.js: Added onMessage listener for { action: "inject" } using chrome.scripting.executeScript
  • extensions/chrome/manifest.json: Added "scripting" permission
  • extensions/safari/manifest.json: Added "scripting" permission
  • extensions/firefox/manifest.json: No changes needed (MV2, uses Strategy 2)