Repository navigation
feat(extension): onboarding consent screen for the opt-in - #1605
Merged
Merged
Conversation
On a first install the extension opens a short consent page (vi, en, cs): what the lookup sends, what the opt-in would add (the same field list as the side panel), that nothing more is sent until the user says yes, and that the side panel can change it. "No" has the focus and the primary style; closing the page keeps the default, off. The choice goes through RATE_UPDATE_SETTINGS to the same setting as the side panel toggle, which now follows changes made elsewhere. The sender guard accepts a tab sender only when it is this extension's consent page URL, exactly; content scripts stay refused. Updates and reloads do not open the page. Refs #1603, #1175 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- isOnboardingSender accepts the exact consent page URL and lets it set the opt-in alone; isPrivilegedExtensionSender refuses tab senders again. - onInstalled writes each missing default before opening the page, so a quick choice is never overwritten; a stored choice is kept. - The page status follows the stored choice. Refs #1603 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- The consent page has its own opt-in text (onboardingOptInBody): the same fields as the side panel, tested, plus the server re-check and "no account, name, email or cookies". The lookup line lists every field lookup sends. - "Off by default" and how to reach the side panel toggle replace the vague line; vi, en and cs say the same. - Keyboard focus stays on the clicked button, the status is announced again on a repeat, and aria-pressed marks the stored choice. - The privacy policy and CHROMEWEBSTORE.md name the consent page; RELEASE.md has a test step and changelog line for it. Refs #1603 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
If your organization's extra usage balance is empty, an organization admin can add extra usage credits at claude.ai/admin-settings/usage. If its monthly spend limit was reached, an admin can raise it on the same page. If neither applies, contact Anthropic support.
Once extra usage is available, someone with write access to this repository can comment @claude review on this pull request to trigger a review.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 26 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
![dos[bot]](https://avatars.githubusercontent.com/in/4711427?s=60&v=4){kind=small}
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1603
Refs #1175
JOY decided on 2026-11-04 ("Cả hai, mặc định tắt"): ask for consent at install and keep the side-panel toggle. The default is off. This completes M1 of
Docs/Proposals/2026-10-28-extension-data-source.md, together with #1602.What is sent, the ingest API and the default are unchanged. Nothing is published.
What changes
src/onboarding/): it opens once, ononInstalledwith reasoninstall, after the defaults are stored. Updates and reloads do not open it. The copy is short and comes in vi, en and cs:aria-pressedmarks the stored choice. Focus stays on the clicked button.RATE_UPDATE_SETTINGS, which writes the samecrowdContributeOptInthat the side-panel toggle uses. The toggle now followsstorage.onChanged.isOnboardingSenderaccepts only this extension's exact consent page URL. A query, a hash, another extension or a web page is refused, and an unknown runtime id fails closed.isPrivilegedExtensionSenderstill refuses every tab sender, so content scripts cannot change settings.web_accessible_resources, so no web page can frame or open the page.CHROMEWEBSTORE.mdname the consent page.RELEASE.mdadds a test step and a changelog line.Checks
pnpm test,tscandpnpm buildpass inapps/extension.Review
Two fresh-context Claude reviews were run on 908152f.
MessageSender.urlandtab, thattabs.createneeds notabspermission, and that the default stays off on every path.Neither review found anything blocking. Fixed in e6253de and 765c92d:
Codex not run.
🤖 Generated with Claude Code
📌 TL;DR
This PR introduces a one-time onboarding consent page that appears on first extension install, allowing users to opt-in to crowd-sourced product data collection. It updates the build pipeline, security guards, and localization files to support this new flow while ensuring the opt-in remains off by default and is only enabled via explicit user action.
🎯 Type of Change
🔍 Changes Walkthrough
apps/extension/CHROMEWEBSTORE.mdapps/extension/RELEASE.mdapps/extension/scripts/build.mjsonboardingdirectory, bundle theonboarding.tsentry point, and copyonboarding.htmlto the dist folder.apps/extension/src/_locales/*/messages.jsononboardingTitle,onboardingLookup,onboardingQuestion, etc.) for the consent page in Czech, English, and Vietnamese.apps/extension/src/background/service-worker.tsonInstalledlistener to open the consent page on first install. UpdatedRATE_UPDATE_SETTINGShandler to accept messages from the onboarding page (restricted to opt-in only).apps/extension/src/onboarding/onboarding.htmlapps/extension/src/onboarding/onboarding.tsapps/extension/src/security-guards.tsONBOARDING_PAGE_PATHconstant andisOnboardingSenderfunction to strictly validate messages from the consent page. AdjustedisPrivilegedExtensionSenderto exclude tab-based senders.apps/extension/src/sidepanel/sidepanel.tschrome.storage.onChangedlistener to sync the side panel's opt-in checkbox with the setting if it is changed via the onboarding page.apps/extension/src/test-extension-pipeline.tsisOnboardingSender(validating URL and sender ID) and verified that the consent page text includes all required field labels.apps/web/locales/*.json📊 Architectural Flow
sequenceDiagram participant User participant Chrome participant SW as Service Worker participant OB as Onboarding Page participant SP as Side Panel participant Storage as chrome.storage.local Note over User, Chrome: First Install User->>Chrome: Install Extension Chrome->>SW: onInstalled (reason: 'install') SW->>Storage: Set defaults (optIn: false) SW->>Chrome: Open Tab (onboarding.html) Chrome->>OB: Load Page OB->>User: Display Consent (Default: No) alt User clicks "Yes" User->>OB: Click "Yes" OB->>SW: RATE_UPDATE_SETTINGS (optIn: true) SW->>OB: Validate Sender (isOnboardingSender) SW->>Storage: Set optIn: true Storage-->>OB: onChanged Event OB->>User: Show "Saved: Contributing" Storage-->>SP: onChanged Event SP->>SP: Update Checkbox to Checked else User clicks "No" or Closes User->>OB: Click "No" / Close Tab Note over OB,Storage: Opt-in remains false (default) end