@rune-kit/rune 2.10.0 → 2.12.0

package/extensions/chrome-ext/PACK.md

@@ -1,93 +1,93 @@
----
-name: "@rune/chrome-ext"
-description: Chrome extension development patterns — Manifest V3 scaffolding, service worker lifecycle, message passing, storage patterns, Chrome Web Store compliance, and built-in AI integration.
-metadata:
-  author: runedev
-  version: "0.1.0"
-  layer: L4
-  price: "free"
-  target: Chrome extension developers
-  format: split
----
-
-# @rune/chrome-ext
-
-## Purpose
-
-Chrome extension development has a steep cliff of Manifest V3 gotchas that no other AI coding pack addresses. Service workers terminate silently after 30 seconds of idle, taking all JS-variable state with them. Fifty-eight percent of Chrome Web Store rejections are preventable compliance errors. The new Chrome AI APIs (Gemini Nano, Chrome 138+) require hardware checks, graceful fallbacks, and port-based streaming — none of which are obvious from the docs. This pack groups six tightly-coupled concerns — MV3 scaffolding, message passing, storage, CWS preflight, store listing, and built-in AI — because a gap in any single layer produces a broken, rejected, or battery-draining extension. Activates automatically when `manifest.json` with `manifest_version: 3` or `chrome.*` API usage is detected.
-
-## Triggers
-
-- Auto-trigger: when `manifest.json` containing `"manifest_version": 3` is found in project root or `src/`
-- Auto-trigger: when files matching `**/background.ts`, `**/service-worker.ts`, `**/content.ts`, `**/popup.ts` exist alongside a `manifest.json`
-- Auto-trigger: when `chrome.*` API calls are found in project source files
-- `/rune chrome-ext` — manual invocation
-- Called by `cook` (L1) when Chrome extension project context is detected
-- Called by `scaffold` (L1) when user requests a new browser extension project
-
-## Skills Included
-
-| Skill | Model | Description |
-|-------|-------|-------------|
-| [mv3-scaffold](skills/mv3-scaffold.md) | sonnet | Manifest V3 project scaffolding — detect extension type, generate minimal-permission manifest, scaffold service worker with correct lifecycle patterns, scaffold content script, and generate build config. |
-| [ext-messaging](skills/ext-messaging.md) | sonnet | Typed message passing between popup, service worker, and content script — discriminated union message types, one-shot sendMessage, long-lived port connections for streaming, and Chrome 146+ error handling. |
-| [ext-storage](skills/ext-storage.md) | sonnet | Typed Chrome storage patterns — choose the right storage tier, define schema, implement typed helpers, handle schema migrations, and monitor quota. |
-| [cws-preflight](skills/cws-preflight.md) | sonnet | Chrome Web Store compliance audit — scan for over-permissioning, remote code execution, CSP violations, missing assets, and generate permission justification text. |
-| [cws-publish](skills/cws-publish.md) | sonnet | Chrome Web Store listing preparation and submission guide — store listing copy, screenshot descriptions, permission justifications, visibility settings, and timeline expectations. |
-| [ext-ai-integration](skills/ext-ai-integration.md) | sonnet | Chrome built-in AI and external API integration — detect AI type, check hardware requirements, implement Gemini Nano with graceful fallback, wire streaming responses via ports, handle rate limits, and test offline behavior. |
-
-## Tech Stack Support
-
-| Build Tool | Plugin | Hot Reload | Notes |
-|------------|--------|------------|-------|
-| Vite 5 | @crxjs/vite-plugin | Yes | Best DX — recommended for MV3 |
-| Webpack 5 | chrome-extension-webpack | Partial | Mature, more config overhead |
-| Parcel 2 | @parcel/config-webextension | Yes | Zero-config option |
-| Vanilla tsc | Manual copy scripts | No | Fine for simple extensions |
-
-| API | Min Chrome Version | Notes |
-|-----|-------------------|-------|
-| chrome.sidePanel | 114 | Sidebar panel (replaces popup for persistent UI) |
-| chrome.aiLanguageModel | 138 | Gemini Nano — built-in LLM |
-| chrome.aiSummarizer | 138 | Specialized summarization API |
-| chrome.offscreen | 109 | Background DOM/audio access workaround |
-| chrome.storage.session | 102 | Session storage surviving SW termination |
-
-## Connections
-
-```
-Calls → sentinel (L2): security audit on permissions, CSP, and storage patterns
-Calls → verification (L3): validate TypeScript types, run extension build
-Calls → git (L3): semantic commit after scaffold or publish prep
-Called By ← cook (L1): when Chrome extension project context detected
-Called By ← scaffold (L1): when user requests new browser extension project
-Called By ← launch (L1): pre-flight check before CWS submission
-Called By ← preflight (L2): runs cws-preflight as part of broader pre-deploy audit
-```
-
-## Sharp Edges
-
-| Failure Mode | Severity | Mitigation |
-|---|---|---|
-| Event listener registered inside `addEventListener('load', ...)` or async IIFE — silently ignored after SW termination | CRITICAL | Grep for `onMessage.addListener` not at module top level; scaffold always generates top-level listeners |
-| `setTimeout` keepalive hack breaks on Chrome 119+ — Chrome patched the timeout extension trick | HIGH | Use `chrome.alarms` for periodic work; use `chrome.storage.session` for state; never rely on SW staying alive |
-| `sendMessage` returns `undefined` when no listener responds — mistaken for success | HIGH | Check `chrome.runtime.lastError` in callback; use typed response interface that includes `error?: string` |
-| Streaming AI returns cumulative text (not delta chunks) — UI duplicates content | HIGH | Slice previous from current: `const delta = chunk.slice(prev.length); prev = chunk` |
-| `chrome.tabs.sendMessage` throws when content script not yet injected or tab is restricted | HIGH | Wrap in try/catch; check `sender.tab` exists; use `executeScript` to inject first if needed |
-| Extension passes local testing but fails CWS review for `eval()` in bundled node_modules | CRITICAL | Run `grep -r "eval(" node_modules/` before submission; replace or patch offending dependency |
-
-## Done When
-
-- `manifest.json` has no declared permissions absent from source code (verified by Grep)
-- Service worker registers all listeners synchronously at module top level — no listener inside async function
-- `chrome.storage` is used for all state — no JS variables relied upon to survive termination
-- No `eval()`, `Function()`, remote `<script>` tags, or external `import()` in any source or bundled file
-- `cws-preflight` report shows no FAIL items and WARN items are reviewed
-- `chrome.aiLanguageModel.capabilities()` is checked before use and graceful fallback is implemented
-- Streaming AI uses port-based messaging and correctly extracts deltas from cumulative chunks
-- Store listing copy is under character limits, permission justifications are written in plain English
-- Extension loads in Chrome via `chrome://extensions → Load unpacked` without errors
-
-## Cost Profile
-
-~1,500–3,000 tokens per skill activation. `haiku` for file scans (Grep, Glob, manifest reading); `sonnet` for scaffold generation, storage schema, and message type definitions; `sonnet` for cws-preflight audit and store listing copy; `sonnet` for AI integration wiring. Full pack activation (all 6 skills) runs ~12,000–18,000 tokens end-to-end. `cws-preflight` is the heaviest single skill (~3,000 tokens) due to multi-pass scanning.
+---
+name: "@rune/chrome-ext"
+description: Chrome extension development patterns — Manifest V3 scaffolding, service worker lifecycle, message passing, storage patterns, Chrome Web Store compliance, and built-in AI integration.
+metadata:
+  author: runedev
+  version: "0.1.0"
+  layer: L4
+  price: "free"
+  target: Chrome extension developers
+  format: split
+---
+
+# @rune/chrome-ext
+
+## Purpose
+
+Chrome extension development has a steep cliff of Manifest V3 gotchas that no other AI coding pack addresses. Service workers terminate silently after 30 seconds of idle, taking all JS-variable state with them. Fifty-eight percent of Chrome Web Store rejections are preventable compliance errors. The new Chrome AI APIs (Gemini Nano, Chrome 138+) require hardware checks, graceful fallbacks, and port-based streaming — none of which are obvious from the docs. This pack groups six tightly-coupled concerns — MV3 scaffolding, message passing, storage, CWS preflight, store listing, and built-in AI — because a gap in any single layer produces a broken, rejected, or battery-draining extension. Activates automatically when `manifest.json` with `manifest_version: 3` or `chrome.*` API usage is detected.
+
+## Triggers
+
+- Auto-trigger: when `manifest.json` containing `"manifest_version": 3` is found in project root or `src/`
+- Auto-trigger: when files matching `**/background.ts`, `**/service-worker.ts`, `**/content.ts`, `**/popup.ts` exist alongside a `manifest.json`
+- Auto-trigger: when `chrome.*` API calls are found in project source files
+- `/rune chrome-ext` — manual invocation
+- Called by `cook` (L1) when Chrome extension project context is detected
+- Called by `scaffold` (L1) when user requests a new browser extension project
+
+## Skills Included
+
+| Skill | Model | Description |
+|-------|-------|-------------|
+| [mv3-scaffold](skills/mv3-scaffold.md) | sonnet | Manifest V3 project scaffolding — detect extension type, generate minimal-permission manifest, scaffold service worker with correct lifecycle patterns, scaffold content script, and generate build config. |
+| [ext-messaging](skills/ext-messaging.md) | sonnet | Typed message passing between popup, service worker, and content script — discriminated union message types, one-shot sendMessage, long-lived port connections for streaming, and Chrome 146+ error handling. |
+| [ext-storage](skills/ext-storage.md) | sonnet | Typed Chrome storage patterns — choose the right storage tier, define schema, implement typed helpers, handle schema migrations, and monitor quota. |
+| [cws-preflight](skills/cws-preflight.md) | sonnet | Chrome Web Store compliance audit — scan for over-permissioning, remote code execution, CSP violations, missing assets, and generate permission justification text. |
+| [cws-publish](skills/cws-publish.md) | sonnet | Chrome Web Store listing preparation and submission guide — store listing copy, screenshot descriptions, permission justifications, visibility settings, and timeline expectations. |
+| [ext-ai-integration](skills/ext-ai-integration.md) | sonnet | Chrome built-in AI and external API integration — detect AI type, check hardware requirements, implement Gemini Nano with graceful fallback, wire streaming responses via ports, handle rate limits, and test offline behavior. |
+
+## Tech Stack Support
+
+| Build Tool | Plugin | Hot Reload | Notes |
+|------------|--------|------------|-------|
+| Vite 5 | @crxjs/vite-plugin | Yes | Best DX — recommended for MV3 |
+| Webpack 5 | chrome-extension-webpack | Partial | Mature, more config overhead |
+| Parcel 2 | @parcel/config-webextension | Yes | Zero-config option |
+| Vanilla tsc | Manual copy scripts | No | Fine for simple extensions |
+
+| API | Min Chrome Version | Notes |
+|-----|-------------------|-------|
+| chrome.sidePanel | 114 | Sidebar panel (replaces popup for persistent UI) |
+| chrome.aiLanguageModel | 138 | Gemini Nano — built-in LLM |
+| chrome.aiSummarizer | 138 | Specialized summarization API |
+| chrome.offscreen | 109 | Background DOM/audio access workaround |
+| chrome.storage.session | 102 | Session storage surviving SW termination |
+
+## Connections
+
+```
+Calls → sentinel (L2): security audit on permissions, CSP, and storage patterns
+Calls → verification (L3): validate TypeScript types, run extension build
+Calls → git (L3): semantic commit after scaffold or publish prep
+Called By ← cook (L1): when Chrome extension project context detected
+Called By ← scaffold (L1): when user requests new browser extension project
+Called By ← launch (L1): pre-flight check before CWS submission
+Called By ← preflight (L2): runs cws-preflight as part of broader pre-deploy audit
+```
+
+## Sharp Edges
+
+| Failure Mode | Severity | Mitigation |
+|---|---|---|
+| Event listener registered inside `addEventListener('load', ...)` or async IIFE — silently ignored after SW termination | CRITICAL | Grep for `onMessage.addListener` not at module top level; scaffold always generates top-level listeners |
+| `setTimeout` keepalive hack breaks on Chrome 119+ — Chrome patched the timeout extension trick | HIGH | Use `chrome.alarms` for periodic work; use `chrome.storage.session` for state; never rely on SW staying alive |
+| `sendMessage` returns `undefined` when no listener responds — mistaken for success | HIGH | Check `chrome.runtime.lastError` in callback; use typed response interface that includes `error?: string` |
+| Streaming AI returns cumulative text (not delta chunks) — UI duplicates content | HIGH | Slice previous from current: `const delta = chunk.slice(prev.length); prev = chunk` |
+| `chrome.tabs.sendMessage` throws when content script not yet injected or tab is restricted | HIGH | Wrap in try/catch; check `sender.tab` exists; use `executeScript` to inject first if needed |
+| Extension passes local testing but fails CWS review for `eval()` in bundled node_modules | CRITICAL | Run `grep -r "eval(" node_modules/` before submission; replace or patch offending dependency |
+
+## Done When
+
+- `manifest.json` has no declared permissions absent from source code (verified by Grep)
+- Service worker registers all listeners synchronously at module top level — no listener inside async function
+- `chrome.storage` is used for all state — no JS variables relied upon to survive termination
+- No `eval()`, `Function()`, remote `<script>` tags, or external `import()` in any source or bundled file
+- `cws-preflight` report shows no FAIL items and WARN items are reviewed
+- `chrome.aiLanguageModel.capabilities()` is checked before use and graceful fallback is implemented
+- Streaming AI uses port-based messaging and correctly extracts deltas from cumulative chunks
+- Store listing copy is under character limits, permission justifications are written in plain English
+- Extension loads in Chrome via `chrome://extensions → Load unpacked` without errors
+
+## Cost Profile
+
+~1,500–3,000 tokens per skill activation. `haiku` for file scans (Grep, Glob, manifest reading); `sonnet` for scaffold generation, storage schema, and message type definitions; `sonnet` for cws-preflight audit and store listing copy; `sonnet` for AI integration wiring. Full pack activation (all 6 skills) runs ~12,000–18,000 tokens end-to-end. `cws-preflight` is the heaviest single skill (~3,000 tokens) due to multi-pass scanning.

package/extensions/chrome-ext/skills/cws-preflight.md

@@ -1,143 +1,143 @@
----
-name: "cws-preflight"
-pack: "@rune/chrome-ext"
-description: "Chrome Web Store compliance audit — scan for over-permissioning, remote code execution, CSP violations, missing assets, and generate permission justification text."
-model: sonnet
-tools: [Read, Edit, Write, Grep, Glob, Bash]
----
-
-# cws-preflight
-
-Chrome Web Store compliance audit — scan for over-permissioning, remote code execution, CSP violations, missing assets, and generate permission justification text. The highest-value skill in this pack: 58% of CWS rejections are preventable compliance errors caught here before submission.
-
-**Top 5 CWS rejection reasons (2024 data):**
-1. Over-permissioning — requesting permissions not demonstrably used in submitted code
-2. Remote code execution — `eval()`, `Function()` constructor, CDN `<script>` tags, `import()` from external URLs
-3. Misleading description — functionality not matching store listing claims
-4. Missing or inaccessible privacy policy — required for any extension that handles user data
-5. Branding violations — trademarked names (Google, Chrome, YouTube) in extension name or icon
-
-**Triggers for manual review (3+ weeks instead of 24-72h):**
-- Broad `host_permissions` with `<all_urls>` or `https://*/*`
-- Sensitive permission combinations: `tabs` + `history` + `cookies`
-- New developer account submitting extension with sensitive permissions
-- Relaxed `content_security_policy` (`unsafe-eval`, `unsafe-inline`)
-- First submission of a new extension (always manual)
-
-#### Workflow
-
-**Step 1 — Lint manifest for over-permissioning**
-Use `Read` on `manifest.json`. For each declared permission, verify it is actually used in source code with `Grep`. Flag any permission declared but not found in `*.ts` / `*.js` source files. Severity: HIGH.
-
-Common over-permissioning patterns to flag:
-- `"tabs"` declared when only `activeTab` is needed (activeTab is granted on user click, requires no declaration)
-- `"history"` declared without `chrome.history.*` usage
-- `"bookmarks"` declared without `chrome.bookmarks.*` usage
-- `"<all_urls>"` in `host_permissions` when specific domains suffice
-- `"cookies"` declared without `chrome.cookies.*` usage
-
-**Step 2 — Scan for remote code execution**
-Use `Grep` to find patterns that trigger automatic CWS rejection:
-
-```
-pattern: "eval\s*\(" → remote code execution
-pattern: "new Function\s*\(" → remote code execution
-pattern: "<script[^>]+src=['\"]https?://" → remote script loading in HTML files
-pattern: "import\s*\(['\"]https?://" → dynamic import from external URL
-```
-
-Flag each result as CRITICAL — these cause automatic rejection with no appeal path.
-
-**Step 3 — Validate Content Security Policy**
-Read the `content_security_policy.extension_pages` value from `manifest.json`. Flag any of:
-- `'unsafe-eval'` in `script-src` — allows eval, triggers rejection
-- `'unsafe-inline'` in `script-src` — allows inline scripts, triggers rejection
-- External domains in `script-src` (anything not `'self'`) — remote code execution risk
-- Missing CSP entirely — defaults to `script-src 'self'` which is fine, but document it
-
-**Step 4 — Verify privacy policy**
-Check if the extension collects user data (network requests to external servers, `chrome.storage` usage, content script reading page content). If yes:
-- Privacy policy URL must be set in CWS Developer Dashboard
-- Privacy policy must be publicly accessible (verify URL is live)
-- Generate a minimal privacy policy template if none exists
-
-**Step 5 — Check required assets**
-Verify the following exist at declared paths in `manifest.json`:
-- Icon at 128×128px (required for store listing)
-- Screenshots: at least 1, dimensions 1280×800 or 640×400 (PNG or JPEG)
-- Promotional tile: 440×280px (optional but strongly recommended)
-- All declared icons (16, 32, 48, 128px) present at referenced paths
-
-Use `Glob` to verify file existence. Use `Bash` to check image dimensions with `file` or `identify` if ImageMagick is available.
-
-**Step 6 — Generate permission justification text**
-For each declared permission, generate CWS-ready justification text. The CWS dashboard requires one justification per permission. Justifications must be specific — "We need this to work" is rejected.
-
-**Step 7 — Produce preflight report**
-Write `.rune/chrome-ext/preflight-report.md` with:
-- PASS / WARN / FAIL per check
-- Specific file + line for each issue
-- Fix instructions
-- Estimated review timeline (fast-track vs manual review triggers)
-- Submission checklist
-
-#### Example
-
-```markdown
-<!-- .rune/chrome-ext/preflight-report.md (generated by cws-preflight) -->
-
-# CWS Preflight Report — Page Summarizer v1.0.0
-Generated: 2026-03-12
-
-## Summary
-| Check | Status | Issues |
-|-------|--------|--------|
-| Permissions audit | ⚠️ WARN | 1 over-permission |
-| Remote code execution | ✅ PASS | None found |
-| Content Security Policy | ✅ PASS | Correct default |
-| Privacy policy | ⚠️ WARN | URL not set in manifest |
-| Required assets | ✅ PASS | All present |
-| Permission justifications | ✅ READY | Generated below |
-
-## Issues
-
-### WARN: Over-permission — `"tabs"` not required
-**File**: manifest.json line 7
-**Detail**: `"tabs"` permission is declared but no `chrome.tabs.*` API calls found in source.
-The extension uses `activeTab` (implicit on action click) — remove `"tabs"` from permissions array.
-**Fix**: Remove `"tabs"` from `"permissions"` array.
-
-### WARN: Privacy policy URL missing
-**Detail**: Extension reads page content via content script (content.ts:L12 — `document.body.innerText`).
-This constitutes user data handling and requires a privacy policy URL in the CWS Developer Dashboard.
-**Fix**: Add privacy policy URL at publish time. Template: `.rune/chrome-ext/privacy-policy-template.md`
-
-## Permission Justifications (paste into CWS dashboard)
-
-### activeTab
-"The extension reads the content of the current active tab when the user clicks the toolbar button
-to initiate a summarization. No data is collected without explicit user action."
-
-### storage
-"The extension stores user settings (AI preference, API key, summary length) locally to persist
-preferences between browser sessions. No data is synced externally."
-
-### sidePanel
-"The extension uses the Side Panel API to display AI-generated summaries in a persistent panel
-without obscuring the page content."
-
-## Estimated Review Timeline
-- No sensitive permissions detected
-- No broad host_permissions
-- Timeline: **24–72 hours** (standard review)
-- Recommendation: submit Tuesday–Thursday for fastest turnaround
-
-## Submission Checklist
-- [ ] Remove `"tabs"` from permissions array
-- [ ] Add privacy policy URL to CWS Developer Dashboard
-- [ ] Upload 1280×800 screenshot showing extension in use
-- [ ] Write store description (min 132 chars for detailed description)
-- [ ] Set category: Productivity
-- [ ] Set language: English
-- [ ] $5 one-time developer registration fee paid
-```
+---
+name: "cws-preflight"
+pack: "@rune/chrome-ext"
+description: "Chrome Web Store compliance audit — scan for over-permissioning, remote code execution, CSP violations, missing assets, and generate permission justification text."
+model: sonnet
+tools: [Read, Edit, Write, Grep, Glob, Bash]
+---
+
+# cws-preflight
+
+Chrome Web Store compliance audit — scan for over-permissioning, remote code execution, CSP violations, missing assets, and generate permission justification text. The highest-value skill in this pack: 58% of CWS rejections are preventable compliance errors caught here before submission.
+
+**Top 5 CWS rejection reasons (2024 data):**
+1. Over-permissioning — requesting permissions not demonstrably used in submitted code
+2. Remote code execution — `eval()`, `Function()` constructor, CDN `<script>` tags, `import()` from external URLs
+3. Misleading description — functionality not matching store listing claims
+4. Missing or inaccessible privacy policy — required for any extension that handles user data
+5. Branding violations — trademarked names (Google, Chrome, YouTube) in extension name or icon
+
+**Triggers for manual review (3+ weeks instead of 24-72h):**
+- Broad `host_permissions` with `<all_urls>` or `https://*/*`
+- Sensitive permission combinations: `tabs` + `history` + `cookies`
+- New developer account submitting extension with sensitive permissions
+- Relaxed `content_security_policy` (`unsafe-eval`, `unsafe-inline`)
+- First submission of a new extension (always manual)
+
+#### Workflow
+
+**Step 1 — Lint manifest for over-permissioning**
+Use `Read` on `manifest.json`. For each declared permission, verify it is actually used in source code with `Grep`. Flag any permission declared but not found in `*.ts` / `*.js` source files. Severity: HIGH.
+
+Common over-permissioning patterns to flag:
+- `"tabs"` declared when only `activeTab` is needed (activeTab is granted on user click, requires no declaration)
+- `"history"` declared without `chrome.history.*` usage
+- `"bookmarks"` declared without `chrome.bookmarks.*` usage
+- `"<all_urls>"` in `host_permissions` when specific domains suffice
+- `"cookies"` declared without `chrome.cookies.*` usage
+
+**Step 2 — Scan for remote code execution**
+Use `Grep` to find patterns that trigger automatic CWS rejection:
+
+```
+pattern: "eval\s*\(" → remote code execution
+pattern: "new Function\s*\(" → remote code execution
+pattern: "<script[^>]+src=['\"]https?://" → remote script loading in HTML files
+pattern: "import\s*\(['\"]https?://" → dynamic import from external URL
+```
+
+Flag each result as CRITICAL — these cause automatic rejection with no appeal path.
+
+**Step 3 — Validate Content Security Policy**
+Read the `content_security_policy.extension_pages` value from `manifest.json`. Flag any of:
+- `'unsafe-eval'` in `script-src` — allows eval, triggers rejection
+- `'unsafe-inline'` in `script-src` — allows inline scripts, triggers rejection
+- External domains in `script-src` (anything not `'self'`) — remote code execution risk
+- Missing CSP entirely — defaults to `script-src 'self'` which is fine, but document it
+
+**Step 4 — Verify privacy policy**
+Check if the extension collects user data (network requests to external servers, `chrome.storage` usage, content script reading page content). If yes:
+- Privacy policy URL must be set in CWS Developer Dashboard
+- Privacy policy must be publicly accessible (verify URL is live)
+- Generate a minimal privacy policy template if none exists
+
+**Step 5 — Check required assets**
+Verify the following exist at declared paths in `manifest.json`:
+- Icon at 128×128px (required for store listing)
+- Screenshots: at least 1, dimensions 1280×800 or 640×400 (PNG or JPEG)
+- Promotional tile: 440×280px (optional but strongly recommended)
+- All declared icons (16, 32, 48, 128px) present at referenced paths
+
+Use `Glob` to verify file existence. Use `Bash` to check image dimensions with `file` or `identify` if ImageMagick is available.
+
+**Step 6 — Generate permission justification text**
+For each declared permission, generate CWS-ready justification text. The CWS dashboard requires one justification per permission. Justifications must be specific — "We need this to work" is rejected.
+
+**Step 7 — Produce preflight report**
+Write `.rune/chrome-ext/preflight-report.md` with:
+- PASS / WARN / FAIL per check
+- Specific file + line for each issue
+- Fix instructions
+- Estimated review timeline (fast-track vs manual review triggers)
+- Submission checklist
+
+#### Example
+
+```markdown
+<!-- .rune/chrome-ext/preflight-report.md (generated by cws-preflight) -->
+
+# CWS Preflight Report — Page Summarizer v1.0.0
+Generated: 2026-03-12
+
+## Summary
+| Check | Status | Issues |
+|-------|--------|--------|
+| Permissions audit | ⚠️ WARN | 1 over-permission |
+| Remote code execution | ✅ PASS | None found |
+| Content Security Policy | ✅ PASS | Correct default |
+| Privacy policy | ⚠️ WARN | URL not set in manifest |
+| Required assets | ✅ PASS | All present |
+| Permission justifications | ✅ READY | Generated below |
+
+## Issues
+
+### WARN: Over-permission — `"tabs"` not required
+**File**: manifest.json line 7
+**Detail**: `"tabs"` permission is declared but no `chrome.tabs.*` API calls found in source.
+The extension uses `activeTab` (implicit on action click) — remove `"tabs"` from permissions array.
+**Fix**: Remove `"tabs"` from `"permissions"` array.
+
+### WARN: Privacy policy URL missing
+**Detail**: Extension reads page content via content script (content.ts:L12 — `document.body.innerText`).
+This constitutes user data handling and requires a privacy policy URL in the CWS Developer Dashboard.
+**Fix**: Add privacy policy URL at publish time. Template: `.rune/chrome-ext/privacy-policy-template.md`
+
+## Permission Justifications (paste into CWS dashboard)
+
+### activeTab
+"The extension reads the content of the current active tab when the user clicks the toolbar button
+to initiate a summarization. No data is collected without explicit user action."
+
+### storage
+"The extension stores user settings (AI preference, API key, summary length) locally to persist
+preferences between browser sessions. No data is synced externally."
+
+### sidePanel
+"The extension uses the Side Panel API to display AI-generated summaries in a persistent panel
+without obscuring the page content."
+
+## Estimated Review Timeline
+- No sensitive permissions detected
+- No broad host_permissions
+- Timeline: **24–72 hours** (standard review)
+- Recommendation: submit Tuesday–Thursday for fastest turnaround
+
+## Submission Checklist
+- [ ] Remove `"tabs"` from permissions array
+- [ ] Add privacy policy URL to CWS Developer Dashboard
+- [ ] Upload 1280×800 screenshot showing extension in use
+- [ ] Write store description (min 132 chars for detailed description)
+- [ ] Set category: Productivity
+- [ ] Set language: English
+- [ ] $5 one-time developer registration fee paid
+```