sourcemonkey 0.0.0-stage → 0.5.0

package/dist/extension/parse-sandbox.js

@@ -0,0 +1,175 @@
+"use strict";
+// Sandboxed compile-only parse check. Loaded by `parse-sandbox.html`,
+// which is declared under `sandbox.pages` in the manifest — the one
+// context in an MV3 extension allowed to declare `'unsafe-eval'`.
+//
+// See the comment in `parse-sandbox.html` for why the compile has to
+// happen in a sandbox at all, and why compiling untrusted source here
+// is safe.
+//
+// This file deliberately imports nothing. tsc would emit an ES module
+// for a file with imports, and a sandboxed page loads it as a classic
+// `<script src>`. The message shapes below are mirrored (not shared)
+// from `src/parse-check-protocol.ts`, which is the source of truth;
+// they are small and change together.
+// `new Function` compiles the body and returns; it never runs it. A
+// SyntaxError anywhere in the text is the answer we want.
+function checkOne(source) {
+    try {
+        // eslint-disable-next-line no-new-func
+        new Function(source);
+        return { status: 'ok' };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        // ONLY a SyntaxError means "this source is broken". Everything
+        // else means "we couldn't tell", and the difference matters more
+        // than it looks:
+        //
+        //   - A `RangeError: Maximum call stack size exceeded` on a
+        //     pathologically nested source is the parser running out of
+        //     budget HERE — inside a message handler inside a promise
+        //     chain — which is not the budget `chrome.userScripts` will
+        //     compile the real entry with. Reporting it as a syntax error
+        //     would disable a script V8 is perfectly willing to run.
+        //   - If the sandbox CSP ever stopped applying, `new Function`
+        //     would throw `EvalError` and every script in the profile
+        //     would be branded broken at once. That is the exact outcome
+        //     the design says cannot happen.
+        if (!(err instanceof SyntaxError))
+            return { status: 'unknown', message };
+        return { status: 'syntax-error', message, probes: locate(source) };
+    }
+}
+// ---------- Finding out WHERE ----------
+//
+// `new Function` answers "does this parse?" and nothing else: no line,
+// no column, not even a position in `err.stack`, which stops at
+// `at new Function (<anonymous>)`. V8 does report a position when a
+// classic `<script>` fails to parse — the window `error` event carries
+// `lineno` and `colno` — so once the verdict is in we compile the same
+// text a second way, purely to locate the error it already found.
+//
+// **Appending a `<script>` normally runs it.** What keeps this
+// compile-only is the sentinel below, not luck; see `PROBE_SENTINEL`.
+//
+// Two probes, because neither framing is faithful on its own:
+//
+//   - **wrapped** reproduces `new Function`'s semantics exactly — the
+//     text is a function body, so a top-level `return` is legal, as it
+//     is in the entry we actually inject. Its weakness is that a
+//     source with unbalanced braces swallows the wrapper's closing
+//     `}`, and the parse then runs on to a later, different error.
+//   - **raw** has no wrapper to swallow, so it places a stray or
+//     missing brace exactly — but it is a *Script*, where a top-level
+//     `return` is an error V8 would never have raised for real.
+//
+// The caller picks. See `selectParseLocation` in parse-location.ts.
+function locate(source) {
+    try {
+        return {
+            wrapped: runProbe(`${WRAPPER_HEAD}${source}${WRAPPER_TAIL}${PROBE_SENTINEL}`, 1),
+            raw: runProbe(`${source}${PROBE_SENTINEL}`, 0),
+        };
+    }
+    catch {
+        // Locating is a nicety; the verdict is the product. Never let a
+        // DOM failure here turn a usable `syntax-error` into a throw.
+        return undefined;
+    }
+}
+// An unmatched OPENER, appended to whatever we compile, so the probe
+// script can never parse — and therefore can never execute a single
+// statement, since a parse failure aborts the whole script before
+// evaluation begins.
+//
+// It has to be an opener. A closing `}` or `)` would be *closed by*
+// whatever the source left dangling: appending `}` to a source ending
+// in `if (1) {` produces a valid program, and it runs. An opener at
+// end of input has nothing after it to close it.
+//
+// The leading newline matters too — without it a source whose last
+// line is a `//` comment swallows the sentinel.
+//
+// V8 reports the FIRST error it hits, so a real error in the source is
+// still the one reported; the sentinel only speaks when the source had
+// nothing to say. A probe that comes back with NO error at all would
+// therefore mean the sentinel failed to do its job and the source ran —
+// so it reports no position, and `selectParseLocation` simply has one
+// fewer probe to choose from.
+const PROBE_SENTINEL = '\n(';
+const WRAPPER_HEAD = 'function __smParseProbe__() {\n';
+const WRAPPER_TAIL = '\n}';
+// Compile `text` as a classic script and report where it failed.
+// `lineOffset` is how many lines of our own framing precede the
+// source, so the caller gets source coordinates back.
+function runProbe(text, lineOffset) {
+    let hit;
+    const onError = (event) => {
+        hit = {
+            // `event.error.message` is the clean one; `event.message` has
+            // "Uncaught SyntaxError: " in front of it as well.
+            message: stripDomPrefix(event.error instanceof Error ? event.error.message : event.message),
+            line: event.lineno - lineOffset,
+            column: event.colno,
+        };
+        // Marks the error handled, which is what stops Chrome reporting it
+        // as an uncaught page error — and an uncaught error in an
+        // extension context is forwarded into chrome://extensions/?errors,
+        // making SourceMonkey look broken when it is working exactly as
+        // designed. Verified: without this the error surfaces, with it the
+        // console stays clean. See CLAUDE.md.
+        event.preventDefault();
+    };
+    window.addEventListener('error', onError);
+    const el = document.createElement('script');
+    el.textContent = text;
+    try {
+        // The parse — and the `error` event it fires — both happen
+        // synchronously inside this call, which is why `hit` is readable
+        // immediately after it and no async plumbing is needed.
+        document.body.append(el);
+    }
+    finally {
+        el.remove();
+        window.removeEventListener('error', onError);
+    }
+    return hit;
+}
+// Inserting the script means the SyntaxError arrives wrapped in the
+// DOM method that raised it: "Failed to execute 'append' on 'Element':
+// Unexpected token ';'". Strip it so the message we may end up showing
+// is about the user's code and not about our insertion trick. Matched
+// loosely rather than by exact string so a different insertion method
+// (or wording) degrades to a cosmetic prefix rather than a wrong
+// message — and `selectParseLocation` compares with `endsWith`, so an
+// unstripped prefix still matches.
+function stripDomPrefix(message) {
+    return message.replace(/^Failed to execute '[^']*' on '[^']*': /, '');
+}
+window.addEventListener('message', (event) => {
+    // Only our embedder may ask.
+    if (event.source !== window.parent)
+        return;
+    const data = event.data;
+    if (!data || data.type !== 'sm:parse-check')
+        return;
+    if (!Array.isArray(data.sources) || typeof data.id !== 'string')
+        return;
+    const verdicts = data.sources.map((s) => checkOne(typeof s === 'string' ? s : ''));
+    // Reply to the embedder only, and to nothing else. A sandboxed page
+    // has an opaque origin, so the target origin has to be '*' — which
+    // makes the `event.source` check the only thing standing between us
+    // and replying to an arbitrary window. Nothing can reach this page
+    // today (the manifest declares no `web_accessible_resources`, so no
+    // web page can frame or navigate to it), so this enforces the
+    // property rather than relying on it staying true.
+    window.parent.postMessage({ type: 'sm:parse-check-result', id: data.id, verdicts }, '*');
+});
+// Announce readiness. The embedder cannot detect it any other way: a
+// sandboxed frame is opaque-origin, so its `contentDocument` is always
+// null and `readyState` is unreadable from outside. Without this the
+// embedder's only signal is the iframe's `load` event, and a listener
+// attached even a moment late would miss it — leaving every request to
+// time out silently for the rest of the session.
+window.parent.postMessage({ type: 'sm:parse-sandbox-ready' }, '*');

package/dist/extension/popup-commands-open.js

@@ -0,0 +1,41 @@
+// Which scripts' menu command lists the person opened or closed in a
+// tab's popup, kept for the tab's lifetime: someone using one of a
+// script's commands is likely to come back for another, so a list they
+// opened stays open the next time the popup shows, across reloads and
+// navigations in the tab.
+//
+// One `popupopen:<tabId>` row per tab in `chrome.storage.session`
+// ({ [scriptId]: open }), which outlasts the worker going idle between
+// popups and clears with the browser. Only the worker writes it (the
+// popup asks, `POPUP_SET_COMMANDS_OPEN_MESSAGE`); background.ts's
+// `tabs.onRemoved` drops a closed tab's row.
+const KEY_PREFIX = 'popupopen:';
+function rowKey(tabId) {
+    return `${KEY_PREFIX}${tabId}`;
+}
+// Writes are chained, so two quick toggles in a row don't both read the
+// row before either writes it.
+let writes = Promise.resolve();
+async function readRow(tabId) {
+    const row = (await chrome.storage.session.get(rowKey(tabId)))[rowKey(tabId)];
+    return row && typeof row === 'object' ? row : {};
+}
+// After the writes already asked for, so a popup opened just after a
+// toggle sees it.
+export async function getCommandsOpen(tabId) {
+    await writes;
+    return readRow(tabId);
+}
+export function setCommandsOpen(tabId, scriptId, open) {
+    const write = writes.then(async () => {
+        const row = await readRow(tabId);
+        await chrome.storage.session.set({ [rowKey(tabId)]: { ...row, [scriptId]: open } });
+    });
+    writes = write.catch(() => undefined);
+    return write;
+}
+export function dropCommandsOpen(tabId) {
+    const write = writes.then(() => chrome.storage.session.remove(rowKey(tabId)));
+    writes = write.catch(() => undefined);
+    return write;
+}

package/dist/extension/popup-view.js

@@ -0,0 +1,387 @@
+// Pure model behind the toolbar popup ("Active scripts", popup.html):
+// which scripts it lists for a tab, under which collection, with what
+// status, tooltip, and reload banner. Built in the service worker
+// (`popupViewForTab` in background.ts), which owns the inputs, and
+// rendered as-is by src/extension/popup.ts. Kept free of chrome.* so the
+// rules can be unit tested. Design: docs/status-popup.md.
+import { RUN_SCRIPT_LABEL } from '../userscript-header.js';
+import { compareScriptNames } from '../script-display.js';
+import { comparePreferred, preferredCopy } from './copy-preference.js';
+import { isSettling, runsHere, skippedOnDocument } from './tab-status.js';
+export const POPUP_STATUS_LABELS = {
+    OK: 'Running',
+    ERROR: 'Error',
+    REJECTED: 'Rejected',
+    RELOAD: 'Updated',
+    MISSING: 'Missing',
+    UNEXPECTED: 'Unexpected',
+    NOT_LOADED: 'Not loaded',
+    UNTRACKED: 'Reload',
+    PENDING: 'Reload to run',
+    STILL_RUNNING: 'Still running',
+    WARNING: 'Warning',
+    INVALID: 'Invalid',
+    NOT_RUN: 'Not run',
+};
+// Every pill's tooltip ends with what a click does: a Reload to run or
+// Reload pill reloads the page, as the banner's Reload does; the rest open
+// the Log.
+export const POPUP_PILL_CLICK_HINT = 'Click to open the script log.';
+export const POPUP_PILL_RELOAD_HINT = 'Click to reload the page.';
+// The page menu's item, and the icon's right-click item doing the same.
+export const RELOAD_NO_SCRIPTS_LABEL = 'Reload page with no userscripts';
+export const COLLECTION_OFF_LABEL = 'Collection off';
+export const COLLECTION_OFF_TOOLTIP = 'This collection is disabled, so none of its scripts run';
+export const POPUP_NO_SCRIPTS = 'No scripts match this page.';
+export const POPUP_NOT_INJECTABLE = 'SourceMonkey can\'t run scripts on this page.';
+// The group for scripts removed since the page loaded that still run in
+// it: no stored row or collection is left to list them under.
+export const REMOVED_GROUP_ID = 'sm:removed';
+export const REMOVED_GROUP_NAME = 'Removed scripts';
+export { RUN_SCRIPT_LABEL };
+// ---- Messages between the popup page and the service worker ----
+// Popup → worker: the view for a tab. Answered with a `PopupView`.
+export const POPUP_VIEW_MESSAGE = 'sm:popup-view';
+// Popup → worker: reload the tab, with some of its scripts kept out.
+export const POPUP_RELOAD_MESSAGE = 'sm:popup-reload';
+// Popup → worker: run one of a script's menu commands.
+export const POPUP_COMMAND_MESSAGE = 'sm:popup-command';
+// Popup → worker: run a manual script now ("Run this script").
+export const POPUP_RUN_SCRIPT_MESSAGE = 'sm:popup-run-script';
+// Popup → worker: tick or untick a script's or a collection's box. The
+// worker writes it, so the popup needn't load the script store.
+export const POPUP_SET_ENABLED_MESSAGE = 'sm:popup-set-enabled';
+// Popup → worker: a script's command list was opened or closed, which
+// lasts for the tab's lifetime.
+export const POPUP_SET_COMMANDS_OPEN_MESSAGE = 'sm:popup-set-commands-open';
+// Worker → popup: something the view for `tabId` shows changed
+// (badge state, menu commands). The popup asks for a fresh view. Sent
+// over the port an open popup holds, named this prefix + its tab id.
+export const POPUP_CHANGED_MESSAGE = 'sm:popup-changed';
+// Worker → popup, over the same port: close. The click that opened it
+// turned out to be the first of a double click.
+export const POPUP_CLOSE_MESSAGE = 'sm:popup-close';
+// Popup → worker, over the port: closing after an action (a link, a
+// menu command). Its close is then no double click's second click.
+export const POPUP_CLOSING_MESSAGE = 'sm:popup-closing';
+export const POPUP_PORT_PREFIX = 'sm-popup:';
+const DEFAULT_TOOLTIPS = {
+    OK: 'Running on this page',
+    ERROR: 'The script reported an error on this page',
+    REJECTED: 'Chrome refused to register this script, so it can\'t run',
+    RELOAD: 'The script changed since this page loaded. Reload to run the new version.',
+    MISSING: 'Expected on this page, but it hasn\'t started',
+    UNEXPECTED: 'Started on this page, but its rules don\'t match this page',
+    NOT_LOADED: 'Not run on this page load',
+    UNTRACKED: 'This page loaded before SourceMonkey started, so its status is unknown. Reload to restart.',
+    PENDING: 'Enabled since this page loaded. Reload to run it.',
+    STILL_RUNNING: 'Disabled since this page loaded. It keeps running until a reload.',
+    WARNING: 'Running on this page, with warnings',
+    INVALID: 'The script failed to load, so it can\'t run',
+    NOT_RUN: `This script runs only when you choose ${RUN_SCRIPT_LABEL}`,
+};
+// A manual script's OK tooltip: how many times it was run here.
+export function manualRunsText(runs) {
+    return runs === 1 ? 'Ran once on this page' : `Ran ${runs} times on this page`;
+}
+// OK's tooltip for a script running only in the page's iframes.
+const FRAMES_OK_TOOLTIP = 'Running in frames on this page';
+// The heading of every surface that says user scripts are disabled: the
+// collections page's banner, the popup's bar and the toolbar tooltip.
+export const USER_SCRIPTS_OFF_HEADING = 'User scripts are not allowed yet.';
+// NOT_LOADED's tooltip on such a page while they still are.
+const NOT_RUN_USERSCRIPTS_DISABLED = 'Not run: user scripts are disabled';
+// UNTRACKED's tooltip on a page that loaded while user scripts were disabled.
+const LOADED_WITHOUT_USERSCRIPTS_TOOLTIP = 'This page loaded while user scripts were disabled, so its scripts didn\'t run. Reload to run them.';
+// STILL_RUNNING's tooltip for a script removed since the page loaded.
+const REMOVED_TOOLTIP = 'Removed since this page loaded. It keeps running until a reload.';
+// PENDING's tooltip for a script that matches only the URL the page
+// moved to in place: Chrome injects at a document load, not on pushState.
+const MOVED_ONLY_TOOLTIP = 'This page changed its address since it loaded, and the script matches only the new one. Reload to run it.';
+// Why a NOT_LOADED script didn't run: which kind of reload, or the
+// sm-dev claim, kept it out.
+const SM_DEV_KEPT_OUT = 'Not run: the sm-dev run controlling this tab kept it out';
+function notLoadedReason(state, nameOf) {
+    if (state.loadedWithoutUserscripts)
+        return NOT_RUN_USERSCRIPTS_DISABLED;
+    if (state.scriptsSkipped)
+        return 'Not run: the page was reloaded with no userscripts';
+    if (state.skipOnly !== undefined)
+        return `Not run: the page was reloaded with only ${nameOf(state.skipOnly)}`;
+    if (state.skipWithout !== undefined)
+        return 'Not run: the page was reloaded without this script';
+    if (state.smDevAllow !== undefined)
+        return SM_DEV_KEPT_OUT;
+    return DEFAULT_TOOLTIPS.NOT_LOADED;
+}
+// The reload banner's text, naming the most specific cause.
+export function bannerText(c) {
+    // First: it explains every other cause there may be.
+    if (c.loadedBefore)
+        return 'Reload required: Page loaded before SourceMonkey started';
+    if (c.loadedWithoutUserscripts)
+        return 'Reload required: Page loaded while user scripts were disabled';
+    if (c.enabled && (c.disabled || c.removed))
+        return 'Reload required: Enabled scripts changed';
+    if (c.enabled)
+        return 'Reload required: Scripts enabled';
+    if (c.disabled && c.removed)
+        return 'Reload required: Scripts disabled and removed';
+    if (c.disabled)
+        return 'Reload required: Scripts disabled';
+    if (c.removed)
+        return 'Reload required: Scripts removed';
+    if (c.updated)
+        return 'Reload required: Scripts updated';
+    if (c.notYetRun)
+        return 'Reload required: Some scripts haven\'t run on this page yet';
+    if (c.missing && c.unexpected)
+        return 'Reload required: Some scripts are missing or unexpected';
+    if (c.missing)
+        return 'Reload required: Some scripts are missing';
+    if (c.unexpected)
+        return 'Reload required: Unexpected scripts are running';
+    return null;
+}
+export function buildPopupView(input) {
+    const { state } = input;
+    const smDev = state?.smDevAllow !== undefined;
+    const view = {
+        url: input.url,
+        ...(input.userScriptsDisabled ? { userScriptsDisabled: true } : {}),
+        injectable: input.injectable,
+        smDev,
+        banner: null,
+        bannerRecheckAt: null,
+        perScriptReload: !smDev && state != null,
+        enabled: [],
+        frames: [],
+        manual: [],
+        disabled: [],
+        collections: [...input.collections],
+    };
+    if (!input.injectable)
+        return view;
+    const collections = new Map(input.collections.map((c) => [c.id, c]));
+    const scripts = new Map(input.scripts.map((s) => [s.id, s]));
+    const badgeById = new Map(input.badgeRows.map((r) => [r.id, r]));
+    const nameOf = (id) => scripts.get(id)?.name ?? badgeById.get(id)?.name ?? id;
+    const isActive = (s) => s.enabled && (collections.get(s.collectionId)?.enabled ?? false);
+    const isRunning = (id) => state != null && runsHere(state, id);
+    const settling = state != null && isSettling(state, input.now ?? Date.now());
+    // Every candidate, then one identity at a time: the copies that are
+    // active or running here all show; with none of those, one copy
+    // stands for the script in Disabled.
+    const keep = input.keepIds ?? new Set();
+    const candidates = new Set([...input.matchingIds, ...badgeById.keys(), ...keep]);
+    const byIdentity = new Map();
+    // Scripts deleted since they ran that still run here: listed in a
+    // group of their own, since they have no collection left.
+    const removed = [];
+    for (const id of candidates) {
+        const s = scripts.get(id);
+        if (!s || !collections.has(s.collectionId)) {
+            if (isRunning(id) && !input.hiddenIds?.has(id))
+                removed.push(id);
+            continue;
+        }
+        const key = s.identity ?? `id:${s.id}`;
+        const list = byIdentity.get(key);
+        if (list)
+            list.push(s);
+        else
+            byIdentity.set(key, [s]);
+    }
+    const shown = [];
+    for (const copies of byIdentity.values()) {
+        const otherCopies = copies.length > 1;
+        const live = copies.filter((s) => isActive(s) || isRunning(s.id));
+        const kept = copies.filter((s) => keep.has(s.id) && !live.includes(s));
+        if (live.length > 0 || kept.length > 0) {
+            const activeCount = live.filter(isActive).length;
+            for (const s of [...live, ...kept])
+                shown.push({ script: s, dup: activeCount > 1 && isActive(s), otherCopies });
+            continue;
+        }
+        // The representative: the copy closest to running and most likely
+        // to be turned back on (`comparePreferred`, docs/script-enablement.md).
+        const pick = preferredCopy(copies, (s) => {
+            const c = collections.get(s.collectionId);
+            return {
+                enabled: s.enabled,
+                collectionOn: c.enabled,
+                collectionName: c.name,
+                activeSince: s.activeSince,
+                inactiveSince: s.inactiveSince,
+                version: s.version,
+                location: s.location,
+            };
+        }, comparePreferred);
+        shown.push({ script: pick, dup: false, otherCopies });
+    }
+    const causes = {};
+    const rowsByCollection = {
+        enabled: new Map(),
+        frames: new Map(),
+        manual: new Map(),
+        disabled: new Map(),
+    };
+    for (const { script: s, dup, otherCopies } of shown) {
+        const active = isActive(s);
+        const badge = badgeById.get(s.id);
+        let status = null;
+        // PENDING only because the page changed its URL in place.
+        let movedOnly = false;
+        if (s.invalid !== undefined && !isRunning(s.id)) {
+            // Never registered, so no badge row, and a reload won't run it:
+            // not PENDING, and no banner. Disabled ones say so too, so it's
+            // clear that turning one on won't make it run.
+            status = 'INVALID';
+        }
+        else if (s.manual && active) {
+            // Nothing expects a manual script to run, so a reload has nothing
+            // to say about it: no PENDING, RELOAD or banner. In a tab an
+            // sm-dev run controls that keeps it out, it's Not loaded, as a
+            // script kept out of the load would be.
+            if (badge && (badge.status === 'OK' || badge.status === 'ERROR'))
+                status = badge.status;
+            else if (smDev && !input.manualRunnableIds?.has(s.id))
+                status = 'NOT_LOADED';
+            else
+                status = 'NOT_RUN';
+        }
+        else if (active) {
+            status = badge?.status ?? (state ? 'PENDING' : null);
+            // Matched now but not when the page loaded, and never reported:
+            // enabled (or installed) since, or matching only the URL the page
+            // moved to in place. Not in a tab an sm-dev run controls, where a
+            // reload still wouldn't run it, nor over a refusal, which a
+            // reload doesn't cure.
+            const atLoad = state?.loadMatchIds;
+            if (state && atLoad && !atLoad.includes(s.id) && !isRunning(s.id)
+                && status !== 'REJECTED' && !(smDev && skippedOnDocument(state, s.id))) {
+                status = 'PENDING';
+                movedOnly = input.loadUrlMatchingIds !== undefined && !input.loadUrlMatchingIds.has(s.id);
+            }
+        }
+        else if (isRunning(s.id)) {
+            status = 'STILL_RUNNING';
+        }
+        const warned = isRunning(s.id) && (s.headerWarnings || (state?.warnedIds?.includes(s.id) ?? false));
+        if (status === 'OK' && warned)
+            status = 'WARNING';
+        if (status === 'RELOAD')
+            causes.updated = true;
+        if (status === 'PENDING') {
+            if (movedOnly)
+                causes.notYetRun = true;
+            else
+                causes.enabled = true;
+        }
+        if (status === 'STILL_RUNNING')
+            causes.disabled = true;
+        // Not while the page is still settling: its scripts may be on their way.
+        if (status === 'MISSING') {
+            if (settling)
+                view.bannerRecheckAt = state.settleBy;
+            else
+                causes.missing = true;
+        }
+        if (status === 'UNEXPECTED')
+            causes.unexpected = true;
+        if (status === 'UNTRACKED') {
+            if (state?.loadedWithoutUserscripts && !state.loadedBefore)
+                causes.loadedWithoutUserscripts = true;
+            else
+                causes.loadedBefore = true;
+        }
+        let tooltip = null;
+        if (status) {
+            let text = DEFAULT_TOOLTIPS[status];
+            if (status === 'OK' && badge?.framesOnly)
+                text = FRAMES_OK_TOOLTIP;
+            if (status === 'ERROR' && badge?.message)
+                text = badge.message;
+            if (status === 'REJECTED' && input.rejected[s.id])
+                text = input.rejected[s.id];
+            if (status === 'NOT_LOADED' && state) {
+                // A manual script isn't kept out by a reload mode, only by the claim.
+                text = s.manual ? SM_DEV_KEPT_OUT : notLoadedReason(state, nameOf);
+            }
+            if (status === 'UNTRACKED' && state?.loadedWithoutUserscripts && !state.loadedBefore)
+                text = LOADED_WITHOUT_USERSCRIPTS_TOOLTIP;
+            if (status === 'INVALID' && s.invalid)
+                text = `${DEFAULT_TOOLTIPS.INVALID}: ${s.invalid}`;
+            if (movedOnly)
+                text = MOVED_ONLY_TOOLTIP;
+            if (status === 'STILL_RUNNING' && s.enabled) {
+                text = 'Its collection was disabled since this page loaded. It keeps running until a reload.';
+            }
+            const runs = state?.manualRuns?.[s.id];
+            if (s.manual && status === 'OK' && runs)
+                text = manualRunsText(runs);
+            const reloads = status === 'PENDING' || status === 'UNTRACKED';
+            tooltip = `${text}\n${reloads ? POPUP_PILL_RELOAD_HINT : POPUP_PILL_CLICK_HINT}`;
+        }
+        const row = {
+            id: s.id,
+            name: s.name,
+            checked: s.enabled,
+            active,
+            status,
+            warned,
+            tooltip,
+            versionLine: dup && s.version ? `Version ${s.version}` : null,
+            otherCopies,
+            commands: active || isRunning(s.id) ? [...(input.menuCommands.get(s.id) ?? [])] : [],
+            ...(s.manual ? { manual: true } : {}),
+            ...(s.manual && active && s.invalid === undefined && input.manualRunnableIds?.has(s.id) ? { runnable: true } : {}),
+        };
+        // Anything running in the page is listed with the active scripts,
+        // even when it's disabled now (Still running) or unexpected. Manual
+        // scripts have their own section, by the same rule, and so do
+        // scripts running only in frames.
+        const into = !(active || isRunning(s.id))
+            ? rowsByCollection.disabled
+            : s.manual ? rowsByCollection.manual
+                : badge?.framesOnly ? rowsByCollection.frames : rowsByCollection.enabled;
+        const list = into.get(s.collectionId);
+        if (list)
+            list.push(row);
+        else
+            into.set(s.collectionId, [row]);
+    }
+    const toGroups = (byColl) => input.collections
+        .filter((c) => byColl.has(c.id))
+        .map((c) => ({
+        collection: c,
+        rows: byColl.get(c.id).sort((a, b) => compareScriptNames(a.name, b.name)),
+    }));
+    view.enabled = toGroups(rowsByCollection.enabled);
+    view.frames = toGroups(rowsByCollection.frames);
+    view.manual = toGroups(rowsByCollection.manual);
+    view.disabled = toGroups(rowsByCollection.disabled);
+    if (removed.length > 0) {
+        causes.removed = true;
+        const collection = { id: REMOVED_GROUP_ID, name: REMOVED_GROUP_NAME, path: '', enabled: true };
+        view.collections.push(collection);
+        view.enabled.push({
+            collection,
+            rows: removed.map((id) => ({
+                id,
+                name: nameOf(id),
+                checked: false,
+                active: false,
+                status: 'STILL_RUNNING',
+                warned: false,
+                // No click hint: there is no script page left to open.
+                tooltip: REMOVED_TOOLTIP,
+                versionLine: null,
+                otherCopies: false,
+                commands: [...(input.menuCommands.get(id) ?? [])],
+            })).sort((a, b) => compareScriptNames(a.name, b.name)),
+        });
+    }
+    view.banner = bannerText(causes);
+    return view;
+}