chrome-extension

Service worker module-scope state disappears when Chrome terminates the worker after 30 seconds of inactivity. Persist anything the user would notice losing in chrome.storage: session for hot state, local for user data, sync for preferences, and read it inside each event handler.

An async onMessage listener returns a Promise, which is truthy but not the literal true Chrome requires to keep the channel open, so sendMessage resolves with undefined. Use a non-async listener that calls sendResponse in a .then() and returns literal true.

No, content scripts run in an isolated world where only the DOM is shared with the page. Either declare world: "MAIN" (losing all chrome.* APIs) or inject a small page-world bridge script via chrome.runtime.getURL() that posts values back with window.postMessage.

Unpacked builds skip the chrome.alarms 30-second minimum clamp, so a too-frequent alarm works in development but is refused once installed. Also check anything bound to the extension id, which differs between unpacked and published builds.

Remotely hosted code such as a CDN script tag triggers a Blue Argon rejection, and a CSP relaxed past script-src 'self' 'wasm-unsafe-eval' fails at install. Broad host permissions without plain-language justifications and obfuscated code also drive rejections and longer review.

Use WXT when the project involves TypeScript, a framework UI, or cross-browser output; it provides entrypoint conventions, storage.defineItem migrations, and testing plugins. Keep raw files only for single-file experiments, and keep an existing Vite plus CRXJS setup rather than converting it.