From 2a9793bf9d3719107e2c899ca870f05fb138de10 Mon Sep 17 00:00:00 2001
From: "Tommy D. Rossi" <beats.by.morse@gmail.com>
Date: Mon, 24 Nov 2025 11:59:37 +0100
Subject: [PATCH] disable tabs permission when not testing

---
 extension/permissions.md  | 21 ++++++++++++++-------
 extension/vite.config.mts | 13 ++++++++++++-
 2 files changed, 26 insertions(+), 8 deletions(-)

diff --git a/extension/permissions.md b/extension/permissions.md
index c0e6e73..2f7c26c 100644
--- a/extension/permissions.md
+++ b/extension/permissions.md
@@ -14,14 +14,21 @@ Required to attach the Chrome debugger to the current tab when the user clicks t
 
 Essential for core functionality. This permission allows the extension to attach Chrome DevTools Protocol (CDP) to tabs selected by the user (via clicking the extension icon). CDP access enables the extension to relay automation commands from local Playwright scripts to the browser, allowing actions like page navigation, element interaction, and JavaScript execution for testing and development purposes.
 
-### tabs
+### tabs (Testing Only - Removed in Production Builds)
 
-Required to:
-- Track which tabs have active debugger connections (shown via icon color)
-- Detect when connected tabs are closed to properly clean up debugger attachments
-- Update extension icon state across all tabs
-- Create, close, and switch between automated tabs
-- Monitor tab activation events
+**Note: This permission is automatically removed during production builds and is only included in test builds.**
+
+The tabs permission is only needed during development/testing to:
+- Access the URL property of tabs for test identification (finding tabs by URL pattern)
+- Query all tabs with full information for test assertions
+
+In production, the extension functions perfectly without the tabs permission because:
+- Tab event listeners (onRemoved, onActivated, onUpdated) work without it
+- chrome.tabs.create() and chrome.tabs.remove() work without it
+- chrome.tabs.query() for active tab works without it
+- chrome.tabs.get() works without it (returns limited info which is sufficient)
+
+The build process (vite.config.mts) automatically removes this permission when TESTING environment variable is not set.
 
 ### host_permissions (<all_urls>)
 
diff --git a/extension/vite.config.mts b/extension/vite.config.mts
index 76d7526..1f1152c 100644
--- a/extension/vite.config.mts
+++ b/extension/vite.config.mts
@@ -2,6 +2,7 @@ import { fileURLToPath } from 'url';
 import { dirname, resolve } from 'path';
 import { defineConfig } from 'vite';
 import { viteStaticCopy } from 'vite-plugin-static-copy';
+import fs from 'node:fs';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -21,7 +22,17 @@ export default defineConfig({
         },
         {
           src: resolve(__dirname, 'manifest.json'),
-          dest: '.'
+          dest: '.',
+          transform: (content) => {
+            const manifest = JSON.parse(content);
+            
+            // Only include tabs permission during testing
+            if (!process.env.TESTING) {
+              manifest.permissions = manifest.permissions.filter((p: string) => p !== 'tabs');
+            }
+            
+            return JSON.stringify(manifest, null, 2);
+          }
         },
         {
           src: resolve(__dirname, 'welcome.html'),