ATlast — you'll never need to find your favorites on another platform again. Find your favs in the ATmosphere.
atproto
fix: add Firefox extension CORS support
- Added moz-extension:// origin detection to CORS handler
- Added cookies permission to Firefox manifest for credentialed requests
- Functions now properly reflect Firefox extension origins with credentials
+272
-24
+16
-16
docs/git-history.json
+16
-16
docs/git-history.json
···
8
8
"files_changed": 4
9
9
},
10
10
{
11
-
"hash": "bd3aabb75abb1875aef125610fcdccb14967a8e3",
12
-
"short_hash": "bd3aabb",
11
+
"hash": "603cf0a187850664336a12c9e5cbb49038906f53",
12
+
"short_hash": "603cf0a",
13
13
"author": "Ariel M. Lighty",
14
-
"date": "2025-12-27T22:10:11-05:00",
15
-
"message": "fix: extension dark mode and build mode messaging\n\n- Changed darkMode from 'class' to 'media' for automatic system preference detection\n- Made server offline message conditional on build mode (dev vs prod)\n- Hide dev server instructions in production builds",
16
-
"files_changed": 5
14
+
"date": "2025-12-27T22:42:43-05:00",
15
+
"message": "fix: CORS for extension credentialed requests\n\nUpdated CORS headers to support credentials from Chrome extensions:\n- Added getCorsHeaders() to detect chrome-extension:// origins\n- Changed from wildcard Access-Control-Allow-Origin to specific origin\n- Added Access-Control-Allow-Credentials: true for credentialed requests\n- Updated session endpoint to pass event for CORS header detection",
16
+
"files_changed": 4
17
17
},
18
18
{
19
19
"hash": "bd3aabb75abb1875aef125610fcdccb14967a8e3",
···
40
40
"files_changed": 6
41
41
},
42
42
{
43
-
"hash": "2a163c5f033a79324b100a236ea26c905909bfc6",
44
-
"short_hash": "2a163c5",
43
+
"hash": "fe29bb3e5faa0151f63c14724f7509af669860de",
44
+
"short_hash": "fe29bb3",
45
45
"author": "Ariel M. Lighty",
46
-
"date": "2025-12-27T15:49:08-05:00",
47
-
"message": "docs: update decision graph after documentation improvements",
48
-
"files_changed": 2
46
+
"date": "2025-12-27T16:02:10-05:00",
47
+
"message": "docs: update all .md files to reflect current project status\n\nUpdated 4 markdown files with current state:\n\nEXTENSION_STATUS.md:\n- Changed status from DEBUGGING to COMPLETE\n- Updated decision graph count (295 → 332 nodes)\n- Added recently completed section (nodes 296-332)\n- Marked all extension bugs as resolved\n\nCONTRIBUTING.md:\n- Replaced npm with pnpm throughout\n- Added monorepo structure documentation\n- Updated development commands (netlify-cli dev --filter)\n- Added extension development workflow\n\nPLAN.md:\n- Updated status to Phase 1 COMPLETE\n- Added all recent fixes to completion list\n- Updated decision graph count to 332 nodes\n- Added changelog entries for latest work\n\npackages/extension/README.md:\n- Added prerequisites section (dev server + login required)\n- Updated build commands with dev/prod distinction\n- Added Step 0: Start ATlast Dev Server\n- Added common issues for auth and server states\n\nAll files now accurately reflect completion status and use pnpm.",
48
+
"files_changed": 6
49
49
},
50
50
{
51
51
"hash": "fcf682bb8969aca108262348e7e17531077713be",
···
160
160
"files_changed": 3
161
161
},
162
162
{
163
-
"hash": "ba29fd68872913ba0a587aa7f29f97b3d373a732",
164
-
"short_hash": "ba29fd6",
163
+
"hash": "32cdee3aeac7ef986df47e0fff786b5f7471e55b",
164
+
"short_hash": "32cdee3",
165
165
"author": "Ariel M. Lighty",
166
166
"date": "2025-12-25T13:22:32-05:00",
167
167
"message": "configure Netlify dev for monorepo with --filter flag\n\nFixed Netlify CLI monorepo detection issue by using --filter flag:\n- Updated root package.json scripts to use 'npx netlify-cli dev --filter @atlast/web'\n- Updated netlify.toml [dev] section to use npm with --prefix for framework command\n- Added monorepo development instructions to CLAUDE.md\n- Documented Windows Git Bash compatibility issue with netlify command\n\nSolution: Use 'npx netlify-cli dev --filter @atlast/web' to bypass monorepo\nproject selection prompt and specify which workspace package to run.\n\nDev server now runs successfully at http://localhost:8888 with all backend\nfunctions loaded.",
168
-
"files_changed": 5
168
+
"files_changed": 4
169
169
},
170
170
{
171
-
"hash": "32cdee3aeac7ef986df47e0fff786b5f7471e55b",
172
-
"short_hash": "32cdee3",
171
+
"hash": "ba29fd68872913ba0a587aa7f29f97b3d373a732",
172
+
"short_hash": "ba29fd6",
173
173
"author": "Ariel M. Lighty",
174
174
"date": "2025-12-25T13:22:32-05:00",
175
175
"message": "configure Netlify dev for monorepo with --filter flag\n\nFixed Netlify CLI monorepo detection issue by using --filter flag:\n- Updated root package.json scripts to use 'npx netlify-cli dev --filter @atlast/web'\n- Updated netlify.toml [dev] section to use npm with --prefix for framework command\n- Added monorepo development instructions to CLAUDE.md\n- Documented Windows Git Bash compatibility issue with netlify command\n\nSolution: Use 'npx netlify-cli dev --filter @atlast/web' to bypass monorepo\nproject selection prompt and specify which workspace package to run.\n\nDev server now runs successfully at http://localhost:8888 with all backend\nfunctions loaded.",
176
-
"files_changed": 4
176
+
"files_changed": 5
177
177
},
178
178
{
179
179
"hash": "c3e7afad396d130791d801a85cbfc9643bcd6309",
+237
-6
docs/graph-data.json
+237
-6
docs/graph-data.json
···
4032
4032
"node_type": "goal",
4033
4033
"title": "Create Firefox-compatible version of Twitter scraper extension",
4034
4034
"description": null,
4035
-
"status": "pending",
4035
+
"status": "completed",
4036
4036
"created_at": "2025-12-28T18:09:33.241860800-05:00",
4037
-
"updated_at": "2025-12-28T18:09:33.241860800-05:00",
4037
+
"updated_at": "2025-12-28T19:21:32.412499-05:00",
4038
4038
"metadata_json": "{\"branch\":\"master\",\"confidence\":85,\"prompt\":\"let's make the extension have a firefox compatible version too.\"}"
4039
4039
},
4040
4040
{
···
4120
4120
"node_type": "action",
4121
4121
"title": "Installing webextension-polyfill and updating source files to use browser.* API",
4122
4122
"description": null,
4123
-
"status": "pending",
4123
+
"status": "completed",
4124
4124
"created_at": "2025-12-28T19:08:14.642882400-05:00",
4125
-
"updated_at": "2025-12-28T19:08:14.642882400-05:00",
4125
+
"updated_at": "2025-12-28T19:21:32.531034800-05:00",
4126
4126
"metadata_json": "{\"branch\":\"master\",\"confidence\":90}"
4127
4127
},
4128
4128
{
···
4131
4131
"node_type": "outcome",
4132
4132
"title": "Successfully implemented Firefox compatibility with webextension-polyfill. Both Chrome and Firefox builds compile successfully. Chrome uses service_worker (MV3), Firefox uses scripts array with browser_specific_settings. All chrome.* API calls replaced with browser.* imports.",
4133
4133
"description": null,
4134
+
"status": "completed",
4135
+
"created_at": "2025-12-28T19:14:22.309457600-05:00",
4136
+
"updated_at": "2025-12-28T19:21:32.658297400-05:00",
4137
+
"metadata_json": "{\"branch\":\"master\",\"confidence\":95}"
4138
+
},
4139
+
{
4140
+
"id": 377,
4141
+
"change_id": "1dffa024-413f-4a95-b069-66db350abfaa",
4142
+
"node_type": "goal",
4143
+
"title": "Fix Firefox extension server detection and login check",
4144
+
"description": null,
4134
4145
"status": "pending",
4135
-
"created_at": "2025-12-28T19:14:22.309457600-05:00",
4136
-
"updated_at": "2025-12-28T19:14:22.309457600-05:00",
4146
+
"created_at": "2025-12-28T20:14:51.646204800-05:00",
4147
+
"updated_at": "2025-12-28T20:14:51.646204800-05:00",
4148
+
"metadata_json": "{\"branch\":\"master\",\"confidence\":85,\"prompt\":\"The extension works in chrome. In firefox, it's failing to detect that the dev server is running and open + logged in on firefox. There's no right-click to inspect on the popup either.\"}"
4149
+
},
4150
+
{
4151
+
"id": 378,
4152
+
"change_id": "9d5626d2-a9ae-42aa-8fda-be3c7528156f",
4153
+
"node_type": "observation",
4154
+
"title": "Firefox extension debugging differs from Chrome - need to use about:debugging Inspect button or Browser Console, not right-click popup",
4155
+
"description": null,
4156
+
"status": "pending",
4157
+
"created_at": "2025-12-28T20:15:11.710473-05:00",
4158
+
"updated_at": "2025-12-28T20:15:11.710473-05:00",
4159
+
"metadata_json": "{\"branch\":\"master\",\"confidence\":95}"
4160
+
},
4161
+
{
4162
+
"id": 379,
4163
+
"change_id": "7a5af3fe-8567-4f1c-85cd-e47891704974",
4164
+
"node_type": "observation",
4165
+
"title": "Potential Firefox issues: 1) CORS with credentials:include may be stricter, 2) Cookie partitioning/third-party cookie blocking, 3) Extension needs explicit host_permissions for cookies to work. Firefox manifest has host_permissions but may need additional cookie permissions.",
4166
+
"description": null,
4167
+
"status": "pending",
4168
+
"created_at": "2025-12-28T20:15:31.278249900-05:00",
4169
+
"updated_at": "2025-12-28T20:15:31.278249900-05:00",
4170
+
"metadata_json": "{\"branch\":\"master\",\"confidence\":85}"
4171
+
},
4172
+
{
4173
+
"id": 380,
4174
+
"change_id": "9c197aae-18d5-46ae-87e7-82c240c8f313",
4175
+
"node_type": "action",
4176
+
"title": "Adding cookies permission to Firefox manifest for credentials:include support",
4177
+
"description": null,
4178
+
"status": "pending",
4179
+
"created_at": "2025-12-28T20:16:12.019659700-05:00",
4180
+
"updated_at": "2025-12-28T20:16:12.019659700-05:00",
4181
+
"metadata_json": "{\"branch\":\"master\",\"confidence\":90}"
4182
+
},
4183
+
{
4184
+
"id": 381,
4185
+
"change_id": "485a03b0-8a25-4fdf-a8e2-9d3a25c8edf8",
4186
+
"node_type": "outcome",
4187
+
"title": "Fixed Firefox cookie issue by adding cookies permission to manifest. Firefox requires explicit permission even with host_permissions. Rebuild successful.",
4188
+
"description": null,
4189
+
"status": "pending",
4190
+
"created_at": "2025-12-28T20:16:41.702322300-05:00",
4191
+
"updated_at": "2025-12-28T20:16:41.702322300-05:00",
4192
+
"metadata_json": "{\"branch\":\"master\",\"confidence\":95}"
4193
+
},
4194
+
{
4195
+
"id": 382,
4196
+
"change_id": "35b13d37-0228-435f-a4bc-c5c42811fec3",
4197
+
"node_type": "observation",
4198
+
"title": "Firefox blocks extension fetch with CORS error despite host_permissions. Server responds 200 but missing Access-Control-Allow-Origin header. Firefox stricter than Chrome on extension CORS.",
4199
+
"description": null,
4200
+
"status": "pending",
4201
+
"created_at": "2025-12-28T20:17:23.414134300-05:00",
4202
+
"updated_at": "2025-12-28T20:17:23.414134300-05:00",
4203
+
"metadata_json": "{\"branch\":\"master\",\"confidence\":95}"
4204
+
},
4205
+
{
4206
+
"id": 383,
4207
+
"change_id": "adc120cd-e56d-400a-9b3e-8207880378c3",
4208
+
"node_type": "action",
4209
+
"title": "Adding CORS headers to netlify.toml for extension compatibility - wildcard origin with credentials for dev",
4210
+
"description": null,
4211
+
"status": "pending",
4212
+
"created_at": "2025-12-28T20:18:22.172869600-05:00",
4213
+
"updated_at": "2025-12-28T20:18:22.172869600-05:00",
4214
+
"metadata_json": "{\"branch\":\"master\",\"confidence\":90}"
4215
+
},
4216
+
{
4217
+
"id": 384,
4218
+
"change_id": "0f77bfd9-590f-4f1e-be08-78a9deef6d8a",
4219
+
"node_type": "outcome",
4220
+
"title": "Added CORS headers to netlify.toml for all paths including root and functions. Headers include Access-Control-Allow-Origin:*, Allow-Credentials:true for dev environment. User needs to restart dev server.",
4221
+
"description": null,
4222
+
"status": "pending",
4223
+
"created_at": "2025-12-28T20:19:54.829093600-05:00",
4224
+
"updated_at": "2025-12-28T20:19:54.829093600-05:00",
4225
+
"metadata_json": "{\"branch\":\"master\",\"confidence\":90}"
4226
+
},
4227
+
{
4228
+
"id": 385,
4229
+
"change_id": "cc0910f0-2381-4aee-bb5d-397cb0f804d1",
4230
+
"node_type": "observation",
4231
+
"title": "CORS wildcard (*) incompatible with credentials:include. Browser security prevents wildcard CORS with credentialed requests. Extension origins are dynamic (moz-extension://, chrome-extension://). Need to handle CORS in serverless functions by reflecting request origin.",
4232
+
"description": null,
4233
+
"status": "pending",
4234
+
"created_at": "2025-12-28T20:27:31.848523900-05:00",
4235
+
"updated_at": "2025-12-28T20:27:31.848523900-05:00",
4236
+
"metadata_json": "{\"branch\":\"master\",\"confidence\":95}"
4237
+
},
4238
+
{
4239
+
"id": 386,
4240
+
"change_id": "ad4a5ca7-15d1-4776-8ede-6b615613f6e1",
4241
+
"node_type": "action",
4242
+
"title": "Adding moz-extension:// origin detection to CORS handler for Firefox extension support",
4243
+
"description": null,
4244
+
"status": "pending",
4245
+
"created_at": "2025-12-28T20:28:31.661326900-05:00",
4246
+
"updated_at": "2025-12-28T20:28:31.661326900-05:00",
4247
+
"metadata_json": "{\"branch\":\"master\",\"confidence\":95}"
4248
+
},
4249
+
{
4250
+
"id": 387,
4251
+
"change_id": "cffdee0f-8535-4d88-83ed-fdf6101f7ac3",
4252
+
"node_type": "outcome",
4253
+
"title": "Fixed Firefox extension CORS by adding moz-extension:// origin detection to response.utils.ts. Reverted netlify.toml changes as functions handle CORS correctly. User needs to restart dev server.",
4254
+
"description": null,
4255
+
"status": "pending",
4256
+
"created_at": "2025-12-28T20:29:39.856303800-05:00",
4257
+
"updated_at": "2025-12-28T20:29:39.856303800-05:00",
4137
4258
"metadata_json": "{\"branch\":\"master\",\"confidence\":95}"
4138
4259
}
4139
4260
],
···
8240
8361
"weight": 1.0,
8241
8362
"rationale": "Implementation completed successfully",
8242
8363
"created_at": "2025-12-28T19:14:24.961595600-05:00"
8364
+
},
8365
+
{
8366
+
"id": 374,
8367
+
"from_node_id": 377,
8368
+
"to_node_id": 378,
8369
+
"from_change_id": "1dffa024-413f-4a95-b069-66db350abfaa",
8370
+
"to_change_id": "9d5626d2-a9ae-42aa-8fda-be3c7528156f",
8371
+
"edge_type": "leads_to",
8372
+
"weight": 1.0,
8373
+
"rationale": "First observation about debugging",
8374
+
"created_at": "2025-12-28T20:15:13.725635900-05:00"
8375
+
},
8376
+
{
8377
+
"id": 375,
8378
+
"from_node_id": 378,
8379
+
"to_node_id": 379,
8380
+
"from_change_id": "9d5626d2-a9ae-42aa-8fda-be3c7528156f",
8381
+
"to_change_id": "7a5af3fe-8567-4f1c-85cd-e47891704974",
8382
+
"edge_type": "leads_to",
8383
+
"weight": 1.0,
8384
+
"rationale": "Hypothesis about root causes",
8385
+
"created_at": "2025-12-28T20:15:33.187041700-05:00"
8386
+
},
8387
+
{
8388
+
"id": 376,
8389
+
"from_node_id": 379,
8390
+
"to_node_id": 380,
8391
+
"from_change_id": "7a5af3fe-8567-4f1c-85cd-e47891704974",
8392
+
"to_change_id": "9c197aae-18d5-46ae-87e7-82c240c8f313",
8393
+
"edge_type": "leads_to",
8394
+
"weight": 1.0,
8395
+
"rationale": "Fix based on hypothesis",
8396
+
"created_at": "2025-12-28T20:16:14.104406300-05:00"
8397
+
},
8398
+
{
8399
+
"id": 377,
8400
+
"from_node_id": 380,
8401
+
"to_node_id": 381,
8402
+
"from_change_id": "9c197aae-18d5-46ae-87e7-82c240c8f313",
8403
+
"to_change_id": "485a03b0-8a25-4fdf-a8e2-9d3a25c8edf8",
8404
+
"edge_type": "leads_to",
8405
+
"weight": 1.0,
8406
+
"rationale": "Fix implemented and tested",
8407
+
"created_at": "2025-12-28T20:16:43.953511400-05:00"
8408
+
},
8409
+
{
8410
+
"id": 378,
8411
+
"from_node_id": 381,
8412
+
"to_node_id": 382,
8413
+
"from_change_id": "485a03b0-8a25-4fdf-a8e2-9d3a25c8edf8",
8414
+
"to_change_id": "35b13d37-0228-435f-a4bc-c5c42811fec3",
8415
+
"edge_type": "leads_to",
8416
+
"weight": 1.0,
8417
+
"rationale": "Root cause identified from error logs",
8418
+
"created_at": "2025-12-28T20:17:25.488041200-05:00"
8419
+
},
8420
+
{
8421
+
"id": 379,
8422
+
"from_node_id": 382,
8423
+
"to_node_id": 383,
8424
+
"from_change_id": "35b13d37-0228-435f-a4bc-c5c42811fec3",
8425
+
"to_change_id": "adc120cd-e56d-400a-9b3e-8207880378c3",
8426
+
"edge_type": "leads_to",
8427
+
"weight": 1.0,
8428
+
"rationale": "Fix for CORS issue",
8429
+
"created_at": "2025-12-28T20:19:41.484076700-05:00"
8430
+
},
8431
+
{
8432
+
"id": 380,
8433
+
"from_node_id": 383,
8434
+
"to_node_id": 384,
8435
+
"from_change_id": "adc120cd-e56d-400a-9b3e-8207880378c3",
8436
+
"to_change_id": "0f77bfd9-590f-4f1e-be08-78a9deef6d8a",
8437
+
"edge_type": "leads_to",
8438
+
"weight": 1.0,
8439
+
"rationale": "Implementation complete",
8440
+
"created_at": "2025-12-28T20:19:56.872404900-05:00"
8441
+
},
8442
+
{
8443
+
"id": 381,
8444
+
"from_node_id": 384,
8445
+
"to_node_id": 385,
8446
+
"from_change_id": "0f77bfd9-590f-4f1e-be08-78a9deef6d8a",
8447
+
"to_change_id": "cc0910f0-2381-4aee-bb5d-397cb0f804d1",
8448
+
"edge_type": "leads_to",
8449
+
"weight": 1.0,
8450
+
"rationale": "New error reveals real issue",
8451
+
"created_at": "2025-12-28T20:27:34.035766400-05:00"
8452
+
},
8453
+
{
8454
+
"id": 382,
8455
+
"from_node_id": 385,
8456
+
"to_node_id": 386,
8457
+
"from_change_id": "cc0910f0-2381-4aee-bb5d-397cb0f804d1",
8458
+
"to_change_id": "ad4a5ca7-15d1-4776-8ede-6b615613f6e1",
8459
+
"edge_type": "leads_to",
8460
+
"weight": 1.0,
8461
+
"rationale": "Fix for Firefox extension origin",
8462
+
"created_at": "2025-12-28T20:28:33.839045700-05:00"
8463
+
},
8464
+
{
8465
+
"id": 383,
8466
+
"from_node_id": 386,
8467
+
"to_node_id": 387,
8468
+
"from_change_id": "ad4a5ca7-15d1-4776-8ede-6b615613f6e1",
8469
+
"to_change_id": "cffdee0f-8535-4d88-83ed-fdf6101f7ac3",
8470
+
"edge_type": "leads_to",
8471
+
"weight": 1.0,
8472
+
"rationale": "Complete fix implemented",
8473
+
"created_at": "2025-12-28T20:30:09.745415200-05:00"
8243
8474
}
8244
8475
]
8245
8476
}
+2
-1
packages/extension/manifest.firefox.json
+2
-1
packages/extension/manifest.firefox.json
+1
-1
packages/functions/src/utils/response.utils.ts
+1
-1
packages/functions/src/utils/response.utils.ts
···
22
22
'https://atlast.byarielm.fyi',
23
23
];
24
24
25
-
const isExtension = origin.startsWith('chrome-extension://');
25
+
const isExtension = origin.startsWith('chrome-extension://') || origin.startsWith('moz-extension://');
26
26
const isAllowedOrigin = allowedOrigins.includes(origin);
27
27
28
28
if (isExtension || isAllowedOrigin) {
+16
pnpm-lock.yaml
+16
pnpm-lock.yaml
···
114
114
'@atlast/shared':
115
115
specifier: workspace:*
116
116
version: link:../shared
117
+
webextension-polyfill:
118
+
specifier: ^0.12.0
119
+
version: 0.12.0
117
120
devDependencies:
118
121
'@types/chrome':
119
122
specifier: ^0.0.256
120
123
version: 0.0.256
124
+
'@types/webextension-polyfill':
125
+
specifier: ^0.12.4
126
+
version: 0.12.4
121
127
autoprefixer:
122
128
specifier: ^10.4.23
123
129
version: 10.4.23(postcss@8.5.6)
···
1245
1251
'@types/triple-beam@1.3.5':
1246
1252
resolution: {integrity: sha512-6WaYesThRMCl19iryMYP7/x2OVgCtbIVflDGFpWnb9irXI3UjYE4AzmYuiUKY1AJstGijoY+MgUszMgRxIYTYw==}
1247
1253
1254
+
'@types/webextension-polyfill@0.12.4':
1255
+
resolution: {integrity: sha512-wK8YdSI0pDiaehSLDIvtvonYmLwUUivg4Z6JCJO8rkyssMAG82cFJgwPK/V7NO61mJBLg/tXeoXQL8AFzpXZmQ==}
1256
+
1248
1257
'@types/yauzl@2.10.3':
1249
1258
resolution: {integrity: sha512-oJoftv0LSuaDZE3Le4DbKX+KS9G36NzOeSap90UIK0yMA/NhKJhqlSGtNDORNRaIbQfzjXDrQa0ytJ6mNRGz/Q==}
1250
1259
···
3144
3153
optional: true
3145
3154
terser:
3146
3155
optional: true
3156
+
3157
+
webextension-polyfill@0.12.0:
3158
+
resolution: {integrity: sha512-97TBmpoWJEE+3nFBQ4VocyCdLKfw54rFaJ6EVQYLBCXqCIpLSZkwGgASpv4oPt9gdKCJ80RJlcmNzNn008Ag6Q==}
3147
3159
3148
3160
webidl-conversions@3.0.1:
3149
3161
resolution: {integrity: sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==}
···
4172
4184
4173
4185
'@types/triple-beam@1.3.5': {}
4174
4186
4187
+
'@types/webextension-polyfill@0.12.4': {}
4188
+
4175
4189
'@types/yauzl@2.10.3':
4176
4190
dependencies:
4177
4191
'@types/node': 24.10.4
···
6108
6122
optionalDependencies:
6109
6123
'@types/node': 24.10.4
6110
6124
fsevents: 2.3.3
6125
+
6126
+
webextension-polyfill@0.12.0: {}
6111
6127
6112
6128
webidl-conversions@3.0.1: {}
6113
6129