PEEK v0.1.0-beta SUBMISSION REPORT
RELEASE STATUS
READY WITH WARNINGS
BUILD RESULTS
- npm run typecheck: PASS
- npm test: PASS (3 test files, 6 tests)
- npm run build: PASS
- npm audit --omit=dev: PASS (0 vulnerabilities)
- Lint: not configured
- Integration tests: not configured
- Strict manifest/output validation: PASS (Manifest V3; service worker, content script, popup, and all four icon paths present)
- Static scan: no unsafe HTML sinks, eval-like APIs, remote code references, source maps, or secrets found in runtime output/source.
- Runtime package size before ZIP compression: 24,878 bytes
TEST RESULTS
Unit coverage covers URL validation/normalization, remote metadata extraction, generic local fallback construction, and local/remote field merging. Browser smoke testing could not be performed because no controllable browser tab was available in this environment.
SECURITY FINDINGS
Critical: none found.
High: none found.
Medium: broad all-sites host access is powerful, but required for the arbitrary-link preview promise.
Low: public destinations may block, rate-limit, redirect, or return weak HTML; Peek fails without bypassing protections.
Informational: fetched HTML is extracted as untrusted data and rendered through DOM APIs/textContent. No remote scripts/styles are executed.
PERMISSION REVIEW
- storage: required only for the persisted peekEnabled toolbar preference. Low concern.
- http://*/* and https://*/* host permissions plus matching content-script patterns: required to detect and fetch arbitrary public links on arbitrary websites. These will produce a broad all-sites permission warning. An allowlist, activeTab, or optional per-site permissions would materially break seamless previewing. Keep them for the current product scope.
PRIVACY/DATA FLOW SUMMARY
Peek reads the hovered link URL and limited visible surrounding context (link text, labels, nested image information, and nearby card/article/list text). It sends the hovered destination URL directly to that destination only when a preview fetch is needed, with credential-omitting fetches. Preview images/favicons may be requested to render the card. There is no Peek backend, analytics, tracking, advertising SDK, account system, AI API, or third-party SDK in the audited code. Successful previews are cached in service-worker memory for 10 minutes; failures for 1 minute. Chrome sync storage contains only the boolean peekEnabled preference.
STORE ASSET STATUS
- Original local PNG icons: READY (16, 32, 48, and 128px).
- Store listing/privacy/permission copy: READY in
elease/store-assets/SUBMISSION.txt.
- Genuine screenshots: NOT INCLUDED. Capture actual Chrome screenshots manually; no mock screenshots were fabricated.
ZIP INSPECTION
- ZIP path: release/peek-v0.1.0-beta.zip
- ZIP size: 14730 bytes
- SHA-256: B6171CBF643344A2AD6CC567B4865E3B7964DD028F8C09AF2CA0CEC0A72180E3
- Contains only deployable extension assets at ZIP root: manifest, service worker, content script, popup, popup assets, and four PNG icons.
- Excludes source, tests, fixtures, store assets, reports, node_modules, development config, repository metadata, source maps, and secrets.
KNOWN LIMITATIONS
- Add four genuine Chrome Web Store screenshots before submission.
- Some destinations cannot provide public HTML due to authentication, bot protection, rate limiting, JavaScript-only rendering, redirects, or response latency.
- No lint or browser integration test harness exists; manual Chrome validation remains required.
MANUAL STEPS I MUST PERFORM
1. Capture real screenshots in Chrome: Google Search preview, article/news preview, Google Images preview, and local-context fallback.
2. Review and host the privacy-policy copy from
elease/store-assets/SUBMISSION.txt on a public URL if required by your listing.
3. Load dist unpacked in Chrome and smoke-test Google Search, Google Images, Reddit, Wikipedia, GitHub, YouTube, ecommerce/news links, blocked/slow links, rapid A-to-B-to-C hover, caching, dismissal, toolbar toggle, and normal link clicks.
4. In Chrome Web Store submission, accurately explain that Peek requests hovered destination URLs and needs broad site access for arbitrary link previews.
5. Upload the final ZIP manually. Do not include store-assets in the ZIP.
FINAL RECOMMENDATION
Proceed with a private/trusted-tester beta submission after completing the manual screenshots and Chrome smoke test. The deployable package is structurally clean and validated, but broad all-sites permissions and destination fetches must be clearly justified in the listing and privacy disclosures.