Register blocking header rewrites only on manifest v2 by PeterDaveHello · Pull Request #1122 · ChatGPTBox-dev/chatGPTBox

PeterDaveHello · 2026-10-14T15:54:06Z

Register Bing and Claude blocking header rewrites only on this project's Manifest V2 builds. Its Manifest V3 build uses existing DNR rules and does not need the non-blocking JavaScript listeners.

Extract the listeners into a testable module, remove unconditional request logging, and discard partial rewrites on failure. Add tests for registration, rewrites, logging, and DNR rule consistency.

Summary by CodeRabbit

Compatibility
- Bing and Claude request headers continue to be updated on extension manifest versions below 3. Manifest version 3 and later do not use blocking header listeners.
Reliability
- Header updates handle capitalization differences and leave requests unchanged when headers cannot be safely updated.
- Errors are logged without exposing header values; Bing header names are logged when updates occur.

coderabbitai · 2026-10-14T15:54:32Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 195a3974-31de-4598-9d66-266fffcaec48

📥 Commits

Reviewing files that changed from the base of the PR and between c9f5f90 and bdee8a5.

📒 Files selected for processing: 2

src/background/webrequest-listeners.mjs
tests/unit/background/webrequest-listeners.test.mjs

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

📝 Walkthrough

The background entry point now uses a shared module to register Bing and Claude header-rewrite listeners. Registration occurs only when the manifest version is below 3 and the webRequest API is available. Unit tests cover rewrite behavior, registration filters, and alignment with manifest v3 declarative rules.

Changes: Bing and Claude header rewrites

Layer / File(s)	Summary
Header rewrite behavior `src/background/webrequest-listeners.mjs`, `tests/unit/background/webrequest-listeners.test.mjs`	The shared listeners rewrite existing `Origin` and `Referer` headers case-insensitively. They return modified headers only when a rewrite occurs. They also handle invalid inputs and rewrite errors. Tests cover header preservation, logging, and error handling.
Manifest-gated registration and integration `src/background/webrequest-listeners.mjs`, `src/background/index.mjs`, `tests/unit/background/webrequest-listeners.test.mjs`	The background entry point calls the registration helper. The helper registers blocking listeners for manifest versions below 3 when the webRequest API is available. Tests check registration filters and compare listener configuration with manifest v3 DNR rules.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to bdee8

No newly introduced issue is established; the change is mergeable after normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 3 files.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly summarizes the primary change: blocking header-rewrite listeners register only for Manifest V2.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

qodo-code-review · 2026-10-14T15:55:08Z

PR Summary by Qodo

Skip ineffective header rewrite listeners on Manifest V3

🐞 Bug fix ✨ Enhancement 🧪 Tests 🕐 20-40 Minutes

AI Description

• Register blocking Bing and Claude header listeners only on Manifest V2, avoiding unnecessary V3
 request work.
• Preserve V2 rewrites while reducing logging and returning no rewrite on failure.
• Test listener behavior and consistency with the existing Manifest V3 DNR rules.

Diagram

graph TD
  BG["Background startup"] --> GATE{"Manifest v2?"} -->|Yes| WR["Blocking listeners"] --> HEAD["Request headers"]
  GATE -->|No JS listener| DNR["Enabled DNR rules"] --> HEAD

High-Level Assessment

Keep the version-gated listeners: Manifest V2 needs blocking webRequest rewrites, while Manifest V3 already has DNR rules. A single declarative mechanism is not available to the current V2 build, and retaining V3 JavaScript listeners preserves the avoidable per-request work.

Files changed (3) +564 / -65

Enhancement (2) +134 / -65

index.mjsRoute header listener registration through the version-gated helper +4/-65

Route header listener registration through the version-gated helper
• Replaces inline Bing and Claude listener registration with a helper call that receives the active manifest version. This prevents their ineffective registration on Manifest V3.
src/background/index.mjs

webrequest-listeners.mjsExtract Manifest V2 blocking header listeners +130/-0

Extract Manifest V2 blocking header listeners

• Adds shared Bing and Claude rewrite logic and registers blocking listeners only before Manifest V3. It removes per-request trigger logging, avoids logging header values on errors, and returns no rewrite when headers are absent or rewriting fails.

src/background/webrequest-listeners.mjs

Tests (1) +430 / -0

webrequest-listeners.test.mjsCover listener gating, rewrites, failures, and DNR consistency +430/-0

Cover listener gating, rewrites, failures, and DNR consistency
• Tests version-dependent registration, filters, header changes, no-op and failure paths, and logging. It also checks that manifest permissions and existing DNR rules remain consistent with the V2 listener behavior where applicable.
tests/unit/background/webrequest-listeners.test.mjs

qodo-code-review · 2026-10-14T15:56:10Z

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

1. ~~A listener test exceeds 100 columns~~ ✓ Resolved

Description

The final assert.match call keeps its regular expression on one physical line at
tests/unit/background/webrequest-listeners.test.mjs:427. Because the added line is non-comment and
longer than 100 characters, the test file violates the source-width limit even though ESLint does
not flag it.

Code

tests/unit/background/webrequest-listeners.test.mjs[427]
+    /registerBlockingHeaderListeners\(\s*Browser\.webRequest,\s*Browser\.runtime\.getManifest\(\)\.manifest_version,?\s*\)/,

Evidence
The added assertion at line 427 places the entire regular expression on one non-comment physical
line that exceeds the checklist's 100-character limit.
Rule 2261946: Limit source line length to 100 characters
tests/unit/background/webrequest-listeners.test.mjs[427-427]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The regular-expression assertion is a non-comment source line longer than 100 characters.

## Fix Focus Areas
- tests/unit/background/webrequest-listeners.test.mjs[427-427]

## Recommended Fix
Split the regular expression across multiple physical lines while preserving the same assertion and matching behavior, keeping every line at or below 100 characters.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Context sources

✅ Compliance rules (platform): 6 rules

Review mode: Auto: ⚖️ Balanced: Runtime header rewriting changes have meaningful cross-browser behavioral risk.

Tip of the day

💡 Did you know, you can pick a display mode instead of tweaking every Display option by hand

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Previous reviews

Review updated until commit bdee8a5 ⚖️ Balanced

Results up to commit d0e7869 ⚖️ Balanced

No changes from previous review

Results up to commit c9f5f90 ⚖️ Balanced

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. ~~A listener test exceeds 100 columns~~ ✓ Resolved

Description

The final assert.match call keeps its regular expression on one physical line at
tests/unit/background/webrequest-listeners.test.mjs:427. Because the added line is non-comment and
longer than 100 characters, the test file violates the source-width limit even though ESLint does
not flag it.

Code

tests/unit/background/webrequest-listeners.test.mjs[427]
+    /registerBlockingHeaderListeners\(\s*Browser\.webRequest,\s*Browser\.runtime\.getManifest\(\)\.manifest_version,?\s*\)/,

Evidence
The added assertion at line 427 places the entire regular expression on one non-comment physical
line that exceeds the checklist's 100-character limit.
Rule 2261946: Limit source line length to 100 characters
tests/unit/background/webrequest-listeners.test.mjs[427-427]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The regular-expression assertion is a non-comment source line longer than 100 characters.

## Fix Focus Areas
- tests/unit/background/webrequest-listeners.test.mjs[427-427]

## Recommended Fix
Split the regular expression across multiple physical lines while preserving the same assertion and matching behavior, keeping every line at or below 100 characters.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

cubic-dev-ai

No issues found across 3 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{View guided diff | Re-trigger cubic}

greptile-apps · 2026-10-14T15:57:19Z

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no actionable issues were found.

Summary

Moves Bing and Claude header listeners into a shared module and registers them only on Manifest V2.

Manifest v3 skips Bing and Claude's JavaScript header listeners.
Bing and Claude rewrites leave requests unchanged when no safe rewrite is available.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Background starts] --> B{Manifest version}
  B -->|V2| C[Register blocking Bing and Claude listeners]
  B -->|V3 or later| D[Skip header listeners]
  D --> E[Existing DNR rules rewrite headers]

_{Reviews (3) · Last reviewed commit: "Register blocking header rewrites only o..." · Reviewed by Greptile}

pullfrog

✅ No new issues found.

Reviewed changes — extracted the Manifest V2-only Bing/Claude blocking header-rewrite listeners into a testable module and gated their registration on the manifest version.

src/background/index.mjs — the two inline onBeforeSendHeaders registrations are replaced by one registerBlockingHeaderListeners(Browser.webRequest, Browser.runtime.getManifest().manifest_version) call, still inside the existing try { … } catch for webRequest setup.
src/background/webrequest-listeners.mjs — new module exporting the rewrite value maps and registerBlockingHeaderListeners; it returns early on MV3+ and registers both listeners with ['requestHeaders', 'blocking'] on MV2. Unknown/missing requestHeaders and thrown rewrites now fail closed (undefined) instead of returning a partially mutated array, and error logs carry only the URL.
tests/unit/background/webrequest-listeners.test.mjs — covers registration gating, rewrites, fail-closed behavior, log sanitization, and keeps rules.json and the manifest expectations in sync with the listener filters.

The MV3 removal is provably a no-op reduction: the old listeners already ran non-blocking there ('blocking' was gated on manifest_version < 3), so their return values were discarded, and rules.json rules 1/3 remain the MV3 mechanism. MV2 registration and rewrite behavior are unchanged. I verified the suite (npm test, 1122 passing, including the 15 new tests), eslint/prettier on the changed files, and a production build — all green.

^{｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

chatgpt-codex-connector · 2026-10-14T15:58:04Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T16:10:42.728072Z	`bdee8a5`	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

Copilot

🟢 Approval recommended

The manifest gating is correct, preserves existing rewrite behavior, and is comprehensively tested.

0 open findings

What changed in this PR

Limits blocking header rewrites to Manifest V2 while preserving Manifest V3 DNR behavior.

Changes:

Extracts Bing and Claude header rewriting into a tested module.
Removes unnecessary Manifest V3 listeners and sensitive failure logging.
Adds coverage for registration, rewrites, failure handling, and DNR consistency.

File	Description
`src/background/index.mjs`	Uses the manifest-aware registration helper.
`src/background/webrequest-listeners.mjs`	Implements gated, defensive header rewrites.
`tests/unit/background/webrequest-listeners.test.mjs`	Tests listeners and DNR parity.

🧠 Review effort: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

🟢 Approval recommended

The focused refactor preserves successful Manifest V2 rewrites and removes ineffective Manifest V3 listeners, with no blocking issues identified.

0 open findings

🧠 Review effort: Balanced

cubic-dev-ai

All reported issues were addressed across 2 files (changes from recent commits).

_{Tip: Get a Slack DM when cubic finishes reviewing your PRs. Connect Slack

View guided diff | Re-trigger cubic}

qodo-code-review · 2026-10-16T15:52:09Z

Code review by qodo was updated up to the latest commit c9f5f90

Skip ineffective Bing and Claude listeners on manifest v3, where the existing DNR rules handle header rewrites. Preserve manifest v2 rewrites, remove per-request debug logging, and handle rewrite failures consistently. Add tests for listener registration, rewrites, and DNR rule consistency.

Copilot

🟢 Approval recommended

The focused refactor preserves existing header handling while removing redundant Manifest V3 listeners, with no identified blocking issues.

0 open findings

🧠 Review effort: Balanced

qodo-code-review · 2026-10-16T16:42:53Z

Code review by qodo was updated up to the latest commit bdee8a5

Copilot AI balanced review requested due to automatic review settings October 14, 2026 15:54

Copilot started reviewing on behalf of PeterDaveHello October 14, 2026 15:54

View session

qodo-code-review Bot added the 🕐 20-40 Minutes label Oct 14, 2026

cubic-dev-ai Bot reviewed Oct 14, 2026

View reviewed changes

pullfrog Bot approved these changes Oct 14, 2026

View reviewed changes

Copilot AI reviewed Oct 14, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings October 16, 2026 15:29

PeterDaveHello force-pushed the perf/skip-mv3-noop-webrequest-listeners branch from d0e7869 to c9f5f90 Compare October 16, 2026 15:29

Copilot started reviewing on behalf of PeterDaveHello October 16, 2026 15:30

View session

Copilot AI reviewed Oct 16, 2026

View reviewed changes

cubic-dev-ai Bot reviewed Oct 16, 2026

View reviewed changes

Comment thread src/background/webrequest-listeners.mjs Outdated

qodo-code-review Bot reviewed Oct 16, 2026

View reviewed changes

Comment thread tests/unit/background/webrequest-listeners.test.mjs Outdated

Copilot AI balanced review requested due to automatic review settings October 16, 2026 16:06

PeterDaveHello force-pushed the perf/skip-mv3-noop-webrequest-listeners branch from c9f5f90 to bdee8a5 Compare October 16, 2026 16:06

Copilot started reviewing on behalf of PeterDaveHello October 16, 2026 16:07

View session

Copilot AI reviewed Oct 16, 2026

View reviewed changes

Conversation

PeterDaveHello commented Oct 14, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qodo-code-review Bot commented Oct 14, 2026

PR Summary by Qodo

Uh oh!

qodo-code-review Bot commented Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot commented Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Diagram

Uh oh!

pullfrog Bot left a comment

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot commented Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

qodo-code-review Bot commented Oct 16, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

qodo-code-review Bot commented Oct 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

PeterDaveHello commented Oct 14, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 14, 2026 •

edited

Loading

qodo-code-review Bot commented Oct 14, 2026 •

edited

Loading

greptile-apps Bot commented Oct 14, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 14, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading