Verification cases - mv2-to-mv3-migration-test-checklist

Per-item verification matrices and worked test code for the six migration sections plus the Firefox divergence cells. The skill's Step 2 walks these; the SW-survival core test lives inline in SKILL.md Step 2. Sources are in the link list at the bottom.

Section 1 - Update the manifest

Per cr-checklist, three items:

import manifest from '../dist/manifest.json';
import { describe, it, expect } from 'vitest';

describe('MV3 manifest - Section 1', () => {
  it('manifest_version is 3', () => {
    expect(manifest.manifest_version).toBe(3);
  });

  it('no host patterns left in permissions[]', () => {
    const hostPattern = /^(\*|https?):\/\//;
    const stray = (manifest.permissions ?? []).filter((p: string) =>
      hostPattern.test(p)
    );
    expect(stray).toEqual([]);
  });

  it('web_accessible_resources is object-array shape', () => {
    const war = manifest.web_accessible_resources ?? [];
    for (const entry of war) {
      expect(typeof entry).toBe('object');
      expect(Array.isArray(entry.resources)).toBe(true);
      expect(Array.isArray(entry.matches) || Array.isArray(entry.extension_ids)).toBe(true);
    }
  });
});

Section 2 - Migrate to a service worker

Per cr-checklist, eight items; each maps to a runtime assertion against the loaded extension (not just the manifest). The SW-survival test for the "Persist states" item is in SKILL.md Step 2.

Section 3 - Update API calls

Per cr-checklist, six items:

The scripting namespace requires the "scripting" permission per cr-scripting; verify the inventory included it after migration.

Section 4 - Replace blocking web request listeners

Per cr-checklist, two items:

test('DNR ruleset is well-formed', () => {
  const dnr = manifest.declarative_net_request;
  expect(dnr).toBeDefined();
  expect(Array.isArray(dnr.rule_resources)).toBe(true);
  for (const rs of dnr.rule_resources) {
    expect(typeof rs.id).toBe('string');
    expect(typeof rs.path).toBe('string');
    expect(typeof rs.enabled).toBe('boolean');
  }
});

Per cr-dnr, each rule resource must declare id, enabled, and path to a JSON file containing the rule array.

Section 5 - Improve extension security

Per cr-checklist, four items, all assertable against the built manifest + source:

it('CSP is MV3 object shape with no unsafe-eval', () => {
  const csp = manifest.content_security_policy;
  expect(typeof csp).toBe('object');
  expect(typeof csp.extension_pages).toBe('string');
  expect(csp.extension_pages).not.toMatch(/unsafe-eval/);
  expect(csp.extension_pages).not.toMatch(/https?:\/\//); // no remote hosts
});

Per cr-mig-overview: "Manifest V3 removes support for remotely hosted code and execution of arbitrary strings."

Firefox divergence cells

Per ff-mig, Firefox MV3 diverges from Chrome MV3 in four observable ways; each gets its own conditional test, gated on target browser:

Notes from ff-mig: "if an extension update grants new host permissions, these are not shown to the user" - a test asserting "new host permissions trigger a re-prompt on update" will fail on Firefox; document as expected. Also rename the deprecated applications manifest key to browser_specific_settings, and ensure browser_specific_settings.gecko.id is set for Firefox AMO publication.

Section 6 - Publication rollout gates

Per cr-checklist section 6 (publish):