This is to match the current permissions Better3.0 uses. If any addon requires more permissions, for example, "notifications" or https://assets.scratch.mit.edu, they should be added as optional permissions.

Is your feature request related to a problem? Please describe.

Right now, it returns undefined, which can cause problems and even make you not notice misspellings.

Describe the solution you'd like

Make the function throw when the option ID isn't present in the manifest. Addons can't dynamically create settings, so there are no situations where throwing would be unexpected.

Describe the new addon

It allows you to see which blocks currently run in the Scratch editor.

Link to the new addon

https://gist.github.com/BoomerScratch/0592337050810244236d69a4267b3913

Is your feature request related to a problem? Please describe.

Many addons that interact with the editor will likely want a direct reference to the Scratch VM object.

Describe the solution you'd like

A new method inside addon.tab that resolves to the VM object when it's found.

Describe alternatives you've considered

Make the promise reject if the VM won't ever be found? Not sure how that would work.

Additional context

Code here: https://gist.github.com/BoomerScratch/0592337050810244236d69a4267b3913

I got used to clicking once on the Scratch Notifier extension icon to open messages. Here, it wouldn't work since we want to implement popups (#16). Maybe we could find a way to trigger an action when the icon is double clicked, and allow the user to choose which addon can listen to that event.

Describe the new addon
when you get to a project 404 page maybe an addon can exist that attempts to see if it exists and then display it/link to it with scratch-gui or something idk

Link to the new addon
this is a suggestion but i think i'll try making it

Should work in all execution contexts, and be an event target.
"Child" settings, like the ones in the scratch-notifier addon, should only return true if their parent setting is enabled.

We can use chrome.runtime.getManifest().version to get the current extension version, and then we can fetch the manifest on raw.githubusercontent.com. We can also fetch the CRX file from the chrome web store, extract it and read the manifest.json for more accuracy, but that requires more work and libraries.

If the manifest version doesn't equal, the user will be notified. We need to discuss a way to notify the user. If the user then opens the pop-up (the window that appears when clicking the extension icon), a message will appear saying that there is an update available. It also tells the user how to update the extension.

In the options page, there should also be a switch that disables/enables update notifications (enabled by default) and a number input which allows the user to change the update check interval. (I recommend 1 hour as the default value)

(I know that Chrome updates extensions automatically, but this is just something useful idk)

Here are the userstyles that I have collected so far:

Scratch forum editor buttons .svg’s
• https://github.com/JeffaloBob/material-scratch-forum-editor-buttons
Forum quote beautifier:
• https://github.com/BoomerScratch/userstyles/blob/master/scratch-forum-quote-code-beautifier.user.css
Forum post scrollbars:
• https://github.com/BoomerScratch/userstyles/blob/master/scratch-forum-quote-code-beautifier.user.css
Scratch forums long signatures and scratch blocks scrollbarifier:
• https://sheeptester.github.io/hello-world/userscripts/scratch-forums.user.css
Scratch dark mode (by _nix)
• https://gist.github.com/towerofnix/806550f907da63f63f55bb39c99789bf

(I am in the process of archiving these)

Allow addons to add "right click extension icon" actions. However because of browser limitations, I think only about 5 addons could do this at the same time.
We should also consider allowing addons to add menu items when right clicking inside the Scratch website.

Describe the bug

To Reproduce

Load the extension and click the "Errors" button.

Expected behavior

Works normally

Device (please complete the following information):

Windows 10, Chrome 84

We should request the notification permission (and others potentially) only when the user enables an addon or addon setting that needs it. This is important to get approved in Chrome Web Store.

Describe the bug

To Reproduce

Open the options page. See Not Working icons
Open console
See
not available

index.html:121 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval'". Either the 'unsafe-inline' keyword, a hash ('sha256-rHlxGRx2sBxFirVgDiDAJcH8G0KjhzqrwHXB4CNXtak='), or a nonce ('nonce-...') is required to enable inline execution.
index.html:1 Refused to load the script 'https://code.iconify.design/1/1.0.7/iconify.min.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

Expected behavior

Icons should work

Device (please complete the following information):
ChromeOS

chrome.runtime.setUninstallURL will open an URL once the extension gets uninstalled. It can link to a 'goodbye' page which tells the user to give feedback if they have (using GitHub issues).

https://github.com/ScratchAddons/extension/blob/95fa8f3f2f4857b5e49684afc3728e2de1d3fa6c/background/get-userscripts.js#L36
https://scratch.mit.edu/users/kaj should match https://scratch.mit.edu/users/*/. A slash at the end should be implicit.
I should also remove the function from the window object. I did that to debug something and forgot about it.

I think there's an "eval-free" version that should be suitable here...

Is your feature request related to a problem? Please describe.

Privacy policy: people sometimes want to know which data gets collected, and more. We can create a privacy policy for that.
Security policy: a security policy can be used to tell people what they need to do if they found a security vulnerability.

Describe the solution you'd like

For a privacy policy: create a PRIVACY.md markdown file.
For a security policy: create a SECURITY.md markdown file, or go here.

https://github.com/WorldLanguages/FollowersNumberEnabler (Just amazing, maybe add a # of favorites, comments, curated studios & following studios.)

Probably shouldn't be enabled by default, and we should probably provide settings on what should be loaded, since it slows down the page. I'd be fine with follow counts.

Describe the new addon

Exact count is a JavaScript program that shows the exact number of projects in a Scratch studio, even if it's larger than 100.

Link to the new addon

https://github.com/mxmou/exactcount

Should probably not be enabled by default since it requires multiple requests. Or it could be enabled by default, but require user interaction.

Pls @GDUcrash
Make a pull request with mockup HTML/CSS for the settings page. Then I can make it reactive for Vue. Having an UI to interact with while developing is nice.

We need to find a good way to support userstyles, that isn't porting them as a userscript.

cc @mxmou

Right now it sends notifications for any type of message, let's use the addon.settings API to only do that when the user wants.

Describe the new addon
it uploads images

Link to the new addon
https://github.com/jeffaloBob/scratch-image-uploader

it comes in userscript/extension version, (although the userscript is a super hacky way of doing it...) i'm not really sure how this whole project works, but i'm assuming porting my thingy can't be too hard and its super cool so it must be there...

And we should let users choose what addon can use the badge.
Also, what would happen if the addon the user configured to use the badge got disabled? 🤔

Since this is an userscript collection, I think it is better to make the license compatible with common licenses, so I recommend GPL. For example, if a user requests his GPL-licensed userscript (griffpatch's dev tool for example) to be added, we will have to reject it, and I don't want this to happen! So I recommend using GPL.
There are still incompatible licenses, but they are usually very rare so it becomes a small issue after switching to GPL.
What license do you think we should choose?

Describe the new addon

Enables the full screen button in Scratch's YouTube video player

Link to the new addon

https://github.com/mxmou/customize-scratch#watch-youtube-videos-on-scratch-in-full-screen

Should be disabled by default because it slows down the experience a bit (and I don't think we have a way for userscripts to run on document_start yet, unfortunately)

Let's say a userscript only works on user profiles. The current match would currently be https://scratch.mit.edu/users/*/, why not just userprofile? And other potential filters for common use.

Hello! I am very interested in Scratch extensions and userscripts; I use them on a daily basis. Here are some a userscripts you guys should add:

https://github.com/mxmou/exactcount (Is there a way to show comment, curators, and managers too?)
https://github.com/WorldLanguages/studioToolsBookmarklet (This is amazing.)
https://github.com/WorldLanguages/animatedThumbnailsBookmarklet (You should add a button on the scratch project sites themselves to add a new thumbnail. Also add a way to change thumbnails via MyStuff page.)
https://github.com/WorldLanguages/FollowersNumberEnabler (Just amazing, maybe add a # of favorites, comments, curated studios & following studios.)
https://github.com/WorldLanguages/isOnlinev2 (When I used this, it led me to a porn site. Make a working version of this that will also show if the person is online or not-found to the left of the follower button-, as long as they also use the add-on. )

I know it's a lot and some of this might not be possible, but these would be amazing.
(Can't wait to test out the addon on chrome when it's ready! If you guys have a beta, let me in plz. 😀

First single addon suggestion issue!! 🎉

Describe the new addon

My bookmarklet for studio tools made into an addon.
I should probably make it a bit prettier (it has a weird red as a bookmarklet so that the user can notice it has loaded) and it should be OK to have it enabled by default.

Link to the new addon

https://github.com/WorldLanguages/studioToolsBookmarklet/blob/master/script.js

Should be easy using the _kill() implementation.
Would be useful for when settings change, maybe.

Describe the new addon

Make all links clickable even if they're not inside scratch.mit.edu

Link to the new addon

Inspired by https://github.com/Hans5958/userscripts/blob/master/Scratch/More%20Links%20in%20Scratch.user.js

Would allow us to port Griffpatch's messaging extension into the extension popup, and potentially let users customize what popup to use (or if we let them move between them, their order)

There should be an API that allows userscripts to send messages to their own addon's persistent script, for example.

Describe the new addon

My animated thumbnail bookmarklet as an addon.

Link to the new addon

https://github.com/WorldLanguages/animatedThumbnailsBookmarklet/blob/master/code.js

Should probably be off by default, and add a button so it can be used if enabled.

Describe the new addon

Userscripts that improve Scratch 3. (currently unmaintained, many scripts are broken or work inconsistently)

Link to the new addon

https://github.com/forkphorus/cat-plus#readme

I have created a commit for the README.md file because I thought it looked a little bland. Here's my Pull request! #29

We should allow users to globally mute notifications by using the context menu.

Currently it's only getMsgCount()

• addon.self
• addon.auth
• addon.account
• addon.fetch
• addon.browserTabs & addon.browserWindows
• addon.notifications
• addon.badge
• global

I think it does "weird" stuff by adding a trap to addEventListener. To avoid addons from interfering with each other, such traps should be handled by the addon handler and maybe we should provide a Scratch editor specific API.

Allow userscripts to know basic stuff about the page they're currently on.

You'll want to kill me for this lol, @BoomerScratch, yes I finally want to remove the CSP (but for other reasons)

I believe specifying unsafe-eval in the CSP might cause delays in extension reviews in the Chrome Web Store, sadly, because it's a hint we might be using remote code (we aren't). So, let's try to avoid any issues.
So if we move to a service worker model that allows addon JS files to become modules without us doing it by adding something like export default async function(addon, /* ... */) { at the start of the file, we can then use dynamic import like const addon = await import("url"); addon.default(); to run an addon persistent script, removing the requirement for a CSP since we're not using eval. Technically using eval and changing the code in the service worker produce identical results, but the last approach doesn't require any special manifest declarations to work, which should help with Chrome Web Store review times. The service worker won't be hard to read, so even if we get reviewed, it should be clear there's no remote code execution coming from the service worker. Without a CSP and without a hard to read service worker, a reviewer will easily tell we're not RCEing.
Content scripts aren't affected, and should continue to use eval() because our service worker only works in the background page, however for consistency we should wrap them in an async function as well (oh and TODO: I should make sure these evals are in strict mode as well).
Oh, and with this change, top level await could be used by addon scripts! :)
Only downside I see for this is a few more milliseconds before launching background addons, and the fact the Sources tab in devtools will show export default async function(addon, /* ... */) { at the start of the file, which might affect line number indicators, unless we make the first line of the real file go next to that, which might look weird, but at least line numbers will match.

We can use ESLint for linting code automatically on pull requests and commits. Note: this requires a package.json. EDIT: noticed it isn't needed 😉 It is only required for generating a .eslintrc.json file.

Describe the bug

Firefox send this warning:

Reading manifest: Warning processing options_page: An unexpected property was found in the WebExtension manifest.

To Reproduce

Just load it in firefox.

Expected behavior

Make options page behave normally.

Screenshots

Device (please complete the following information):

• OS: Win10
• Browser: firefox
• Version: none

Additional context

Explain persistent scripts (formerly background scripts), userscripts, frames (formerly popups).
Explain scope when running multiple scripts.
Clarify they always use strict mode.

Describe the new addon

A way to quickly launch projects to Phosphorus, Sulfurous, Forkphorus, Leopard, and other various Scratch compilers/players (if that's the right word.)

These files are community healthfiles in the community profile here

• Description (Technically not a file)
• README
• Code of conduct (#35)
• Contributing guideline
• License
• Issue templates
• PR templates
• Repository admins accept content reports

Describe the bug

Error in event handler: TypeError: Cannot read property 'startsWith' of undefined at chrome.webRequest.onBeforeSendHeaders.addListener.urls (chrome-extension://aeepldbjfoihffgcaejikpoeppffnlbd/background/handle-fetch.js:12:26) at subEventCallback (extensions::webRequestEvent:81:32)

To Reproduce

Not sure, happened while browsing other stuff, then saw the log in the devtools I left open.

Expected behavior

The code should check if details.initiator and details.originUrl are strings. (TODO: look at MDN, when would they not be?)

Device (please complete the following information):

Latest Chromium