Touch up GM Api's for release

Author: MrBlankCoding

README.md

@@ -1,56 +1,79 @@
 # CodeTweak
 
-**CodeTweak** is a modern user script manager and JavaScript editor, designed as a modern alternative to Tampermonkey. It is fully open source and built with privacy in mind.
+CodeTweak is a Manifest V3 userscript manager with a built-in editor.
 
----
+## What it does
 
-## Description
+- Create, edit, enable, and disable userscripts.
+- Run scripts by URL pattern and run timing.
+- Support common GM APIs (`GM_getValue`, `GM_setValue`, `GM_xmlhttpRequest`, etc).
+- Import scripts from Greasy Fork.
 
-CodeTweak provides full support for **Manifest V3**, offering a modern code editor with linting, formatting, basic autocomplete, and syntax highlighting. It supports all safe GM APIs and URL matching. Users can install scripts directly from **Greasy Fork** and manage them via the dashboard.
+## Install
 
-We prioritize privacy: **no tracking, no analytics, no selling of user data**. All permissions are only requested for GM API support.
+### Chrome / Chromium (manual)
 
----
+```bash
+npm install
+npm run build:chrome
+```
 
-## Features
+Then:
 
-* **Code Editor** — Customizable editor with linting, formatting, autocomplete, and syntax highlighting.
-* **GM API Support** — Supports all safe GM APIs.
-* **Regex URLs** — Modern regex support for URL matching.
-* **Greasy Fork Integration** — Install scripts directly from CodeTweak or the Greasy Fork website.
-* **Privacy First** — No tracking, no analytics, only necessary permissions.
+1. Open `chrome://extensions`.
+2. Enable `Developer mode`.
+3. Click `Load unpacked`.
+4. Select `build/chrome`.
 
----
+### Firefox (manual)
 
-## Contributing
+```bash
+npm install
+npm run build:firefox
+```
 
-We welcome contributions from the community! Whether fixing bugs, adding features, or improving documentation, your help is appreciated.
+Use the generated package:
 
-### Development
+- `build/codetweak-firefox.zip`
 
-#### Prerequisites
+## Development
 
-* Node.js 16+
-* npm
-* Chrome/Chromium browser
+```bash
+npm install
+npm run lint
+npm run build:chrome
+npm run build:firefox
+```
 
-#### Build
+Docs:
 
 ```bash
-npm install
-npm build.js
+npm run docs:dev
+npm run docs:build
 ```
 
----
+## Project structure
+
+- `src/` extension source
+- `buildScripts/` browser build scripts
+- `docs-src/` VitePress documentation source
 
-## Acknowledgments
+## Example userscript
 
-* Built with [CodeMirror](https://codemirror.net/)
-* Inspired by [Tampermonkey](https://www.tampermonkey.net/) and [Greasemonkey](https://www.greasespot.net/)
-* Icons from [Feather](https://feathericons.com/)
+```javascript
+// ==UserScript==
+// @name        Demo: mark page ready
+// @match       https://example.com/*
+// @run-at      document-end
+// @grant       GM_setValue
+// ==/UserScript==
 
----
+(async () => {
+  document.body.setAttribute("data-codetweak", "ready");
+  await GM_setValue("lastRun", Date.now());
+})();
+```
 
 ## License
 
-This project is licensed under the **MIT License**. See the [LICENSE](LICENSE.txt) file for details.
+MIT. See `LICENSE.txt`.

buildScripts/build-firefox.js

@@ -38,21 +38,17 @@ for (const dir of copyDirs) {
 
 const chromeManifest = JSON.parse(readFileSync("src/manifest.json", "utf8"));
 const firefoxManifest = { ...chromeManifest };
-
-// Firefox MV3 uses background.scripts instead of background.service_worker
 if (firefoxManifest.background?.service_worker) {
   firefoxManifest.background = {
     scripts: [firefoxManifest.background.service_worker],
     type: "module",
   };
 }
 
-// Remove Chrome-specific permissions
 firefoxManifest.permissions = (firefoxManifest.permissions || []).filter(
   (p) => p !== "offscreen"
 );
 
-// Remove the 'world' property from content_scripts (not supported in Firefox)
 if (firefoxManifest.content_scripts) {
   firefoxManifest.content_scripts = firefoxManifest.content_scripts.map(
     (cs) => {
@@ -66,9 +62,6 @@ firefoxManifest.browser_specific_settings = {
   gecko: {
     id: "codetweak@MrBlankCoding",
     strict_min_version: "128.0",
-    data_collection_permissions: {
-      required: ["none"],
-    },
   },
 };
 
@@ -89,20 +82,73 @@ await build({
     "src/popup/popup.js",
     "src/editor/editor.js",
     "src/dashboard/dashboard.js",
-    "src/ai_dom_editor/ai_dom_content.js",
-    "src/ai_dom_editor/ai_dom_sidebar.js",
-    "src/ai_dom_editor/ai_dom_editor.js",
-    "src/ai_dom_editor/ai_settings.js",
+    "src/ai_dom_editor/editor/ai_dom_content.js",
+    "src/ai_dom_editor/sidebar/ai_dom_sidebar.js",
+    "src/ai_dom_editor/editor/ai_dom_editor.js",
+    "src/ai_dom_editor/settings/ai_settings.js",
   ],
   bundle: true,
   outdir,
   logLevel: "info",
   platform: "browser",
   define: {
     "process.env.BROWSER": JSON.stringify(browser),
+    global: "window",
   },
 });
 
+// --- POST-BUILD CLEANUP --- //
+// Remove eval and Function("return this") which violate CSP
+const filesToCleanup = [
+  join(outdir, "ai_dom_editor/editor/ai_dom_editor.js"),
+  join(outdir, "editor/editor.js"),
+  join(outdir, "dashboard/dashboard.js"),
+  join(outdir, "popup/popup.js"),
+  join(outdir, "ai_dom_editor/settings/ai_settings.js"),
+  join(outdir, "GM/gm_core.js"),
+];
+
+for (const file of filesToCleanup) {
+  try {
+    let content = readFileSync(file, "utf8");
+    let changed = false;
+
+    if (content.includes('Function("return this")')) {
+      content = content.replace(/Function\("return this"\)/g, "(function() { return window; })");
+      changed = true;
+    }
+    if (/new\s+Function\s*\(\s*['"]unsafeWindow['"]\s*,\s*userCode\s*\)/.test(content)) {
+      content = content.replace(/new\s+Function\s*\(\s*['"]unsafeWindow['"]\s*,\s*userCode\s*\)/g, "(function(){ throw new EvalError('Function constructor is blocked in Firefox'); })");
+      changed = true;
+    }
+
+    const evalPatterns = [
+      /eval\("this"\)/g,
+      /\(1,\s*eval\)\("this"\)/g,
+    ];
+
+    for (const pattern of evalPatterns) {
+      if (pattern.test(content)) {
+        content = content.replace(pattern, "window");
+        changed = true;
+      }
+    }
+
+    const iframeWritePattern = /iframeDocument\.write\([^;]*document\.F=Object[^;]*\);/g;
+    if (iframeWritePattern.test(content)) {
+      content = content.replace(iframeWritePattern, "iframeDocument.F = Object;");
+      changed = true;
+    }
+
+    if (changed) {
+      writeFileSync(file, content);
+      console.log(`Cleaned up CSP-violating patterns in ${file}`);
+    }
+  } catch (err) {
+    console.warn(`Could not cleanup ${file}: ${err.message}`);
+  }
+}
+
 // --- ZIP IN PRODUCTION --- //
 if (isProduction) {
   const archiveName = `codetweak-firefox.zip`;

docs-src/README.md

@@ -1,5 +1,11 @@
-# CodeTweak Docs Source
+# Docs Source
 
-This folder contains VitePress source files.
+VitePress source files for CodeTweak docs.
 
-Build output is generated into `/docs` for GitHub Pages.
+## Commands
+
+```bash
+npm run docs:dev
+npm run docs:build
+npm run docs:preview
+```

docs-src/guide/dashboard.md

@@ -1,28 +1,25 @@
 # Manage Scripts
 
-Use the dashboard to control all scripts.
+Use the dashboard to control scripts and global settings.
 
-## Script list
+## Script list actions
 
-You can:
+- Enable or disable scripts.
+- Search by script name.
+- Filter by status and run timing.
+- Open script in editor.
+- Delete script.
 
-- Enable or disable scripts
-- Search by name
-- Filter by website, status, and run timing
-- Edit or delete scripts
+## Settings that matter
 
-## Settings tab
+- `Enable scripts by default`
+- `Show notifications`
+- `Enhanced debugging`
+- `Allow external resources`
+- `Confirm first run`
 
-Main settings include:
+## Safe defaults
 
-- Enable scripts by default
-- Show notifications
-- Enhanced debugging
-- Allow external resources
-- Confirm first run
-
-## Best practices
-
-- Keep unused scripts disabled.
-- Review scripts with broad `@match` rules.
-- Keep `allow external resources` off unless needed.
+- Keep `Allow external resources` off unless needed.
+- Keep URL scope tight in `@match`.
+- Disable scripts you are not using.

docs-src/guide/editor.md

@@ -1,32 +1,57 @@
 # Use the Editor
 
-The editor is where you write and save scripts.
+CodeTweak has two editing modes:
 
-## Create a script
+- Standard script editor
+- AI DOM Editor sidebar
 
-1. Open dashboard.
-2. Click `New Script`.
-3. Fill script name and metadata.
+## Standard editor workflow
 
-## Recommended metadata
+1. Set metadata.
+2. Write script code.
+3. Save.
+4. Test on a matching URL.
+
+Minimal metadata template:
 
 ```javascript
 // ==UserScript==
-// @name         My Script
-// @match        *://example.com/*
-// @run-at       document_end
+// @name        My Script
+// @match       https://app.example.com/*
+// @run-at      document-end
+// @grant       GM_getValue
+// @grant       GM_setValue
 // ==/UserScript==
 ```
 
-## Run timing
+State example:
+
+```javascript
+(async () => {
+  const count = await GM_getValue("count", 0);
+  await GM_setValue("count", count + 1);
+  console.log("runs:", count + 1);
+})();
+```
+
+## AI DOM Editor workflow
+
+1. Open popup.
+2. Click `AI DOM Editor`.
+3. Click `Select Element` in sidebar.
+4. Click target element on page.
+5. Enter instruction.
+
+Example instructions:
+
+- `Hide this element`
+- `Change this button text to "Checkout"`
+- `Add red border to this card`
 
-- `document_start`: runs early
-- `document_end`: runs when DOM is ready
-- `document_idle`: runs after page load
+Review generated code before saving.
 
-## Tips
+## Common mistakes
 
-- Keep one purpose per script.
-- Use clear names.
-- Keep match patterns narrow.
-- Test on one site before broad patterns.
+- `@match` too broad (`*://*/*`) or too narrow.
+- Wrong `@run-at` for the DOM state you expect.
+- Missing `@grant` for GM APIs.