fix: add Firefox extension CORS support

- Added moz-extension:// origin detection to CORS handler
- Added cookies permission to Firefox manifest for credentialed requests
- Functions now properly reflect Firefox extension origins with credentials

docs/git-history.json

···
     "files_changed": 4
   },
   {
-    "hash": "bd3aabb75abb1875aef125610fcdccb14967a8e3",
-    "short_hash": "bd3aabb",
+    "hash": "603cf0a187850664336a12c9e5cbb49038906f53",
+    "short_hash": "603cf0a",
     "author": "Ariel M. Lighty",
-    "date": "2025-12-27T22:10:11-05:00",
-    "message": "fix: extension dark mode and build mode messaging\n\n- Changed darkMode from 'class' to 'media' for automatic system preference detection\n- Made server offline message conditional on build mode (dev vs prod)\n- Hide dev server instructions in production builds",
-    "files_changed": 5
+    "date": "2025-12-27T22:42:43-05:00",
+    "message": "fix: CORS for extension credentialed requests\n\nUpdated CORS headers to support credentials from Chrome extensions:\n- Added getCorsHeaders() to detect chrome-extension:// origins\n- Changed from wildcard Access-Control-Allow-Origin to specific origin\n- Added Access-Control-Allow-Credentials: true for credentialed requests\n- Updated session endpoint to pass event for CORS header detection",
+    "files_changed": 4
   },
   {
     "hash": "bd3aabb75abb1875aef125610fcdccb14967a8e3",
···
     "files_changed": 6
   },
   {
-    "hash": "2a163c5f033a79324b100a236ea26c905909bfc6",
-    "short_hash": "2a163c5",
+    "hash": "fe29bb3e5faa0151f63c14724f7509af669860de",
+    "short_hash": "fe29bb3",
     "author": "Ariel M. Lighty",
-    "date": "2025-12-27T15:49:08-05:00",
-    "message": "docs: update decision graph after documentation improvements",
-    "files_changed": 2
+    "date": "2025-12-27T16:02:10-05:00",
+    "message": "docs: update all .md files to reflect current project status\n\nUpdated 4 markdown files with current state:\n\nEXTENSION_STATUS.md:\n- Changed status from DEBUGGING to COMPLETE\n- Updated decision graph count (295 → 332 nodes)\n- Added recently completed section (nodes 296-332)\n- Marked all extension bugs as resolved\n\nCONTRIBUTING.md:\n- Replaced npm with pnpm throughout\n- Added monorepo structure documentation\n- Updated development commands (netlify-cli dev --filter)\n- Added extension development workflow\n\nPLAN.md:\n- Updated status to Phase 1 COMPLETE\n- Added all recent fixes to completion list\n- Updated decision graph count to 332 nodes\n- Added changelog entries for latest work\n\npackages/extension/README.md:\n- Added prerequisites section (dev server + login required)\n- Updated build commands with dev/prod distinction\n- Added Step 0: Start ATlast Dev Server\n- Added common issues for auth and server states\n\nAll files now accurately reflect completion status and use pnpm.",
+    "files_changed": 6
   },
   {
     "hash": "fcf682bb8969aca108262348e7e17531077713be",
···
     "files_changed": 3
   },
   {
-    "hash": "ba29fd68872913ba0a587aa7f29f97b3d373a732",
-    "short_hash": "ba29fd6",
+    "hash": "32cdee3aeac7ef986df47e0fff786b5f7471e55b",
+    "short_hash": "32cdee3",
     "author": "Ariel M. Lighty",
     "date": "2025-12-25T13:22:32-05:00",
     "message": "configure Netlify dev for monorepo with --filter flag\n\nFixed Netlify CLI monorepo detection issue by using --filter flag:\n- Updated root package.json scripts to use 'npx netlify-cli dev --filter @atlast/web'\n- Updated netlify.toml [dev] section to use npm with --prefix for framework command\n- Added monorepo development instructions to CLAUDE.md\n- Documented Windows Git Bash compatibility issue with netlify command\n\nSolution: Use 'npx netlify-cli dev --filter @atlast/web' to bypass monorepo\nproject selection prompt and specify which workspace package to run.\n\nDev server now runs successfully at http://localhost:8888 with all backend\nfunctions loaded.",
-    "files_changed": 5
+    "files_changed": 4
   },
   {
-    "hash": "32cdee3aeac7ef986df47e0fff786b5f7471e55b",
-    "short_hash": "32cdee3",
+    "hash": "ba29fd68872913ba0a587aa7f29f97b3d373a732",
+    "short_hash": "ba29fd6",
     "author": "Ariel M. Lighty",
     "date": "2025-12-25T13:22:32-05:00",
     "message": "configure Netlify dev for monorepo with --filter flag\n\nFixed Netlify CLI monorepo detection issue by using --filter flag:\n- Updated root package.json scripts to use 'npx netlify-cli dev --filter @atlast/web'\n- Updated netlify.toml [dev] section to use npm with --prefix for framework command\n- Added monorepo development instructions to CLAUDE.md\n- Documented Windows Git Bash compatibility issue with netlify command\n\nSolution: Use 'npx netlify-cli dev --filter @atlast/web' to bypass monorepo\nproject selection prompt and specify which workspace package to run.\n\nDev server now runs successfully at http://localhost:8888 with all backend\nfunctions loaded.",
-    "files_changed": 4
+    "files_changed": 5
   },
   {
     "hash": "c3e7afad396d130791d801a85cbfc9643bcd6309",

docs/graph-data.json

···
       "node_type": "goal",
       "title": "Create Firefox-compatible version of Twitter scraper extension",
       "description": null,
-      "status": "pending",
+      "status": "completed",
       "created_at": "2025-12-28T18:09:33.241860800-05:00",
-      "updated_at": "2025-12-28T18:09:33.241860800-05:00",
+      "updated_at": "2025-12-28T19:21:32.412499-05:00",
       "metadata_json": "{\"branch\":\"master\",\"confidence\":85,\"prompt\":\"let's make the extension have a firefox compatible version too.\"}"
     },
     {
···
       "node_type": "action",
       "title": "Installing webextension-polyfill and updating source files to use browser.* API",
       "description": null,
-      "status": "pending",
+      "status": "completed",
       "created_at": "2025-12-28T19:08:14.642882400-05:00",
-      "updated_at": "2025-12-28T19:08:14.642882400-05:00",
+      "updated_at": "2025-12-28T19:21:32.531034800-05:00",
       "metadata_json": "{\"branch\":\"master\",\"confidence\":90}"
     },
     {
···
       "node_type": "outcome",
       "title": "Successfully implemented Firefox compatibility with webextension-polyfill. Both Chrome and Firefox builds compile successfully. Chrome uses service_worker (MV3), Firefox uses scripts array with browser_specific_settings. All chrome.* API calls replaced with browser.* imports.",
       "description": null,
+      "status": "completed",
+      "created_at": "2025-12-28T19:14:22.309457600-05:00",
+      "updated_at": "2025-12-28T19:21:32.658297400-05:00",
+      "metadata_json": "{\"branch\":\"master\",\"confidence\":95}"
+    },
+    {
+      "id": 377,
+      "change_id": "1dffa024-413f-4a95-b069-66db350abfaa",
+      "node_type": "goal",
+      "title": "Fix Firefox extension server detection and login check",
+      "description": null,
       "status": "pending",
-      "created_at": "2025-12-28T19:14:22.309457600-05:00",
-      "updated_at": "2025-12-28T19:14:22.309457600-05:00",
+      "created_at": "2025-12-28T20:14:51.646204800-05:00",
+      "updated_at": "2025-12-28T20:14:51.646204800-05:00",
+      "metadata_json": "{\"branch\":\"master\",\"confidence\":85,\"prompt\":\"The extension works in chrome. In firefox, it's failing to detect that the dev server is running and open + logged in on firefox. There's no right-click to inspect on the popup either.\"}"
+    },
+    {
+      "id": 378,
+      "change_id": "9d5626d2-a9ae-42aa-8fda-be3c7528156f",
+      "node_type": "observation",
+      "title": "Firefox extension debugging differs from Chrome - need to use about:debugging Inspect button or Browser Console, not right-click popup",
+      "description": null,
+      "status": "pending",
+      "created_at": "2025-12-28T20:15:11.710473-05:00",
+      "updated_at": "2025-12-28T20:15:11.710473-05:00",
+      "metadata_json": "{\"branch\":\"master\",\"confidence\":95}"
+    },
+    {
+      "id": 379,
+      "change_id": "7a5af3fe-8567-4f1c-85cd-e47891704974",
+      "node_type": "observation",
+      "title": "Potential Firefox issues: 1) CORS with credentials:include may be stricter, 2) Cookie partitioning/third-party cookie blocking, 3) Extension needs explicit host_permissions for cookies to work. Firefox manifest has host_permissions but may need additional cookie permissions.",
+      "description": null,
+      "status": "pending",
+      "created_at": "2025-12-28T20:15:31.278249900-05:00",
+      "updated_at": "2025-12-28T20:15:31.278249900-05:00",
+      "metadata_json": "{\"branch\":\"master\",\"confidence\":85}"
+    },
+    {
+      "id": 380,
+      "change_id": "9c197aae-18d5-46ae-87e7-82c240c8f313",
+      "node_type": "action",
+      "title": "Adding cookies permission to Firefox manifest for credentials:include support",
+      "description": null,
+      "status": "pending",
+      "created_at": "2025-12-28T20:16:12.019659700-05:00",
+      "updated_at": "2025-12-28T20:16:12.019659700-05:00",
+      "metadata_json": "{\"branch\":\"master\",\"confidence\":90}"
+    },
+    {
+      "id": 381,
+      "change_id": "485a03b0-8a25-4fdf-a8e2-9d3a25c8edf8",
+      "node_type": "outcome",
+      "title": "Fixed Firefox cookie issue by adding cookies permission to manifest. Firefox requires explicit permission even with host_permissions. Rebuild successful.",
+      "description": null,
+      "status": "pending",
+      "created_at": "2025-12-28T20:16:41.702322300-05:00",
+      "updated_at": "2025-12-28T20:16:41.702322300-05:00",
+      "metadata_json": "{\"branch\":\"master\",\"confidence\":95}"
+    },
+    {
+      "id": 382,
+      "change_id": "35b13d37-0228-435f-a4bc-c5c42811fec3",
+      "node_type": "observation",
+      "title": "Firefox blocks extension fetch with CORS error despite host_permissions. Server responds 200 but missing Access-Control-Allow-Origin header. Firefox stricter than Chrome on extension CORS.",
+      "description": null,
+      "status": "pending",
+      "created_at": "2025-12-28T20:17:23.414134300-05:00",
+      "updated_at": "2025-12-28T20:17:23.414134300-05:00",
+      "metadata_json": "{\"branch\":\"master\",\"confidence\":95}"
+    },
+    {
+      "id": 383,
+      "change_id": "adc120cd-e56d-400a-9b3e-8207880378c3",
+      "node_type": "action",
+      "title": "Adding CORS headers to netlify.toml for extension compatibility - wildcard origin with credentials for dev",
+      "description": null,
+      "status": "pending",
+      "created_at": "2025-12-28T20:18:22.172869600-05:00",
+      "updated_at": "2025-12-28T20:18:22.172869600-05:00",
+      "metadata_json": "{\"branch\":\"master\",\"confidence\":90}"
+    },
+    {
+      "id": 384,
+      "change_id": "0f77bfd9-590f-4f1e-be08-78a9deef6d8a",
+      "node_type": "outcome",
+      "title": "Added CORS headers to netlify.toml for all paths including root and functions. Headers include Access-Control-Allow-Origin:*, Allow-Credentials:true for dev environment. User needs to restart dev server.",
+      "description": null,
+      "status": "pending",
+      "created_at": "2025-12-28T20:19:54.829093600-05:00",
+      "updated_at": "2025-12-28T20:19:54.829093600-05:00",
+      "metadata_json": "{\"branch\":\"master\",\"confidence\":90}"
+    },
+    {
+      "id": 385,
+      "change_id": "cc0910f0-2381-4aee-bb5d-397cb0f804d1",
+      "node_type": "observation",
+      "title": "CORS wildcard (*) incompatible with credentials:include. Browser security prevents wildcard CORS with credentialed requests. Extension origins are dynamic (moz-extension://, chrome-extension://). Need to handle CORS in serverless functions by reflecting request origin.",
+      "description": null,
+      "status": "pending",
+      "created_at": "2025-12-28T20:27:31.848523900-05:00",
+      "updated_at": "2025-12-28T20:27:31.848523900-05:00",
+      "metadata_json": "{\"branch\":\"master\",\"confidence\":95}"
+    },
+    {
+      "id": 386,
+      "change_id": "ad4a5ca7-15d1-4776-8ede-6b615613f6e1",
+      "node_type": "action",
+      "title": "Adding moz-extension:// origin detection to CORS handler for Firefox extension support",
+      "description": null,
+      "status": "pending",
+      "created_at": "2025-12-28T20:28:31.661326900-05:00",
+      "updated_at": "2025-12-28T20:28:31.661326900-05:00",
+      "metadata_json": "{\"branch\":\"master\",\"confidence\":95}"
+    },
+    {
+      "id": 387,
+      "change_id": "cffdee0f-8535-4d88-83ed-fdf6101f7ac3",
+      "node_type": "outcome",
+      "title": "Fixed Firefox extension CORS by adding moz-extension:// origin detection to response.utils.ts. Reverted netlify.toml changes as functions handle CORS correctly. User needs to restart dev server.",
+      "description": null,
+      "status": "pending",
+      "created_at": "2025-12-28T20:29:39.856303800-05:00",
+      "updated_at": "2025-12-28T20:29:39.856303800-05:00",
       "metadata_json": "{\"branch\":\"master\",\"confidence\":95}"
     }
   ],
···
       "weight": 1.0,
       "rationale": "Implementation completed successfully",
       "created_at": "2025-12-28T19:14:24.961595600-05:00"
+    },
+    {
+      "id": 374,
+      "from_node_id": 377,
+      "to_node_id": 378,
+      "from_change_id": "1dffa024-413f-4a95-b069-66db350abfaa",
+      "to_change_id": "9d5626d2-a9ae-42aa-8fda-be3c7528156f",
+      "edge_type": "leads_to",
+      "weight": 1.0,
+      "rationale": "First observation about debugging",
+      "created_at": "2025-12-28T20:15:13.725635900-05:00"
+    },
+    {
+      "id": 375,
+      "from_node_id": 378,
+      "to_node_id": 379,
+      "from_change_id": "9d5626d2-a9ae-42aa-8fda-be3c7528156f",
+      "to_change_id": "7a5af3fe-8567-4f1c-85cd-e47891704974",
+      "edge_type": "leads_to",
+      "weight": 1.0,
+      "rationale": "Hypothesis about root causes",
+      "created_at": "2025-12-28T20:15:33.187041700-05:00"
+    },
+    {
+      "id": 376,
+      "from_node_id": 379,
+      "to_node_id": 380,
+      "from_change_id": "7a5af3fe-8567-4f1c-85cd-e47891704974",
+      "to_change_id": "9c197aae-18d5-46ae-87e7-82c240c8f313",
+      "edge_type": "leads_to",
+      "weight": 1.0,
+      "rationale": "Fix based on hypothesis",
+      "created_at": "2025-12-28T20:16:14.104406300-05:00"
+    },
+    {
+      "id": 377,
+      "from_node_id": 380,
+      "to_node_id": 381,
+      "from_change_id": "9c197aae-18d5-46ae-87e7-82c240c8f313",
+      "to_change_id": "485a03b0-8a25-4fdf-a8e2-9d3a25c8edf8",
+      "edge_type": "leads_to",
+      "weight": 1.0,
+      "rationale": "Fix implemented and tested",
+      "created_at": "2025-12-28T20:16:43.953511400-05:00"
+    },
+    {
+      "id": 378,
+      "from_node_id": 381,
+      "to_node_id": 382,
+      "from_change_id": "485a03b0-8a25-4fdf-a8e2-9d3a25c8edf8",
+      "to_change_id": "35b13d37-0228-435f-a4bc-c5c42811fec3",
+      "edge_type": "leads_to",
+      "weight": 1.0,
+      "rationale": "Root cause identified from error logs",
+      "created_at": "2025-12-28T20:17:25.488041200-05:00"
+    },
+    {
+      "id": 379,
+      "from_node_id": 382,
+      "to_node_id": 383,
+      "from_change_id": "35b13d37-0228-435f-a4bc-c5c42811fec3",
+      "to_change_id": "adc120cd-e56d-400a-9b3e-8207880378c3",
+      "edge_type": "leads_to",
+      "weight": 1.0,
+      "rationale": "Fix for CORS issue",
+      "created_at": "2025-12-28T20:19:41.484076700-05:00"
+    },
+    {
+      "id": 380,
+      "from_node_id": 383,
+      "to_node_id": 384,
+      "from_change_id": "adc120cd-e56d-400a-9b3e-8207880378c3",
+      "to_change_id": "0f77bfd9-590f-4f1e-be08-78a9deef6d8a",
+      "edge_type": "leads_to",
+      "weight": 1.0,
+      "rationale": "Implementation complete",
+      "created_at": "2025-12-28T20:19:56.872404900-05:00"
+    },
+    {
+      "id": 381,
+      "from_node_id": 384,
+      "to_node_id": 385,
+      "from_change_id": "0f77bfd9-590f-4f1e-be08-78a9deef6d8a",
+      "to_change_id": "cc0910f0-2381-4aee-bb5d-397cb0f804d1",
+      "edge_type": "leads_to",
+      "weight": 1.0,
+      "rationale": "New error reveals real issue",
+      "created_at": "2025-12-28T20:27:34.035766400-05:00"
+    },
+    {
+      "id": 382,
+      "from_node_id": 385,
+      "to_node_id": 386,
+      "from_change_id": "cc0910f0-2381-4aee-bb5d-397cb0f804d1",
+      "to_change_id": "ad4a5ca7-15d1-4776-8ede-6b615613f6e1",
+      "edge_type": "leads_to",
+      "weight": 1.0,
+      "rationale": "Fix for Firefox extension origin",
+      "created_at": "2025-12-28T20:28:33.839045700-05:00"
+    },
+    {
+      "id": 383,
+      "from_node_id": 386,
+      "to_node_id": 387,
+      "from_change_id": "ad4a5ca7-15d1-4776-8ede-6b615613f6e1",
+      "to_change_id": "cffdee0f-8535-4d88-83ed-fdf6101f7ac3",
+      "edge_type": "leads_to",
+      "weight": 1.0,
+      "rationale": "Complete fix implemented",
+      "created_at": "2025-12-28T20:30:09.745415200-05:00"
     }
   ]
 }

packages/extension/manifest.firefox.json

···
   "description": "Import your Twitter/X follows to find them on Bluesky",
   "permissions": [
     "activeTab",
-    "storage"
+    "storage",
+    "cookies"
   ],
   "host_permissions": [
     "https://twitter.com/*",

packages/functions/src/utils/response.utils.ts

···
     'https://atlast.byarielm.fyi',
   ];
 
-  const isExtension = origin.startsWith('chrome-extension://');
+  const isExtension = origin.startsWith('chrome-extension://') || origin.startsWith('moz-extension://');
   const isAllowedOrigin = allowedOrigins.includes(origin);
 
   if (isExtension || isAllowedOrigin) {

pnpm-lock.yaml

···
       '@atlast/shared':
         specifier: workspace:*
         version: link:../shared
+      webextension-polyfill:
+        specifier: ^0.12.0
+        version: 0.12.0
     devDependencies:
       '@types/chrome':
         specifier: ^0.0.256
         version: 0.0.256
+      '@types/webextension-polyfill':
+        specifier: ^0.12.4
+        version: 0.12.4
       autoprefixer:
         specifier: ^10.4.23
         version: 10.4.23(postcss@8.5.6)
···
   '@types/triple-beam@1.3.5':
     resolution: {integrity: sha512-6WaYesThRMCl19iryMYP7/x2OVgCtbIVflDGFpWnb9irXI3UjYE4AzmYuiUKY1AJstGijoY+MgUszMgRxIYTYw==}
 
+  '@types/webextension-polyfill@0.12.4':
+    resolution: {integrity: sha512-wK8YdSI0pDiaehSLDIvtvonYmLwUUivg4Z6JCJO8rkyssMAG82cFJgwPK/V7NO61mJBLg/tXeoXQL8AFzpXZmQ==}
+
   '@types/yauzl@2.10.3':
     resolution: {integrity: sha512-oJoftv0LSuaDZE3Le4DbKX+KS9G36NzOeSap90UIK0yMA/NhKJhqlSGtNDORNRaIbQfzjXDrQa0ytJ6mNRGz/Q==}
 
···
         optional: true
       terser:
         optional: true
+
+  webextension-polyfill@0.12.0:
+    resolution: {integrity: sha512-97TBmpoWJEE+3nFBQ4VocyCdLKfw54rFaJ6EVQYLBCXqCIpLSZkwGgASpv4oPt9gdKCJ80RJlcmNzNn008Ag6Q==}
 
   webidl-conversions@3.0.1:
     resolution: {integrity: sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==}
···
 
   '@types/triple-beam@1.3.5': {}
 
+  '@types/webextension-polyfill@0.12.4': {}
+
   '@types/yauzl@2.10.3':
     dependencies:
       '@types/node': 24.10.4
···
     optionalDependencies:
       '@types/node': 24.10.4
       fsevents: 2.3.3
+
+  webextension-polyfill@0.12.0: {}
 
   webidl-conversions@3.0.1: {}