Skip to content

Managed build and approved origins

Guidepost ships from one codebase in two production flavours. The flavour is chosen at build time with GUIDEPOST_BUILD.

Flavour Host access in the manifest Who grants site access
store (default) None. optional_host_permissions is https://*/* plus http://localhost/* and http://127.0.0.1/* Each user, per site, from a click
managed host_permissions equals the list in GUIDEPOST_APPROVED_ORIGINS You, at build time. Users are not asked
dev http://localhost/* Used by the e2e suite. Do not ship

The rule lives in one function, hostPermissionsFor in apps/extension/build-flavour.ts (decision 76). WXT copies a content script's matches into host_permissions by default, so the build overwrites that list with the flavour's own.

Building a managed package

GUIDEPOST_BUILD=managed \
GUIDEPOST_APPROVED_ORIGINS="https://claims.example.com,https://*.example.com" \
pnpm build

GUIDEPOST_APPROVED_ORIGINS is comma-separated. Whitespace is trimmed and empty entries are dropped. Each entry is a Chrome match pattern and becomes a host_permissions entry as written.

The output is apps/extension/.output/chrome-mv3. Use pnpm zip to package it. For Edge use pnpm build:edge, which writes .output/edge-mv3; run it with the same two variables set.

Warning

Dev, store and managed builds all write to .output/chrome-mv3. A later build overwrites an earlier one. Package each flavour before building the next.

What approved origins do

The content script gate is registered at run time with scripting.registerContentScripts for granted origins only, in all frames. With a managed build the granted set is the approved list from the first run, so users see tours with no prompt. Content still only appears on pages that match a published item's path patterns for the app.

Gotchas

  • An empty GUIDEPOST_APPROVED_ORIGINS with GUIDEPOST_BUILD=managed gives a build with no host permissions. Nothing runs until a user grants a site.
  • GUIDEPOST_BUILD and GUIDEPOST_APPROVED_ORIGINS are read by wxt.config.ts when it starts. A typo in the flavour name falls through to the store rules without a warning.
  • Wildcard approvals are as broad as the pattern says. https://*/* in a managed build gives the extension access to every HTTPS site on managed devices. Prefer an explicit list.
  • A managed build is for your fleet. Do not publish it to a public store.