fix: limit Chrome-only permissions to non-Firefox browsers

[ryan-carpenter]

Closes #695 by removing a redundant permission and limiting Chrome-only permissions to non-Firefox builds. Claude.ai suggested changes, I inspected, implemented, and tested in Firefox. The manifest warnings were resolved. I have not tested in Chrome.

[tobiasdiez]

might want to change this to "browser == chrome => offscreen included". But for now that's okay.

[ryan-carpenter]

Claude originally suggested browser === 'chrome' ? ['offscreen'] and browser === "chrome" || browser === "edge" || browser === "opera" ? ["offscreen"].

I reversed this and excluded Firefox, to grant the permission to chromium-based browsers without listing them explicitly. Failing to provide permission to a chromium browser could break functionality, whereas granting permission to a Firefox/Gecko browser only produces a warning that users don't see. Firefox can't use the permission in any case, so if the extension depends on this, it has to be provided another way.

[tobiasdiez]

Thanks a lot!

[tobiasdiez]

CI fails now with a strange

  pnpm wxt submit \
    --dry-run \
    --firefox-zip .output/*-firefox.zip --firefox-sources-zip .output/*-sources.zip

[error] Invalid config:
  - `firefox.jwtIssuer`: Expected a nonempty string but received an empty one
  - `firefox.jwtSecret`: Expected a nonempty string but received an empty one

I don't understand this and sadly don't have time right now to investigate further. Will look at it again hopefully at the end of next week.

[ryan-carpenter]

pnpm wxt submit needs jwtIssuer and jwtSecret to authenticate the request, with or without --dry-run. ClaudeAI says to add the credentials, if you have them, to .env using wxt submit init, which will prompt you for
FIREFOX_JWT_ISSUER, FIREFOX_JWT_SECRET, and FIREFOX_EXTENSION_ID as well as credentials for other browser stores. FIREFOX_EXTENSION_ID is optional because it is also provided by the manifest. Alternatively, you can export FIREFOX_JWT_ISSUER, FIREFOX_JWT_SECRET to your environment.

[Siedlerchr]

github secrets are not available on forks, that's why CI is failing