Ajax Session Capture

# Chrome Web Store listing kit — Ajax Session Capture Everything needed to publish `capture-extension-v<version>.zip` on the Chrome Web Store. Hand this file + the ZIP to whoever owns the developer account. ## Upload steps 1. Chrome Web Store **Developer Dashboard** → **Add new item**. 2. Upload `capture-extension-v<version>.zip` (built with `npm run package`). 3. Fill the **Store listing**, **Privacy practices**, and **Distribution** tabs (below). 4. **Submit for review.** Sensitive-permission extensions can take longer than the usual few days. ## Store listing - **Item name:** Ajax Session Capture - **Category:** Developer Tools - **Language:** English - **Short description (≤132 chars):** Capture your authenticated session for a pentest target and hand it to the EmulateAI Ajax launch wizard. - **Detailed description:** > Ajax Session Capture lets a security operator hand an already-authenticated > session to the EmulateAI Ajax launch wizard without copy-pasting tokens. > > You start a capture from the Ajax wizard, authorize the extension for the one > target site you're testing, and sign in to that target in your own browser. > The extension reads the resulting session — cookies, and any OAuth2/bearer > token, refresh token, and token endpoint — and delivers it back to the wizard > page for review before the scan. > > Because you sign in yourself in a normal browser tab, it works against targets > that block automated logins (Cloudflare Access, CAPTCHA, magic links). > > The extension requests access to only the single site you authorize, for the > duration of that capture, and gives the access back afterwards. Captured data > is delivered only to your own Ajax wizard page in the same browser — never to > EmulateAI or any third party. - **Screenshots (need ≥1, 1280×800 or 640×400):** suggested shots — 1. The extension popup showing the numbered capture steps. 2. The Ajax wizard "Capture with browser" step with the live step guide. 3. The masked review/prefill after a capture. ## Single purpose (required) Capture the operator's authenticated session for a single, operator-authorized pentest target and deliver it to the EmulateAI Ajax launch wizard running in the same browser. ## Permission justifications (required — reviewers read these) - **`cookies`** — Reads the session cookies of the one target site the operator authorizes for a capture, to assemble the credential handed to the operator's own Ajax wizard. - **`webRequest`** — Observes the authorized target's request headers (`Authorization`) and its OAuth2 token-endpoint request, to capture a bearer/refresh token and token URL. Observe-only; no blocking or modification. - **`scripting`** — Injects a one-shot reader into the authorized target tab to read the session token from page storage (localStorage / sessionStorage / IndexedDB). Nothing is injected into any other site. - **`tabs`** — Opens the target's login in a tab and tracks that tab so capture is scoped to it. - **Host permissions (`*://*/*`, declared as `optional_host_permissions`)** — The extension holds **no** standing host access. For each capture it requests access to just the single target origin via Chrome's per-site prompt, uses it only during that capture, and **relinquishes it immediately after** delivery. ## Privacy practices tab - **Does it collect user data?** Yes — *Authentication information* (the target session: cookies and tokens). - **Purpose:** App functionality only. - **Disclosures:** Data is used solely to deliver the captured session to the operator's own Ajax wizard page in the same browser. It is **not** sold, **not** transferred to third parties, and **not** sent to EmulateAI servers. No analytics, no remote code. - **Privacy policy URL:** https://emulateai.ai/privacy-policy ## Distribution - **Visibility:** Public (as decided). Consider **Unlisted** if you'd rather keep it link-only given it's an internal tool. ## Before packaging — confirm the production origin `npm run package` strips `localhost`/`127.0.0.1` and ships only the `*.emulateai.ai` / `*.emulateai.dev` content-script origins. If the production Ajax-ui is served from a different domain, add it to `content_scripts[].matches` in `manifest.json` first, or the extension won't detect the wizard.