Verified against Bolt.new · 2026-07-30
Build a Chrome extension prototype that loads as a real unpacked extension
A Bolt.new brief for a Manifest V3 Chrome extension scoped to the minimum permissions it actually needs, with explicit cross-context message passing and real load-as-unpacked-extension testing steps.
The prompt
Ready to copy — highlighted parts are example details you can swap.
Build a Chrome extension called QuickQuote that lets you highlight text on any webpage and save it as a quote with the source URL, viewable later from the extension popup, using Manifest V3, structured so it can be loaded as a real unpacked extension in Chrome — not just previewed as a regular web page inside Bolt.new's own preview pane, which will not accurately show extension-specific behavior like a popup or a content script. MANIFEST AND PERMISSIONS Write a manifest.json targeting Manifest V3 specifically — background scripts are service workers, not persistent background pages, which changes how state has to be handled (no long-lived in-memory state between events; use chrome.storage instead). Request only the permissions this extension actually needs to do lets you highlight text on any webpage and save it as a quote with the source URL, viewable later from the extension popup — list each permission in the manifest with a one-line comment next to it explaining why it's needed; do not request tabs, webRequest, or history just because they're commonly used in extension examples, since Chrome's Web Store review process and cautious users both treat an overpermissioned extension as a red flag, and an unused permission is pure downside with no upside during this build. COMPONENTS - A content script that adds a small "Save quote" button next to any text selection, plus a popup listing all saved quotes — build this as the primary interaction surface. - Use chrome.storage.local (or chrome.storage.sync if the setting should follow the user across their signed-in Chrome instances) for any persisted setting or data — never localStorage, which behaves inconsistently across an extension's different execution contexts (popup, content script, background service worker each have their own). - If this extension needs to read or modify the content of pages the user visits, use a content script scoped with matches patterns as narrow as all sites, since quotes can come from anywhere the user is reading actually requires — never <all_urls> unless the extension genuinely needs to run on every site, which is a different and much larger permission ask. MESSAGE PASSING If the popup, content script, and background service worker need to talk to each other, use chrome.runtime.sendMessage and chrome.runtime.onMessage explicitly — name which component sends and which listens for each message type, since an extension with three separate execution contexts silently failing to communicate (a click in the popup that the content script never hears about) is the most common Manifest V3 bug, precisely because each context genuinely cannot just call a function in another context directly. TESTING INSTRUCTIONS Since Bolt.new's own preview pane cannot load this as a real Chrome extension, end your output with the exact steps to load it as an unpacked extension from chrome://extensions in developer mode, and what to click through to actually exercise lets you highlight text on any webpage and save it as a quote with the source URL, viewable later from the extension popup once loaded — don't leave me to figure out loading it myself. CONSTRAINTS minimal, one accent color, system font stack, no logo needed yet Keep the popup UI small and fast — it has no meaningful loading budget; anything that takes more than a second to render in a 350px-wide popup will feel broken.
Customize
Optional — swap in your own details for the highlighted parts above.
Why this works
The Manifest V3 service-worker note targets a real, well-documented migration gap: a service-worker-based background script can be terminated by Chrome at any time and restarted fresh on the next event, so any code pattern relying on a variable staying in memory between events — the default assumption in an ordinary persistent background page from Manifest V2 — silently loses its state. A model not told this explicitly may generate exactly that pattern anyway, since it's still what a large share of extension tutorials and examples show for "background script," even though it's the wrong pattern for the manifest version this build is targeting.
Requiring narrow match patterns instead of <all_urls>, with a one-line justification per permission, targets a documented Chrome Web Store review friction point and a real security posture. An extension requesting broad host permissions it doesn't actually use is both slower to get through review and a larger attack surface if the extension's own code is ever compromised, and a generic "add whatever permissions you need" instruction defaults toward over-requesting, because reaching for a broad permission is the path of least resistance for making everything work without thinking carefully about scope.
Explicit message-passing between popup, content script, and background contexts addresses the actual reason cross-context Chrome extension bugs are so common and so confusing to debug. These three contexts are genuinely separate JavaScript execution environments with no shared memory between them, so a natural-looking function call from one to another simply does nothing rather than throwing an obvious error a developer would notice immediately. A generated extension that isn't explicitly told which component sends which message type will often wire only the parts that happen to land in the same file during generation, leaving a click in the popup that the content script silently never learns about — a bug that looks like nothing happened, with no error to point at the actual cause.
Verified against
Bolt.new Bolt.new web app (StackBlitz WebContainers) · 2026-07-30
Changelog
- 2026-07-30 — Initial publish, verified against Bolt.new with an explicit Manifest V3 permission audit and real unpacked-extension load steps.
Need this built into your business?
If a prompt isn't enough — custom software, built and maintained for you — that's Scult's day job.
EXPLORE CUSTOM SOFTWARE
