# Tasks — LexAI

> Active task contracts, derived from `RECOMMENDATIONS.md` (full read 2026-07-13). Task numbers match the recommendation numbers for traceability. Completed contracts move to `HANDOFF.md`; durable choices move to `DECISIONS.md`.

## Suggested order (from RECOMMENDATIONS)

Quick wins first: **T-03, T-06, T-09, T-11, T-15, T-16** (all small, mostly independent). Then structural refactors **T-04, T-05, T-08**. Do **T-01 / T-02** (permissions + key story) before any serious Chrome Web Store push. Save **T-10, T-12, T-13** for a focused Phase 2.

## Active (next up — fully specified)

### T-03 — Gate debug logging behind a DEV flag

- **Status:** ready · **Owner:** lexai-extension-dev · **Effort:** S
- **Goal:** Stop leaking selection text/element values to the host-page console in production.
- **In scope:** `entrypoints/content.ts` `[LexAI …]` logs (captureForButton, Replace paths).
- **Out of scope:** removing logs entirely; other files.
- **Constraints:** keep logs available in dev; no behavior change.
- **Deliverable:** logs wrapped in `import.meta.env.DEV` (or a `__DEV__` guard).
- **Verification:** `npm run build` then grep the built `content.js` for `[LexAI` — none present; `npm run dev` still logs.
- **Stop condition:** production bundle has no LexAI console output.

### T-06 — Remove or wire dead dependencies

- **Status:** ready · **Owner:** builder · **Effort:** S
- **Goal:** Drop confusion and install weight from unused deps.
- **In scope:** `zustand` (no store exists), `tailwindcss` + `autoprefixer` (inactive).
- **Constraints:** if kept, they must be actually wired; otherwise remove from `package.json`.
- **Deliverable:** updated `package.json` + lockfile, or a documented decision to wire them.
- **Verification:** `npm install` && `npm run typecheck` && `npm run build` clean.
- **Stop condition:** no installed-but-unused runtime deps remain unexplained.

### T-09 — Fix or quarantine the e2e suite

- **Status:** ready · **Owner:** lexai-extension-dev · **Effort:** S
- **Goal:** Make CI green mean something.
- **In scope:** `tests/e2e/extension.test.ts` hard-coded `chrome-extension://[EXTENSION_ID]/…`.
- **Deliverable:** resolve the extension ID at runtime (from the service-worker target), or `.skip` the suite with a TODO until fixed.
- **Verification:** `npm run build` && `npm run test:e2e` — passes or is cleanly skipped, not failing.
- **Stop condition:** e2e no longer red for the placeholder reason.

### T-15 / T-16 — Pin toolchain & single-source the version

- **Status:** ready · **Owner:** builder · **Effort:** S
- **Goal:** Prevent `npm run *` failing with no version guard, and prevent shipping mismatched versions.
- **In scope:** add `engines`/confirm `.nvmrc` (Node 22) + `packageManager` field; make `wxt.config.ts` read `version` from `package.json` (or a bump script that writes both).
- **Verification:** bump once; confirm `package.json` and the built `manifest.json` version match.
- **Stop condition:** version is a single edit; toolchain pinned to CI's Node 22.

## Backlog (ready, from RECOMMENDATIONS)

| ID | Task | Theme | Effort |
| --- | --- | --- | --- |
| T-01 | Narrow host permissions from `<all_urls>` (activeTab / allowlist) — do before CWS push | Security | M |
| T-02 | Fix the key story: don't co-locate `encKey` with ciphertext; be honest in UI ("stored locally, obscured") | Security | M |
| T-04 | Collapse duplicated provider layer into `callProvider(config, messages/system, text)` + per-provider adapter | Maintainability | M |
| T-05 | Extract shared theme/styles into `src/ui/theme.ts` (palette used across content/Options/Popup) | Maintainability | M |
| T-07 | Centralize provider/model/endpoint config in one shared module (Options + background drift) | Maintainability | S |
| T-08 | Unit-test real code: extract `getSystemPrompt`, `decryptApiKey`, provider router; test prompt normalization, encrypt→decrypt round-trip, routing, error extraction | Testing | M |
| T-10 | Add content-script DOM test for selection→snapshot→replace (textarea + contenteditable) | Testing | L |
| T-11 | Make `max_tokens` adaptive (scale with input length or expose in settings) — currently hard-coded 1024 | UX | S |
| T-12 | Add response streaming into the modal | UX | L |
| T-13 | Accessibility: aria-labels, focus management, focus trap on modal, keyboard nav | UX | M |
| T-14 | React error boundaries + graceful storage-failure handling on Options/Popup | UX | S |
| T-17 | CI: use checked-out workspace instead of `git clone` into /tmp; stop disabling TLS verification | Build/release | S |

## Task contract format

```markdown
### T-NN — [verb + concrete deliverable]
- **Status:** ready | in progress | blocked | in review | done · **Owner:** [agent] · **Effort:** S/M/L
- **Goal / In scope / Out of scope / Constraints / Deliverable / Verification / Stop condition**
```

## Done (recent)

- Phase 1 (2026-03-06): 7 workitems — WXT setup, selection detection, floating toolbar, SW LLM proxy, OpenAI+Anthropic+Groq+OpenRouter providers, Options page, result modal with Replace. See `PHASE1_SUMMARY.md`.