LexAI/docs/TASKS.md

Tasks — LexAI

Active task contracts, derived from RECOMMENDATIONS.md (full read 2026-07-13). Task numbers match the recommendation numbers for traceability. Completed contracts move to HANDOFF.md; durable choices move to DECISIONS.md.

Suggested order (from RECOMMENDATIONS)

Quick wins first: T-03, T-06, T-09, T-11, T-15, T-16 (all small, mostly independent). Then structural refactors T-04, T-05, T-08. Do T-01 / T-02 (permissions + key story) before any serious Chrome Web Store push. Save T-10, T-12, T-13 for a focused Phase 2.

Active (next up — fully specified)

T-03 — Gate debug logging behind a DEV flag

• Status: ready · Owner: lexai-extension-dev · Effort: S
• Goal: Stop leaking selection text/element values to the host-page console in production.
• In scope: entrypoints/content.ts [LexAI …] logs (captureForButton, Replace paths).
• Out of scope: removing logs entirely; other files.
• Constraints: keep logs available in dev; no behavior change.
• Deliverable: logs wrapped in import.meta.env.DEV (or a __DEV__ guard).
• Verification: npm run build then grep the built content.js for [LexAI — none present; npm run dev still logs.
• Stop condition: production bundle has no LexAI console output.

T-06 — Remove or wire dead dependencies

• Status: ready · Owner: builder · Effort: S
• Goal: Drop confusion and install weight from unused deps.
• In scope: zustand (no store exists), tailwindcss + autoprefixer (inactive).
• Constraints: if kept, they must be actually wired; otherwise remove from package.json.
• Deliverable: updated package.json + lockfile, or a documented decision to wire them.
• Verification: npm install && npm run typecheck && npm run build clean.
• Stop condition: no installed-but-unused runtime deps remain unexplained.

T-09 — Fix or quarantine the e2e suite

• Status: ready · Owner: lexai-extension-dev · Effort: S
• Goal: Make CI green mean something.
• In scope: tests/e2e/extension.test.ts hard-coded chrome-extension://[EXTENSION_ID]/….
• Deliverable: resolve the extension ID at runtime (from the service-worker target), or .skip the suite with a TODO until fixed.
• Verification: npm run build && npm run test:e2e — passes or is cleanly skipped, not failing.
• Stop condition: e2e no longer red for the placeholder reason.

T-15 / T-16 — Pin toolchain & single-source the version

• Status: ready · Owner: builder · Effort: S
• Goal: Prevent npm run * failing with no version guard, and prevent shipping mismatched versions.
• In scope: add engines/confirm .nvmrc (Node 22) + packageManager field; make wxt.config.ts read version from package.json (or a bump script that writes both).
• Verification: bump once; confirm package.json and the built manifest.json version match.
• Stop condition: version is a single edit; toolchain pinned to CI's Node 22.

Backlog (ready, from RECOMMENDATIONS)

ID	Task	Theme	Effort
T-01	Narrow host permissions from <all_urls> (activeTab / allowlist) — do before CWS push	Security	M
T-02	Fix the key story: don't co-locate encKey with ciphertext; be honest in UI ("stored locally, obscured")	Security	M
T-04	Collapse duplicated provider layer into callProvider(config, messages/system, text) + per-provider adapter	Maintainability	M
T-05	Extract shared theme/styles into src/ui/theme.ts (palette used across content/Options/Popup)	Maintainability	M
T-07	Centralize provider/model/endpoint config in one shared module (Options + background drift)	Maintainability	S
T-08	Unit-test real code: extract getSystemPrompt, decryptApiKey, provider router; test prompt normalization, encrypt→decrypt round-trip, routing, error extraction	Testing	M
T-10	Add content-script DOM test for selection→snapshot→replace (textarea + contenteditable)	Testing	L
T-11	Make max_tokens adaptive (scale with input length or expose in settings) — currently hard-coded 1024	UX	S
T-12	Add response streaming into the modal	UX	L
T-13	Accessibility: aria-labels, focus management, focus trap on modal, keyboard nav	UX	M
T-14	React error boundaries + graceful storage-failure handling on Options/Popup	UX	S
T-17	CI: use checked-out workspace instead of git clone into /tmp; stop disabling TLS verification	Build/release	S

Task contract format

### T-NN — [verb + concrete deliverable]
- **Status:** ready | in progress | blocked | in review | done · **Owner:** [agent] · **Effort:** S/M/L
- **Goal / In scope / Out of scope / Constraints / Deliverable / Verification / Stop condition**

Done (recent)

• Phase 1 (2026-03-06): 7 workitems — WXT setup, selection detection, floating toolbar, SW LLM proxy, OpenAI+Anthropic+Groq+OpenRouter providers, Options page, result modal with Replace. See PHASE1_SUMMARY.md.