The Problem

Chrome users accumulate a dozen + extensions for tab management, cookie editing, dark‑mode toggles, and site‑specific tweaks. Each additional extension expands the attack surface, because most are closed‑source and impossible to audit. The pain point is the need to balance functionality with security — users want powerful features without installing opaque, potentially malicious code.

What This Does

superlevels consolidates 12 + capabilities into a single open‑source package. Core features and the files that implement them:

  • Tab Cleaner – background.js marks inactive tabs and saveClosedTab re‑opens them; popup.js provides the renderExclusionList UI.
  • Cookie Editor – nocookie.js injects/removes CSS for cookie banners; jsonformat.js lets users view/edit cookies as JSON.
  • Redirect Tracer – background.js records renderStep hops; the UI is driven from popup.js.
  • Dark Mode – darkmode.js builds a CSS filter (buildCSS, applyDarkMode) that inverts colors per‑site.
  • X/Twitter Dim – xdim.js supplies paletteFromHue, getActiveHueSat and a live preview in the popup.
  • JS Toggle – popup.js toggles script execution per‑site.
  • GDPR Cookie Consent Dismisser – nocookie.js auto‑clicks OneTrust, CookieBot, Didomi, etc.
  • Live CSS Editor – livecss.js streams applyCSS in real time.
  • YouTube Unhook – background.js removes feed/sidebar/end‑screen elements.
  • Music Recognizer – background.js captures audio and forwards it to ACRCloud (user‑provided API key).
  • Picture‑in‑Picture – viewimage.js pops the largest video into a floating window.
  • Google Maps Links – gmaps.js re‑adds clickable map previews in search results.
  • View Image – viewimage.js adds a “View Image” button on Google Images.
  • JSON Formatter – jsonformat.js formats pure JSON responses with syntax highlighting and collapsible sections.

All UI interactions originate in popup.js (40 functions) and are routed through the background script for persistent state.

How It Is Wired

Execution starts when the user clicks the extension icon; popup.js’s switchToPage determines the active feature. The internal call graph (111 self‑edges) shows that esc is called from 7 places, loadCookies from 4, and applyDim/syncThemeColor from 3 each. background.js defines markActive and saveClosedTab, handling lifecycle events that persist across browser restarts. Module connectivity is flat: 10 JavaScript files with zero import edges and no circular dependencies, so a change in one file rarely ripples unpredictably—except for the oversized popup.js (896 lines) and the branching‑heavy background.js (50 branch points over 171 lines).

External interactions are limited to the Chrome extension APIs (storage, tabs, webRequest, etc.) and, for the music recognizer, the user‑supplied ACRCloud key stored in manifest.json.

How To Use It

Clone the repository and load it as an unpacked extension:

git clone https://github.com/moses-y/superlevels
  1. Open Chrome and navigate to chrome://extensions/.
  2. Enable Developer mode.
  3. Click Load unpacked and select the cloned folder.

No environment variables or secret keys are required unless you want the music‑recognizer feature; in that case place your ACRCloud API key in the extension’s storage (via the popup UI).

Real‑World Use

A researcher needs to keep important tabs open while discarding stale ones, edit cookies for a test site, and quickly dim the X/Twitter homepage to reduce distraction. They open the popup, enable Tab Cleaner with a 5‑minute timeout, add example.com to the exclusion list, edit a cookie’s SameSite flag via the JSON formatter, and select the Jade dim palette. The extension applies the changes instantly, and the researcher can inspect the source at any time because every file is visible on disk.

Code Health & Issues

  • Duplicated code blocks – 6‑line fragments repeat in popup.js and xdim.js; extract a shared helper to DRY the logic.
  • Oversized file – popup.js contains 896 code lines, making it hard to reason about changes; split into cohesive units by responsibility.
  • High branching density – background.js has 50 branch points over 171 lines; decompose decision logic (e.g., table‑driven dispatch) to lower cognitive load.

Measured SDLC gaps (static‑analysis findings):

  • No test suite exists; any change ships with no signal that existing behaviour holds.
  • No CI/CD pipeline is configured; merges occur without an automated build/test gate.

High‑priority recommendations (from the code‑health audit):

  • Add a test suite—one test per public entry point—and a CI step that runs them on every push.
  • Add a workflow that builds and tests this repository on push and pull_request.

The Bottom Line

superlevels delivers a compelling, privacy‑first alternative to a dozen closed‑source extensions, with full source transparency and a rich feature set. The codebase is functional but suffers from size‑related maintainability risks and lacks automated testing/CI, which should be addressed before wider adoption in security‑sensitive environments. It is well‑suited for power users and teams that value auditability and can tolerate a modest refactor effort to improve long‑term stability.