Catalyst pairs in one click

The visible change at the end of July is small and good: connecting the Chrome extension to your account became one click. Before that you generated a token in the web app, copied it, opened the extension, and pasted it in. Now you press Connect.

Copy-paste authentication is one of those things that seems acceptable while you are building it and is obviously unacceptable the moment you watch somebody else do it. It is four context switches to answer a question the browser could have answered itself, and every one of them is a place to give up.

That is the headline. What is behind it is a week of finding out that most of what the extension claimed about itself was false.

It had never worked

The extension's core function is to add a person from a web page into your CRM.

Every one of its four capture paths failed, every time, and had done since the day they were written. The insert statements omitted a required column, and the column has no default, so the database rejected every attempt with a constraint violation.

Not intermittently. Not under load. Always, since the beginning.

The commit that found it records both halves of the verification, and the order matters: the route was called directly and observed to fail, and then production was checked and found to contain zero prospects created by the extension. The second fact is corroboration, not evidence. On its own, "nobody has used this feature" is exactly what a lightly-used feature looks like. It only becomes damning once you have independently proved the path cannot work.

I keep coming back to that, because a lot of this project's worst bugs have the same shape: a feature whose failure is indistinguishable from disuse. Nobody complains, because the people who tried it assumed they had done something wrong, and there were not many of them.

Three documents claiming a submission that never happened

The extension's own paperwork was worse than its code.

Three separate documents stated that it had been submitted to the Chrome Web Store. It had not. The commit that fixes this checks the evidence and lists it: the build directory is empty, the screenshots directory has no images, and no store identifier or signing key exists anywhere in the repository. The claim had been written in May at the point where the work was specified rather than the point where it was done, which is the most common way a document becomes untrue.

What I like about the fix is that it corrected the historical changelog entry in place rather than adding a new one, on the explicit grounds that this is a correction to the record rather than a new event. Appending "actually, that never happened" as a fresh dated entry would have been more traceable and less honest.

Then there is the privacy policy, which is the one that would have mattered.

It described a setting as doing slightly more than the code actually did. The commit that fixed it is titled, precisely, "make the privacy policy true, in the policy and in the code," and it changed the code rather than the wording.

That direction is the only acceptable one. A privacy policy is a promise, and when the promise and the implementation disagree you do not get to resolve it by editing the promise. The temptation to reword is enormous, because rewording is a one-line change that closes the ticket and nobody outside the company can tell the difference. That is exactly why the rule has to be absolute rather than case-by-case.

A related correction, smaller but the same species: the extension advertised a fifty kilobyte cap on what it transmits. The cap actually counts characters, not bytes, and on pages written in a language whose characters take three bytes each, fifty thousand characters is a great deal more than fifty kilobytes. The disclosure was rewritten to say what the code measures, and to state how much of it actually reaches the model, which is roughly a third.

Nobody was harmed by that one. It is still a claim that was wrong in the direction of flattering us.

A dead extension is a silent extension

The other substantial piece of work has the best title of the week, and it is a principle rather than a fix.

An extension injects itself into somebody else's web page. When it loses its connection to the application, or the user signs out, or the tab has been open for six hours, the honest behaviour is to stop drawing on the page and remove what it has already drawn. The dishonest behaviour, and the default one, is to leave broken furniture sitting on top of a site the user is trying to read.

So the extension acquired a lifecycle: a way to know it is alive, a way to register cleanup, and a shutdown that runs it.

The same commit fixed a performance disgrace. The badge that marks people you already have in your CRM was walking the entire page once per name it was looking for. With five hundred prospects in your pipeline, that is up to a thousand full document traversals per scan, and it re-ran every time the site changed its URL. It is now one pass, capped, scheduled during idle time, and it gives up entirely on pages beyond a certain size.

And a small lie was removed: a button in the feed recorded every interaction as a like regardless of what you actually did, and its error branch was unreachable, so it reported success even when the request came back rejected.

Two engineering details from that week deserve to outlive it.

The endpoint that lets the extension know your subscription tier is thirteen lines. It exists so the popup can show a locked state with an upgrade link, rather than letting you record a call and then rejecting the upload afterwards. Thirteen lines to convert a failure into an explanation.

And the change letting the extension's identity satisfy the existing permission check is one line. The alternative was a parallel version of the check for extension requests, and the commit argues against it precisely: the copy would drift from the original the first time billing changed, and the forgotten copy is always the one that matters.

That is the whole week, really. Not much new capability. A great deal of making the thing true.

— DealArena Team