01 · Surface
Side-panel UI
Vanilla JavaScript, one file, 530 lines. Skill chips, chat thread, voice button, settings, and the Pro-Prompt toggle. State in plain variables, rendered by rebuilding on change. No framework, no bundler.
1,727
Lines of code, three files
10
Bundled skills, day one
2
AI providers supported
0
Backend, analytics, telemetry
The opportunity
The workflow is on the page. The AI lives elsewhere.
Knowledge work happens in browser tabs. AI lives in separate apps, separate subscriptions, separate windows. Copy out, paste in, copy back. Every context switch is a tax on attention.
Before
Read a doc in one tab, switch to the AI tool in another, paste the selection, wait, switch back, apply it. Repeat for every paragraph and every email. The AI is always one window away from the work.
Subscription tools charge monthly whether you touch them or not. Browser wrappers route requests through a vendor proxy, so your prompts and your key behaviour are visible to a third party.
After
Open the side panel on any page. Select text, right-click, pick a skill. The response streams back beside the work. No tab switch, no paste.
Bring your own key. Calls go from the browser straight to the provider: no proxy, no middleware, no third party. Keys live in local storage, and the extension owns nothing about you by design.
The surface
Lives beside the work.
A Chrome side panel that docks to the right of any tab. Skill chips, streaming responses, voice input, a right-click menu. No overlay, no popup.
What was built
Three files. No framework, no build step.
Six systems collapsed into a service worker, a side-panel UI, and a content script. Loaded straight by Chrome, packaged for the store as-is.
02 · Worker
Background router
510 lines. Seeds the default skills on install, builds the context menus, resolves the provider from the key present, calls Anthropic or OpenAI directly, and streams responses back to the panel over a port.
03 · Content
Page reader and voice
122 lines. Extracts the selection or falls back to the full page, and wraps the Web Speech API for voice. URL-restricted so it never injects on browser-internal pages, returning a clean error instead of a silent failure.
04 · BYO key
Local key storage
Keys live in local browser storage and never leave it, except to reach the model provider directly. The provider auto-selects from the key present. No backend to compromise, because there is no backend.
05 · Skills
Ten bundled skills
Summarise, Rewrite, Explain, Translate, Extract Actions, Spreadsheet, Aligned Ideation, Debug, Free Chat, and Pro-Prompt. Each is a stored record, so custom skills drop in later with no code change.
06 · Meta
Pro-Prompt
An optional pass that runs the prompt through a lighter model to sharpen it before the main call. A first-use note explains the cost trade, and the before-and-after sits inline so the user sees what changed.
What was overcome
Perceived hard vs actually hard.
Perceived
Manifest V3 service workers are ephemeral, so a streamed response would die mid-token when the worker spun down.
Reality
The worker stays alive while a runtime port is open. The panel opens the port, the worker pumps the stream through it, and the port keeps the worker resident for the duration.
Resolution
The panel connects a named stream port. The worker writes chunks until the API stream ends, then closes the port. It streams cleanly to completion every time.
Perceived
Trust without a backend. Users will not enter an API key into an unfamiliar extension if it might exfiltrate the key.
Reality
The only fix is to give them nothing to trust. No backend, no proxy, no analytics. All the code ships to the store and sits in git, readable and runnable by anyone.
Resolution
Keys live in local storage, requests go straight to the provider, and the privacy panel states plainly what is and is not collected. None of it is. The audit takes ten minutes.
Private by construction. Not by promise.
Context Co-Pilot is live and free on the Chrome Web Store. Ten skills, two providers, voice input, streaming responses, and zero backend to compromise, because there is no backend. The user owns the key, the data, and the spend.
Get it on the Chrome Web Store