Chrome extension

The Chrome extension, Nistor Inspector, adds Nistor to the Google Cloud console. When the current tab shows a resource it recognises, its toolbar badge counts the incidents on the resource and upstream of it (or shows ! when only upstream nodes have incidents), and its popup shows the resource with Nistor's view of it, in the tabs Overview, Incidents, Quality, FinOps, Lineage and Ops.

It recognises these pages of console.cloud.google.com: BigQuery tables and datasets, Cloud Run services, Cloud Scheduler jobs, Cloud Storage buckets, Pub/Sub topics and subscriptions, and Dataform repositories. Nistor knows these resources through the Google Cloud integration.

The extension also:

• checks your due node reminders (/api/v1/reminders/due) on a timer, counts them on the badge and raises a desktop notification for each new one;
• shows an Ask AI button to a user who holds ai:use. It opens a chat in Chrome's side panel, which the AI module of Nistor Enterprise serves.

Build and load#

Build it from a clone of the repository. The build also reads the shared interface code in shared/nistor-ui:

cd chrome-extension
npm ci
npm run build

npm run build writes the extension to chrome-extension/dist. In Chrome, open chrome://extensions, turn on Developer mode, choose Load unpacked and pick that directory.

npm run build makes a production build: the extension starts on its prod backend entry, and its manifest grants it access to console.cloud.google.com and *.run.app only. A development build (npx vite build --mode development) starts on the local entry and also has access to localhost:8000.

Choose the backend#

The popup's settings (the gear icon) choose one of four entries: local, dev, test and prod. Every entry points at http://localhost:8000 for the API and http://localhost:3000 for the web shell, unless you override it in the extension's storage. There is no settings screen for the override yet. Set the keys nistor.backendUrls and nistor.frontendUrls, each a map from entry to URL without a trailing slash, from the console of the extension's service worker (on chrome://extensions, under Inspect views):

chrome.storage.local.set({
  "nistor.backendUrls": { "prod": "https://<backend-host>" },
  "nistor.frontendUrls": { "prod": "https://<web-shell-host>" }
});

The popup's Open in Nistor button and the links of reminder notifications do not read the override: they open http://localhost:3000.

A backend outside the extension's host permissions must accept requests from the extension's origin. In an environment other than local or dev, set the backend's CORS_CHROME_EXTENSION_ID to the extension's id (shown on chrome://extensions), or allow it through CORS_ORIGIN_REGEX.

Sign in#

Sign in to Nistor in the popup opens the web shell's /extension-token-redeem page in a Chrome sign-in window. If you are signed in to the web shell, the page sends a one-time code back to the extension, which trades it for a token at POST /api/v1/auth/extension-tokens/exchange. The extension keeps the token in Chrome's session storage, so closing the browser signs you out. The token carries your identity and lasts EXTENSION_TOKEN_TTL_DAYS days (7 by default).

Two settings must be in place first:

Permissions#

The FinOps module's routes that the popup and the badge read need gcp:inspect, which the viewer role template includes. They read Google Cloud metadata with the backend's service account, so this permission grants broad read access to resource metadata across projects.