Case study // 02
AI Email Assistant
Manifest V3 side-panel assistant for Gmail & Outlook — smart replies, summaries, and voice compose without leaving the inbox.
Built as Replybox for Gmail & Outlook Web
Role · Extension + API integration owner
Overview
Knowledge workers waste time on long threads and context-switching to external AI tools. This extension sits beside Gmail and Outlook as a Chrome Side Panel companion: summarize the open thread, draft a tone-controlled reply, or compose from a prompt — then edit in Quill and paste back into the native composer.
Productization includes Free/Pro usage metering, local draft caching, speech-to-text compose, and store-oriented security/a11y hardening that earned the Chrome Web Store Featured badge.
Chrome Web Store Featured
The Featured badge is Google's quality signal for Chrome extensions. Chrome staff review each listing for technical best practices (including modern Manifest V3 APIs), an intuitive user experience, privacy respect, and a clear store listing. Publishers cannot pay for it — it is earned through review.
Trust
Users see an official quality mark before they install — stronger social proof than self-claims.
Discovery
Featured items can rank higher in search/filters and appear in Chrome Web Store promotions.
Engineering bar
Signals MV3, privacy, UX, and listing quality met Chrome’s published best-practice bar.
Architecture
Presentation (side panel + provider content scripts) talks to a service-worker orchestration layer that deduplicates requests and updates usage counts, then calls a hardened network client to a Vercel-hosted generation API. Auth uses Google OAuth with an optional Firebase login bridge. Generative HTML is sanitized before it touches the DOM.
- 3-layer MV3 architecture: presentation → orchestration → network
- Adapter pattern for Gmail and Outlook DOM providers
- Distributed locking via chrome.storage without a server mutex
- Backend LLM (keys never in the extension package)
Features
Challenges → Solutions
20–25 duplicate AI calls per email open
Atomic storage locks + service-worker dedupe + API gateway
Content scripts can’t share session storage reliably
Coordinate via chrome.storage.local flags across contexts
Generative XSS risk in rich output
Allowlist HTML sanitizer + CSP hardening
AI cost on Free tier
Pre-network entitlement gates before generation
Tech stack
Next