Cove：以本機為先的 Firefox 平靜新分頁擴充功能

Cove is a calm, local-first Manifest V3 new tab extension for Firefox. It replaces the new tab with a workspace, a ranked newsroom, an offline reader, a Pomodoro timer, and procedural focus sound — 166.2 KB gzipped, zero runtime dependencies, no account, no analytics, no server. Data stays in chrome.storage.local and IndexedDB. One click from Firefox Add-ons. Open source, Apache-2.0.

Why 300 downloads didn't stay

The first post about Cove got 7,400 views and about 300 downloads. In my judgment, most of those people didn't stay. The answer wasn't the product. It was the install.

I sold calm, then asked people to do the least calm install on the internet: download a ZIP, unzip it, turn on Developer mode, Load unpacked, keep the folder forever. People who wanted a quiet tab bounced before they ever saw one.

The second mistake was pitching everyone. "A calm new tab for anyone" tells nobody anything. Developers starred the repo and went back to their old tab. Non-developers bounced at the GitHub funnel.

The third mistake was listing features instead of showing one moment. Workspace plus newsroom plus reader plus Pomodoro plus sound, in words, gives a reader nothing to picture doing at 9 a.m. tomorrow.

This post fixes all three in the order a developer needs them: who it's for, how it works, how to verify every claim yourself, and how to install it. The install problem is fixed for Firefox: Cove is on Firefox Add-ons, one click, no ZIP.

What is Cove, and who is it for?

Cove replaces your new tab with four stages: Bento Dashboard, Ambient Home, Focus Sanctuary, and Pure Stillness. Under them sit quick links, notes, read-later, tab triage, saved sessions, the newsroom, the reader, a timer, and sound. The point isn't more to look at. It's the few things you use in the morning, then out of the way.

Cove is for you if:

• You use Firefox, or you'll install manually on Chrome, Brave, Arc, Edge, or Zen for now.
• You open a new tab dozens of times a day and want the first second quiet.
• You'd rather read the permission list than be surprised by it later.

Cove is not for you if you want cross-device sync, cloud recommendations, or a server-side profile. There is no server. That's a design decision, not a missing feature.

I'm 18, in my first year of a B.Tech in AI and Robotics in Indore, and I built Cove for myself first. The first version shipped in a single day — 60+ commits on 27 October 2026 — because I wanted the tab on my own machine that night. I kept building because other people said they wanted the same tab. That is still the strategy: build the tab I want to open, document every trade-off, let anyone read the code.

How does it work?

Four systems, all local, no account.

Discover: newsroom ranked on your device

Discover pulls 11 curated RSS/Atom feeds plus three keyless APIs: Spaceflight News, DEV.to, and Hacker News (Algolia). You can add your own feeds. Ranking runs on-device with an 18-hour freshness half-life — newer stories rise, old ones fade, no server watching clicks. Topic, source, and keyword affinity shape the order, a diversity pass stops one feed taking over, and feedback signals adjust what surfaces next.

Up to 120 extracted articles are cached in IndexedDB for offline reading. Bad Wi-Fi, train, dropping connection: the article is already there.

Reader: local extraction, no paywall bypass

The reader extracts locally with DOMParser, strips scripts, styles, navigation, iframes, and forms, and rebuilds the article as clean, escaped HTML. Story briefs, serif/sans surfaces, Glass/Paper/Ink themes, reading progress. No account, no sync.

One rule is load-bearing: Cove does not bypass paywalls. Blocked article? It links to the original.

Search: answers without leaving the tab

v0.1.3 added a search studio with 14 presets — Startpage, Kagi, Perplexity, ChatGPT, Claude, Stack Overflow, GitLab, npm, PyPI, Reddit, Hacker News, arXiv, Google Maps, Unsplash — plus custom HTTPS templates. Bangs work both ways: !gh query and query !gh do the same thing. !w finds Wikipedia. !github finds a repo.

Instant answers compute locally: date differences, Unix timestamps, base conversion, tips and percentage change, RGB/HSL colours, word counts. Press Cmd/Ctrl+K for the command palette. Search box plus palette is most of the navigation. A ten-section Settings Studio exists if you want it; day one shouldn't need it.

Focus: Pomodoro, friction blocker, sound made in code

A Pomodoro timer. A site blocker on declarativeNetRequest that works by friction, not pretend security — you can still reach the site, it just makes you pause first. Focus Sound: five procedural soundscapes generated in code, zero audio files.

The audio was renamed from "neural" branding on purpose. It's sound that helps some people concentrate. Not a medical device. Doesn't treat anything. The disclaimer stays in the product.

Verify it yourself

Don't take the claims above on trust. The repo is small enough to check in minutes.

git clone https://github.com/DevAnimecx/cove.git
cd cove
npm ci          # Node >= 22.18
npm run build
npm run budget  # fails CI over 170 KB — the budget is enforced, not a slogan

Check the security claims the same way:

grep -rn "innerHTML\|eval(" src/ || echo "clean"

Expect no matches for innerHTML or eval( in src/ — that was the result of the code search on 27 October 2026. The extension CSP is strict:

Content-Security-Policy: script-src 'self'; object-src 'self'

Where to look in the code:

src/lib/
  state.svelte.ts       # single store — oversized, splitting it is on the list
  smart-engine.ts       # ranking / focus logic
  discover.ts           # feeds + article extraction
DiscoverFeed.svelte     # newsroom UI
SettingsStudio.svelte   # 10-section settings — oversized, splitting it is on the list
docs/                   # 25 docs: architecture, privacy ledger, threat model, release process
llms.txt                # short machine-readable project summary
llms-full.txt           # full machine-readable project summary

CI runs typecheck, tests, build, core audits, budget, verify, and artifact upload, with release publishing on tags. The two oversized files above are known and named here because you'd find them in the repo anyway. Naming the debt beats hiding it.

Privacy and permissions

Short answer: there's nowhere for your data to go. No backend, no account, no analytics. Every network call is listed — destination, default, control — in the privacy ledger in the repo and on the privacy page.

The honest part: Cove asks for broad permissions, including <all_urls> host access — the broadest permission possible. It's needed to fetch feeds, including feeds you add yourself, and to extract articles from arbitrary sites. It can't be fully narrowed without breaking custom feeds, and I won't pretend otherwise.

The full permission list, what each one is for, and what controls it, is in the privacy ledger and docs/privacy.md. If that trade-off isn't right for you, don't install it. I'd rather lose a user than hide a permission.

The repo also ships llms.txt and llms-full.txt, a citation file, a security policy, and docs on architecture, the ranking engine, and the threat model — so an AI assistant evaluating the repo can answer from source instead of guessing.

Measured

All numbers from the v0.1.3 build, checked 29–31 October 2026:

Cove is not the smallest extension ever made, and I won't claim it is. It's small on purpose, under a machine-enforced budget. Wallpapers and fonts are bundled, so the full archive is larger — the budget covers JS + CSS, and that's the claim, no more.

Install

Firefox — one click

1. Open the Cove listing on Firefox Add-ons.
2. Select Add to Firefox.
3. Open a new tab. Ten seconds, and you know if it's for you.

Chrome, Brave, Arc, Edge, Zen — manual, about a minute

Chrome and Edge store listings are next, not already done. Until then, install from the install page (release ZIPs + SHA-256 checksums):

1. Download the ZIP for your browser, unzip it into a permanent folder.
2. Extensions page → Developer mode on → Load unpacked → pick the folder.
3. Open a new tab. Keep the folder where it is — the browser loads from it.

Found a bug? File it on GitHub with what you did, what you expected, and what happened instead. That's the feedback that actually changes the roadmap.

What Cove is not

• Not a VPN or security tool. The blocker adds friction; it doesn't protect you.
• Not a medical device. Focus Sound is procedural audio. It treats nothing.
• Not a paywall bypass. Blocked articles link to the original.
• Not a cloud product. No sync, no account, no server-side profile.
• Not the smallest extension ever. 166.2 KB gzipped under a CI budget is the claim — no more.

What's next

Firefox is live. Chrome and Edge listings are next, with the same copy and permission justifications already in the repo — no new claims for the store. After that, the roadmap is feedback-driven: which feed failed, which article extracted badly, which instant answer was wrong, what your new tab does first that you wish it wouldn't.

FAQ

What is Cove?
A calm, local-first Manifest V3 new tab extension for Firefox: workspace, ranked newsroom, offline reader, Pomodoro timer, and procedural focus sound in 166.2 KB gzipped, with no account, no analytics, and no server.

Is Cove free?
Yes. Open source under Apache-2.0, no subscription, no account, no paid tier. Read the full code on GitHub.

Does Cove track me?
No. No account, no analytics, no Cove server. Data stays in chrome.storage.local and IndexedDB, and every network call is listed in the privacy ledger.

How do I install Cove on Firefox?
Open the Cove listing on Firefox Add-ons, select Add to Firefox, open a new tab. About ten seconds.

How do I install Cove on Chrome or Brave?
Manually for now: ZIP from the install page, unzip, Developer mode on, Load unpacked, pick the folder. Chrome and Edge store listings are next.

Why does Cove ask for <all_urls>?
To fetch feeds, including feeds you add yourself, and extract articles from arbitrary sites. The full permission list and justifications are in the privacy ledger. If the trade-off isn't right for you, don't install it.

How big is Cove?
166.2 KB gzipped (141.0 KB JS + 25.2 KB CSS) in v0.1.3, under a CI-enforced 170 KB budget, zero runtime dependencies, 66 unit tests plus 2 integration audits.

How do I run the checks myself?
Clone the repo, npm ci (Node >= 22.18), then npm run build and npm run budget. Tests and core audits run in CI on every push; the budget check fails the build over 170 KB.

Does Cove work offline?
In part. Up to 120 extracted articles are cached locally for offline reading. Live feed fetching and search presets need a connection; reader, timer, and sound don't.

What does Cove do that a default new tab doesn't?
Workspace, ranked newsroom, offline reader, Pomodoro, and procedural sound in one tab — no ads, no upsells, no login, no server-side profile — with every permission and network call documented in the open.

In one sentence: Cove is a 166.2 KB, local-first new tab extension for Firefox that gives you a quiet workspace, a ranked newsroom, an offline reader, and focus tools — no account, no tracking, no server — and every claim in this post is verifiable in its open-source repo.

I built Cove for me, but the people who downloaded it after the first post found things I'd never have found alone. Two questions, and I'll read every answer: