Implement scriptBadge.requestToAct.

chrome/common/extensions/api/script_badge.json

Index: chrome/common/extensions/api/script_badge.json
diff --git a/chrome/common/extensions/api/script_badge.json b/chrome/common/extensions/api/script_badge.json
index 4cba6966207b5951a1db2d01c1b0188e253b24c9..7d2305fe630f42dcbb3724a940997632e5b0ba64 100644
--- a/chrome/common/extensions/api/script_badge.json
+++ b/chrome/common/extensions/api/script_badge.json
@@ -51,6 +51,23 @@
             ]
           }
         ]
+      },
+      {
+        "name": "requestToAct",

[Aaron Boodman, 2012/07/03 01:29:31]

Despite my previous statements, I think we should call this something like
getAttention().

[Jeffrey Yasskin, 2012/07/10 21:52:33]

Done.

+        "type": "function",
+        "description": "Shows a greyed-out script badge in order to ask permission to run on this tab.  If the user clicks on the badge, the activeTab APIs become available.  If the extension already has permission to run on this tab, or the tab is privileged so that the extension could never run on it, this call does nothing.",

[Aaron Boodman, 2012/07/03 01:29:31]

Don't think we should commit to exact presentation in the docs. How about:

Brings the script badge to the attention of the user, imploring her to click.
You should call this when you detect that you can do something to a particular
tab. Do not call this for every tab. That's tacky.

<then your bits about active tab>

[Aaron Boodman, 2012/07/03 01:29:31]

I don't think we should do anything special if the extension already has access,
or could never obtain access.

I don't think this state should be so tightly coupled to injecting script. In
the future, developers could use this just to get the current URL. Or they might
just use it because it comes to mean "I can do something to this tab".

[Jeffrey Yasskin, 2012/07/10 21:52:33]

Done.

[Jeffrey Yasskin, 2012/07/10 21:52:33]

If the extension has already run script, we'd have to do something special to
make it get the user's attention. At the moment, it would either turn grey again
(misleading, since that's an assertion that script hasn't run), or nothing would
happen.

It seems misleading to show the grey'ed out script badge on a chrome:// page,
since if the user clicks, the extension still won't get to run. It would be even
worse to let the badge turn into a normal script badge after the click, since
that would assert to the user that the extension is running on the privileged
page, which is alarming and untrue.
We need to think more about how to present "get the current URL" to the user. At
the moment, clicking a script badge gives full access to the content of the
page, so we should train users not to do it on gmail or a bank site. However, if
an extension only wants the URL, that's safe almost anywhere and should use a
different gesture or appearance so the user can tell it's safe.

[Aaron Boodman, 2012/07/10 22:50:46]

If the script badge is already showing, I think that getAttention() should be a
no-op.
But why would a developer call getAttention() on such a page in the first place?
This seems unlikely to occur unless the developer can actually do something (for
example with the URL, or the tab object itself), in which case it is correct to
show the getAttention() state.
Hm, I am not sure. I agree there is some meaning overloading going on here, but
I am not sure that it is worse than trying to distinguish all the different
shades of grey with different UI.

The request-to-act state means "I can do something to this tab". The
script-badge state means "I am doing something to this tab".

At the implementation level we moderate what exact meanings these statements can
have, for security reasons. I don't think we should surface that detail to users
though.

[Jeffrey Yasskin, 2012/07/16 21:33:37]

I've removed the "for now" about this.
I'm thinking of extensions that can do something to every page, so they always
call .getAttention(), without checking the URL. I guess I don't mind asserting
that those extensions are misbehaving. I've removed the "privileged" comment,
and updated the code to not enforce it.
Yeah, I don't really know. Maybe for most users we shouldn't distinguish, but
the right click menu should expose something for situations where someone cares?
I don't mind leaving any more fine-grained support for later.

+        "parameters": [
+          {
+            "name": "details",
+            "type": "object",
+            "properties": {
+              "tabId": {
+                "type": "integer",
+                "description": "Specify the tab to request to act on."
+              }
+            }
+          }
+        ]
       }
     ],
     "events": [