Manifest V3 host_permissions must be separated from permissions in CI

In Manifest V3, host match patterns such as https://*/* belong in the host_permissions array, not in permissions. A match pattern left in permissions is flagged as invalid.

What this error means

Validation reports that a value in permissions is not a valid permission and that host match patterns must be declared under host_permissions.

MANIFEST_PERMISSIONS
"/permissions/2": "https://*/*" is not a valid permission in manifest version 3.
Host permissions must be specified in "host_permissions".

Common causes

Match patterns still listed under permissions

A V2 manifest mixed host patterns into permissions; V3 requires them in a separate host_permissions array.

Incomplete migration of permissions

API permissions were kept but the host patterns were not moved during the V3 migration.

How to fix it

Move host patterns to host_permissions

1. Keep API permissions (storage, tabs) in permissions.
2. Move every URL match pattern into host_permissions.
3. Re-lint to confirm no patterns remain in permissions.

"permissions": ["storage", "tabs"],
"host_permissions": ["https://*/*"]

Lint the split in CI

Run web-ext lint on the built manifest so a misplaced host pattern fails the build.

- run: npx web-ext lint --source-dir dist

How to prevent it

• Separate API and host permissions during migration.
• Lint the built manifest in CI.
• Search for match patterns left under permissions.

Related guides