skyclone is a live, goth-mode
unofficial bsky.app — real AppView data, threaded replies,
a spider that crawls your screen on a new notification, a witch button
that curses a post out of existence.
cobweb started as the opposite of that on purpose — a popup
whose whole timeline is a const DATA = [...] array, no
fetch, no network tab activity at all. That part's still here below.
But the actual ask was a second thing: a plugin that runs on
the real bsky.app and turns every Follow button into a
genuine Block button — for real, not a
curse. So cobweb now ships a content script that does exactly that:
it watches the live page, relabels Follow buttons red, and on click
drives bsky.app's own "•••" → Block account → confirm flow itself.
No API calls, no token of its own — it just clicks the buttons the
real site already drew, using your already-logged-in session. Still
zero fetch in this extension, ever.
Both buttons above download a data:application/zip;base64,…
URI — the zip bytes are a literal string sitting in this page's HTML,
not a file the server hosts separately. View source and you can see the
whole plugin as one long data literal.
chrome://extensions,
turn on Developer mode (top right), click Load unpacked,
and pick the unzipped folder.about:debugging#/runtime/this-firefox,
click Load Temporary Add-on, and pick manifest.json
inside the unzipped folder. (Permanent install needs it signed by
Mozilla — this is the developer/temporary path.)xcrun safari-web-extension-converter on the
unzipped Chrome folder, then build the generated Xcode project and
enable it in Safari's Extensions settings.bsky.app and look at any profile's Follow button.manifest.json — Manifest V3. The only permission is a
content_scripts match on bsky.app /
bsky.net — no host_permissions, because the
content script never fetches anything, it only clicks.popup.html / popup.css / popup.js —
the original frozen goth timeline, unchanged: a DATA literal,
a NOTIFS literal, the witch button, the spider crawl.content.js — the new part. Finds real "Follow" buttons
on bsky.app, relabels them "Block" in red, and on click intercepts the
real click (so the actual follow write never fires) and instead drives
the site's own overflow menu → Block account → confirm dialog, in
order, waiting for each to actually appear. If bsky.app's markup ever
changes enough to break the automation, it just tells you to use the
real "•••" menu — it never fakes success.You can also read the source straight from the browser first: popup.js · content.js · manifest.json.
This started from "build another that serves this from a data literal as a browser plugin" and got read as "freeze skyclone into a popup" — close, but the actual ask was that the Follow→Block plugin itself should be hosted as a data literal, and that the plugin should work for real on the real bsky.app. Both are true now: the download above is a data: URI literal, not a hosted file, and the content script performs an honest block through Bluesky's real UI — no curse, no jar of pinned flies, an actual write to your actual account. The popup stays as the original bit of goth theater; the content script is the part that isn't kidding.