fix: Firefox signing — proper .env loading and config rename

The previous approach (source .env && npm run sign:firefox) failed
because npm subshells don't inherit env vars consistently, and
quoted values in .env weren't being stripped.

New approach: sign-firefox.sh reads .env itself, strips quotes,
and passes --api-key/--api-secret directly to web-ext sign.

Also renames web-ext-config.js → web-ext-config.cjs to fix the
deprecation warning, and bumps package.json version to 0.2.0.

https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw

README.md

@@ -141,15 +141,16 @@ Save and close the file.
 
 #### Step 4: Build and sign
 
-**Mac / Linux:**
+**All platforms (Mac, Linux, Windows with Git Bash):**
 ```bash
-source .env && npm run sign:firefox
+npm run sign:firefox
 ```
 
-**Windows (Command Prompt):**
+The sign script reads your `.env` file automatically — no need to `source` it.
+
+**Windows (Command Prompt — if not using Git Bash):**
 ```cmd
-set /p x= < nul & for /f "tokens=1,* delims==" %a in (.env) do @set %a=%~b
-npm run sign:firefox
+node -e "require('fs').readFileSync('.env','utf8').split('\n').forEach(l=>{const[k,v]=l.split('=');if(k&&v)process.env[k.trim()]=v.trim().replace(/^\"|\"$/g,'')})" && npm run sign:firefox
 ```
 
 **Windows (PowerShell):**

package.json

@@ -1,6 +1,6 @@
 {
   "name": "silent-send",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "private": true,
   "description": "Browser extension that substitutes personal data before sending to AI services",
   "scripts": {
@@ -8,7 +8,7 @@
     "build:firefox": "./build.sh firefox",
     "build": "./build.sh both",
     "lint:firefox": "npx web-ext lint --source-dir dist/firefox",
-    "sign:firefox": "./build.sh firefox && npx web-ext sign --source-dir dist/firefox --artifacts-dir dist/firefox-signed --channel unlisted",
+    "sign:firefox": "./sign-firefox.sh",
     "run:firefox": "./build.sh firefox && npx web-ext run --source-dir dist/firefox"
   },
   "devDependencies": {

sign-firefox.sh

@@ -0,0 +1,55 @@
+#!/bin/bash
+#
+# Sign the Firefox extension using Mozilla's API.
+#
+# Reads credentials from .env file (WEB_EXT_API_KEY and WEB_EXT_API_SECRET).
+#
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+ENV_FILE="$SCRIPT_DIR/.env"
+
+if [ ! -f "$ENV_FILE" ]; then
+  echo "Error: .env file not found. Copy .env.example to .env and fill in your credentials."
+  echo "  cp .env.example .env"
+  exit 1
+fi
+
+# Read .env, strip quotes and whitespace
+while IFS='=' read -r key value; do
+  # Skip comments and empty lines
+  [[ "$key" =~ ^#.*$ ]] && continue
+  [[ -z "$key" ]] && continue
+  # Strip surrounding quotes
+  value="${value%\"}"
+  value="${value#\"}"
+  value="${value%\'}"
+  value="${value#\'}"
+  # Trim whitespace
+  key="$(echo "$key" | xargs)"
+  value="$(echo "$value" | xargs)"
+  export "$key=$value"
+done < "$ENV_FILE"
+
+if [ -z "$WEB_EXT_API_KEY" ] || [ -z "$WEB_EXT_API_SECRET" ]; then
+  echo "Error: WEB_EXT_API_KEY and WEB_EXT_API_SECRET must be set in .env"
+  echo ""
+  echo "Get your credentials at: https://addons.mozilla.org/developers/addon/api/key/"
+  exit 1
+fi
+
+echo "Building Firefox extension..."
+"$SCRIPT_DIR/build.sh" firefox
+
+echo "Signing with Mozilla..."
+npx web-ext sign \
+  --source-dir "$SCRIPT_DIR/dist/firefox" \
+  --artifacts-dir "$SCRIPT_DIR/dist/firefox-signed" \
+  --channel unlisted \
+  --api-key "$WEB_EXT_API_KEY" \
+  --api-secret "$WEB_EXT_API_SECRET"
+
+echo ""
+echo "Done! Install the .xpi file from dist/firefox-signed/"
+echo "Drag it into Firefox or use File → Open File."