From 43701a431d0a5ac0688b503f5e94dc569761616a Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 26 Mar 2026 02:06:34 +0000
Subject: [PATCH] =?UTF-8?q?fix:=20Firefox=20signing=20=E2=80=94=20proper?=
 =?UTF-8?q?=20.env=20loading=20and=20config=20rename?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous approach (source .env && npm run sign:firefox) failed
because npm subshells don't inherit env vars consistently, and
quoted values in .env weren't being stripped.

New approach: sign-firefox.sh reads .env itself, strips quotes,
and passes --api-key/--api-secret directly to web-ext sign.

Also renames web-ext-config.js → web-ext-config.cjs to fix the
deprecation warning, and bumps package.json version to 0.2.0.

https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
---
 README.md                               | 11 ++---
 package.json                            |  4 +-
 sign-firefox.sh                         | 55 +++++++++++++++++++++++++
 web-ext-config.js => web-ext-config.cjs |  0
 4 files changed, 63 insertions(+), 7 deletions(-)
 create mode 100755 sign-firefox.sh
 rename web-ext-config.js => web-ext-config.cjs (100%)

diff --git a/README.md b/README.md
index 97859fb..65bce26 100644
--- a/README.md
+++ b/README.md
@@ -141,15 +141,16 @@ Save and close the file.
 
 #### Step 4: Build and sign
 
-**Mac / Linux:**
+**All platforms (Mac, Linux, Windows with Git Bash):**
 ```bash
-source .env && npm run sign:firefox
+npm run sign:firefox
 ```
 
-**Windows (Command Prompt):**
+The sign script reads your `.env` file automatically — no need to `source` it.
+
+**Windows (Command Prompt — if not using Git Bash):**
 ```cmd
-set /p x= < nul & for /f "tokens=1,* delims==" %a in (.env) do @set %a=%~b
-npm run sign:firefox
+node -e "require('fs').readFileSync('.env','utf8').split('\n').forEach(l=>{const[k,v]=l.split('=');if(k&&v)process.env[k.trim()]=v.trim().replace(/^\"|\"$/g,'')})" && npm run sign:firefox
 ```
 
 **Windows (PowerShell):**
diff --git a/package.json b/package.json
index c583360..e5a8bd1 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "silent-send",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "private": true,
   "description": "Browser extension that substitutes personal data before sending to AI services",
   "scripts": {
@@ -8,7 +8,7 @@
     "build:firefox": "./build.sh firefox",
     "build": "./build.sh both",
     "lint:firefox": "npx web-ext lint --source-dir dist/firefox",
-    "sign:firefox": "./build.sh firefox && npx web-ext sign --source-dir dist/firefox --artifacts-dir dist/firefox-signed --channel unlisted",
+    "sign:firefox": "./sign-firefox.sh",
     "run:firefox": "./build.sh firefox && npx web-ext run --source-dir dist/firefox"
   },
   "devDependencies": {
diff --git a/sign-firefox.sh b/sign-firefox.sh
new file mode 100755
index 0000000..ede11ee
--- /dev/null
+++ b/sign-firefox.sh
@@ -0,0 +1,55 @@
+#!/bin/bash
+#
+# Sign the Firefox extension using Mozilla's API.
+#
+# Reads credentials from .env file (WEB_EXT_API_KEY and WEB_EXT_API_SECRET).
+#
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+ENV_FILE="$SCRIPT_DIR/.env"
+
+if [ ! -f "$ENV_FILE" ]; then
+  echo "Error: .env file not found. Copy .env.example to .env and fill in your credentials."
+  echo "  cp .env.example .env"
+  exit 1
+fi
+
+# Read .env, strip quotes and whitespace
+while IFS='=' read -r key value; do
+  # Skip comments and empty lines
+  [[ "$key" =~ ^#.*$ ]] && continue
+  [[ -z "$key" ]] && continue
+  # Strip surrounding quotes
+  value="${value%\"}"
+  value="${value#\"}"
+  value="${value%\'}"
+  value="${value#\'}"
+  # Trim whitespace
+  key="$(echo "$key" | xargs)"
+  value="$(echo "$value" | xargs)"
+  export "$key=$value"
+done < "$ENV_FILE"
+
+if [ -z "$WEB_EXT_API_KEY" ] || [ -z "$WEB_EXT_API_SECRET" ]; then
+  echo "Error: WEB_EXT_API_KEY and WEB_EXT_API_SECRET must be set in .env"
+  echo ""
+  echo "Get your credentials at: https://addons.mozilla.org/developers/addon/api/key/"
+  exit 1
+fi
+
+echo "Building Firefox extension..."
+"$SCRIPT_DIR/build.sh" firefox
+
+echo "Signing with Mozilla..."
+npx web-ext sign \
+  --source-dir "$SCRIPT_DIR/dist/firefox" \
+  --artifacts-dir "$SCRIPT_DIR/dist/firefox-signed" \
+  --channel unlisted \
+  --api-key "$WEB_EXT_API_KEY" \
+  --api-secret "$WEB_EXT_API_SECRET"
+
+echo ""
+echo "Done! Install the .xpi file from dist/firefox-signed/"
+echo "Drag it into Firefox or use File → Open File."
diff --git a/web-ext-config.js b/web-ext-config.cjs
similarity index 100%
rename from web-ext-config.js
rename to web-ext-config.cjs