sessionSubstitutions stored keys as toLowerCase() for lookup, but the
lowercase key was also used as the substitute value when building
reveal pairs. This caused unrevealText to replace "John Smith" with
"ademo demo" instead of "Ademo Demo".
Fixed by storing both the original-case substitute and the original
real value in sessionSubstitutions. The lowercase key is still used
for lookup, but the preserved-case value is used for reveal pairs.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
When reveal mode was turned OFF, text stayed showing real data
(e.g. "John Smith") instead of reverting to the AI's actual text
("Ademo Demo"). The unreveal function relied on a WeakMap of
original text nodes which lost entries when DOM nodes were replaced
during streaming responses.
Fixed by replacing WeakMap-based restore with active reverse
replacement: unrevealText() replaces real→substitute (the opposite
direction of revealText). This is reliable regardless of DOM changes.
Removed originalTexts WeakMap entirely.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
1. Removed data_collection_permissions from Firefox manifest — it
requires Firefox 140+ but we target 128+. Only produces a warning
when missing, not a blocking error.
2. Fixed JS syntax error in content.js line 450 — two extra closing
braces from a bad merge in the proper noun detection function
caused a parse error that blocked Mozilla validation.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Replaced all 31 innerHTML assignments across popup.js (12),
options.js (17), and content.js (3) to pass Mozilla AMO linter.
Each file gets a safeHTML(el, html) helper:
- popup.js/options.js: DOMParser-based (extension page context)
- content.js: <template> element pattern (page world context)
Empty innerHTML clears replaced with el.replaceChildren().
innerHTML += replaced with createElement + safeHTML + appendChild.
All event listener bindings after HTML rebuilds remain functional
since safeHTML uses replaceChildren() which populates DOM
synchronously before querySelectorAll + addEventListener calls.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Required for Firefox Add-ons (AMO) public listing submission.
Documents that all processing is 100% local, no data collection,
no servers, no analytics. Explains each permission and all
optional network requests (sync, org policy).
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Set Chrome, Firefox, and package.json all to version 2.0.0
(major bump reflecting encrypted storage, document scanning,
org/team features, sync improvements).
Sign script rewritten:
- Tries current version first instead of always bumping
- Only bumps on "version already exists" errors
- Handles rate limiting by parsing throttle duration from error
and waiting the exact time (not blindly retrying)
- Only updates source files on successful signing (not before)
- Reduced max attempts to 5 (with proper backoff, shouldn't need more)
- Commits version bump only after successful sign
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
The X icon looked like a dismiss/close button (temporary). Changed to
a small 'IGNORE' text link that clearly communicates the action is
permanent — the value will never be flagged again.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Proper noun heuristic:
- Changed from matching any single capitalized word to requiring
TWO OR MORE consecutive capitalized words (e.g. "Acme Corp")
- Single capitalized words at sentence starts were causing massive
false positives — every sentence starts with a capital letter
- Minimum 5 characters total and 2 proper words required
Ignore button:
- Each PPI warning item now has an X (ignore) button alongside
the + (add mapping) button
- Ignored values are persisted to storage (ss_ignored_ppi) so
they stay dismissed across page reloads
- Ignored values are skipped in both pattern detection and
proper noun detection
- Clicking ignore removes the item from the warning and re-scans
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Reveal mode's text replacement was walking ALL text nodes on the page
including contenteditable elements (the chat input box on Claude.ai,
ChatGPT, etc.), overwriting the user's typed text with garbled
revealed content.
Fixed by adding contenteditable checks to:
- revealInElement() — returns early if element is contenteditable
- unrevealInElement() — same
- highlightMatches() — TreeWalker filter rejects contenteditable nodes
- MutationObserver — skips addedNodes and characterData mutations
inside contenteditable elements
All four code paths now use parent.closest('[contenteditable="true"]')
to detect and skip chat input areas.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
The sign script's sed command was replacing ALL "version" patterns
including "manifest_version": 3, corrupting it to "manifest_version": 1.
Fixed by anchoring the sed pattern to only match the top-level
"version" field (starts with two spaces at line beginning).
Also:
- Added data_collection_permissions to Firefox manifest (new Mozilla
requirement for all extensions)
- Added 8-second sleep between retry attempts to avoid Mozilla API
rate limiting (was causing cascading failures)
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Removed ZIP read/write complexity. All document formats now extract
text and upload as plaintext — the AI extracts text from files anyway,
no need to preserve formatting in a file the user never gets back.
Added support for: DOC, XLS (old binary), ODT, ODS, ODP (OpenDocument),
PPTX (PowerPoint), RTF.
Extraction methods:
- PDF: content stream operators (Tj, TJ)
- DOCX/XLSX/PPTX/ODT/ODS/ODP: ZIP XML text extraction with DEFLATE
- DOC/XLS: UTF-16LE and ASCII text run extraction from binary
- RTF: strip formatting commands, keep text
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
DOCX and XLSX files now get actual text substitution, not just
scan-and-warn:
- Reads the ZIP structure (DOCX/XLSX are ZIP files of XML)
- Decompresses DEFLATE entries via DecompressionStream API
- Finds XML text content between tags
- Applies substituteAll() to each text node
- Rewrites modified entries as uncompressed (stored) in new ZIP
- Unmodified entries preserved with original compression
- Rebuilds central directory and end-of-central-directory record
DOCX targets: word/document.xml, word/header*.xml, word/footer*.xml,
word/comments.xml, word/endnotes.xml, word/footnotes.xml
XLSX targets: xl/sharedStrings.xml, xl/worksheets/sheet*.xml
Formatting, styles, images, formulas all preserved — only text
content between XML tags is modified. Preview mode still shows
findings before upload for user confirmation.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
New module: document-scanner.js
- PDF: extracts text from content streams, scans for PPI, converts to
sanitized plaintext for upload (PDFs can't be reliably edited in-place)
- DOCX/XLSX: extracts text from XML entries, scans for PPI
- Text files: direct string substitution
- Handles scanned/image-only PDFs gracefully (skips with message)
Fetch interceptor (content.js):
- Now intercepts FormData uploads (file uploads) in addition to JSON
- Processes each file through document scanner
- Preview mode for PDF/DOCX/XLSX: shows PPI findings with counts,
user clicks "Substitute & Upload" or "Upload Original"
- Text files substituted silently (no preview friction)
- String form fields also substituted
- 30-second auto-dismiss on preview (uploads original if no response)
Preview UI (content.css):
- Centered overlay with dark theme matching existing warning UI
- Shows original → substituted pairs for each PPI found
- File format note (e.g. "PDF will be converted to plain text")
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Passwords imported from password managers are now:
- Displayed as dots (••••••••) by default in both options and popup
- Separated into their own "Passwords" section in options page
- Only revealable by entering the vault encryption password
- Always masked in the popup mappings list (no reveal there)
Options page:
- New Passwords section with locked/unlocked states
- Reveal button validates against vault encryption password
- Hide button re-masks all password values
- Password mappings excluded from the general Mappings table
- Delete and enable/disable controls work while masked
Popup:
- Password-category mappings show dots for real value
- Password category added to mapping add form dropdown
Storage:
- Added 'password' to default categories list
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Import parser:
- Passwords now imported from Chrome/Firefox/Bitwarden/1Password CSVs
as exact-match auto-redacted mappings (→ [REDACTED-PASSWORD-N])
- Catches passwords in any context, not just key=value patterns
Proper noun heuristic:
- Auto-detect scanner now catches capitalized words mid-sentence as
potential names, company names, or project names
- Filters against 200+ common English words, programming terms, days,
months to reduce false positives
- Added to both content.js (page world) and auto-detect.js (popup)
README:
- Documented proper noun detection with examples
- Documented bulk import with all supported formats
- Added Sync features section (auto sync, conflict resolution,
version history, connected devices)
- Added Organization/Team section with policy format
- Added tamper protection documentation
- Added Legal section with liability analysis
- Updated architecture with all new modules
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
New module: import-parser.js
- Auto-detects format from filename and content headers
- Chrome/Firefox password CSV: extracts usernames, emails, domains
(NEVER imports passwords)
- Bitwarden/1Password CSV: extracts usernames, emails, domains
- Browser autofill CSV: extracts names, emails, phones, addresses
- Plain CSV: two-column real→substitute with optional category
- Plain text: one value per line, auto-categorizes (email, phone, name)
- Values without substitutes are marked "needs mapping" so the user
can see what needs filling in
Options UI:
- Import button in Transfer Data section
- Preview panel shows parsed items before applying
- Summary shows counts and highlights items needing substitutes
- Apply merges into active profile (identity) and mappings table
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Settings now encrypted at rest alongside identity, mappings, and log.
Custom domains reveal which private AI services the user accesses,
which is arguably PPI. Only the encryption salt and verification blob
remain plaintext (needed for key derivation bootstrap).
Updated README with comprehensive security documentation:
- At-rest encryption details (what's encrypted, what's not, why)
- Vault unlock flow explanation
- Authentication options table (password, TOTP, WebAuthn)
- Cross-device sync encryption flow
- Smart reveal behavior
- LOCK badge state in icon colors table
- Updated architecture section with crypto/sync modules
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
All sensitive data (identity, mappings, activity log) is now AES-256
encrypted in browser.storage.local when sync encryption is enabled.
TOTP secret is also encrypted at rest using the derived key.
Vault unlock flow:
- On browser restart, extension detects locked state (encrypted data,
no cached CryptoKey) and shows LOCK badge in red
- Popup shows a full-screen unlock prompt with password field,
optional TOTP, and biometric button
- After unlock, background decrypts and broadcasts data to all tabs
- Content scripts start with empty config when locked; receive
decrypted config via vault:unlocked message after unlock
- Injector skips encrypted blobs in storage change events
Storage module changes:
- _readSecure / _writeSecure transparently encrypt/decrypt
- encryptExistingData() migrates plaintext → encrypted on setup
- decryptAllData() restores plaintext when encryption is disabled
- isLocked() checks for encrypted data + missing key
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Encrypted sync data now embeds the encryption config so new devices
can self-bootstrap from just the sync data + the password:
Outer envelope (plaintext):
- salt + verificationBlob — needed to derive key on new device
Inner payload (encrypted):
- TOTP secret, authMethod, ttlDays, webauthn flag
Flow on new device:
1. Pull encrypted sync data from any channel
2. _decryptFromSync detects no local config, bootstraps from _encConfig
3. User enters password → key derived → payload decrypted
4. Full config (including TOTP secret) restored from inner _encMeta
5. Device is now fully configured — WebAuthn can be registered locally
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Re-verification (TTL expired, key still cached) now accepts any ONE of:
- WebAuthn (biometric/PIN)
- TOTP code alone (no password needed)
- Password alone (no TOTP needed)
First-device setup still requires password (+ TOTP if configured) since
the password is needed to derive the encryption key.
Added reverifyWithTOTP() and reverifyWithPassword() to sync.js.
Auth prompt UI adapts: first-device shows password+TOTP fields,
re-verify shows all three methods as alternatives.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
- CryptoKey now persists in IndexedDB forever — never auto-deleted
- TTL controls when re-verification is needed, not key lifetime
- WebAuthn is the primary re-auth method (not a post-expiry fallback)
- Password only needed once per device (first-time setup)
- Added needsReverification() and markVerified() to crypto.js
- Auth prompt adapts message: first-device vs re-verify vs decrypt
- Biometric button hidden on first-device setup (no credential yet)
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Sync encryption:
- AES-256-GCM encryption for all sync channels (browser sync, gist,
custom URL, folder sync, sync codes)
- Password with optional TOTP (RFC 6238) second factor
- Configurable auth TTL: session, 30/90/180/365 days, or never
- CryptoKey cached in IndexedDB — auth only needed when cache expires
AND new data exists (lastModified check runs before auth prompt)
- WebAuthn (biometric/PIN) as low-friction re-authentication gate
- Full options UI for setup, password change, and inline auth prompt
Smart reveal:
- Track which substitute values were actually sent outbound per session
- Reveal mode only replaces values that were genuinely substituted,
preventing false positives (e.g. AI using the word "user" won't be
replaced with a real username that maps to "user")
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
GitHub Gist sync:
- pushToGist(token): pushes all settings to a private Gist; creates a
new Gist on first use and stores the Gist ID in local storage so
subsequent pushes update the same Gist.
- pullFromGist(token): fetches the Gist, compares lastModified, applies
if newer (raw_url used to avoid API truncation).
- No desktop client needed; works across any browser/OS with a GitHub PAT.
- Options page shows a token field + Push/Pull buttons; Gist ID shown
once linked.
Custom URL sync:
- pushToUrl({ url, method, headers }): HTTP PUT to any endpoint.
- pullFromUrl({ url, headers }): HTTP GET, applies if newer.
- Works with Nextcloud/ownCloud WebDAV, self-hosted servers, cloud
functions, or any static-file host that allows PUT.
- Options page shows URL + optional JSON headers field + Push/Pull.
Both methods write ss_sync_notification on apply, triggering the purple
'SYN' badge and desktop notification added in the previous commit.
https://claude.ai/code/session_01TKpSR9M8JgHLXCp5CeDsQP
Notification system:
- When sync applies data (file folder, browser account, or sync code),
ss_sync_notification is written to local storage with the source.
- Service worker catches it via storage.onChanged, shows a purple 'SYN'
badge on the extension icon that persists until Options is opened, and
fires a desktop notification ('Settings updated via sync folder — open
Options to review').
- Clicking the desktop notification opens the Options page directly.
- On service worker wake, SYN badge is restored if the notification was
not yet dismissed.
- Opening Options clears ss_sync_notification, resets the badge, and
sends a sync:notification-seen message to the service worker.
- Added 'notifications' permission to both manifests.
Cloud storage clarity:
- Options page now explicitly lists that the folder sync works with any
cloud storage that has a desktop sync client: Dropbox, OneDrive, Google
Drive, iCloud Drive, Box, pCloud, Nextcloud, Synology Drive, etc.
https://claude.ai/code/session_01TKpSR9M8JgHLXCp5CeDsQP
PPI + button fix:
- After adding a mapping, the real PPI value is now immediately replaced
with the fake value in the input/contenteditable element via the new
replaceInInput() helper (handles both <textarea>/<input> and
contenteditable divs by walking text nodes).
- Triggers a re-scan 150ms later so the pre-send warning updates or
dismisses itself if no more PPI remains.
Auto-sync folder (File System Access API):
- User picks a folder once per browser via "Choose Sync Folder".
Any settings/mappings/identity change writes silent-send-sync.json
to that folder automatically (via api.storage.onChanged listener).
- On options page open and every time the page regains focus, the file
is read back; if its lastModified is newer than local data, settings
are imported immediately and the UI refreshes.
- File handle is stored in IndexedDB (ss_sync_handles) so it persists
across browser sessions without repeated permission prompts.
- Pick the SAME folder in each browser (or a synced cloud folder for
cross-computer sync) — fully automatic after that, no copy-paste.
- sync.js gains saveSyncDirHandle / loadSyncDirHandle / clearSyncDirHandle
helpers backed by IndexedDB.
https://claude.ai/code/session_01TKpSR9M8JgHLXCp5CeDsQP
Bug fixes:
- Date (possible DOB) pattern now requires context words (born, birthday,
dob, etc.) before firing — prevents spurious warnings on page-load API
calls that happen to contain ISO dates in conversation history.
- Highlight regex now uses word boundaries (\b) so short substitute values
(e.g. "aud") no longer match inside unrelated words like "Claude".
- Both TreeWalkers in content.js now skip the extension's own UI elements
(.ss-autodetect-warning, .ss-presend-warning, .ss-reveal-badge) to
prevent the highlight API from marking text in the extension's banners.
Settings sync:
- New src/lib/sync.js: exportSyncCode / importSyncCode (base64 JSON) for
manual copy-paste across any browser combination. Newest lastModified
timestamp wins; force flag available to override.
- browser.storage.sync support: when "Browser account sync" is enabled the
extension automatically pushes/pulls via Firefox Sync or Chrome account,
chunked to stay within per-item quota limits.
- storage.js now writes ss_lastModified on every save so conflict resolution
has an accurate timestamp.
- service-worker.js listens for both local and sync storage changes to keep
all copies in sync.
- New "Sync Between Browsers" section in options.html with Generate/Copy/
Import Sync Code UI and the browser sync toggle.
https://claude.ai/code/session_01TKpSR9M8JgHLXCp5CeDsQP
Detected PPI is now auto-redacted in the fetch hook using
RFC/standard reserved values — not just warned about:
- IPs → 192.0.2.1 (RFC 5737 TEST-NET-1, never routed)
- MACs → 00:00:00:00:00:00
- Addresses → 123 Example Street, Anytown, ST 00000
- GPS → 0.000000,0.000000 (Gulf of Guinea)
- Dates → 01/01/1970 (Unix epoch)
- EINs → 00-0000000 (impossible prefix)
- Paths → /home/user
- Git → example org
These are obviously fake and guaranteed not to be real data,
unlike random values which could be confused with actual PPI.
New Options toggle: "Auto-redact detected PPI on send" (on by
default). When on, PPI is caught in the fetch hook even if the
user hits Enter immediately after pasting. Warning banner now
says "Auto-redacted with standard placeholders" instead of
"These were sent as-is."
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Like spellcheck for privacy. Scans text as you type and paste
into chat inputs (debounced 800ms). Shows a dark floating warning
panel listing detected PPI BEFORE you hit Enter.
Each detected item has a green [+] button that instantly:
1. Generates a plausible fake value (random IP, fake address, etc.)
2. Adds it as a mapping to storage
3. Shows a checkmark to confirm
The warning disappears when you clear the text or when all
detected items have been addressed.
Three new Options toggles:
- Auto-detect unconfigured PPI (on by default)
- Offer to auto-add detected PPI (on by default)
Also adds a storage bridge (postMessage) so the page-world
content script can read/write chrome.storage through the
injector.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Scans outbound messages AFTER all substitutions for personal data
the user forgot to configure:
- Private/public IP addresses (skips 127.0.0.1, 8.8.8.8, etc.)
- MAC addresses
- Street addresses ("123 Main St")
- GPS coordinates
- Dates (possible DOBs)
- EIN/tax IDs
- Home directory paths not caught by smart patterns
- Shell prompts (user@host)
- Git remotes (reveals username/org)
- Environment variable assignments (HOME=, USER=, etc.)
Shows a floating dark warning banner (top-right, auto-dismisses
after 15s) listing each detected item with its type, value, and
hint. Skips values already in the user's identity config.
Also shows PPI warnings in the popup Test tab and adds toggle
in Options to disable auto-detect.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
License: Changed from MIT to BSL 1.1. Free for personal use,
commercial use requires a paid license. Auto-converts to MIT
on March 26, 2030.
Export/Import: Options page now has "Transfer Data" section:
- Export All (plain) — JSON file with all identities, mappings, settings
- Export Encrypted — AES-256-GCM with PBKDF2 password derivation,
saved as .ssbackup file
- Import — handles both plain and encrypted backups, prompts for
password if encrypted
Crypto uses Web Crypto API (browser-native, no dependencies):
100k PBKDF2 iterations, random salt + IV per export.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
No timestamp metadata in versions. Uses simple incrementing patch
numbers (0.3.3, 0.3.4, etc.). If Mozilla rejects the version as
already existing, auto-increments and retries up to 10 times.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Old approach: increment patch by 1 each time. Failed when the
same patch number was already signed with Mozilla from a
previous session.
New approach: version is 1.MMDD.HHMM (e.g., 1.326.1542).
Guaranteed unique per minute, all parts under 65535.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Two visual modes using the Highlight API (zero DOM modification):
- Yellow highlight: fake/substituted values the AI received.
Shows automatically in all AI responses, even without reveal mode.
"The AI sees these yellow values, not your real data."
- Terminal style (black bg, green text): your real data shown
in reveal mode. "This is YOUR data — the AI never saw this."
Uses CSS.highlights with ::highlight() pseudo-elements — no
spans, no DOM changes, no copy/paste artifacts. Falls back to
CSS class-based styling if Highlight API is unavailable.
Highlights are debounced (500ms) to handle streaming responses
without excessive reflows.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Claude