The smart engine records individual name parts ("Ademo"→"John",
"Demo"→"Smith") AND the combined form ("Ademo Demo"→"John Smith")
in sessionSubstitutions. The catch-all in buildRevealPairs was
adding all of them, causing partial replacements that corrupted
the DOM and made the cache oscillate between 4 and 0 pairs.
Fix: skip session entries whose key is a substring of a longer
entry (e.g. "ademo" is part of "ademo demo"). Only the combined
form gets added as a reveal pair.
Also: remove debug logging, improve cache with size tracking.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
Root cause found: commit 9a11896 (v2.0.14) added isInNonChatArea()
and expanded SKIP_REVEAL_TAGS with NAV/ASIDE/HEADER/FOOTER, but that
commit was on a branch that was never merged into main. When we started
our work from main, these fixes were missing.
Restored:
- isInNonChatArea() function — prevents reveal from touching sidebars,
navigation, headers, footers, and other non-chat UI
- SKIP_REVEAL_TAGS expanded with NAV, ASIDE, HEADER, FOOTER
- isInNonChatArea checks added to revealInElement, unrevealInElement,
and highlightMatches (both element-level and walker-level)
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
Two bugs found:
1. Individual name parts ("Ademo"→"John", "Demo"→"Smith") were added
as reveal pairs, causing partial replacements that corrupted the DOM.
The smart engine sends combined forms ("Ademo Demo"→"John Smith")
which the catch-all already handles. Removed individual name entries
from buildRevealPairs — only emails, usernames, hostnames, phones
are matched individually.
2. Cache invalidated on every ss:config-updated (including settings-only
changes like reveal toggle). Now only invalidates when mappings or
identity actually change.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
If reveal mode was saved as ON in settings, the page loaded with
revealMode=true and prevRevealMode=true. The checkRevealToggle
function only fires on transitions (off→on or on→off), so the
reveal interval was never started. Added initialization check
that starts the reveal interval immediately if revealMode is
already true at page load.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
AMO expects { required: false } not { collect_user_data: false }.
Bumped strict_min_version to 140.0 (when data_collection_permissions
was introduced). Version 0.9.8.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
When at-rest encryption is enabled, storage.onChanged fires with
encrypted blobs for ss_settings. The injector was passing this
encrypted blob directly as settings to the page world content script,
overwriting real settings with { _ssLocalEncrypted: true, data: ... }.
This broke reveal mode, highlights, and any setting toggle because
the content script's settings object became the encrypted blob.
Fix: skip encrypted settings blobs in injector.js (same check already
existed for mappings and identity). The background's settings:updated
message already sends decrypted settings correctly.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
Added copilot.microsoft.com to host_permissions, content_scripts
matches, and BUILTIN_URL_PATTERNS in both Chrome and Firefox manifests
plus the service worker.
Updated README:
- Added Copilot to supported services table
- Added Edge and Brave to browser list
- Added note about desktop apps (can't intercept, use web version)
- Removed old duplicate browser note
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
New AI sites: Perplexity, Copilot, DeepSeek, HuggingChat, Poe
Developer/support: GitHub, GitLab, Reddit (www + old), Stack Overflow, Pastebin
The existing interception is service-agnostic — it scans all JSON strings
in POST/PUT/PATCH requests through the 4-stage substitution pipeline.
No site-specific handling needed; all sites use the same method.
https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
Accept (+) button:
- Was reading raw storage (getStorageData) which returns encrypted
blobs when encryption is enabled, silently failing to add mappings
- Fixed: adds directly to the local mappings array and persists via
setStorageData (storage bridge handles encryption transparently)
Auto-detect false positives:
- Was only checking identity values, not explicit mappings — values
already in the mappings table still got flagged as unconfigured PPI
- Fixed: now adds all mapping real/substitute values to the skip set
Ignore button:
- Changed from plain text link to grey pill button for better UX
- Still persists permanently via ss_ignored_ppi in storage
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
When at-rest encryption is enabled, storage.local contains encrypted
blobs. The injector reads raw storage (content script world, no
access to IndexedDB CryptoKey) and sees { _ssLocalEncrypted: true }.
It passed empty config to content.js → no mappings → no substitution.
This is why Firefox stopped working after encryption was enabled.
Chrome/Brave worked because the user hadn't set up encryption there.
Fixed: injector now detects encrypted data and asks the background
script for decrypted config via 'get:decrypted-config' message.
The background uses the Storage module (which has IndexedDB access)
to decrypt and return the data. Falls back to empty config if the
vault is actually locked.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
The early hook approach (inline script, then external early-hook.js)
kept breaking Firefox due to CSP restrictions and timing issues with
the async external script load. Each fix for ChatGPT introduced a
new regression for Firefox/Brave.
Reverted to the original simple approach:
- Injector reads storage, injects content.js via <script src="...">
- content.js captures window.fetch at load time and patches it
- No inline scripts, no early hooks, no __ssOriginalFetch globals
This is what worked on Claude.ai across all browsers before the
ChatGPT fix attempts. ChatGPT support may need a different approach
later (possibly using declarativeNetRequest for header-only changes,
or a ChatGPT-specific content script), but it should not break the
core functionality on Claude.ai.
Kept the Request object handling in the fetch interceptor (needed for
some frameworks) but removed all early hook dependencies.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
The inline <script> with textContent was blocked by claude.ai's
Content Security Policy on Firefox (Chrome is more permissive).
No fetch interception = no substitution = completely broken on FF.
Fixed by moving the early fetch hook to its own file (early-hook.js)
loaded via <script src="..."> which is CSP-compliant. Added to
web_accessible_resources in both Chrome and Firefox manifests.
Also fixed duplicate 'const api' declaration in injector.js that
would have crashed the content script.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Bug 1 - Reveal mode not working (all browsers):
sessionSubstitutions stored "ademo demo" (full name) as key, but
buildRevealPairs looked up "ademo" and "demo" individually. No match,
no reveal pairs, reveal did nothing. Fixed by also storing individual
words from multi-word replacements so both "ademo demo" AND "ademo"
AND "demo" are in the map.
Bug 2 - Missing await on _handleDecryptedMeta (sync.js):
Two call sites returned the Promise instead of the resolved value.
Downstream code checking decResult.data got undefined. Added await.
Bug 3 - Profile selector broken by safeHTML (popup.js):
DOMParser.parseFromString wraps content in <html><body> which
mangles <option> elements when moved to a <select>. Replaced with
new Option() DOM API which creates proper option elements.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Root cause: when importing an encrypted sync code from another device,
_decryptFromSync was replacing the local encryption config (salt) with
the source device's salt. This caused:
1. Local key cache derived from wrong salt
2. Local data (encrypted with local salt) became unreadable
3. _applyData tried to write with the wrong key
Fixed with a complete refactor of cross-device decryption:
- authenticateForSync() derives a TEMPORARY key using the source salt
- Temporary key stored separately as 'tempSyncKey' in IndexedDB
- Local encryption config and cached key are NEVER modified
- After decryption, _applyData writes via _writeSecure using the
LOCAL key (which uses the local salt)
- _handleDecryptedMeta extracted for code reuse
Also:
- Options.js auth handler detects pending sync import and routes to
authenticateForSync instead of regular authenticate
- After auth success, automatically retries the import
- README updated: imported passwords are protected (dots in UI,
vault password to reveal, AES-256 encrypted at rest)
- Bumped to v2.0.9
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
ChatGPT (and potentially other AI services) calls fetch() with a
Request object as the first argument: fetch(new Request(url, opts))
instead of fetch(url, opts). The interceptor only handled the second
form, so ChatGPT's conversation requests passed through unmodified.
Fixed by handling both fetch signatures:
- fetch(url, options) — existing path
- fetch(Request) — new: extracts URL, method, headers, reads body
via request.text() for JSON/text content types
Also handles non-string body types:
- Blob → text via blob.text()
- ArrayBuffer → text via TextDecoder
- URLSearchParams → string via toString()
These cover the various ways modern frameworks call fetch().
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Set Chrome, Firefox, and package.json all to version 2.0.0
(major bump reflecting encrypted storage, document scanning,
org/team features, sync improvements).
Sign script rewritten:
- Tries current version first instead of always bumping
- Only bumps on "version already exists" errors
- Handles rate limiting by parsing throttle duration from error
and waiting the exact time (not blindly retrying)
- Only updates source files on successful signing (not before)
- Reduced max attempts to 5 (with proper backoff, shouldn't need more)
- Commits version bump only after successful sign
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Notification system:
- When sync applies data (file folder, browser account, or sync code),
ss_sync_notification is written to local storage with the source.
- Service worker catches it via storage.onChanged, shows a purple 'SYN'
badge on the extension icon that persists until Options is opened, and
fires a desktop notification ('Settings updated via sync folder — open
Options to review').
- Clicking the desktop notification opens the Options page directly.
- On service worker wake, SYN badge is restored if the notification was
not yet dismissed.
- Opening Options clears ss_sync_notification, resets the badge, and
sends a sync:notification-seen message to the service worker.
- Added 'notifications' permission to both manifests.
Cloud storage clarity:
- Options page now explicitly lists that the folder sync works with any
cloud storage that has a desktop sync client: Dropbox, OneDrive, Google
Drive, iCloud Drive, Box, pCloud, Nextcloud, Synology Drive, etc.
https://claude.ai/code/session_01TKpSR9M8JgHLXCp5CeDsQP
Outis