- CryptoKey now persists in IndexedDB forever — never auto-deleted
- TTL controls when re-verification is needed, not key lifetime
- WebAuthn is the primary re-auth method (not a post-expiry fallback)
- Password only needed once per device (first-time setup)
- Added needsReverification() and markVerified() to crypto.js
- Auth prompt adapts message: first-device vs re-verify vs decrypt
- Biometric button hidden on first-device setup (no credential yet)
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Sync encryption:
- AES-256-GCM encryption for all sync channels (browser sync, gist,
custom URL, folder sync, sync codes)
- Password with optional TOTP (RFC 6238) second factor
- Configurable auth TTL: session, 30/90/180/365 days, or never
- CryptoKey cached in IndexedDB — auth only needed when cache expires
AND new data exists (lastModified check runs before auth prompt)
- WebAuthn (biometric/PIN) as low-friction re-authentication gate
- Full options UI for setup, password change, and inline auth prompt
Smart reveal:
- Track which substitute values were actually sent outbound per session
- Reveal mode only replaces values that were genuinely substituted,
preventing false positives (e.g. AI using the word "user" won't be
replaced with a real username that maps to "user")
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
GitHub Gist sync:
- pushToGist(token): pushes all settings to a private Gist; creates a
new Gist on first use and stores the Gist ID in local storage so
subsequent pushes update the same Gist.
- pullFromGist(token): fetches the Gist, compares lastModified, applies
if newer (raw_url used to avoid API truncation).
- No desktop client needed; works across any browser/OS with a GitHub PAT.
- Options page shows a token field + Push/Pull buttons; Gist ID shown
once linked.
Custom URL sync:
- pushToUrl({ url, method, headers }): HTTP PUT to any endpoint.
- pullFromUrl({ url, headers }): HTTP GET, applies if newer.
- Works with Nextcloud/ownCloud WebDAV, self-hosted servers, cloud
functions, or any static-file host that allows PUT.
- Options page shows URL + optional JSON headers field + Push/Pull.
Both methods write ss_sync_notification on apply, triggering the purple
'SYN' badge and desktop notification added in the previous commit.
https://claude.ai/code/session_01TKpSR9M8JgHLXCp5CeDsQP
Notification system:
- When sync applies data (file folder, browser account, or sync code),
ss_sync_notification is written to local storage with the source.
- Service worker catches it via storage.onChanged, shows a purple 'SYN'
badge on the extension icon that persists until Options is opened, and
fires a desktop notification ('Settings updated via sync folder — open
Options to review').
- Clicking the desktop notification opens the Options page directly.
- On service worker wake, SYN badge is restored if the notification was
not yet dismissed.
- Opening Options clears ss_sync_notification, resets the badge, and
sends a sync:notification-seen message to the service worker.
- Added 'notifications' permission to both manifests.
Cloud storage clarity:
- Options page now explicitly lists that the folder sync works with any
cloud storage that has a desktop sync client: Dropbox, OneDrive, Google
Drive, iCloud Drive, Box, pCloud, Nextcloud, Synology Drive, etc.
https://claude.ai/code/session_01TKpSR9M8JgHLXCp5CeDsQP
PPI + button fix:
- After adding a mapping, the real PPI value is now immediately replaced
with the fake value in the input/contenteditable element via the new
replaceInInput() helper (handles both <textarea>/<input> and
contenteditable divs by walking text nodes).
- Triggers a re-scan 150ms later so the pre-send warning updates or
dismisses itself if no more PPI remains.
Auto-sync folder (File System Access API):
- User picks a folder once per browser via "Choose Sync Folder".
Any settings/mappings/identity change writes silent-send-sync.json
to that folder automatically (via api.storage.onChanged listener).
- On options page open and every time the page regains focus, the file
is read back; if its lastModified is newer than local data, settings
are imported immediately and the UI refreshes.
- File handle is stored in IndexedDB (ss_sync_handles) so it persists
across browser sessions without repeated permission prompts.
- Pick the SAME folder in each browser (or a synced cloud folder for
cross-computer sync) — fully automatic after that, no copy-paste.
- sync.js gains saveSyncDirHandle / loadSyncDirHandle / clearSyncDirHandle
helpers backed by IndexedDB.
https://claude.ai/code/session_01TKpSR9M8JgHLXCp5CeDsQP
Bug fixes:
- Date (possible DOB) pattern now requires context words (born, birthday,
dob, etc.) before firing — prevents spurious warnings on page-load API
calls that happen to contain ISO dates in conversation history.
- Highlight regex now uses word boundaries (\b) so short substitute values
(e.g. "aud") no longer match inside unrelated words like "Claude".
- Both TreeWalkers in content.js now skip the extension's own UI elements
(.ss-autodetect-warning, .ss-presend-warning, .ss-reveal-badge) to
prevent the highlight API from marking text in the extension's banners.
Settings sync:
- New src/lib/sync.js: exportSyncCode / importSyncCode (base64 JSON) for
manual copy-paste across any browser combination. Newest lastModified
timestamp wins; force flag available to override.
- browser.storage.sync support: when "Browser account sync" is enabled the
extension automatically pushes/pulls via Firefox Sync or Chrome account,
chunked to stay within per-item quota limits.
- storage.js now writes ss_lastModified on every save so conflict resolution
has an accurate timestamp.
- service-worker.js listens for both local and sync storage changes to keep
all copies in sync.
- New "Sync Between Browsers" section in options.html with Generate/Copy/
Import Sync Code UI and the browser sync toggle.
https://claude.ai/code/session_01TKpSR9M8JgHLXCp5CeDsQP
Claude