Storage issue: Chromium/Brave keeps storage.local data even when
an unpacked extension is removed and reloaded. Added "Reset
Everything" button in Options → Danger Zone that clears all data
(double-confirm to prevent accidents).
Reveal mode: Now re-runs revealAllResponses() every 2 seconds
while active to catch streamed content and dynamically loaded
responses. Adds console logging for reveal toggle state changes
to aid debugging. Cleans up interval when reveal mode is turned off.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Interception is now completely inactive until the user configures
at least one identity field or explicit mapping. Before that:
- Icon shows gray (unconfigured)
- No fetch/XHR hooks fire
- First-run banner tells user to set up
Custom domains: clicking "Add Domain" in Options now triggers
the browser's native permission prompt via permissions.request().
No more manual chrome://extensions site access step.
Icon states are now:
- Gray = unconfigured (nothing will happen)
- Black = active and protecting
- Blue = reveal mode on
- Red = manually disabled
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Adds a secret scanning layer that runs after identity/explicit
substitutions. Catches secrets the user didn't configure:
- API keys: OpenAI (sk-), Anthropic (sk-ant-), Google (AIza),
AWS (AKIA), GitHub (ghp_), GitLab (glpat-), Slack (xox),
Stripe (sk_live/test), SendGrid (SG.)
- Auth: Bearer tokens, key=value assignments (password=, secret=,
api_key=, token=), private key blocks (-----BEGIN PRIVATE KEY-----)
- Connection strings: mongodb://, postgres://, mysql:// with creds
- PII: SSN (xxx-xx-xxxx), credit card numbers (Visa/MC/Amex/Discover)
Redacted values shown in red in the Test tab. Secrets are truncated
in the activity log (first 8 chars + "...") to avoid logging the
full secret. Enabled by default, toggle in Options.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Replace URL-pattern and body-shape matching with universal approach:
Outbound (substitution):
- Hooks ALL POST/PUT/PATCH fetch and XHR requests, not just known
API endpoints. Skips static assets and analytics.
- Deep-walks any JSON structure recursively to find and substitute
all string values. Skips metadata keys (model, id, token, etc.).
- Falls back to raw string substitution for non-JSON bodies.
Inbound (reveal):
- Walks ALL text nodes in document.body, not just specific CSS
selectors. Skips SCRIPT, STYLE, INPUT, TEXTAREA tags.
- Handles streaming by observing characterData mutations globally.
This makes Silent Send survive any API restructuring — the only
thing that could break it is a site encrypting request bodies in
JS before fetch, which would also break their own dev tools.
Performance: reveal pairs are cached and only rebuilt on config
change. Deep walk skips known non-content keys to avoid touching
auth tokens or request metadata.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Reveal mode (eye icon) now works as intended:
- Toggle ON: all existing responses on the page get fake→real
substitution applied immediately (paths, names, emails, etc.)
- Streaming responses are revealed in real-time as they arrive
- Toggle OFF: original text is restored from saved state
- Covers code blocks, artifacts, pre tags, and all response
containers across all supported services
- Blue floating badge shows "Reveal Mode — showing real data"
when active so user knows what they're seeing
The workflow is now: type /home/jsmith/... → Claude sees
/home/ademo/... → Claude responds with /home/ademo/... →
reveal mode shows /home/jsmith/... → user copies real path.
Also adds privacy note in popup footer: data stays in local
browser storage, no servers, no tracking, no analytics.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Test tab now has two modes:
- Strip (real → fake): paste text with real data, see what gets sent
- Reveal (fake → real): paste AI output with fake data, get back
real data with a "Copy to Clipboard" button
Also fixes:
- content.js smartSubstitute bailing when identity.enabled was
undefined (defaulted enabled to all-true instead of returning)
- Test tab now reloads identity from storage on tab switch so
changes saved in the Identity tab take effect immediately
- Shows yellow warning when identity fields are missing
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Extend Silent Send to intercept API requests on all major AI chat
services. Each service has different API shapes:
- ChatGPT: /backend-api/conversation with content.parts arrays
- Grok: GraphQL + /2/grok/add_response with message field
- Gemini: form-encoded f.req with nested arrays (+ generateContent)
- OpenWebUI: /api/chat and /ollama/api/chat (self-hosted)
All services share the same substitution pipeline. Manifests updated
for both Chrome and Firefox with host_permissions for all domains.
OpenWebUI supported via localhost/127.0.0.1 for self-hosted instances.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
jsmith@macbook-pro now becomes ademo@mycomputer when both username
and hostname are configured in the Identity tab. Hostnames are also
caught standalone (e.g. just "macbook-pro" in text).
Also rewrites README with detailed step-by-step Mozilla API key
setup instructions for Firefox signing.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Instead of requiring explicit mappings for every variation, users
now configure their identity once (Identity tab) and Silent Send
auto-catches:
- Emails: any address @gmail, @yahoo, @outlook, etc.
- Names: first/last, full name, reversed, possessives, case variants
- Usernames: user@host, ~user, /home/user, C:\Users\user
- Phones: all common formats ((555) 123-4567, 555.123.4567, etc.)
Smart patterns run before explicit mappings, so explicit rules
can override smart catches when needed.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Chrome Manifest V3 extension that intercepts personal data and
substitutes it with user-defined replacements before sending to
Claude.ai. Hooks fetch() in the page's main world to catch API
requests, with bidirectional substitution (real→fake on send,
fake→real on display via reveal mode).
Includes popup UI with mapping management, live test/diff view,
activity log with badge count, options page with import/export,
and Shadow DOM traversal for Claude.ai compatibility.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Claude