Added
Tools tab (Alt+3): transform workbench, live regex tester, URL unfurler, and file hash analysis, all local, on collapsible and resizable cards that remember their state

Removed
Notes tab; stored investigation notes are dropped once on the next popup open

Since 0.5.5.

• Duplicate IOCs no longer reach the results, graph, exports, or Ask AI prompt; IPv6
addresses extract whole; the context-menu extract refangs defanged text
• Popup fixes: restored settings show the right toggle state, defanged rows no longer
send broken values to enrichment, Ask AI and Enrich-remaining no longer leak the
previous case's data, Export Selected exports the selection, snippet Edit saves the
right snippet, System theme persists, Copy Crypto works, the PDNS/ASN cache viewer
opens
• Enrichment fixes: urlscan edges return to the graph, 401/429 classify as bad key or
rate limit instead of network error, VirusTotal ASN and URL data parse correctly, a
URLhaus outage is an error not a clean lookup, the cache caps at 1000 entries and
shares rate budgets fairly
• OSINT links open in background tabs so the popup stays open
• The floating window is resizable via a corner grip, fills its frame, and closes on
Esc
• Optional sidebar navigation, set in the new "Window & Layout" settings section
• Chrome side panel: dock the toolkit from the popup header, Settings, or an opt-in
that makes the toolbar icon open it; narrow windows share the same spacious layout
• Tests run the real popup and service worker (158 assertions, every fix behind a
failing test first) and CI fails on version drift
• Screenshot pipeline fixed and extended with three new store shots

• Search box above the IOC list that filters results live as you type, combining with the category filter
• The expand/collapse-all-links choice is remembered, so rows open the same way next popup session

• Expand-all-links toggle saved its state inverted, so the persisted choice never matched the toggle
• Popup version label read from the manifest instead of a hardcoded "v0.4"
• vis-network.min.js replaced with an unminified build (Chrome Web Store rejected the minified bundle for readability review)

• Verdict chips and risk scores on each result row; clicking a chip expands per-provider facts with per-value copy buttons, and "Details" opens the full enrichment panel
• Per-row Enrich and Links buttons; OSINT links are collapsed by default
• Collapsible IOC relation graph; the collapsed or expanded choice is remembered
• "Expand all links" control above the results list

• Results header reduced to a single Actions menu holding copy, enrich, export, filter, and graph controls