Maintenance release with improved developer tooling, dependency updates, and the features introduced in the v1.5.0 release.

• Added JavaScript type checking across the extension source
• Updated CI to run type checking and use Node.js 22
• Updated the indirect postcss and nanoid dependencies
• Added weekly Dependabot updates for npm packages and GitHub Actions
• Added a README badge linking to the GitLab mirror

v1.5.0

Feed Sanitizer now covers Reddit, LinkedIn, TikTok, and Threads in addition to YouTube, Instagram, and Facebook.

New:
- Stats dashboard (popup → Stats)
- Onboarding page on first install
- "Trust this site" allowlist button in popup
- Custom ad blocker keywords and URL patterns in Settings
- Per-site exceptions (disable any feature on specific domains)
- Inline card editing in Flashcard Manager
- Delete default cards once you have custom ones
- Card search/filter in Flashcard Manager
- Anki CSV export
- Storage meter on Flashcard Manager
- Flashcard timing sliders in Settings
- Daily hidden element count in popup
- Tip lines on writing suggestions

[1.4.0] - 2026-06-18

Added

• Alt+Shift+T shortcut - reopens and re-runs the Tone Translator panel on demand when it has been closed or minimized; mirrors the existing Alt+Shift+F flashcard shortcut
• SRS progress in export/import - flashcard export now bundles spaced-repetition state alongside cards as { version: 1, cards, srs }; import restores progress on a new device, merging with any existing local state (existing progress always takes priority); legacy plain-array exports still import correctly

Fixed

• Malicious iframe URLs ignored - isMalicious() only checked href on anchor elements; iframes were queried by querySelectorAll('a[href], iframe[src]') but their src was never tested against hrefPatterns; URL check now covers iframes via el.src
• Filter fetch timeout - updateFilterLists() had no timeout; a slow or unresponsive filter list server could stall the service worker indefinitely; each fetch now aborts after 10 seconds via AbortSignal.timeout
• Custom card storage overflow - adding or importing cards gave no feedback when the sync storage per-item limit (~8 KB) would be exceeded; both paths now check serialized size before writing and show a clear error

Tests

• Added tests/adBlocker.test.js (6 tests) covering isMalicious: href pattern match, text keyword match, clean element, empty inputs, 120-char truncation, and iframe src match
• Added tests/filterIntegrity.test.js (5 tests) covering the 70% selector integrity check: below threshold, at/above threshold, exact boundary, just below, and no-cache base case
• Extended tests/flashcard.test.js with a cardKey special-characters/emoji stability test (closes issue #17)
• Aligned pickCardPure test helper with the real implementation (uses Math.random); tests now pin randomness via vi.spyOn so helper and source can never silently diverge

[1.3.0] - 2026-06-05

Fixed

• cardKey collision - cardKey() now uses a djb2 hash of the full question string instead of truncating to 40 characters; eliminates silent SRS data overwrites for cards sharing a long prefix (issue #10)
• SRS storage quota - SRS state migrated from chrome.storage.sync to chrome.storage.local; existing data is automatically migrated on first load; prevents silent data loss as card sets grow (issue #11)
• Silent storage errors - getSRS, saveSRS, and recordResult now wrap storage calls in try/catch and log failures to console; SRS tracking no longer silently breaks mid-session on storage errors (issue #12)
• Flashcard focus trap - flashcard dialog now traps Tab/Shift+Tab focus within the three buttons (Close, Reveal, Skip), honouring the aria-modal="true" contract; Escape also dismisses the card (issue #13)

Added

• Flashcard keyboard navigation - Space/Enter reveals a card; 1 marks "Got it"; 2 skips; keyboard hints shown on buttons
• Flashcard light theme - flashcard widget reads the user theme from extension state and applies a light palette when light or system-light is active; updates live without a page reload (issue #16)

Changed

• Persist writing assistant collapse state - the panel's minimized/expanded state is now saved to chrome.storage.local and restored on each page load
• Shared DEFAULTS constant - DEFAULTS extracted to config/defaults.js loaded by both the background service worker and popup; eliminates the duplicated "keep in sync" definitions in background.js and popup.js (issue #18)

MindTab Zip AOM

Recent Changes:

[1.2.0] — 2026-05-16

Added

• Spaced repetition (SM-2); Flashcards now use a lightweight SM-2 algorithm. "Got it" increases a card's interval; "Skip" or timeout resets it. Due cards are shown first, and a badge on the overlay shows how many cards are currently due
• Flashcard export / import; Custom cards can now be exported as JSON and imported back (or shared as a deck). Import merges into existing cards, with schema validation
• Writing check controls; Settings page now lets you toggle each Tone Translator check independently (passive voice, hedge words, long sentences, filler words, repeated words) and configure the long-sentence word threshold (15–50 words)
• Manual theme override; Settings page has a System / Light / Dark segmented control that overrides prefers-color-scheme; preference persisted in sync storage
• Custom filter list sources; Settings page exposes the three filter list URLs with add/remove UI; previously only configurable programmatically. Changes take effect on next update
• Various GitHub Only Changes/Additions not Included in this zip.

Changed

• Keyboard shortcuts: Esc closes the Tone Translator panel; Alt+Shift+F triggers a flashcard on demand
• ARIA improvements; Tone panel has role="complementary" + aria-label; flashcard overlay has role="dialog" + aria-modal="true"; flashcard buttons receive focus on card show
• Grammar server cooldown; Added a 750 ms post-analysis cooldown to prevent hammering the grammar server during rapid typing (on top of the existing debounce)
• Filter list integrity check; If a fetched update drops the total selector count by more than 30% vs. the cached set, the update is rejected and the cache is preserved
• Branding; Credit updated to AetherAssembly across all UI pages, linking to https://aetherassembly.org/about
• Bump version to 1.2.0
• Various GitHub Only Changes/Additions not Included in this zip.

View the Full ChangeLog here

MD5: 4dc843422b7039054b8a7577260bf236

SHA256: f8f8951a7b9bd03b050e80014771ba336498af1f5f51e51d4fe28255111579f2

SHA512: 4dd02acaf6ca0366019eaf81828406326ec310f897d9758a6aa15aa3681c285ca6a0aa0cd06a56f73666ab480cbe1dbe31781c83040df0a3e01d18c6609b1199

[1.1.2] — 2026-05-12

Added

• Dedicated Settings page — settings moved out of the popup collapsible into a full-page ui/settings.html, opened in a new tab via a Settings button in the popup
• Test Connection button — verifies the grammar server URL by pinging /health, showing latency and upstream URL on success or a descriptive error on failure
• Tone Translator server status dot — small indicator in the writing assistant panel header shows connection state: green (connected), orange (unavailable), gray (not configured)
• Tone Translator offline/error states — grammar section now shows contextual messages instead of silently hiding: "Local analysis only" when no server is configured, "Checking grammar…" while a request is in-flight, "✓ No grammar issues found" on a clean result, and "Server unavailable" with a Retry button on failure

Fixed

• Incomplete URL sanitization — feedSanitizer.js used host.includes('youtube.com') which matched spoofed domains like fake-youtube.com; replaced with exact match + .endsWith() checks (resolves CodeQL alerts #3–6)
• Permissive CORS — grammar proxy server defaulted to Access-Control-Allow-Origin: *, allowing any website to use the proxy; origin is now unconditionally validated against moz-extension://, chrome-extension://, and localhost — the CORS_ORIGIN env var bypass has been removed (resolves CodeQL alert #7)