v0.10.0 — Markdown report to the clipboard

Added

• Copy the finished report to the clipboard as Markdown. A third hand-off next to Save and Save + Email, for teams who take bug reports in Jira, GitHub/GitLab issues or Teams rather than by email. Until now those testers retyped by hand what the extension had already collected — and the fields that go first when retyping are the browser version and the CPU architecture, the very ones lib/environment.ts exists to report accurately.
• The copied report carries the same evidence as the email body, laid out for a tracker: a heading, a table with the reporter, page address, capture time, machine and extension version, then the numbered sticky notes, the last ten console errors in a fenced code block, and the names of the saved files. A pipe inside user text is escaped so a description cannot break the table, and the code fence widens when a console message contains backticks of its own.
• No new permission is involved. navigator.clipboard.writeText() needs no grant from an extension page that holds focus, so the permission set stays byte-identical to the published v0.9.1 and the store update carries no new consent screen. The clipboard is written on a click and never read.
• When the clipboard refuses the write — a tab that lost focus, an enterprise policy — the report appears in a text box with everything selected, to be copied by hand. The files are already saved by then, so the report itself is never lost.
• MIT licence (LICENSE), and license: MIT in package.json. The repository was public but carried no licence, which legally means "all rights reserved" — nobody could reuse the code, and the store listing could not honestly call it open source.
• scripts/make-docs-pdf.mjs, which rebuilds the printable guides from docs/index.html. The existing PDFs had been printed from Chrome by hand, leaving no record of how; the recipe now lives in the repository next to the HTML generator.

Changed

• User-guide screenshots, the online guide and both PDFs regenerated from the current build, so they show the third button rather than a toolbar that no longer exists.

v0.9.1 — text box no longer swallows the first characters

Fixed

• The text and sticky-note box could swallow the first characters typed into it. Focus was applied one tick after the box appeared, so anything typed in that gap went nowhere — it showed up as an annotation reading "ative total?!" instead of "Negative total?!" in a freshly generated screenshot. Focus is now claimed the moment the box enters the document, and the click that opens it no longer lets the browser move focus to the canvas, which would otherwise blur the box in the same frame.
• Documentation and store screenshots regenerated from the current build, so they show sticky notes, the version badge and the current Settings.

v0.9.0 — share a project profile as a file

Added

• Export and import a project profile as a file. A developer prepares one profile — recipients, CC, subject prefix, Downloads subfolder, description template, project domains, recording limits — and sends the JSON to every tester, instead of each tester configuring Settings by hand and getting one field wrong.
• Importing shows what the file will add — the recipients above all — and stores nothing until it is confirmed. A profile file sets where finished reports are sent, so a file from an untrusted source could otherwise quietly redirect screenshots of a customer's application to a stranger.
• The exported file carries project settings only. Reporter details (name, customer number, AnyDesk) are per-person and never travel in a shared file, report history never leaves the machine, and the profile id is dropped so an import cannot overwrite an existing profile.
• Every field in an imported file is validated and clamped before it reaches storage: path escapes are stripped from the subfolder, recipients that are not addresses are dropped, domain patterns that would match every site are rejected, recording limits are bounded, over-long text is truncated, and unknown keys are discarded.

Changed

• The import confirmation button reads "Add and select this profile" rather than repeating the existing "Add profile" label, so no two controls in Settings say the same thing. E2E now also asserts that no two Settings labels collide.

v0.8.0 — yellow sticky notes

Added

• Yellow sticky notes — a new annotation tool for a reviewer's comment, as opposed to the one-word label the Text tool draws. The note sizes itself from the image: max(12px, 1.1% of width), so a 240 px region crop stays readable where a plain proportion would collapse to 2.6 px, and a retina capture gets a note that reads the same after the browser scales it down. The shared "Size" slider does not apply.
• Notes are numbered on the image, and their number and text go into the companion .json and the email body, so the developer can search and quote a comment instead of retyping it from the screenshot. The number is derived from the note's position in the list, so the image and the report cannot disagree about which note is which.
• Inside a note Enter breaks the line and Ctrl/Cmd+Enter commits — a note is sentences, not a label — with a hint under the field stating so. Escape discards.
• docs/BACKLOG.md, recording accepted ideas and the reasoning behind them; linked from the README.

Fixed

• The console.error wrapper sometimes never installed on a configured project domain. The gate and the MAIN-world script are injected independently, so the gate could dispatch its decision before the other script had registered a listener — and nothing re-sent it. The two now shake hands. This surfaced as an intermittently failing E2E check, which was a real product race rather than test flakiness.

v0.7.0 — version badge by the app name, feedback footer

Added

• The installed version is shown next to the app name on every surface — popup, settings, annotation view and recorder — so you can name your build when reporting a problem without opening chrome://extensions. The badge is selectable as one unit for easy copying.
• A footer in the annotation view, where a report has just been finished: a link to rate the extension in the Chrome Web Store, and a link to request a missing feature on the project page.

Fixed

• The E2E check for the project-domain gate was flaky: it slept for a fixed time while waiting on an asynchronous chrome.storage write and the content script that reads it. It now polls for the actual conditions. A test that only sometimes passes reports nothing.

v0.6.0 — real OS, CPU architecture and browser version in reports

Fixed

• Reports described the wrong machine (user report). Chrome deliberately misreports the legacy signals: navigator.platform returns MacIntel even on Apple Silicon, the UA string freezes macOS at 10_15_7, and the browser version in it is reduced to <major>.0.0.0. A report filed from an M4 Mac therefore read "Intel Mac OS X 10_15_7". The environment block is now built from User-Agent Client Hints, so the same machine reports e.g. macOS 15.3.0 | arm64 | Google Chrome 150.0.7827.55.

Added

• architecture and browser fields in the companion .json, and the raw userAgent moved to its own line in the email body so the readable summary comes first.
• Windows is named from its Client Hints platform version (Windows 11 / Windows 10) instead of the compatibility number it reports.

Changed

• PRIVACY.md now lists operating system and version, CPU architecture and exact browser version explicitly, replacing the vaguer "browser/OS version".

v0.5.1 — click-path toggle honoured, settings labels fixed

Fixed

• "Track click path for screenshots" was a dead switch. Nothing read the setting: clicks were written into every companion .json and email body even with it turned off. Both context toggles now run through one gate (lib/reportContext.ts), covered by unit tests.
• Settings showed two different controls under the same label — v0.5.0 reused the console-error toggle's translation key for the new domain list, so the checkbox read "Capture console errors on these domains". The toggle and the domain list now have their own labels, and E2E asserts they stay distinct.

v0.5.0 — console.error capture scoped to project domains

Added

• Project domains in each project profile. console.error messages are captured only on the domains listed there (comma-separated, *.staging.example.com and localhost supported).

Changed

• BREAKING console.error is no longer captured on every page. The domain list is empty by default, so after this update the extension collects logged console errors nowhere until a domain is filled in. Uncaught errors and rejected promises are unaffected — they are still captured on any page you capture.
• The reason: wrapping console.error makes the extension a frame in the call stack of every console.error on every page. Sites with client-side error telemetry (observed on facebook.com) ship that frame to their own servers, which tells them the user has UsrHelper installed. The extension itself still transmits nothing; this stops it from making other pages report its presence. See docs/superpowers/specs/2026-07-21-console-capture-scope-design.md.
• PRIVACY.md and docs/STORE_LISTING.md updated to describe the narrowed data flow. The <all_urls> justification is unchanged — click path, recording overlays and region capture still require it.

v0.4.5 — zero known vulnerabilities in the toolchain

Security

• All 16 open Dependabot alerts (5 critical, 6 high, 5 moderate) are closed — npm audit reports zero. Every one of them sat in the build toolchain; the only runtime dependency is Preact, so no vulnerable code was ever shipped to users or to the Chrome Web Store.
• Toolchain upgraded: WXT 0.19 → 0.20.27, Vitest 2.1 → 4.1, Vite 5.4 → 8.1 (the whole tree now shares one Vite; the audit flagged every Vite ≤ 6.4.2).
• Patched transitive build dependencies pinned via package.json overrides — tar, tmp, adm-zip, shell-quote, uuid, esbuild. Their parents (giget, web-ext-run, which serve wxt init templates and Firefox runs this project never uses) still ship the vulnerable ranges, so no wxt release fixes them.

Changed

• BREAKING (build only) WXT 0.20 removed the extensionApi option; it is gone from wxt.config.ts and the global chrome.* API is now typed through @types/chrome. No change to the extension's behaviour, permissions or manifest — verified by the full suite: 35 unit tests and 39/39 E2E checks against the built extension.

v0.4.4 — text annotation fixes

Fixed

• A text annotation was added twice for a single text box (user report). Chrome fires blur on the textarea while it is being removed from the DOM, so pressing Enter ran the commit once for the key and once for that blur — the text was drawn on top of itself and Undo had to be pressed twice to remove it. The commit is now gated by a synchronously cleared anchor, so whichever trigger fires first commits and the rest are no-ops.
• Every text box after the first one opened unfocused and swallowed the typing: the autofocus attribute is processed only once per document. The editor now focuses the box explicitly when it opens.
• Escape now really discards the draft and closes the box. It used to leave the box behind, and a leftover box blocks onPointerDown — which made every drawing tool go dead until the editor was reopened.

Added

• scripts/probe-text-dup.mjs — focused Playwright repro for the text-box commit path; the same assertions run inside the main E2E suite (scripts/e2e.mjs).