Skip to content

v0.2.0

Choose a tag to compare

View all tags
@IvanKuria IvanKuria released this 09 Aug 16:05
· 4 commits to main since this release
v0.2.0
b1926ef

Prebuilt Chrome extension, ready to load unpacked. No Node or pnpm needed — the zip below is built by CI from this tag, so it matches the source exactly.

Install (Windows)

  1. Download the zip below and extract it
  2. Open Chrome — not Helium, Thorium, or other ungoogled-chromium builds. They remove FCM, and Chrome's Push API is FCM, so codes can never arrive
  3. chrome://extensions → Developer mode → Load unpacked → pick the extracted folder
  4. Click the extension icon and follow the setup guide

Setup takes about two minutes and is mostly on your phone. There is a 90-second walkthrough video in the guide.

Try it without your phone

Open the test page, paste your pairing code, and press Send code. The field fills in about half a second. This exercises everything except the iPhone automation.

What changed since 0.1.0

  • Codes now autofill. Previously every code showed a pill you had to click, because silent filling required a domain-bound SMS sigil that almost no service sends. Filling is now granted by focus — if the caret is in the field, or an OTP field was focused in the last minute, or you opted the site in. A domain mismatch still refuses to fill and warns.
  • Setup diagnoses itself. "No codes yet" now distinguishes a live pairing from a dead one and points at the missing automation, which is the step people skip.
  • Walkthrough video on the setup page and in the guide.
  • Corrected the shortcut name. iOS lists an imported shortcut by its filename, so it appears as sms-code-bridge — every screen used to say "OTP Bridge", which is not a thing you can find on your phone.
  • Deep link to the Automation tab, removing two steps from the only part of setup that cannot be automated.
  • Security: pages carrying a pairing token now send no-store, no-referrer and a strict CSP.
  • Browsers with no push service are detected and named, instead of blaming the relay.

Known limitations

  • Creating the automation is manual. Apple allows sharing shortcuts but not automations; this was researched exhaustively and there is no mechanism, for anyone.
  • iOS forces a notification each time the automation runs. It cannot be disabled.
  • Codes reach the relay over TLS but are not end-to-end encrypted — Shortcuts has no crypto actions. They are never written to disk or logged. See PRIVACY.md.
  • Locked-phone automation reliability is not yet measured. See docs/SPIKES.md.
Assets 3
Loading