v0.3.1 — freeze fix, frozen page stays on screen

Fixed

• Freezing the tab you were looking at did not actually freeze it. The
  tab said "frozen" but its page kept running, because the freeze command
  reached Chromium while the page was still on screen (the set-aside trails
  the thumbnail capture by up to 400 ms) and Chromium quietly ignores a
  freeze for a visible page. The command now waits for the page to be off
  screen; npm run smoke proves the active-tab path too.

Changed

• Freezing the tab on screen no longer drops you to the grid. Its last
  frame stays up as a still page with a "Frozen" banner — click it (or
  Continue) to carry on where you were; Sleep and Grid are one click away.
  A page can only be frozen off screen, so the still is its last frame.

v0.3.0 — freeze, downloads, command palette

Added

• Command palette (R-111). Ctrl/⌘+K: fuzzy-jump to any open tab or
  folder, or run a command (new tab, sleep/freeze/pin this tab, sleep all,
  organize, history, downloads, settings, find, toggle sidebar).
• Downloads panel (R-106). Toolbar button / Ctrl+J: this session's
  downloads with progress, Open, Show in folder, Cancel and Clear finished.
  Session-only by design — never written to disk.
• Wake preview (R-105). Rest the pointer on a sleeping or frozen tab in
  the sidebar and a preview of the page appears — without waking it.
• Spellcheck (R-118). Text fields are checked again — with the system
  dictionary on macOS (offline; right-click a red word for corrections or
  Add to Dictionary). Windows/Linux stay off by default because Chromium
  would download a dictionary from Google; Settings → Spellcheck → Always
  allows that one-time fetch and says so.
• Freeze — make a tab static instead of killing it (R-127, ADR-0014).
  A frozen tab keeps its process but stops running: no CPU, no memory
  growth, the page exactly as you left it — scroll, typed text, JS state —
  and it continues instantly when you click it. Background tabs freeze on
  their own after 2 minutes idle (Settings → "Freeze background tabs after";
  Never / 1–30 min); pinned, audio and loading tabs are never frozen
  automatically, and pinning a frozen tab thaws it. Freeze by hand from the
  sidebar, the grid, the live bar (snowflake on the left of a chip, moon on
  the right), the toolbar snowflake, the tab's right-click menu, or
  ⌘/Ctrl+Shift+F. The first freeze says once that some pages notice a
  stopped clock — live chats, calls, video and uploads can need a reload
  after thawing. The runaway prompt now offers Freeze first for a CPU hog
  (Sleep for a memory hog). Frozen memory is real memory: the live bar counts
  it and says how many tabs are frozen. Sleep is still the only thing that
  returns memory.

Changed

• Bundled ad/tracker blocklists refreshed (EasyList/EasyPrivacy as of
  2026-09-22). They ship with the app and are never fetched at runtime
  (ADR-0009), so a release is the only time they move.

v0.2.0

v0.2.0 — 2026-09-15

Fixed

• Sign-in pages no longer hang on "use a passkey". Microsoft Entra
  (e.g. Purdue login) offers a passkey via Microsoft Authenticator; in Raha
  the request never completed and the page spun forever, because Electron
  has no cross-device (QR) passkey UI and Touch ID passkeys need a signed
  build (R-108). Raha now reports no passkey support at all
  (PublicKeyCredential is absent), so such pages fall back to their other
  methods (Authenticator push, Duo, password). USB security keys are off as
  part of this; they return with the signed-build passkey work.

Changed

• Electron 44.2.0 → 44.3.0 (Chromium 152.0.7977.76 → .78, Node
  unchanged at 24.20.0). Google never shipped .78 as a Chrome stable (the
  152 line went .77 → .82), so Sec-CH-UA-Full-Version-List carries a
  patch level no real Chrome sent (ADR-0012, divergence 3); the brand
  tables are unchanged within a major.
• Updater's YAML parser moved to js-yaml 5.4.2 via a scoped npm
  override (CVE-2026-59870, quadratic CPU on hostile !!omap, has no fix
  on the 4.x line electron-updater declares). Only the release manifest
  Raha fetches from its own GitHub Releases is ever parsed; the real
  latest-mac.yml parses identically under 4.x and 5.x. electron-builder
  (dev-only) stays on 4.x.
• ⌘/Ctrl+T from a showing tab opens the grid on All tabs, so the new
  tab lands at the top level instead of whichever folder the sidebar last
  remembered. On a folder's grid it still lands in that folder.

Raha v0.1.0

First release, on Electron 44.2.0 / Chromium 152.0.7977.76. The thesis,
working end to end:

Changed

• Electron 43.4.0 → 44.2.0 (Chromium 150.0.7871.224 → 152.0.7977.76,
  Node 24.18.1 → 24.20.0). 152.0.7977.76 is a build Google shipped as
  Chrome stable, so the full-version client hint matches a real Chrome.
  Consequences from upstream: macOS 13 (Ventura) or later is now
  required, and 32-bit Windows/ARM Linux builds are no longer possible
  (Raha never shipped them). The Chrome-identity brand tables were
  re-checked against the Chromium 152 source and are unchanged; the brand
  order rotates with the major, as in Chrome.

Fixed

• Typing an address no longer opens a surprise tab: on the grid (after
  ⌘T, closing a tab, or clicking a folder) Enter silently created the tab in
  whatever folder the sidebar had selected — often an imported "Window 3".
  It now opens in the current tab, and the dropdown says what will happen
  before you press Enter: Open here, Switch to open tab when another tab
  already has that page, and Open in new tab → folder (⌘/Ctrl+Enter),
  which names the folder the tab will land in — beside the tab you're on,
  or the folder you're viewing on the grid.
• "Verify you are human" checks: Raha now presents one consistent Chrome
  identity. Cloudflare-style challenges looped forever. What was measured:
  Raha's three views of itself disagreed — exactly what such checks score —
  and the earlier header-only alignment (2026-08-22) was not enough: it
  added the "Google Chrome" brand to headers Chromium already sent, while
  navigations still carried no client hints at all, page JavaScript still
  reported Chromium-only brands, and cross-origin iframes — where the
  challenge widget itself lives — exposed the raw Electron user agent. What
  ships now agrees at three layers: a DevTools-protocol identity per tab
  (the in-page view, the page's own requests, its workers, and every
  cross-origin iframe), header synthesis for navigations (the one request
  kind Electron leaves bare and Chrome decorates), and Accept-CH emulation
  for the high-entropy hints sites ask for — delivered only where Chrome
  would deliver them (first-party; never to a cross-origin frame or a
  third-party fetch) and forgotten with the site's data (ADR-0012).
  Verified by automated header-and-JavaScript tests against the real wire,
  including a side-by-side comparison with Chrome 150 (WebSocket and worker
  requests carry no hints in either). This removes the identity mismatches
  we measured — and, verified live on 2026-08-26 from a fresh profile with
  no automation, openreview.net's Cloudflare challenge passed on its own and
  landed on the paper; the release playbook (step 1d) repeats that check
  before every tag rather than trusting this sentence. Known divergences
  from Chrome remain, listed in ADR-0012 rather than hidden: window.chrome
  is an empty object; an undecided permission reads "denied" to a check
  where Chrome says "prompt" (ADR-0013); no Critical-CH restart (the first visit to an origin lacks
  the high-entropy hints Chrome would re-request the page with); synthesized
  navigation hints sit after Accept-Language where Chrome puts them first;
  and the bundled Chromium patch level need not be one Chrome ever shipped.
  If a site still challenges you, see USER_GUIDE.
• New tabs now open in the folder you're viewing: typing an address from
  a folder's grid (or after "New tab here") used to create the tab at the
  top level, outside the folder — navigating inside folders scattered tabs
  everywhere. The omnibox now reports the viewed folder and the tab lands
  in it.
• Drag-to-reorder tabs actually works: reordering was implemented but
  the sidebar rebuilt itself every ~2.5s, killing any drag in progress.
  Renders are now suspended during a drag (and skipped entirely when
  nothing changed), so hold-and-move reordering behaves; drop on a row's
  upper half to insert before it, lower half to insert after.
• Grid/sidebar shimmer ("tabs hovered one by one"): every governor tick
  rebuilt the grid and sidebar DOM, recreating every thumbnail and favicon
  image — cards without a thumbnail (imported tabs that never woke) flashed
  their fallback in a staggered wave, and dead favicons were re-fetched
  from the network every ~2.5s. Unchanged content now keeps its DOM;
  regions only rebuild when something they show actually changed.
• Modals opened invisibly behind the page: the web page is a native view
  layered above the chrome, so History/Settings/Organize and the runaway and
  memory-limit prompts rendered BEHIND an active tab — clicking the clock
  "did nothing" unless you were on the grid. The chrome is now raised above
  the page while any overlay is open, and toasts moved over the sidebar so
  they are visible while browsing.
• Sidebar/settings/history jumped to the top while scrolling: every
  governor tick re-renders the UI, which reset scroll positions (~every
  2.5s). Scroll is now preserved across re-renders, like focus already was.
• Back-button trap on dead history entries: a failed page load used to
  navigate to an internal error page, pushing a history entry — so pressing
  Back onto an entry that can no longer load (e.g. a blob: page after the
  tab slept, or an offline site) bounced between it and the error page
  forever. Load failures now render their error in place, keeping the
  entry and its position, so Back walks past them like any browser.
  (Found by the automated security suite below.)

Added

• A sleeping tab wakes where you left it (R-104): scroll position and
  unsent form text are captured before a tab sleeps and put back after it
  wakes. Password fields are never captured, values are capped, and the
  Remember scroll position and unsent form text setting wipes everything
  stored when turned off.
• Sites now ask before using your camera, microphone, location,
  notifications, or clipboard (ADR-0013). Where Raha used to refuse
  everything with a toast — so video calls in the browser simply could not
  work — it now shows its own prompt naming the site and the need
  ("meet.example wants to use your camera and microphone"), with Allow
  once, Always allow, Never for this site, and Not now. Nothing is
  granted silently, and you never see a prompt for a page you can't see: a
  background tab's request waits until you switch to it. Always and
  Never are remembered per site and listed under Settings → Site
  permissions, where one click makes Raha ask again; Allow once lasts
  until you leave the page. Screen sharing is still refused (R-103b).
  Honest limit: a site you have never decided on reads "denied" to a mere
  check (navigator.permissions.query, Notification.permission) where
  Chrome would say "prompt" — Electron offers no third answer — and is
  asked the moment it actually requests.
• App links ask instead of dead-ending (ADR-0011): clicking a link to
  Zoom, Teams, Slack, mailto:, tel:… now opens an in-app prompt naming
  the app and showing the full address, with Open / Cancel and an optional
  "always allow" for that kind of link (revocable in Settings). The OS is
  never touched without your yes. Dangerous schemes — file:,
  javascript:, the Windows protocol handlers with RCE history — are still
  refused outright and never offered.
• Address-bar suggestions, strictly local: start typing and Raha offers
  your open tabs ("switch to tab" — jumps there instead of duplicating) and
  pages you've visited, ranked by how often and how recently. Arrows to
  move, Enter to go, Tab to fill, Esc to dismiss. Unlike every mainstream
  browser, keystrokes are matched against a local file — never sent to a
  "suggest" service. Raha now remembers its own visits to power this
  (on by default; a file on this computer only; Settings toggle to stop,
  History panel clears it; raha:// pages are never recorded).
• Find in page (Ctrl/⌘+F): a find bar in the toolbar with a live match
  count ("2/9"), Enter/Shift+Enter for next/previous, Esc to clear the
  highlights. The bar closes itself when you switch tabs or navigate — the
  count never describes a page you didn't search.
• Reopen closed tab (Ctrl/⌘+Shift+T): restores the last-closed tab —
  address, title, folder, and position — up to 20 back, including tabs lost
  by deleting a folder. Plus a shortcut wave: History on ⌘Y (Ctrl+H),
  Ctrl/⌘+1…9 jumps to your Nth running tab (9 = last), ⌘W on the grid
  returns to your last tab instead of doing nothing, ⌘[/⌘] go
  back/forward on macOS, and the Window menu (⌘M) exists now.
• Tabs drag out of folders, everywhere: grid cards are draggable; drop a
  tab on a folder card or sidebar row to file it, on a breadcrumb to move it
  up, or on the grid background to move it into the folder you're viewing.
  (Dropping on the grid used to look allowed and silently do nothing.)
• Settings → About: shows the app version at last (bug reports, welcome),
  with GitHub / report-a-bug / support links that open as ordinary tabs.
• A home on the web + a way to donate: the website
  (https://magronox.github.io/raha-browser/ — static, no cookies, no
  analytics, no third-party requests, enforced by a deploy-time check) and
  quiet support links in About and the welcome tour. Donations fund exactly
  one thing: code-signing certificates, so installs stop warning.
• Clear cookies & site data: right-click any page → "Clear Cookies &
  Data for This Site" (cookies, subdomains, partitioned third-party jar,
  storage — then reloads), and Settings → "Clear all cookies & site data…"
  with confirmation. The un-wedge for bot-check loops, consent walls, and
  corrupted sessions.
• Default-browser support: on first launch Raha asks once, IN the app,
  whether to become your default browser — only a yes there registers with
  the OS (macOS then shows its o...