Development Preview (1.0.104 / 9e2b708e50a9-42444114640-1)

中文

自动更新的开发预览版，可能含有尚未稳定的改动。

• 扩展版本：1.0.104；源提交：9e2b708e50a9a117ac0c022bbd1c11456c28c3c3。
• 验证与构建记录：Linux 发布门禁和 Windows Edge / MDBX Host 验证通过。
• Chrome / Edge 使用扩展 ZIP；Windows MDBX Host 为可选本机助手。解压扩展后在开发者模式加载，更新时替换解压目录并重新加载。
• 每个 ZIP 附带 SHA-256；内含的源码提交和清单保持原构建内容。此预览版不替代正式版更新通道。

English

Rolling development preview; changes may be unstable.

• Extension version: 1.0.104; source commit: 9e2b708e50a9a117ac0c022bbd1c11456c28c3c3.
• Validation and build: Linux release gates and Windows Edge / MDBX Host checks passed.
• Use the extension ZIP for Chrome / Edge; the Windows MDBX Host is optional. Extract and load in developer mode; replace the extracted directory and reload to update.
• Each ZIP includes a SHA-256 sidecar. Embedded source evidence and manifests retain the original build contents. Stable update checks continue to use stable releases.

1.0.104 · TOTP 去重与更新流程改进 / TOTP and update improvements

Monica for Extension 1.0.104

2026-11-04 · 标签 / Tag: v1.0.104 · Windows x64 可选助手 / Optional helper: 0.1.6

中文

更新内容

• 修复 Bitwarden 同一记录的 TOTP 在验证码页重复显示两次：列表和数量只计一次，保留原登录项、验证码数据、编辑和填充能力；不同来源或参数不同的验证器仍分别显示。
• 完善插件内更新流程：检查后可直接下载有效的官方新版 ZIP，显示构建标识和扩展 ID，提供原目录覆盖步骤、扩展管理页入口和确认后重新加载。更新仍需手动替换文件，并非全自动安装。仅提供更高正式版本的直接 ZIP 下载，避免同版本开发版被较旧代码覆盖。
• 在“设置与备份 → 解锁与保护”中自定义自动锁定时间，支持 1～1440 分钟，默认 15 分钟。保存后立即更新当前会话时限；设置随密码库加密保留。时间按密码库内的有效操作计算，普通网页活动不会延长解锁时间。
• 对齐 Android 1.0.324 的附近同步协议：已配对设备可协商增量记录、独立补传缺失附件与加密断点续传；旧端保留完整加密传输。接收删除先审阅，重连重新认证，实际保存后才确认成功。使用这些能力需同步更新可选 Windows 助手至 0.1.6。
• 支持粘贴 Android 热点邀请，并显示系统手动连接步骤；临时凭据在取消、锁定、离开页面或超时后清除。普通 MDBX 继续使用内置浏览器引擎。
• 整理后台同步、附件传输和 Bitwarden Send 的模块职责，统一内部请求授权和互斥执行，补齐取消、重试和会话失效回归。合入社区贡献的 ESLint 10 检查及源码安全规则，作为发布检查的一部分。
• 更新流程补齐全部八种界面语言，并改善窄屏、大字号下的长文本和按钮换行。

安装与更新

下载 monica-extension-1.0.104.zip，解压至固定目录，在 Chrome/Edge 扩展管理页开启开发者模式并加载包含 manifest.json 的目录。

已有安装请完整覆盖浏览器当前加载的原目录，不要额外套一层文件夹，也不要先卸载扩展或清除浏览器数据。保存未完成的编辑后重新加载扩展，再刷新已打开的网页。仅覆盖磁盘文件可能仍保留运行中的旧后台。

重新加载后需要用原 Monica 主密码解锁，这与重新登录 Bitwarden 账号不同。隔离测试中原密码库密文和 Bitwarden 连接配置均保留；服务端凭据失效仍可能要求认证，原反馈账号反复登录的具体原因尚未确认。

Wi-Fi 同步等本机能力使用可选 Windows x64 助手 monica-mdbx2-host-windows-x64-0.1.6.zip，安装方法见包内 README。普通 MDBX 的新建、导入、读取、编辑和保存无需外部组件；旧 Native Host 工作副本保留原后端。每个 ZIP 均附带 SHA-256 校验文件。

支持 Chrome/Edge 128+。Firefox 未签名构建保留在 CI artifact，永久安装需 Mozilla 签名，详见 Firefox 说明。本次公开附件不含未签名 XPI。

现有 Rust ZIP 依赖告警尚未通过升级消除；当前调用未使用相关的 AES 解密、通用解压或流式解压路径，具体适用范围见 ZIP 依赖审查。

维护说明

目前我的主要开发精力仍放在 Android 版，浏览器插件的维护与功能跟进可能有所延迟。欢迎大家通过 Issue 反馈问题、提出建议，也欢迎提交 PR 一起改进。感谢大家的理解和参与！

English

Changes

• Fixed duplicate TOTP tiles and counts for the same Bitwarden record, preserving login items, OTP data, editing and autofill. Authenticators from different sources or with different parameters remain separate.
• Improved the update page with direct downloads for valid official newer-version ZIPs, build and extension IDs, original-directory replacement instructions, an extension-management shortcut and reload confirmation. File replacement remains manual; this is not automatic installation. Direct downloads require a higher stable version to avoid replacing a same-version development build with older code.
• Customize the automatic lock time in Settings and backups → Unlock and protection, from 1 to 1440 minutes (default: 15). Saving updates the active session deadline immediately, and the setting remains encrypted with the vault. The timer follows valid vault activity; ordinary website browsing does not extend it.
• Aligned nearby synchronization with Android 1.0.324: paired devices can negotiate incremental records, transfer missing attachments separately and resume encrypted transfers. Older peers retain full encrypted transfer. Incoming deletions require review, reconnects authenticate again, and success is acknowledged after changes are applied. Update the optional Windows helper to 0.1.6 to use these capabilities.
• Android hotspot invitations show manual system connection instructions. Temporary credentials clear on cancellation, locking, leaving the page or expiry. Ordinary MDBX operations continue to use the bundled browser engine.
• Refactored background synchronization, attachment transfer and Bitwarden Send responsibilities; unified internal request authorization and exclusive execution, with cancellation, retry and stale-session regressions. Integrated the community-contributed ESLint 10 checks and source security rules into release validation.
• Translated the update flow into all eight supported interface languages and improved long-text and button wrapping on narrow screens with large fonts.

Installation and updates

Extract monica-extension-1.0.104.zip to a permanent directory and load the folder containing manifest.json in Chrome/Edge developer mode.

For an existing installation, replace all files in the directory currently loaded by the browser without adding an extra nesting level. Keep the extension installed and preserve browser data. Save unfinished edits, reload the extension and refresh open websites. Replacing disk files alone can leave the old background code running.

Reloading requires unlocking with the existing Monica master password, which is separate from signing into a Bitwarden account. Isolated tests preserved the original encrypted vault and Bitwarden connection settings; expired server credentials can still require authentication. The cause of the reporter's repeated Bitwarden login remains unconfirmed.

Wi-Fi synchronization and other native capabilities use the optional Windows x64 helper monica-mdbx2-host-windows-x64-0.1.6.zip; follow its included README. Ordinary MDBX creation, import, reads, editing and saves require no external component. Existing Native Host working copies retain their backend. Each ZIP has a SHA-256 sidecar.

Chrome/Edge 128+ are supported. The unsigned Firefox build remains a CI artifact; permanent installation requires Mozilla signing. See Firefox instructions. No unsigned XPI is attached to this release.

Existing Rust ZIP dependency advisories remain open. Current callers do not use the affected AES decryption, general-purpose extraction or streaming extraction paths. See the ZIP applicability review for the scope and limits of that assessment.

Maintenance note

My main development focus is still the Android version, so maintenance and feature updates for the browser extension may take longer. Please report bugs and suggestions through Issues, and PRs are welcome. Thank you for your understanding and contributions!

1.0.103 · 密码库打开与 Bitwarden 登录修复 / Vault opening and Bitwarden login fixes

Monica for Extension 1.0.103

2026-10-31 · 标签 / Tag: v1.0.103 · Windows x64 可选助手 / Optional helper: 0.1.5

中文

• 首次使用可直接打开独立 MDBX、完整 MDBX ZIP 备份和 KeePass KDBX。MDBX 在独立工作副本上升级，保留原文件；扩展保护与数据库解锁分别设置。注册期间取消、锁定或日志写入失败时保留已接入副本，解锁后核验归属再重试。
• 修复 Bitwarden 首次登录各次请求使用不同设备标识，以及新设备邮件验证与两步验证接续时丢失验证码的问题。登录、邮件验证与 SSO 共用持久化设备标识，保留已连接账号原有标识；两种验证按任意顺序出现均保留当前登录状态。拒绝验证码后保留所选验证方式并明确提示，更换密码、账号、服务器或关闭弹窗会清除旧验证码。
• Bitwarden 登录增加美国、欧洲和自托管服务器选择，保留自托管地址草稿，请求期间锁定邮箱和服务器输入。密码与 SSO 登录兼容新版嵌套密钥响应，按服务端原始盐值和 KDF 解密，无效参数或密钥校验失败仍拒绝连接。改进密码错误、新设备验证码错误及已知客户端兼容拒绝提示；不回显凭据或任意服务端正文。登录、发送邮件验证码及首次数据库导入前检查页面与后台构建是否一致。
• 登录项附带的动态验证码同时显示在“动态验证码”。没有显式网址且标题为有效主机名的登录项参与网站匹配，已有网址及禁止匹配规则仍优先。
• 合入社区贡献：修复 Vivaldi 工具栏弹窗尺寸，MDBX 批量移动按目标分组复用冲突扫描，新增通过 OneDrive 连接与增量同步 MDBX。上传后核对实际内容，锁库或取消登录会中止请求。
• 修复旧版遗留本地只读导入项目无法删除的问题，支持移入回收站、恢复及确认清空；原始内容保留到永久删除。远端未知类型继续由原密码源管理，新 Bitwarden 明文 JSON 导入仍转换为本地可编辑项目。
• 本地同步增加实际网络接口的定向广播发现，改善电脑连接手机热点后无法通过组播发现设备的情况，保留设备身份验证与加密传输。此改动包含在可选 Windows 本机助手 0.1.5 中。
• Windows Hello 不可用时提示检查 Windows 本机通行密钥保存设置，提供公开 HRESULT、WebAuthn 错误名及 API 版本。创建与验证请求改用 JSON 序列化，保留本机平台验证器和强制用户验证。
• 更新 Vite、Vitest、Undici 和字体构建 Brotli 依赖，修复已知依赖漏洞。

安装或升级：下载 monica-extension-1.0.103.zip，解压至固定目录，在 Chrome/Edge 扩展管理页开启开发者模式并加载该目录。升级时保留原目录和扩展 ID，覆盖文件后重新加载扩展，再刷新已打开的网页，无需卸载扩展或重新导入密码库。

普通 MDBX 新建、导入、读取、编辑和保存使用扩展内置 WASM，无需外部组件。Wi-Fi 同步及部分本机能力使用可选 Windows x64 助手 monica-mdbx2-host-windows-x64-0.1.5.zip；使用这些能力的用户可更新助手，安装方法见包内 README。旧 Native Host 工作副本保留原后端，迁移需明确操作。每个 ZIP 均附带 SHA-256 校验文件。

支持 Chrome/Edge 128+。Firefox 独立未签名构建保留在 CI artifact，永久安装需 Mozilla 签名，见 Firefox 说明，本次公开附件不含未签名 XPI。Bitwarden 合成服务及实际 Edge 回归已通过，反馈账号的官方云端登录、原 Windows Hello 故障设备和真实 OneDrive 账号互通仍待确认。验证范围见发布检查记录。

English

• First run can open standalone MDBX files, complete MDBX ZIP backups and KeePass KDBX databases. MDBX upgrades use independent working copies and preserve source files; extension protection and database unlock remain separate. Cancellation, locks and journal failures during registration preserve attached copies until ownership can be checked and retried after unlock.
• Fixed changing device identifiers across initial Bitwarden requests and lost verification state when new-device email verification and two-step verification occur in either order. Login, email verification and SSO reuse a persistent installation identifier while preserving existing connected-account identifiers. Rejected codes retain the selected method and show an explicit error; changing the password, account or server, or closing the dialog clears previous codes.
• Added US, EU and self-hosted Bitwarden server choices, retaining custom-address drafts and disabling email/server inputs during requests. Password and SSO login accept newer nested unlock metadata, using the exact server salt and KDF while rejecting invalid parameters or failed key authentication. Improved invalid-password, new-device-code and known client-compatibility errors without echoing credentials or arbitrary server responses. Login, email-code sending and first-run database import check that the page and background build agree.
• Login-attached OTPs also appear under authenticators. A valid hostname title can match websites when no explicit URL exists; explicit URLs and never-match rules retain priority.
• Integrated community fixes for Vivaldi toolbar popup sizing and per-collection MDBX move conflict scans, plus OneDrive connection and incremental synchronization for MDBX. Uploads verify stored content, and locking or cancelling login aborts requests.
• Old local readonly imports can now be moved to trash, restored and explicitly purged, preserving their original payload until permanent deletion. Unknown remote records remain managed by their source; new plaintext Bitwarden JSON imports continue to become editable local items.
• Native LAN synchronization probes directed broadcasts from actual local interfaces, helping discover devices when connected to phone hotspots that filter multicast. Device authentication and encrypted transport remain required. This change is included in the optional Windows helper 0.1.5.
• Unavailable Windows Hello errors explain the Windows setting for saving passkeys on this device and include public HRESULT, WebAuthn error name and API version diagnostics. Creation and assertion client data use JSON serialization; the local platform authenticator and required user verification remain enforced.
• Updated Vite, Vitest, Undici and the Brotli font-build dependency to address known dependency vulnerabilities.

Install or upgrade: extract monica-extension-1.0.103.zip to a permanent directory and load it in Chrome/Edge developer mode. To upgrade, keep the existing directory and extension ID, replace its files, reload the extension and refresh open websites. Uninstalling or reimporting the vault is unnecessary.

Ordinary MDBX creation, import, reads, edits and saves use bundled WASM and need no external component. Wi-Fi sync and some native abilities use the optional Windows x64 helper monica-mdbx2-host-windows-x64-0.1.5.zip; users of these abilities can update it using the README inside the package. Existing Native Host working copies retain their backend until explicitly migrated. Each ZIP includes a SHA-256 sidecar.

Chrome/Edge 128+ are supported. The separate unsigned Firefox build remains a CI artifact; permanent installation requires Mozilla signing. See Firefox instructions; this release does not attach an unsigned XPI. Synthetic Bitwarden service and actual Edge regressions pass, while the reporting official-cloud account, original Windows Hello device and real OneDrive-account interoperability still need confirmation. See release verification for the tested scope.

1.0.102 · 自动填充密码更新链路修复 / Autofill password update fix

Monica for Extension 1.0.102

2026-10-25 · 标签 / Tag: v1.0.102

中文

• 修复自动填充后使用原密码登录仍弹出“更新 Monica 中的密码”的问题。提交密码与同网站、同账号已存密码完全一致时不再提示或写入；密码确实变化时继续显示更新提示，空格与大小写变化也按真实变化处理。
• 修改后又恢复原密码时清理旧的更新候选，避免刷新或导航后重新弹出。多个同名记录中已有相同密码时不重复提示；不同账号复用相同密码仍可正常保存。
• 新增独立“导入与导出”设置页：导入先预览，再新增本地副本；每次导出重新验证身份。
• 文件迁移支持 Monica ZIP、KeePass KDBX、Monica/Bitwarden 明文 JSON、多种 CSV、Aegis、Stratum、OTP URI 和 Steam maFile，并显示格式范围和跳过数量。支持 Aegis、Stratum 加密备份导入；它们的导出为明文。
• 修复 Bitwarden 明文 JSON 导入后成为只读记录的问题，支持登录、笔记、卡片、身份和 SSH 项目在本地编辑与删除。
• 已使用公共 Android 虚拟机验证 ZIP/KDBX 双向迁移，以及 CSV、Aegis、Stratum、OTP URI、Steam maFile 的 Android 实际读取。详细范围见导入导出验证。

安装或升级：下载 monica-extension-1.0.102.zip，解压至固定目录，在 Chrome/Edge 扩展管理页开启开发者模式并加载该目录。升级时保留原目录和扩展 ID，覆盖文件后重新加载扩展，再刷新已打开的网页，使新的内容脚本生效。无需卸载扩展或重新导入密码库。

支持 Chrome/Edge 128+。Firefox 独立构建仍按Firefox 说明使用，永久安装需 Mozilla 签名，本次公开附件不包含未签名 XPI。配套 Windows 本机助手未变更，已有用户无需因本次密码提示修复重新安装助手。

English

• Fixed the update-password prompt appearing after signing in with an unchanged Monica-autofilled password. Submitting the exact password already stored for the same site and account now stays silent and does not write a record. Actual changes, including whitespace or case changes, still prompt for an update.
• Clear stale update candidates when an edited password is reverted, preventing the prompt from returning after reload or navigation. An exact match among same-username records stays silent; a different account reusing the same password can still be saved.
• Added a dedicated Import and export settings page with previews, independent local imports and fresh authentication for every export.
• File migration supports Monica ZIP, KeePass KDBX, plaintext Monica/Bitwarden JSON, common CSV formats, Aegis, Stratum, OTP URIs and Steam maFiles, with format scope and skipped-item counts. Encrypted Aegis and Stratum backups can be imported; their exports are plaintext.
• Fixed plaintext Bitwarden JSON becoming read-only records; imported logins, notes, cards, identities and SSH items can be edited and deleted locally.
• Verified ZIP/KDBX round trips with the shared Android emulator and actual Android reads of CSV, Aegis, Stratum, OTP URI and Steam maFile exports. See the import/export verification for scope.

Install or upgrade: extract monica-extension-1.0.102.zip to a permanent directory and load it in Chrome/Edge developer mode. To upgrade, keep the existing directory and extension ID, replace its files, reload the extension, then refresh open websites so the new content scripts take effect. Uninstalling or reimporting the vault is unnecessary.

Chrome/Edge 128+ are supported. Firefox remains a separate build with Mozilla signing required for permanent installation; this release does not attach an unsigned XPI. The optional Windows native helper is unchanged and does not need to be reinstalled for this password-prompt fix.

1.0.101 · 首个正式版 / First stable release

Monica for Extension 1.0.101

中文

Monica 浏览器插件的首个正式版，承接此前的 0.1.x 预览版。

• 加密本地密码库、网页账号与验证码填充、密码保存、Passkey，以及 MDBX、KeePass、WebDAV 和 Bitwarden 密码源。
• 对齐 Android 的新建分组，新增会员卡、积分卡和旅行票证；修复同步卡面图片随机加载失败，暂时隐藏支付方式新建入口。
• 长按或右键进入多选，支持批量收藏、传输和删除。操作栏固定悬浮在窗口底部，列表与分页按实际栏高留出空间，兼容侧栏、窄屏、大字体和矮窗口。
• 导出增加重新认证，可选剪贴板自动清理、加密恢复检查点、运行诊断与 GitHub 更新检测。
• 优化选中账号后的密码填充速度；Passkey 验证窗跟随配色，并可转交 Windows/浏览器验证器。
• 附近同步默认只发送新增和修改，历史删除由用户选择处理；修复 MDBX 恢复记录未实际落库的问题。

安装与升级： 下载 monica-extension-1.0.101.zip，解压到固定目录，在 Chrome/Edge 的扩展管理页开启开发者模式并加载该目录。升级时保留原加载路径与扩展 ID lebnfedmijifofonogjdphpojihgohmc，替换文件后重新加载，避免卸载导致本地数据被清除。

Windows 辅助组件： 附近同步通信组件已包含在插件 ZIP 内，可从设置下载并安装；旧版组件需要同步更新。本页另外提供可选的 monica-mdbx2-host-windows-x64-0.1.4.zip，用于本机 MDBX / Windows Hello。两者复用同一程序，无需都安装。CLI 联动默认关闭并标注“不完善”，其辅助程序由 CLI 项目提供。Firefox 源码构建仍需 Mozilla 签名才能永久安装，本次未发布未签名 XPI，亦未提交浏览器商店。

本轮通过 4,305 项单元测试、113 项原生测试和 58 项 Edge 验收；插件与辅助组件 ZIP 均通过两次独立打包一致性校验。下载附件均附 SHA-256 校验文件。

完整发行说明 · 验证记录与适用范围

English

The first stable Monica browser-extension release, following the 0.1.x previews.

• Encrypted local vault, webpage login/OTP filling, password saving, Passkeys, and MDBX, KeePass, WebDAV and Bitwarden sources.
• Android-aligned creation groups, membership/rewards/travel cards, reliable synced card artwork, and hidden payment-account creation.
• Hold or right-click to select multiple items for favorites, transfer or trash. Actions float at the viewport bottom, with measured clearance after lists and pagination, including narrow sidebars, large text and short windows.
• Fresh export authentication, optional clipboard expiry, encrypted recovery checkpoints, diagnostics and GitHub update checks.
• Faster account-menu filling and themed Passkey verification, with Windows/browser authenticator handoff.
• Nearby sync sends additions and edits by default, asks how to handle historical deletions, and correctly applies restored MDBX records.

Install or upgrade: Extract monica-extension-1.0.101.zip to a permanent directory and load it in Chrome/Edge Developer mode. Retain the original directory and extension ID lebnfedmijifofonogjdphpojihgohmc when upgrading; replace the files and reload. Removing the extension can clear its local data.

Windows helpers: The Wi-Fi communication component is bundled in the extension ZIP and available from settings; update existing installations too. The optional monica-mdbx2-host-windows-x64-0.1.4.zip provides native MDBX / Windows Hello support using the same executable; installing both is unnecessary. CLI integration remains off by default and marked incomplete, with its helper distributed by the CLI project. Firefox builds still need Mozilla signing for permanent installation; unsigned XPI distribution and browser-store publication are outside this release.

Validation: 4,305 unit tests, 113 native tests and 58 Edge acceptance tests passed. Both ZIP packages were reproduced independently twice with identical bytes. SHA-256 checksum files accompany each download.

Full release notes · Verification and scope

0.1.48 preview-beta

0.1.48 preview-beta

发布渠道 / Distribution：GitHub 正式 Release（未标记 Pre-release，标签 v0.1.48） / regular GitHub Release, not marked Pre-release, tag v0.1.48。
构建性质 / Build quality：preview-beta 试用版，不是稳定版，也不代表浏览器商店已上架 / preview-beta for testing and feedback, not a stable release or store listing。
支持范围 / Support：Chrome 128 及以上为声明目标；Firefox 不支持 / Chrome 128+ is the declared target; Firefox is unsupported。
同步方向 / Sync direction：Android 端“附近设备同步”务必选择“双向同步”；“仅发送”或“仅接收”可能与电脑端方向不兼容，导致同步无法开始。/ On Android, always select Bidirectional in Nearby sync; send-only or receive-only may be incompatible with the desktop direction and prevent a sync from starting.

中文

本版修复

• 修复通过 Wi-Fi 同步到扩展的大量 TOTP 认证器显示“不可用”：解码时按 Monica Android TotpDataResolver 的读入规则修复旧记录，包括 secret 字段里存了整段 otpauth:///steam:// URI、period 或 digits 越界、缺少 otpType 的 Steam 认证器，以及 key/serviceName/account 旧字段别名。
• 修复 Android 写出的认证器被解码成 4 位验证码的问题。Kotlin 序列化会省略等于默认值的字段，扩展原先把缺失的 digits/period 读成 0；现在按 Android 的默认值 6 位、30 秒解码。
• 修复 0.1.47 已导入的本地条目：解码修复无法追溯已写入密码库的 4 位参数，现在解锁时会用附近设备同步保留的原始 Android 记录重新核对，只修复 item_data 中确实没有 digits 字段的条目；Android 明确保存的位数（包括确实设为 4 位的钥匙）保持原样。回收站中的条目同样会修复，恢复后即可正常显示。
• 生成端不再把 Android 仍能正常显示的钥匙判为不可用：非正 period 回退 30 秒、digits 收敛到 4–10、不可用计数器按 0 处理、Base32 字母表外的字符按 Android 生成器的方式跳过。
• 登录条目里内嵌的 TOTP 现在按 Android 的上下文规则读取：网址（或标题）作为 issuer、用户名（或标题）作为账户名；Steam 登录自动切换到 5 位 Steam Guard 规则。
• 带 issuer 的 Yandex 钥匙只有在 PIN 可用时才切换到 YAOTP；没有 PIN 时保持数字验证码，不再变成不可用。
• 条目编辑页的 TOTP 密钥新增显示/隐藏切换，与详情页一致，便于定位异常记录。
• 以上修复只影响读取与显示；未改动的记录在同步写回时保持原始字节不变，不会因此覆盖 Android 端数据。

升级与安装

• 扩展 ID 仍为 lebnfedmijifofonogjdphpojihgohmc。替换文件并在扩展管理页重新加载即可；不需要重新导出／恢复密码库，也不需要重新运行 install-wifi.ps1 或 install-host.ps1。
• Chrome：chrome://extensions → Monica → 重新加载。
• Edge：edge://extensions → Monica → 重新加载。
• 本版取代 0.1.47 的发布 ZIP；0.1.47 的安装包包含上述 TOTP 解析缺陷。

验证范围

• 构建、全量单元测试、TOTP 回归测试、安全审计与可复现打包结果见发布验证记录。
• 修复覆盖 Wi-Fi 同步、KeePass KDBX 安全条目与登录内嵌三条读取路径，均由单元测试锁定；验证使用仓库内的合成 fixture，未读取或回放真实密码库数据。
• Chrome 128+ 仍是声明目标；真实手机首次同步、Android 自动调度与 OneDrive 真实登录仍未验收。
• 本版未运行完整 release:check（含联网 npm 审计、Rust 测试和 Playwright E2E），验证范围以记录为准。

下载

• monica-extension-0.1.48.zip
• monica-extension-0.1.48.zip.sha256
• ZIP SHA-256：a7a6d1080bb465675ac7abb8f25a3945c209227ae5a0df5d8f64246cdd7a5077
• ZIP 大小：13,758,195 字节

下载 ZIP 并解压，在 edge://extensions 或 chrome://extensions 开启开发者模式，选择“加载已解压的扩展程序”并指向解压目录。下载列表只含插件 ZIP 与校验文件；依赖清单、许可证清单和源码提交证据已包含在 ZIP 内。

反馈

请注明版本、浏览器、密码来源与复现步骤。不要上传真实密码、Passkey 私钥或密码库。安全问题请按 SECURITY.md 私下报告。

English

Fixes

• Fixed the many TOTP authenticators synced over Wi-Fi that showed “unavailable”: decoding now repairs legacy records with Monica Android's TotpDataResolver read rules, including a whole otpauth:///steam:// URI stored in secret, out-of-range period or digits, Steam authenticators without otpType, and the legacy key/serviceName/account aliases.
• Fixed Android-written authenticators decoding to a 4-digit code. Kotlin serialisation omits fields equal to their defaults, and the extension previously read the missing digits/period as 0; they now decode to Android's defaults of 6 digits and 30 seconds.
• Fixed local items already imported by 0.1.47: a decoder fix cannot retroactively correct digit counts persisted in the vault, so unlocking now re-checks the original Android record retained by Nearby Sync. Only items whose item_data has no digits field are repaired; a digit count Android explicitly stored (including a genuine 4-digit key) is left untouched. Trashed items are repaired too, so restoring one shows the correct code.
• Generation no longer rejects keys Android still renders: a non-positive period falls back to 30 s, digits are clamped into 4–10, an unusable counter is read as 0, and characters outside the Base32 alphabet are skipped the way Android's generator does.
• An inline TOTP on a login now follows Android's context rules: the website (or title) becomes the issuer and the username (or title) the account name; Steam logins switch to the 5-character Steam Guard rule.
• An issuer-based Yandex key only switches to YAOTP when a usable PIN is present; without one it keeps rendering the numeric code instead of becoming unavailable.
• The item editor gains a show/hide toggle for the TOTP secret, matching the detail page, so a failing record can be diagnosed in place.
• These fixes only change reading and display; unchanged records keep their original bytes on sync write-back, so Android data is not overwritten by the repair.

Upgrade and install

• The extension ID remains lebnfedmijifofonogjdphpojihgohmc. Replace the files and reload the extension; no vault export/restore and no install-wifi.ps1/install-host.ps1 rerun are required.
• Chrome: open chrome://extensions and click Reload for Monica.
• Edge: open edge://extensions and click Reload for Monica.
• This release supersedes the 0.1.47 ZIP, which contains the TOTP parsing defects above.

Verification

• The release verification record covers the build, full unit suite, TOTP regression tests, security audit and reproducible packaging results.
• The fixes cover all three read paths — Wi-Fi sync, KeePass KDBX secure items and inline login keys — and are locked by unit tests. Verification used synthetic fixtures from the repository; no real vault data was read or replayed.
• Chrome 128+ remains the declared target. Real-phone first sync, Android automatic scheduling and real OneDrive sign-in remain unverified.
• This build does not run the complete release:check (online npm audit, Rust tests, Playwright E2E); the verification record defines the accepted scope.

Downloads

• monica-extension-0.1.48.zip
• monica-extension-0.1.48.zip.sha256
• ZIP SHA-256: a7a6d1080bb465675ac7abb8f25a3945c209227ae5a0df5d8f64246cdd7a5077
• ZIP size: 13,758,195 bytes

Extract the ZIP, enable Developer mode at edge://extensions or chrome://extensions, and choose “Load unpacked” pointing at the extracted directory. The download list contains only the extension ZIP and its checksum; dependency and license inventories and source-commit evidence are embedded in the ZIP.

Feedback

Include the version, browser, password source and reproduction steps. Do not upload real passwords, Passkey private keys or vaults. Report security issues privately per SECURITY.md.