v2.4.0

fix: audit v2.4.0 — fail-closed rules, split popup

External audit, all findings:
- fresh source ids on profile duplicate + dup-id migration
- central header/RE2 validation; applyRules fails closed,
  records status; popup banner + "!" badge; lastSig only
  kept on success and invalidated on failure
- URL edit clears catalog; failed refresh marks rows stale
- queued sync-first saves, one global error surface
- 10s fetch timeout, refresh button disabled while running
- share format v2 (source selections travel), /i page
  hardened + parity-tested by executing its real script
- landing page: telemetry claim scoped, GoatCounter disclosed
- a11y: escape/focus, arrow tabs, labels, live regions, 24px
- CI on tags; sign-firefox gates on tag<->manifest + tests
- popup.js split into popup/ ES modules

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

v2.3.0

v2.3.0: audit fixes — storage split, import safety, a11y, tests

Post-audit hardening pass (details in CHANGELOG):
- Storage: catalogs → storage.local, config stays in sync (fixes 8 KB-cap
  silent data loss); saveState reports failures; sw.js watches both stores and
  gates DNR rebuilds via injectionSig.
- Share: decode validates CONFIG_VERSION; import lands an INACTIVE profile +
  warns on credential headers / ".*" scope.
- A11y: accessible names, focus-visible, tab/panel wiring; profile delete confirm;
  URL-regex debounce; master-off row dimming; /i selectable copy fallback.
- Docs: import wording, resourceTypes scope, RE2 caveat; LICENSE holder; endpoint
  screenshot → dark. Added node --test suite, ci.yml, tag/version guard,
  CHANGELOG.md, CLAUDE.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

v2.2.0

Named profiles (#1) + landing polish

Profiles (closes #1):
- State model: profiles [{id,name,urlRegex,headers,sources}] + activeProfileId;
  appearance/master stay global. Only the active profile is injected.
- loadState migrates the pre-profiles flat shape into a "Default" profile — no
  data loss for existing installs. activeProfile(state) resolves the current one.
- Popup: profile bar (switch dropdown + new/duplicate/rename/delete). All header/
  source/scope access routed through prof().
- Importing a shared config now lands as a NEW profile instead of merging.

Landing:
- Drop the redundant nav brand (icon+title repeated right above the hero).
- Add "Named profiles" to the feature list; regenerate all three screenshots
  with the profile bar visible.

Bump 2.1.0 -> 2.2.0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

v2.1.0

v2.1.0: standard-header autocomplete, shareable configs, landing site

Squashed release commit covering everything since v2.0.1.

Extension:
- Manual tab autocompletes ~60 standard and X- request headers
  (standard-headers.js) and hints a typical value in the value placeholder.
- Shareable configs: the gear's Config section copies a share link that packs
  manual headers + URL scope + URL sources into a URL-fragment code
  (overhead.metzner.uk/i#<code>); Import merges it back. Entirely client-side —
  nothing is sent to a server. encodeConfig/decodeConfig in rules.js.
- Ship standard-headers.js in both browser builds.

Site (docs/, GitHub Pages → overhead.metzner.uk):
- App-store-style landing page: mono type, static background, three rendered
  popup screenshots, features list, install.
- /i page decodes and previews a shared config before import.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

v2.0.1

Fix Chrome MV3 warning: per-browser background key

Chrome warned "'background.scripts' requires manifest version of 2 or
lower" because the manifest carried both service_worker (Chrome) and
scripts (Firefox). Firefox has no service_worker background (bug
1573659), so one shared manifest always warns on one browser.

Committed manifest.json is now Chrome-canonical (service_worker only) —
no Chrome warning on unpacked load. The release builds rewrite background
to the scripts form for the Firefox zip/.xpi via a jq step, so Firefox
loads warning-free too. Same sw.js everywhere.

- manifest.json: drop background.scripts
- pack.yml: emit overhead-chrome-v*.zip + overhead-firefox-v*.zip
- sign-firefox.yml: jq-inject scripts into the staged manifest
- README: two-zip install, updated "How it works"
- bump 2.0.0 -> 2.0.1

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

v2.0.0

Bump version to 2.0.0 (Overhead rebrand release)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>