fix: hygiene + security follow-ups (closes #33, #34, #35, #39)#40

Merged

paperhurts merged 14 commits into

mainfrom

feat/hygiene-and-hardening

May 27, 2026

Commits on May 26, 2026

fix(ext): dedupe popup.html + options.html via copy-html prebuild script

paperhurts
and
claude
committed
refactor(ext-shared): migrate chrome.* type refs to webextension-polyfill namespace; drop @types/chrome

paperhurts
and
claude
committed
test(ext-shared): assert against browser.* mock paths to match production calls

paperhurts
and
claude
committed
fix(ext): correct e2e prebuild hook name; pin extension-shared types to polyfill
paperhurts
committed
feat(security): explicit CSP on web index.html and both extension manifests
paperhurts
committed
feat(web): sign-out button that clears localStorage and returns to setup

paperhurts
and
claude
committed
docs: document PAT lifecycle and revocation on uninstall
paperhurts
committed
fix(security): filter unsafe URL schemes at apply-remote boundary

paperhurts
and
claude
committed
docs: refresh test counts and document security posture

paperhurts
and
claude
committed
docs: add hygiene-and-hardening implementation plan
paperhurts
committed
chore: update pnpm-lock.yaml after dropping @types/chrome
paperhurts
committed

Commits on May 27, 2026