flythenimbus/bramble 1.4.0-chromium

Chromium Extension 1.4.0

on GitHub

Features

• export an encrypted .bramble vault backup
• store the vault in chrome.storage.local, drop the FSA backend
• restore the popup route on reopen while unlocked
• declare data_collection_permissions (required: none)
• attach buildable source to the AMO listed submission
• Firefox ships listed to AMO; GitHub release carries source only
• metadata:firefox pushes by default, --dry-run to preview
• metadata:firefox pushes the localized AMO listing
• translate web store listings (Chrome + AMO) from the repo
• passkey provider via MAIN-world content-script transport
• relay-forward transport as a negotiated WebRTC fallback
• Firefox WebRTC host iframe — probe increment (option a step 1)
• request persistent storage so the only vault copy isn't evicted (Firefox port, phase 5)
• float current-site matches to the top of the list
• search, filter, sort, and lifecycle timestamps for the vault list
• attach SHA256SUMS to chromium releases (parity with android)

Bug Fixes

• give a clear error for an encrypted Bitwarden export
• suppress native autofill on fields the picker takes over
• await hydration in the webAuthn proxy listeners
• make background passkey vault reads FSA-safe
• decode TOTP QR in the offscreen host, not the service worker
• cache the VEK on security-key unlock
• set the AMO category on listed submissions
• set the GPLv3 license on listed AMO submissions
• resolve web-ext signed .xpi basename against artifactsDir
• pass amoBaseUrl to web-ext sign (8.x makes it required)
• close the unlock window after a locked passkey unlock
• wrap content scripts in an IIFE so they don't clobber each other's globals
• keep-alive alarm so background sync survives event-page suspension
• localize manifest via _locales (default_locale + MSG)
• Firefox testing round 1 (popup close, FSA/security-key/theme gating, sync log)
• set Firefox gecko id to firefox@bramble.app
• gate passkey provider off on Firefox (Firefox port, phase 4)
• preserve \n/\t escapes; escape stray quotes in it/es strings
• escape backslash in strings.xml encoder (CodeQL #30)

Refactors

• rip out dead FSA / file-picker code
• transport-select the crypto+sync host (Firefox port, phase 2)
• cross-browser api shim for chrome.* (Firefox port, phase 1)
• split vault context into state + actions; share prefs provider

Documentation

• rename kdbx-import.md -> encrypted-import.md; add Bitwarden section
• correct the durability note
• add the encrypted-export feature to the Firefox listing
• reflect chrome.storage.local backend; drop false claims
• reflect the chrome.storage.local vault backend (FSA retired)
• correct conflict-loser section to match code (loser dropped, history unbuilt)
• Firefox ships listed on AMO (release-signing + firefox-port)
• current state (passkey verified, i18n done); export/import is what's left
• add Status section + specifics for passkey provider & security-key unlock
• mark relay-forward hardening implemented (timeout, reaper, epoch room, padding)
• decide relay-forward transport + privacy hardening
• correct the WebRTC-in-event-page assumption (RTCPeerConnection absent in FF background)
• fix Vivaldi typo; move file attachments + iframe/shadow-DOM autofill to shipped

Other

• test: cover the legacy FSA->local migration and vault export
• i18n(store): Firefox listing translations (de hand-polished, es/fr/it/pt-BR first pass)
• i18n: translate the content-script UI via _locales + browser.i18n
• i18n: translate the 12 missing vault-list strings (de/es/fr/it/pt-BR)
• polish(ext): explain what unlocking is for on the locked passkey card
• polish(ext): passkey rows act on click; chevron instead of checkmark
• polish(ext): passkey card — Bramble glyph, account list, gradient bg
• polish(ext): passkey corner card gets a key-glyph badge in the header
• chore: reconcile pnpm-lock after rebase onto main
• build(release): firefox bundle + AMO-signed .xpi release pipeline
• harden(sync): epoch-rotating sync room so the relay can't link a group across time
• harden(sync): reap stale relay peers (liveness for the connectionless transport)
• harden(sync): relay-forward handshake timeout + payload size padding
• chore(ext): remove throwaway FF WebRTC-context probes + sync-frame iframe
• chore(ext): probe content-script + page-main-world WebRTC contexts (Firefox)
• chore(ext): surface an RTCPeerConnection probe in the Device-sync panel (Firefox diag)
• build(ext): output Chromium build to dist-chromium (symmetry with dist-firefox)
• chore(ext): rename build/bundle -> build:chromium/bundle:chromium
• build(ext): Firefox manifest + TARGET build wiring (Firefox port, phase 3)

Full Changelog: 1.3.0-chromium...1.4.0-chromium