ScriptVault v1.7.6: null safety across all UI pages

Prevent TypeError crashes from null DOM elements:

- sidepanel.js: $ helper returns dummy div instead of null
- devtools-panel.js: same null-safe $ helper
- install.js: optional chaining on btn-cancel/btn-install/toggle-code listeners
- popup.js: null check on blacklist .menu-item-text querySelector
- dashboard.js: null check on command palette input, optional chaining
  on storage editor button listeners (save/rename/delete/keySpan)

Author: SysAdminDoc

CLAUDE.md

@@ -4,7 +4,7 @@
 Modern userscript manager built with Chrome Manifest V3. Tampermonkey-inspired functionality with cloud sync, auto-updates, a full dashboard, Monaco editor, DevTools panel, and a persistent side panel.
 
 ## Version
-v1.7.5
+v1.7.6
 
 ## Tech Stack
 - Chrome MV3 extension (JavaScript)
@@ -88,8 +88,8 @@ v1.7.5
 - `cleanupStaleCaches()` runs on init to prune expired `require_cache_*`, `res_cache_*`, trash entries, and tombstones >30 days
 - Lint: `@grant none` + GM API usage shows `warning` severity (upgraded from `info` in v1.7.2). Unknown `@grant` values and invalid `@sandbox` values are `error` severity.
 - **Side panel / DevTools must use `action:` key** (not `type:`) for background messages. Background returns `{ scripts: [...] }` — callers need `res?.scripts`. `setScriptSettings` expects `scriptId` not `id`.
-- **GM_cookie_set/GM_cookie_delete** require `url` and `name` parameters (validated in v1.7.5)
-- **GM_unregisterMenuCommand** handler added in v1.7.5 — previously calls were silently dropped
+- **GM_cookie_set/GM_cookie_delete** require `url` and `name` parameters (validated in v1.7.6)
+- **GM_unregisterMenuCommand** handler added in v1.7.6 — previously calls were silently dropped
 - **XHR local request IDs** use sequential counter `_xhrSeqId++` (not `Math.random`) to prevent collision
 - **Notification callbacks** cleaned up on auto-timeout (not all platforms fire `onClosed`)
 - **Menu commands** cleaned from session storage when a script is deleted
@@ -163,7 +163,7 @@ v1.7.5
 - **Side panel**: responds to `chrome.tabs.onActivated` and `chrome.tabs.onUpdated` to refresh script list on navigation. Uses same `sendToBackground` pattern as popup.
 - **DevTools panel**: auto-refreshes every 3s. `getNetworkLog` returns flat array; `getNetworkLogStats` for totals. HAR export uses `URL.createObjectURL` + programmatic `<a>` click.
 
-## v1.7.0 → v1.7.5 Audit (2026-03-24, 4 rounds)
+## v1.7.0 → v1.7.6 Audit (2026-03-24, 4 rounds)
 
 ### v1.7.0 — Major Feature Release
 - DevTools panel, Side panel, Script signing (Ed25519), Monaco editor adapter, Offscreen document
@@ -185,7 +185,7 @@ v1.7.5
 - GM_webRequest added to hints + grant values, duplicate hint directives removed
 - Dashboard: updated column defaults to desc sort, network log cap 500 -> 2000
 
-### v1.7.5 — Memory Leaks & Validation
+### v1.7.6 — Memory Leaks & Validation
 - Added missing GM_unregisterMenuCommand handler (calls were silently dropped)
 - Menu commands cleaned from session storage on script delete
 - Notification callback cleanup on auto-timeout
@@ -232,7 +232,7 @@ v1.7.5
 - Fixed: NetworkLog duration calculation used `_netLogEntry.timestamp` which was undefined; replaced with dedicated `_netLogStartTime` variable
 - Fixed: `state.folders`, `state._collapsedFolders`, `state._lastCheckedId`, `state._quotaWarned` not initialized in dashboard state object
 - Fixed: `switchTab('help')` in command palette failed because help tab is a header icon, not a `.tm-tab`; added special case handling
-- Verified: All version strings match (v1.7.5 across manifest, manifest-firefox, content.js, popup.js, dashboard.js)
+- Verified: All version strings match (v1.7.6 across manifest, manifest-firefox, content.js, popup.js, dashboard.js)
 - Verified: All bg/ modules load before background.core.js in build output
 - Verified: `escapeHtml` available in popup.js (shared/utils.js loaded first)
 - Verified: Column index mapping still correct after pin button addition (pin is inside actions TD, not a new column)

README.md

@@ -9,7 +9,7 @@
 </p>
 
 <p align="center">
-  <img src="https://img.shields.io/badge/version-1.7.5-22c55e?style=flat-square" alt="Version">
+  <img src="https://img.shields.io/badge/version-1.7.6-22c55e?style=flat-square" alt="Version">
   <img src="https://img.shields.io/badge/manifest-v3-60a5fa?style=flat-square" alt="Manifest V3">
   <img src="https://img.shields.io/badge/license-MIT-orange?style=flat-square" alt="License">
   <img src="https://img.shields.io/badge/chrome-120%2B-blue?style=flat-square" alt="Chrome 120+">
@@ -325,6 +325,6 @@ MIT License &mdash; see [LICENSE](LICENSE) for details.
 ---
 
 <p align="center">
-  <strong>ScriptVault v1.7.5</strong><br>
+  <strong>ScriptVault v1.7.6</strong><br>
   <em>Your scripts, your rules &mdash; locked down and loaded</em>
 </p>

background.js

@@ -1,4 +1,4 @@
-// ScriptVault v1.7.5 - Background Service Worker
+// ScriptVault v1.7.6 - Background Service Worker
 // Comprehensive userscript manager with cloud sync and auto-updates
 // NOTE: This file is built from source modules. Edit the individual files in
 // shared/, modules/, and lib/, then run build-background.sh to regenerate.

content.js

@@ -1,4 +1,4 @@
-// ScriptVault v1.7.5 - Content Script Bridge
+// ScriptVault v1.7.6 - Content Script Bridge
 // Bridges messages between userscripts (USER_SCRIPT world) and background service worker
 
 (function() {

manifest-firefox.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "__MSG_extName__",
-  "version": "1.7.5",
+  "version": "1.7.6",
   "description": "__MSG_extDescription__",
   "default_locale": "en",
   "homepage_url": "https://github.com/SysAdminDoc/ScriptVault",

manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "__MSG_extName__",
-  "version": "1.7.5",
+  "version": "1.7.6",
   "description": "__MSG_extDescription__",
   "default_locale": "en",
   "minimum_chrome_version": "120",

offscreen.js

@@ -1,4 +1,4 @@
-// ScriptVault Offscreen Document v1.7.5
+// ScriptVault Offscreen Document v1.7.6
 // Handles CPU-intensive tasks off the service worker:
 //   - AST-based script analysis (via Acorn)
 //   - 3-way text merge for sync conflict resolution

pages/dashboard.js

@@ -1,4 +1,4 @@
-// ScriptVault Dashboard v1.7.5 - Full-Featured Controller
+// ScriptVault Dashboard v1.7.6 - Full-Featured Controller
 (function() {
     'use strict';
 
@@ -2422,15 +2422,15 @@
 
         const keySpan = item.querySelector('.storage-key');
 
-        item.querySelector('.btn:first-of-type').addEventListener('click', async () => {
+        item.querySelector('.btn:first-of-type')?.addEventListener('click', async () => {
             let newVal = item.querySelector('.input-field').value;
             try { newVal = JSON.parse(newVal); } catch (e) {}
             await chrome.runtime.sendMessage({ action: 'setScriptValue', scriptId, key: currentKey, value: newVal });
             showToast('Saved', 'success');
         });
 
         // Rename button
-        item.querySelectorAll('.btn')[1].addEventListener('click', async () => {
+        item.querySelectorAll('.btn')[1]?.addEventListener('click', async () => {
             const newKey = prompt('Rename key:', currentKey);
             if (!newKey || newKey === currentKey) return;
             const res = await chrome.runtime.sendMessage({ action: 'renameScriptValue', scriptId, oldKey: currentKey, newKey });
@@ -2444,9 +2444,9 @@
         });
 
         // Rename on key span click too
-        keySpan.addEventListener('click', () => item.querySelectorAll('.btn')[1].click());
+        keySpan?.addEventListener('click', () => item.querySelectorAll('.btn')[1]?.click());
 
-        item.querySelector('.btn-danger').addEventListener('click', async () => {
+        item.querySelector('.btn-danger')?.addEventListener('click', async () => {
             if (await showConfirmModal('Delete', `Delete "${currentKey}"?`)) {
                 await chrome.runtime.sendMessage({ action: 'deleteScriptValue', scriptId, key: currentKey });
                 item.remove();
@@ -4859,8 +4859,7 @@
 
         overlay.classList.add('open');
         const input = overlay.querySelector('.cmd-input');
-        input.value = '';
-        input.focus();
+        if (input) { input.value = ''; input.focus(); }
         renderCommandResults('');
     }
 

pages/devtools-panel.js

@@ -1,10 +1,10 @@
-// ScriptVault DevTools Panel v1.7.5
+// ScriptVault DevTools Panel v1.7.6
 // Network inspection, execution profiling, and console capture
 
 (function () {
   'use strict';
 
-  const $ = id => document.getElementById(id);
+  const $ = id => document.getElementById(id) || document.createElement('div'); // null-safe
 
   let netLog = [];
   let scripts = [];
@@ -232,7 +232,7 @@
       comment: e.scriptName || ''
     }));
 
-    const har = { log: { version: '1.2', creator: { name: 'ScriptVault', version: '1.7.5' }, entries } };
+    const har = { log: { version: '1.2', creator: { name: 'ScriptVault', version: '1.7.6' }, entries } };
     const blob = new Blob([JSON.stringify(har, null, 2)], { type: 'application/json' });
     const url = URL.createObjectURL(blob);
     const a = document.createElement('a');

pages/install.js

@@ -1,4 +1,4 @@
-// ScriptVault Install Page v1.7.5
+// ScriptVault Install Page v1.7.6
 
 // Dangerous permissions that warrant security warnings
 const DANGEROUS_PERMISSIONS = [
@@ -526,9 +526,9 @@ function renderInstallUI(sourceUrl) {
   setupCodePreview();
 
   // Setup event listeners
-  document.getElementById('btn-cancel').addEventListener('click', handleCancel);
-  document.getElementById('btn-install').addEventListener('click', handleInstall);
-  document.getElementById('toggle-code').addEventListener('click', toggleCodePreview);
+  document.getElementById('btn-cancel')?.addEventListener('click', handleCancel);
+  document.getElementById('btn-install')?.addEventListener('click', handleInstall);
+  document.getElementById('toggle-code')?.addEventListener('click', toggleCodePreview);
 
   document.getElementById('enable-install')?.addEventListener('change', (e) => {
     enableOnInstall = e.target.checked;