ScriptVault v2.0.6

UI/UX Polish Release

Popup

• Full focus descriptor system — keyboard focus persists across re-renders
• Focus fallback logic for search/filter/empty states

Dashboard Store

• Tighter spacing and padding throughout
• Pre-wrap code previews with word-break
• Link button styling fix
• Focus restore on navigation

Install Page

• Expanded layout with better visual hierarchy

DevTools Panel

• Major expansion with enhanced script inspection capabilities

Side Panel

• Additional interactivity improvements

Other

• Public API TypeScript module extended
• Expanded test coverage (dashboard, popup a11y, GUI UX, source modules)

ScriptVault v2.0.5

ScriptVault v2.0.5

Bug Fixes

• Unhandled promise rejections: All 4 chrome.tabs.reload() call sites now handle rejected promises when tabs close during reload
• CSS: Added missing --scrollbar-thumb-hover variable to :root (was always falling back to hardcoded value)
• Crash prevention: Added null guard for canvas.getContext('2d') in gamification profile image renderer
• Crash prevention: Added _container null guard in debugger renderVariableTable() — could crash if called after destroy() via pending setTimeout
• Diff viewer: Collapse toggle now supports expand and re-collapse (was one-way expand only)
• Popup timeline: Added parentNode null check to prevent crash on detached elements
• Quota manager: autoCleanup() aggressive mode now actually cleans analytics/perf history data (cleanup handler was missing — silently no-op)

Performance Optimizations

• getAllScriptsValues: Parallelized with Promise.all() — was O(N) sequential storage reads (100 scripts = 100 serial awaits)
• switchProfile: Parallelized script state writes with Promise.all() — was O(N) sequential storage writes
• _notifCallbacks Map: Capped at 500 entries with oldest-first eviction (was unbounded, leaked in long sessions)
• _openTabTrackers Map: Capped at 1000 entries (orphaned tabs persisted forever)
• ResourceCache: In-memory cache capped at 200 entries with LRU eviction (was unbounded)
• Public API rate limiter: Dead sender entries now evicted when map exceeds 200 entries
• CSP reports: Replaced splice(0, N) head-removal with slice(-500) (avoids O(N) array shift)
• Auto-reload: Deduplicated via Map keyed by scriptId (was pushing duplicate script objects)
• Error log: FIFO trim changed from splice to slice reassignment

UI Improvements

• Popup, sidepanel, install page, and dashboard enhancements
• New accessibility tests for popup and dashboard
• New GUI audit test suites

ScriptVault v2.0.4

What's New in v2.0.4

• Production build with minified background service worker
• Chrome extension CRX and CWS ZIP included as release assets
• Includes all fixes from v2.0.3 audit (36 fixes across 16 files)

ScriptVault v2.0.3

Comprehensive Audit — 36 Fixes

Security (5 fixes)

• Critical: Empty @grant array now correctly denies all permissions (was granting ALL)
• @connect enforcement: URL parse failure no longer silently allows blocked requests
• GM_addElement innerHTML sanitization: case-insensitive check for javascript:/vbscript: URIs
• signing.js trustKey(): rejects __proto__/constructor/prototype keys (prototype pollution)
• Monaco adapter: postMessage listener now validates e.source === frame.contentWindow

Crash/Logic Bugs (10 fixes)

• ScriptStorage.search() crashed on scripts with missing meta.name
• ScriptStorage.getByNamespace() and duplicate() null-safety
• toggleScript accepted undefined for enabled — now coerces to boolean
• Context menu new URL(tab.url) crashed on chrome:// tabs
• GM_cookie.list/set/delete crashed on bridge timeout (undefined result)
• _makeRuleId DNR rule ID collisions (|| 1 → + 1)
• requireCache used wrong key (included SRI fragment)
• Signing: Windows \r\n line endings broke verification
• Signing: insertion failed on non-standard ==/UserScript== whitespace

Performance (5 fixes)

• Backup import handlers (TM/VM/GM) called getAll() inside loops — O(N*M) → O(N)
• resources.js O(N²) string concatenation → chunked String.fromCharCode.apply
• _urlChangeHandlers unbounded growth → dedup guard
• Console capture: unbounded spread capped to 200
• _audioWatchedTabs cleanup on tab close

Robustness (5 fixes)

• Workspaces activate() now uses ScriptStorage.set() for rollback safety
• Background task mutex: 5-minute safety timeout prevents deadlock on hung sync
• matchIncludePattern ReDoS: collapse consecutive * before regex conversion
• GM_getResourceURL defaults to data URI (no blob URL leak)
• Notification _errorCounts now persisted after reset

Dashboard (7 fixes)

• Heatmap innerHTML += destroyed DOM children → appendChild
• Standalone: 5 revokeObjectURL calls delayed to 1000ms
• Profiles _urlWatcherStarted reset on destroy()
• Chains: deep copy steps to prevent cancel bypass
• Diff/Linter: Uint16Array → Uint32Array (overflow-proof)
• DevTools HAR: version from manifest instead of hardcoded 1.7.8

Other (4 fixes)

• Monaco adapter 'null' origin handling
• Offscreen AST walker: cleaned up circular parent refs for GC
• Offscreen resolveWithMarkers: removed dead variables
• i18n.js: escaped regex special chars in placeholder keys

374/374 tests passing. background.js: 16,673 lines.

ScriptVault v2.0.1

ScriptVault v2.0.1

Cleanup release — removes incomplete modules and upgrades the Script Store.

Changes

Removed Modules

• AI Assistant (dashboard-ai.js) — removed incomplete module
• Analytics (dashboard-analytics.js) — removed along with recordAnalytics/getAnalytics background handlers
• Performance Dashboard (dashboard-performance.js) — removed along with getPerfHistory/savePerfSnapshot handlers
• Onboarding Wizard (dashboard-onboarding.js) — removed (one-time modal, low value)
• OpenUserJS (dashboard-openuserjs.js) — merged into Script Store

Upgraded

• Script Store — now multi-source: searches both Greasy Fork and OpenUserJS simultaneously with source badges, color-coded chips, and a source filter bar

Cleaned Up

• Background message handlers for removed analytics/performance features
• Quota manager no longer prunes analytics or perf history data
• Lazy-loader tab mappings updated (heatmap moved to utilities)
• What's New entries trimmed to reflect actual shipped features
• Migration module cleaned of removed feature references

Net change: -5,695 lines removed, +251 added

Downloads

• ScriptVault-v2.0.1.crx — Chrome extension (sideload via chrome://extensions)
• ScriptVault-v2.0.1.zip — Unpacked extension / CWS upload

ScriptVault v2.0.0

ScriptVault v2.0.0

Major release — modular architecture rewrite with 32 new dashboard modules and Monaco editor migration.

Highlights

Architecture

• Dashboard split into 32 lazy-loaded modules for faster load times
• Background service worker expanded to 16,017 lines from 12+ source modules
• New esbuild config for future bundling pipeline
• Vitest test suite with 159 test cases

New Dashboard Modules

• Script Store — Built-in Greasy Fork browser
• AI Assistant — Generate, explain, fix, and security-audit scripts
• Debugger — Console capture, live reload, variable inspector
• Analytics — Detailed script usage charts and metrics
• Scheduler — Time/day/date-based script scheduling
• Theme Editor — Custom theme editor with 10 presets
• Dependency Graph — Force-directed visualization of script dependencies
• Sharing — QR code and data URL script sharing
• Profiles — Multi-profile support for different environments
• Collections — Script bundles/collections management
• CSP Reporter — Content Security Policy compatibility checker
• Onboarding — 5-step welcome wizard for new users
• Card View — Alternative card layout with favicons
• Keyboard Navigation — Full keyboard + vim mode support
• Accessibility — WCAG 2.1 AA compliance
• Pattern Builder — Visual @match pattern builder
• What's New — Per-version changelog modal
• GitHub Gist — Import/export scripts to Gist
• Template Manager — Custom script template library
• Snippets — 30+ reusable code snippets
• Standalone Export — HTML/bookmarklet export
• Firefox Compat — Firefox compatibility polyfills
• Performance Dashboard — Impact scores and monitoring
• Heatmap — Script execution heatmap
• Gamification — Scripting achievements and stats
• Recommendations — Smart script suggestions
• i18n v2 — 8 languages, 600+ keys for all new modules

New Background Modules

• npm-resolve.js — npm package resolution via CDN
• error-log.js — Structured error log with export
• notifications.js — Enhanced notification system
• sync-easycloud.js — Easy Cloud sync via chrome.identity
• backup-scheduler.js — Automatic backup scheduling
• userstyles.js — UserCSS/userstyle support
• public-api.js — External API for other extensions
• migration.js — Data migration from other managers
• quota-manager.js — Storage quota monitoring and management

Other Changes

• Monaco Editor migration (CDN-loaded in sandboxed iframe, replaces CodeMirror addons)
• DevTools Panel v2 — Waterfall timeline, console, body inspector
• Popup Timeline — New timeline view in popup
• Removed CodeMirror addon bundles and Yjs library (replaced by Monaco + offscreen merge)
• Firefox manifest updated to v2.0.0

Downloads

• ScriptVault-v2.0.0.crx — Chrome extension (sideload via chrome://extensions)
• ScriptVault-v2.0.0.zip — Unpacked extension / CWS upload

ScriptVault v1.7.8

v1.7.8 — Script Registration Engine Fixes

Match Pattern Engine

• Port support — isValidMatchPattern now accepts patterns with ports (e.g. http://localhost:3000/*). Previously, any pattern with a port was silently rejected.
• Wildcard subdomain + port fix — matchPattern() correctly handles *.example.com:8080 patterns. The host comparison was using redundant variables that didn't account for ports in subdomain matching.
• convertIncludeToMatch validation — All converted patterns are now validated against isValidMatchPattern() before being returned. Invalid conversions return null instead of broken patterns that would silently fail to match.

Script Registration

• Enabled state consistency — Fixed 4 locations where script.enabled was checked with truthy logic instead of script.enabled !== false. Scripts with undefined enabled state (e.g., from old imports) were incorrectly treated as disabled.
• Registration failure logging — registerAllScripts() now logs which scripts failed to register (was silently swallowed by Promise.allSettled).

DNR Rules

• Rule quota check — applyWebRequestRules() now checks Chrome's 30,000 dynamic rule limit before applying rules. Previously, exceeding the limit caused a silent API error.

Assets

• ScriptVault-v1.7.8.zip — Chrome Web Store ready package
• ScriptVault-v1.7.8.crx — Direct install CRX3 file

ScriptVault v1.7.7

v1.7.7 — GM_audio Fix, Firefox Compatibility, CSS Fixes

GM API Fixes

• GM_audio was completely non-functional — addStateChangeListener() referenced window.__ScriptVault_ChannelID__ which was never defined; all audio state events were silently dropped. Fixed to use the correct CHANNEL_ID variable.
• GM_audio event listener leak — the message handler was added but never removed when removeStateChangeListener() was called. Now stores handler reference and properly cleans up when the last listener is removed.

Firefox MV3 Compatibility

• Keyboard shortcuts restored — manifest-firefox.json had empty commands: {}. Now includes all 3 shortcuts (Alt+Shift+S popup, Alt+Shift+D dashboard, Alt+Shift+E toggle scripts).
• Offscreen API guard — ScriptAnalyzer._ensureOffscreen() now checks chrome.offscreen existence before calling, gracefully falling back to regex analysis on Firefox.

CSS Fixes

• Z-index hierarchy fixed — Find Scripts overlay (50 -> 55) now correctly stacks above editor overlay (50). Setup warning banner (99 -> 101) now visible above sticky header (100).
• Modal responsiveness — min-width: min(400px, 90vw) and max-width: min(500px, 95vw) prevent modals from overflowing on narrow viewports.

Assets

• ScriptVault-v1.7.7.zip — Chrome Web Store ready package
• ScriptVault-v1.7.7.crx — Direct install CRX3 file

ScriptVault v1.7.6

v1.7.6 — Null Safety Hardening

Systematic null check pass across all UI pages to prevent TypeError crashes from missing DOM elements.

Fixes by File

• sidepanel.js — $() helper now returns a dummy div instead of null, preventing crashes when panel HTML elements are missing
• devtools-panel.js — Same null-safe $() helper
• install.js — Optional chaining on btn-cancel, btn-install, toggle-code event listeners
• popup.js — Null check on blacklist .menu-item-text querySelector before setting textContent
• dashboard.js — Command palette input null guard; storage editor save/rename/delete/keySpan buttons all use optional chaining

Impact

These were all "silent crash" scenarios where a missing element would throw a TypeError that blocks subsequent code from running. The sidepanel and devtools panel fixes are especially important since those pages load in constrained contexts (side panel, devtools) where DOM might not be fully available.

Assets

• ScriptVault-v1.7.6.zip — Chrome Web Store ready package
• ScriptVault-v1.7.6.crx — Direct install CRX3 file

ScriptVault v1.7.5

v1.7.5 — Monaco Migration: Toolbar & Editor Features Restored

The Monaco editor migration left many editor toolbar buttons broken because the adapter was missing CodeMirror methods that dashboard.js depends on. This release restores full functionality.

Restored Toolbar Buttons

• Undo / Redo — now route through Monaco's built-in undo/redo
• Fold All / Unfold All — use Monaco's native fold actions (was crashing with foldCode is not a function)
• Comment Toggle (Ctrl+/) — uses Monaco's commentLine action instead of broken CodeMirror line-by-line logic
• Find / Replace — Ctrl+F and Ctrl+H now open Monaco's built-in search
• Lint — shows info toast (Monaco handles diagnostics automatically)

Fixed Features

• Snippet Insert — clicking a snippet template now actually inserts text at the cursor position (was a no-op)
• Beautify Code — getOption('indentWithTabs') and getOption('indentUnit') now return correct defaults instead of undefined
• Auto-hint trigger — showHint() is now a safe no-op instead of throwing (Monaco handles completions internally)

Technical Details

• Monaco adapter: added 12 new CodeMirror-compatible methods
• Editor sandbox iframe: added insert-text and action message handlers
• Dashboard: branched Monaco vs CodeMirror paths for fold, comment, lint operations

Assets

• ScriptVault-v1.7.5.zip — Chrome Web Store ready package
• ScriptVault-v1.7.5.crx — Direct install CRX3 file