Extension 0.5.0: first-run consent, unfret host, dev server #1

Merged

kroshtan merged 1 commit from release-0.5.0 into main

2026-11-09 09:36:07 +00:00

kroshtan commented

2026-11-09 09:06:35 +00:00

Owner

Extension 0.5.0: the first-run consent screen for the Chrome Web Store, the unfret host, the dev server and the audit fixes.

The popup opens on a consent card the first time (nl/en), with three panels:
1. What Veridex does: scam shops, generic goods, fake discounts and dark patterns, explained in plain words.
2. What is sent and when: only on "Analyse this page", the product facts and cleaned visible text go to unfret.kroshtan.com. No account data. URLs aren't stored, nothing is sold, there are no affiliate links, and price observations are kept anonymously for 90 days.
3. Paying: Solana wallet sign-in, prepaid checks, a trial if eligible.
I agree stores {consent: {version: 1}} in storage.local. Analyse stays disabled until then, and the background also refuses to analyse without consent. About & privacy reopens the card, which links to https://unfret.kroshtan.com/privacy (live, served by the backend).
Smoke test: the popup opens on the consent card with Analyse disabled, and clicking I agree stores the flag.

Hosts and dev server

The API base, sign-in relay, update_url and release codebase all move to unfret.kroshtan.com.
https://dev.unfret.kroshtan.com/* is an optional host permission, with a "Use the dev server" button in the options. Its sign-in relay is registered at runtime (scripting.registerContentScripts), and the CSP allows it.
Permissions vs 0.4.0 (checked against the shipped 0.4.0 CRX's manifest): permissions and host_permissions are identical; optional_host_permissions adds the dev host, which has no install warning; the relay content script's match moves from the veridex host to the unfret host, so the single-site warning names the new host.
Installed 0.4.0 copies poll veridex.kroshtan.com, which no longer resolves, so they can't auto-update. Those users need to install 0.5.0 once.

Fixes

#8: a double click no longer starts (and charges) two analyses. The in-flight flag is set synchronously in both the popup and the background.
Countdowns are watched for 1.2 s while the text is cleaned; uploaded text is capped at 24,000 characters.
#3: Shopify compare-at is bound to the variant on show, and integer amounts are always cents (the same cases as the backend's tests).
The options page is translated (nl/en).
#12 (page_type from the step event) was already handled by the client.

Release

make release built, with the existing key, veridex-0.5.0.crx (ID kpllgmbgfmnlpnmkibmhflkafhilckfe, unchanged), updates.xml (codebase on unfret), the store zip veridex-chrome-0.5.0.zip and SHA256SUMS. The artifacts go to the backend's static/extension in a backend PR.

Tests

typecheck, eslint and prettier are clean. vitest: 115 passed. Smoke (headless Chromium): 9 passed.

🤖 Generated with Claude Code

https://claude.ai/code/session_014HgVKRqhxEZCM6yP8io6fk

Extension 0.5.0: the first-run consent screen for the Chrome Web Store, the unfret host, the dev server and the audit fixes. ## Consent screen ("Purple Nickel") - The popup opens on a consent card the first time (nl/en), with three panels: 1. What Veridex does: scam shops, generic goods, fake discounts and dark patterns, explained in plain words. 2. What is sent and when: only on "Analyse this page", the product facts and cleaned visible text go to `unfret.kroshtan.com`. No account data. URLs aren't stored, nothing is sold, there are no affiliate links, and price observations are kept anonymously for 90 days. 3. Paying: Solana wallet sign-in, prepaid checks, a trial if eligible. - **I agree** stores `{consent: {version: 1}}` in `storage.local`. Analyse stays disabled until then, and the background also refuses to analyse without consent. **About & privacy** reopens the card, which links to https://unfret.kroshtan.com/privacy (live, served by the backend). - Smoke test: the popup opens on the consent card with Analyse disabled, and clicking I agree stores the flag. ## Hosts and dev server - The API base, sign-in relay, `update_url` and release `codebase` all move to `unfret.kroshtan.com`. - `https://dev.unfret.kroshtan.com/*` is an **optional** host permission, with a "Use the dev server" button in the options. Its sign-in relay is registered at runtime (`scripting.registerContentScripts`), and the CSP allows it. - **Permissions vs 0.4.0** (checked against the shipped 0.4.0 CRX's manifest): `permissions` and `host_permissions` are identical; `optional_host_permissions` adds the dev host, which has no install warning; the relay content script's match moves from the veridex host to the unfret host, so the single-site warning names the new host. - Installed 0.4.0 copies poll `veridex.kroshtan.com`, which no longer resolves, so they can't auto-update. Those users need to install 0.5.0 once. ## Fixes - #8: a double click no longer starts (and charges) two analyses. The in-flight flag is set synchronously in both the popup and the background. - Countdowns are watched for 1.2 s while the text is cleaned; uploaded text is capped at 24,000 characters. - #3: Shopify compare-at is bound to the variant on show, and integer amounts are always cents (the same cases as the backend's tests). - The options page is translated (nl/en). - #12 (page_type from the step event) was already handled by the client. ## Release `make release` built, with the existing key, `veridex-0.5.0.crx` (ID `kpllgmbgfmnlpnmkibmhflkafhilckfe`, unchanged), `updates.xml` (codebase on unfret), the store zip `veridex-chrome-0.5.0.zip` and `SHA256SUMS`. The artifacts go to the backend's `static/extension` in a backend PR. ## Tests typecheck, eslint and prettier are clean. vitest: 115 passed. Smoke (headless Chromium): 9 passed. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_014HgVKRqhxEZCM6yP8io6fk

kroshtan added 1 commit

2026-11-09 09:06:35 +00:00

feat: first-run consent, unfret host, dev server, v0.5.0

CI / check (pull_request) Successful in 1m12s

Details

9f1c864fae

- First-run consent screen in the popup (nl/en): what Veridex does; what is sent, only on Analyse
  (product facts and cleaned visible text to unfret.kroshtan.com; addresses not stored, nothing
  sold, no affiliate links, anonymous price observations kept 90 days); paying (Solana wallet,
  prepaid checks, a trial if eligible). "I agree" stores {consent: {version}} in storage.local;
  Analyse is disabled until then, the background refuses to analyse without it, and "About &
  privacy" reopens it. Links to https://unfret.kroshtan.com/privacy.
- Hosts: API, sign-in relay, update_url and release codebase on unfret.kroshtan.com (the veridex
  host is gone). The dev deployment (https://dev.unfret.kroshtan.com) is an optional host
  permission with a "Use the dev server" button; its sign-in relay is registered at runtime, so
  no new install warning. Required permissions are unchanged.
- Fixes: a double click no longer starts (and charges) two analyses (in-flight set synchronously
  in the popup and the background); countdowns are watched 1.2 s while the text is cleaned;
  uploaded text capped at 24,000 characters; Shopify compare-at bound to the variant on show,
  integers always cents (matches the backend); the options page is translated (nl/en).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014HgVKRqhxEZCM6yP8io6fk

kroshtan referenced this pull request from kroshtan/unfret_backend

2026-11-09 09:08:59 +00:00

Publish extension 0.5.0; balance_usd_micros #36

kroshtan merged commit 301ba5cd16 into main

2026-11-09 09:36:07 +00:00

kroshtan referenced this pull request from a commit

2026-11-09 09:36:08 +00:00

Extension 0.5.0: first-run consent, unfret host, dev server (#1)