Splash over the empty shell on sign-in; extension v0.2.1 catches submit() logins ...

- App.vue gates on auth state: 'checking' renders a logo + spinner card
  until /me answers, so the shell never flashes empty before the
  sign-in screen appears; 'denied' -> sign-in card, 'ready' -> app.
- content.js: DLE-style <button onclick="submit();"> calls
  form.submit(), which fires no submit event - the login form's
  interceptor stayed silent (animaunt.org regression). Capture happens
  on the submit-button click and Enter too; duplicate captures within
  1.5s with identical credentials are dropped. Verified end-to-end on
  animaunt.org: modal login -> popup save card -> vault entry.
- Release 0.2.1: Makefile + extension manifest bumped, zips rebuilt
  and hashed into the deploy manifest for the download page.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Extension: localized strings ship in the design pack, UI language from the backend

Serve extension design resources from the server as a versioned pack ...

CSS (card + popup), field-detection keyword tables and UI config now ship as
extensions/pack/ with sha256 in pack.json and a monotonic version. The backend
serves pack.json unauthenticated (no-cache) and files versioned/immutable; a
background-worker sync validates schema, ext-version compatibility and hashes,
then stores the pack atomically in chrome.storage.local — content scripts and
the popup only read storage, never fetch, and fall back to the bundled
defaults. Publish tool auto-bumps on content change and writes pack.json last.
Firefox bundle inlines pack-shared.js; release 0.2.0.

E2E (15/15): adoption, live restyle without re-release, rollback and
min-extension guards, sha-mismatch abort, offline fallback. Tests: node 25+21,
pytest 57.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Detect login fields with a scoring classifier instead of heuristics ...

field-detect.js is a pure UMD module: every input becomes a descriptor
(name/id/placeholder/aria-label/label text, visibility state, type,
autocomplete token) scored against multilingual keyword tables with
anti-keywords for traps (search, newsletter, cc, otp and now repeat-
password fields). findLoginTargets pairs one username with one password
per form context, merges confirm-password pairs, and falls back to the
closest preceding input in anonymous SPA forms.

content.js reduces to DOM probing (descriptor building + scan) and the
card/interceptor flow; the manifest loads field-detect.js first.

The module is unit-tested without a browser via tools/test-field-detect.js
(16 plain-node cases over a fake tree) and verified end-to-end in Chromium
on a page mixing russian placeholders, newsletter/search/otp/cc traps and
a confirm-password signup form: three cards, correct pairs, Use fills the
right fields only.

Makefile: the per-file $(SRC) replaces the directory prerequisite (a
stale edit inside src/ never rebuilt the bundles), recipes copy with
cp --parents, and make test runs the node suite.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Render the autofill card in a closed Shadow DOM ...

The card used to be injected straight into the page: host-page CSS could
restyle it (or hide/mimic it), page JS could read the card's DOM — leaking
secret titles — and reach its buttons via querySelector on our class names.

Now it lives in a closed shadow root on a bare sized-to-zero host element:
- CSS does not cross the shadow boundary in either direction, so page styles
  can no longer repaint the card;
- the page cannot traverse into a closed root (host.shadowRoot is null), so
  secret titles and buttons are unreachable from the main world;
- src/content.css is no longer injected into page stylesheets — it is now a
  web-accessible resource, fetched once per page and injected as a <style>
  inside the shadow root (with a graceful no-styles fallback).
- while restyling the card, bring it onto the gnexus-ui-kit 1.0 palette
  (panel #16161e, left accent border, uppercase IBM Plex Mono titles) to
  match the rebuilt popup.

Verified end-to-end in real Chromium: isolation probe reports a bare empty
host, null shadowRoot, no card nodes or CSS rules reachable from the page,
no title leak under deliberately hostile page CSS (color:red !important over
all divs); clicking Use fills the form and removes the card.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Release extension 0.1.1: kit 1.0 lib, shield logo icons ...

Rebuild both browsers' packages against gnexus-ui-kit 1.0 (make lib
from frontend/node_modules) and swap the generic dots mark for the
shield keyhole logo rasterized from frontend/public/logo.svg
(icon.svg + 16/32/48/128 PNG rsvg-convert). Popup verified in
chromium: settings drawer and secrets list render with no page errors.
Version bumped in extension manifest + Makefile; extensions/manifest.json
points at the 0.1.1 zips with fresh sha256/size (0.1.0 zips removed).

Co-Authored-By: Claude Code <noreply@anthropic.com>

Import browser extension source under extensions/extension ...

Move the gnexus-creds-extension sources (Chrome/Firefox MV3) from the
separate sibling repository into extensions/extension/ so builds live
next to the packaged releases this service distributes
 (extensions/dist/ + extensions/manifest.json, untouched).

- add a reproducible `make lib` target materializing lib/ from the
  frontend's pinned gnexus-ui-kit (gitignored, like before)
- drop the playwright-only package.json/lock; system node+zip suffice
- scoped .gitignore so it cannot shadow tracked extensions/dist zips
- README (main + extension): document the in-repo build and publish flow

Rebuilt zips differ from released ones only in the three lib files
(older kit in the release); extension code itself is byte-identical.

Co-Authored-By: Claude Code <noreply@anthropic.com>