From 2b11c253c47ef8d32812d7a62bcc4fead8182ee7 Mon Sep 17 00:00:00 2001 From: Adulph3 Date: Wed, 9 Sep 2026 02:04:13 +0300 Subject: [PATCH] Prepare TraceLens v0.1.1 for AMO --- README.md | 2 +- docs/ENGINEERING_REPORT.md | 2 +- package-lock.json | 4 ++-- package.json | 2 +- scripts/firefox-smoke.mjs | 2 +- src/manifest.json | 4 ++-- tests/manifest.test.ts | 4 ++++ 7 files changed, 12 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 6579e8f..d12e141 100644 --- a/README.md +++ b/README.md @@ -61,7 +61,7 @@ npm run package - The extension uses Firefox Manifest V2 and a persistent in-memory background page intentionally. - Privacy Score 2.0 is stable for the MVP and remains an observed-evidence heuristic, not a universal site rating. - Tracker coverage is a seven-rule, provider-documented seed set generated from validated per-entry provenance. -- The project has not been published to GitHub or submitted to Mozilla Add-ons. +- The project is public on GitHub but has not been submitted to Mozilla Add-ons. ## Architecture diff --git a/docs/ENGINEERING_REPORT.md b/docs/ENGINEERING_REPORT.md index 01211c3..1e89af6 100644 --- a/docs/ENGINEERING_REPORT.md +++ b/docs/ENGINEERING_REPORT.md @@ -130,7 +130,7 @@ HTML output escapes every dynamic string, contains no script or remote asset, an - YouTube with asserted-active uBlock Origin 1.74.0: settled fresh-load observation contained 41 request attempts, 21 third-party requests across 7 domains, 1 advertising tracker domain, and the same 7 cookies (6 persistent, 5 `SameSite=None`, 0 non-Secure), score 79. Coverage was partial. The one-point difference follows the one additional unique domain TraceLens observed; it is not a claim that those attempts were delivered. Individual live loads vary. - Tracker-heavy weather.com validation: the settled fresh-load snapshot contained 214 requests, 114 third-party requests across 36 domains, 11 trackers (8 advertising, 2 analytics, 1 other), and 21 cookies (20 persistent, 0 `SameSite=None`, 15 non-Secure), score 35, full-navigation coverage - Popup layout validation: actual Firefox toolbar panel content measured 420×280px; the full document used 420×600px with vertical scrolling, and the constrained reflow case passed at 320px without horizontal overflow -- `npm run package`: pass; unsigned `artifacts/tracelens-0.1.0.zip` is 76,849 bytes, includes only the 11 required built extension entries, project license, and third-party notice, and passes `unzip -t` +- `npm run package`: pass; unsigned `artifacts/tracelens-0.1.1.zip` is 76,847 bytes with SHA-256 `af9f6df0e8ae26565511d4edb45abe3ecbf6655a8e20e82e14a4f866672b0ffc`, includes only the 11 required built extension entries, project license, and third-party notice, passes `unzip -t`, and has file-content parity with `dist/` - Archive/source parity and privacy scan: pass; all packaged files match `dist`, all seven generated runtime domains are present, sampled removed domains are absent, and no provenance JSON/tooling/evidence URL, absolute local path, secret candidate, remote URL, or executable outbound-network primitive is packaged - `npm audit --omit=dev`: pass, 0 runtime vulnerabilities - full `npm audit`: 3 acknowledged development-only high findings described above diff --git a/package-lock.json b/package-lock.json index 59433d8..b458e56 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "tracelens", - "version": "0.1.0", + "version": "0.1.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "tracelens", - "version": "0.1.0", + "version": "0.1.1", "license": "MIT", "dependencies": { "tldts": "^7.4.11" diff --git a/package.json b/package.json index 609f87c..38255a0 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "tracelens", - "version": "0.1.0", + "version": "0.1.1", "private": true, "license": "MIT", "description": "A local-first, ephemeral Firefox privacy analyzer.", diff --git a/scripts/firefox-smoke.mjs b/scripts/firefox-smoke.mjs index 9ec6fea..aa14317 100644 --- a/scripts/firefox-smoke.mjs +++ b/scripts/firefox-smoke.mjs @@ -108,7 +108,7 @@ try { ); assert.equal(companionActive, true, "uBlock Origin companion add-on is active"); } - const base = await execute('return WebExtensionPolicy.getByID("tracelens@local.invalid").getURL("");'); + const base = await execute('return WebExtensionPolicy.getByID("tracelens@adulph3").getURL("");'); await command("Marionette:SetContext", { value: "content" }); await command("WebDriver:Navigate", { url: `${base}popup/popup.html` }); const evaluate = (body, args = []) => execute(` diff --git a/src/manifest.json b/src/manifest.json index 7a83904..25d6363 100644 --- a/src/manifest.json +++ b/src/manifest.json @@ -1,7 +1,7 @@ { "manifest_version": 2, "name": "TraceLens", - "version": "0.1.0", + "version": "0.1.1", "description": "Analyze the current tab's trackers and privacy signals locally, with no browsing history.", "permissions": [ "webRequest", @@ -35,7 +35,7 @@ "incognito": "not_allowed", "browser_specific_settings": { "gecko": { - "id": "tracelens@local.invalid", + "id": "tracelens@adulph3", "strict_min_version": "153.0", "data_collection_permissions": { "required": ["none"] diff --git a/tests/manifest.test.ts b/tests/manifest.test.ts index b9b0062..e54a6ac 100644 --- a/tests/manifest.test.ts +++ b/tests/manifest.test.ts @@ -6,18 +6,22 @@ test("manifest permissions are limited to the MVP capabilities", async () => { const manifest = JSON.parse( await readFile(new URL("../src/manifest.json", import.meta.url), "utf8"), ) as { + version: string; permissions: string[]; background: { persistent: boolean }; content_security_policy: string; incognito: string; browser_specific_settings: { gecko: { + id: string; strict_min_version: string; data_collection_permissions: { required: string[] }; }; }; }; + assert.equal(manifest.version, "0.1.1"); + assert.equal(manifest.browser_specific_settings.gecko.id, "tracelens@adulph3"); assert.deepEqual(manifest.permissions, [ "webRequest", "cookies",