Prepare TraceLens v0.1.1 for AMO

README.md

@@ -61,7 +61,7 @@ npm run package
 - The extension uses Firefox Manifest V2 and a persistent in-memory background page intentionally.
 - Privacy Score 2.0 is stable for the MVP and remains an observed-evidence heuristic, not a universal site rating.
 - Tracker coverage is a seven-rule, provider-documented seed set generated from validated per-entry provenance.
-- The project has not been published to GitHub or submitted to Mozilla Add-ons.
+- The project is public on GitHub but has not been submitted to Mozilla Add-ons.
 
 ## Architecture
 

docs/ENGINEERING_REPORT.md

@@ -130,7 +130,7 @@ HTML output escapes every dynamic string, contains no script or remote asset, an
 - YouTube with asserted-active uBlock Origin 1.74.0: settled fresh-load observation contained 41 request attempts, 21 third-party requests across 7 domains, 1 advertising tracker domain, and the same 7 cookies (6 persistent, 5 `SameSite=None`, 0 non-Secure), score 79. Coverage was partial. The one-point difference follows the one additional unique domain TraceLens observed; it is not a claim that those attempts were delivered. Individual live loads vary.
 - Tracker-heavy weather.com validation: the settled fresh-load snapshot contained 214 requests, 114 third-party requests across 36 domains, 11 trackers (8 advertising, 2 analytics, 1 other), and 21 cookies (20 persistent, 0 `SameSite=None`, 15 non-Secure), score 35, full-navigation coverage
 - Popup layout validation: actual Firefox toolbar panel content measured 420×280px; the full document used 420×600px with vertical scrolling, and the constrained reflow case passed at 320px without horizontal overflow
-- `npm run package`: pass; unsigned `artifacts/tracelens-0.1.0.zip` is 76,849 bytes, includes only the 11 required built extension entries, project license, and third-party notice, and passes `unzip -t`
+- `npm run package`: pass; unsigned `artifacts/tracelens-0.1.1.zip` is 76,847 bytes with SHA-256 `af9f6df0e8ae26565511d4edb45abe3ecbf6655a8e20e82e14a4f866672b0ffc`, includes only the 11 required built extension entries, project license, and third-party notice, passes `unzip -t`, and has file-content parity with `dist/`
 - Archive/source parity and privacy scan: pass; all packaged files match `dist`, all seven generated runtime domains are present, sampled removed domains are absent, and no provenance JSON/tooling/evidence URL, absolute local path, secret candidate, remote URL, or executable outbound-network primitive is packaged
 - `npm audit --omit=dev`: pass, 0 runtime vulnerabilities
 - full `npm audit`: 3 acknowledged development-only high findings described above

package.json

@@ -1,6 +1,6 @@
 {
   "name": "tracelens",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "private": true,
   "license": "MIT",
   "description": "A local-first, ephemeral Firefox privacy analyzer.",

scripts/firefox-smoke.mjs

@@ -108,7 +108,7 @@ try {
     );
     assert.equal(companionActive, true, "uBlock Origin companion add-on is active");
   }
-  const base = await execute('return WebExtensionPolicy.getByID("tracelens@local.invalid").getURL("");');
+  const base = await execute('return WebExtensionPolicy.getByID("tracelens@adulph3").getURL("");');
   await command("Marionette:SetContext", { value: "content" });
   await command("WebDriver:Navigate", { url: `${base}popup/popup.html` });
   const evaluate = (body, args = []) => execute(`

src/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 2,
   "name": "TraceLens",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Analyze the current tab's trackers and privacy signals locally, with no browsing history.",
   "permissions": [
     "webRequest",
@@ -35,7 +35,7 @@
   "incognito": "not_allowed",
   "browser_specific_settings": {
     "gecko": {
-      "id": "tracelens@local.invalid",
+      "id": "tracelens@adulph3",
       "strict_min_version": "153.0",
       "data_collection_permissions": {
         "required": ["none"]

tests/manifest.test.ts

@@ -6,18 +6,22 @@ test("manifest permissions are limited to the MVP capabilities", async () => {
   const manifest = JSON.parse(
     await readFile(new URL("../src/manifest.json", import.meta.url), "utf8"),
   ) as {
+    version: string;
     permissions: string[];
     background: { persistent: boolean };
     content_security_policy: string;
     incognito: string;
     browser_specific_settings: {
       gecko: {
+        id: string;
         strict_min_version: string;
         data_collection_permissions: { required: string[] };
       };
     };
   };
 
+  assert.equal(manifest.version, "0.1.1");
+  assert.equal(manifest.browser_specific_settings.gecko.id, "tracelens@adulph3");
   assert.deepEqual(manifest.permissions, [
     "webRequest",
     "cookies",