clawbot 375998beaf harden: show a personal message's hex and its text in byte order, hidden characters marked (closes #403) ...

The signature screen showed only the text a personal message decodes
to, with bidirectional, right-to-left and zero-width characters acting
on it, so a site could make the message read differently from the
bytes that are signed, and a message that was not hex was decoded into
NUL characters. The screen now shows the hex as "Raw data" alongside
the text, lays the text out left to right in byte order, and shows each
control character, line and paragraph separator, and character that
paints nothing (the set src/shared/symbolSpoof.js already strips) as a
U+XXXX mark. A message is hex when getBytes, which signing uses, reads
it; one that is not cannot be signed, so it is shown as plain text with
"Sign" disabled.

Model: opus-5-5

2026-10-04 22:09:07 +02:00

..

firefox

harden: key remembered site permissions by full origin (closes #402)

2026-10-04 18:09:04 +02:00

Dockerfile

build: run the browser e2e suites in CI (closes #259)

2026-08-17 08:52:26 +02:00

harness.js

feat: vendor and censor the phishing blocklist at build time (closes #219)

2026-08-17 10:05:56 +02:00

network.js

harden: escape every interpolation into popup innerHTML, and add default-src to both manifests (closes #307)

2026-08-20 13:47:28 +02:00

run.js

harden: show a personal message's hex and its text in byte order, hidden characters marked (closes #403)

2026-10-04 22:09:07 +02:00

storagePartition.js

release: produce a versioned per-browser artifact and pin the Chrome extension id (closes #310)

2026-08-23 16:13:22 +02:00