uncloseai.

Browser Toys

Browser extensions that add the uncloseai. floating button to every web page you visit. Lightweight wrappers around uncloseai.js — no server, no backend, no accounts. The extension injects the script tag, and everything else runs client-side in your browser.

Available Extensions

Chrome / Edge / Brave / Vivaldi / Arc

Manifest V3 extension for all Chromium-based browsers.

Download for Chrome (~10 KB)

1. Download and unzip uncloseai-browser-toy-chrome.zip
2. Verify the download (see checksums below)
3. Open chrome://extensions and enable Developer mode (toggle in top right)
4. Click Load unpacked and select the unzipped folder
5. The uncloseai. button appears on every page you visit

Firefox

Manifest V2 extension for Firefox 109+ and Firefox-based browsers (LibreWolf, Waterfox).

Download for Firefox (~10 KB)

1. Download uncloseai-browser-toy-firefox.zip
2. Verify the download (see checksums below)
3. Open about:debugging#/runtime/this-firefox
4. Click Load Temporary Add-on and select the downloaded zip file
5. The uncloseai. button appears on every page you visit

Safari

Safari Web Extension for macOS and iOS. Requires Xcode conversion.

Download Safari source (~10 KB)

1. Download and unzip uncloseai-browser-toy-safari.zip
2. Verify the download (see checksums below)
3. Convert to Xcode project:

   xcrun safari-web-extension-converter /path/to/unzipped-folder \
     --project-location ./safari-xcode \
     --app-name "uncloseai" \
     --bundle-identifier com.uncloseai.browser-toy \
     --no-open

4. Open safari-xcode/uncloseai.xcodeproj, set your signing team, build (Cmd+R)
5. Enable in Safari Settings > Extensions

Verify your download

Always verify downloads before installing. Checksum files are generated by the build and published alongside the zips.

SHA256SUMS | MD5SUMS

# Download checksums and verify all zips at once
curl -sO https://uncloseai.com/downloads/SHA256SUMS
sha256sum -c SHA256SUMS

# Or verify a single file
curl -s https://uncloseai.com/downloads/SHA256SUMS | grep chrome | sha256sum -c

How it works

1. The content script injects <script src="https://uncloseai.com/uncloseai.js" type="module"> into every page
2. If uncloseai.js is already on the page, it skips injection (no duplicates)
3. The floating uncloseai. button appears in the bottom-right corner
4. Click it to chat with Hermes about the current page
5. Toggle the extension on or off from the toolbar popup

Storage and privacy

These extensions have no backend. Everything runs client-side in your browser.

• Chat history stays in your browser's localStorage, scoped per domain. Conversations on example.com are separate from conversations on github.com. Clear a site's localStorage to clear its chat history.
• Settings (model selection, language preference, voice) are stored in localStorage.
• Secrets (custom API keys, if you configure them) are protected by UncloseVault.
• The extension itself stores one boolean value: enabled on/off. That is the only data the extension touches.

No data leaves your browser except the messages you choose to send to the public machine learning endpoints at hermes.ai.unturf.com, qwen.ai.unturf.com, and speech.ai.unturf.com.

Encrypting your chats

UncloseVault encrypts your conversation history, settings, and API keys with AES-256 behind a password you choose. Everything stays in localStorage on your device, encrypted at rest.

How to enable

1. Click the uncloseai. button on any page to open the chat
2. Open Settings (gear icon)
3. Under Vault, click Create Vault
4. Choose a password (minimum 8 characters)
5. Your settings, API keys, and all conversation history are now encrypted

What gets encrypted

• Conversation history — all chat messages, per domain, encrypted before writing to localStorage
• Settings — model, voice, language preferences
• API keys — custom endpoint credentials
• Unsandbox keys — code execution credentials

How it works

• AES-256 encryption via CryptoJS
• Password-derived key with device-specific salt (SHA-256)
• Session persistence across page navigations (encrypted session key in localStorage)
• Plaintext conversations are automatically migrated to encrypted storage when you create or unlock the vault
• Lock the vault at any time from Settings to end your session

Without the vault password, conversation history and settings are unreadable. If you forget your password, the encrypted data cannot be recovered.

Security

The extension code has been audited across 6 security categories with 49 automated tests. Findings: 0 critical, 0 high, 0 medium, 0 low, 3 informational.

• No innerHTML, eval(), document.write, or new Function()
• No network requests from extension code (all networking is in the injected uncloseai.js)
• Minimal permissions: storage only (plus host access for injection)
• Content Security Policy restricts extension pages to script-src 'self'
• Extension stores exactly one value: {enabled: true|false}

Source Code

📦 git.unturf.com/engineering/unturf/uncloseai-browser-toys

Build from source:

git clone https://git.unturf.com/engineering/unturf/uncloseai-browser-toys.git
cd uncloseai-browser-toys
node scripts/build.js   # outputs zips to dist/

Licensed under AGPL-3.0-only.