sessionStorage was per-tab which forced re-entering the password on
every new tab to the same site. localStorage is scoped per-origin
which is the right granularity. The lock button clears the session
from localStorage when the user wants to end their session.
Each tab now requires its own password unlock. Navigating within a tab
preserves the session (sessionStorage survives navigation). Closing the
tab or opening a new tab requires re-entering the password. Previously
the session was in localStorage, shared across all tabs indefinitely.
Lock button was not properly securing the UI:
- decrypted chat messages stayed in DOM behind the vault gate
- vault gate had no background in base CSS (transparent when no theme set)
- settings content and input area remained visible after locking
- container lacked position:relative for proper gate overlay scoping
- add v1.0.0 release link and inline SHA-256 checksums
- update storage/privacy section to reflect mandatory vault encryption
- replace optional vault setup steps with first launch and returning flows
- add per-site vault and releases page link
window.sendMessage, window.handleUserInput, window.speakText etc
were overwriting host page functions with the same names. This broke
OpenCompletion chat (sendMessage clobbered). Now all exports live
under window.uncloseai namespace. Only uniquely-named globals
(UncloseVault, toggleUncloseaiEmbeddedModal, openTTSModal, etc)
remain on window directly for internal cross-module compat.
Vault password prompt is now the first thing shown when opening
uncloseai. No chat, no greeting, no data written until the user
creates or unlocks their vault. Each site has its own vault with
AES-256 encryption using password + device-specific salt.
- Add vault gate overlay blocking modal until password entered
- Remove plaintext conversation fallback from storage.js
- Route TTS mode, selected voice, language through vault
- Route custom API config reads through vault in models.js
- Add vault gate i18n strings (26 languages) explaining per-site
encryption of chat history, API keys, and settings
- Add missing keys to migration (voice, TTS mode)
- Re-show vault gate on lock from settings
- Permacomputer headers across all source files
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
browser-toys.html: new "Encrypting your chats" section documenting UncloseVault
AES-256 encryption of conversations, settings, and API keys. How to enable,
what gets encrypted, how it works, automatic plaintext migration.
page-intelligence.js: deterministic page analysis (zero API calls) extracting
structured data, heading outline, reading metrics, readability score, code
detection, link topology, media inventory, forms, tables, entity patterns.
Integrated into greeting flow alongside LLM classification.
for known dynamic pages (GitLab CI jobs), fetch the raw/plain text
endpoint instead of scraping a half-loaded DOM. falls back to DOM
extraction with a MutationObserver settle wait when raw isn't accessible.
extractWebpageContent is now async, all callers updated.
