fitPageContent() in content.js: 6 progressive collapse stages (dedup,
nav links, references, lists, code blocks, sidebar debris) before hard
truncation. No summarization, real content structurally compressed.
Wired into both page extraction points in embed modal.
Added .working pulse and .uncloseai-spinner CSS animations for #004.
Updated tickets #001 (CSP root cause), #004 (CSS ready), #005 (fixed).
TTS disabled by default for all users (tickets #002 freeze, #003 truncation).
Embedders re-enable with window.UNCLOSEAI_ENABLE_TTS = true.
Floating button bottom 20px to 141px to avoid overlapping page buttons.
Added docs/tickets/ with 5 issues from cthegray.
Bundle extension script and biome config updates.
sessionStorage was per-tab which forced re-entering the password on
every new tab to the same site. localStorage is scoped per-origin
which is the right granularity. The lock button clears the session
from localStorage when the user wants to end their session.
Each tab now requires its own password unlock. Navigating within a tab
preserves the session (sessionStorage survives navigation). Closing the
tab or opening a new tab requires re-entering the password. Previously
the session was in localStorage, shared across all tabs indefinitely.
Lock button was not properly securing the UI:
- decrypted chat messages stayed in DOM behind the vault gate
- vault gate had no background in base CSS (transparent when no theme set)
- settings content and input area remained visible after locking
- container lacked position:relative for proper gate overlay scoping
- add v1.0.0 release link and inline SHA-256 checksums
- update storage/privacy section to reflect mandatory vault encryption
- replace optional vault setup steps with first launch and returning flows
- add per-site vault and releases page link
window.sendMessage, window.handleUserInput, window.speakText etc
were overwriting host page functions with the same names. This broke
OpenCompletion chat (sendMessage clobbered). Now all exports live
under window.uncloseai namespace. Only uniquely-named globals
(UncloseVault, toggleUncloseaiEmbeddedModal, openTTSModal, etc)
remain on window directly for internal cross-module compat.
Vault password prompt is now the first thing shown when opening
uncloseai. No chat, no greeting, no data written until the user
creates or unlocks their vault. Each site has its own vault with
AES-256 encryption using password + device-specific salt.
- Add vault gate overlay blocking modal until password entered
- Remove plaintext conversation fallback from storage.js
- Route TTS mode, selected voice, language through vault
- Route custom API config reads through vault in models.js
- Add vault gate i18n strings (26 languages) explaining per-site
encryption of chat history, API keys, and settings
- Add missing keys to migration (voice, TTS mode)
- Re-show vault gate on lock from settings
- Permacomputer headers across all source files
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
browser-toys.html: new "Encrypting your chats" section documenting UncloseVault
AES-256 encryption of conversations, settings, and API keys. How to enable,
what gets encrypted, how it works, automatic plaintext migration.
page-intelligence.js: deterministic page analysis (zero API calls) extracting
structured data, heading outline, reading metrics, readability score, code
detection, link topology, media inventory, forms, tables, entity patterns.
Integrated into greeting flow alongside LLM classification.
