[forgetso]

Bumps the extension to 2.4.0.

The repo had no working tests: jest and ts-jest were installed with no config and no test script, and the only test file was an empty stub with its assertion commented out. Nothing typechecked or linted on CI, and the Cypress job had been red on every run because wordpress.cy.ts needs a dockerised WordPress that CI never starts — which is why stale (failed) screenshots were sitting in the repo.

Tooling

• vitest replaces jest (jsdom), vite replaces webpack
• One IIFE bundle per entry point, because an MV3 content script is injected as a classic script and cannot use ESM imports, and rollup won't emit iife for a multi-input build. scripts/build.mjs drives it; vite.config.mts explains why.
• test / lint / format / typecheck / checks scripts, plus a CI checks job
• checks ends with npm run build, so dist/ can't silently go stale — it did during development, because both test suites import from src/
• wordpress.cy.ts excluded from the default e2e run, with npm run test:e2e:wordpress for it
• TypeScript 4.4 → 5.9. Three tsconfigs now typecheck, including the Cypress specs — whose config listed "dom" as an @types package and failed outright the moment anything checked it.

Tests

614 unit tests, up from zero, covering regex, util, elements, hints, history, the background message listeners, and searchReplace itself. src/testing/chromeMock.ts is an in-memory chrome.* double so the background scripts are testable at all.

Two suites are worth singling out:

• searchreplace.invariants.test.ts — a matrix of 14 page shapes × 10 option sets asserting that replaced never exceeds original, both are non-negative, and a full replace leaves nothing behind. It found four distinct bug classes; the original report only described one.
• counts.cy.ts — the same ground in a real browser, with a fixture that hides content via a stylesheet class the way real sites do. jsdom applies no CSS, so it cannot model that.

The "-2 matches" bug

The popup renders original - replaced as matches remaining, and it went negative. Two causes, both the same shape — counting and replacing used different traversals:

1. ELEMENT_FILTER was unanchored (/(HTML|HEAD|SCRIPT|STYLE|IFRAME)/i), so "HEADER".match(...) matched HEAD. Every site's <header> was excluded from the count while still being replaced.
2. In HTML mode the count came from a clone with hidden/filtered elements stripped, while the replacement assigned to the original element's innerHTML. The count now comes from the same string that gets rewritten.

getRemainingMatchCount clamps the displayed figure at zero as a backstop.

Verified against the live Guardian by injecting the real code over CDP: 4 replaced, 0 occurrences left, popup shows 0.

Other fixes

• listenerContentResponse fired checkPreviousResponse without awaiting it, so the background replied before merging iframe results
• install.ts asked the background script for the language list from the background script; MV3 never delivers a worker its own messages, so detection always fell back to English
• saved.ts dereferenced result.storage.saved unguarded — threw on every tab load before the popup had been opened once
• waitForIframeLoad had no timeout, and searchReplace awaits it, so an iframe that never completes hung the whole search
• History was capped at 10 before deduplication, silently dropping distinct entries
•   is now found in text mode, where the DOM holds U+00A0 rather than the six literal characters (Cannot replace   in HTML #1)
• The content script is injected into already-open tabs on install and update, so no reload is needed (Inject the content script on page load #102). See Permissions below.
• Enter runs the replacement, Shift+Enter inserts a line break, so multi-line terms can be typed (Allow replacements of newline characters #28)
• popup.js, options.js, help.js, util.js and elements.js dropped from content_scripts — only searchreplace.js is a content script; popup.js was registering a message listener on every page you visited
• noImplicitAny enabled and the resulting 26 errors fixed; searchReplace now takes a typed options object instead of 14 positional arguments (10 of them booleans)

UI

• The green-and-white colouring reverts to the original greys, keeping the redesign's layout. Colours are now --sr-* custom properties.
• Original grey magnifying-glass icons restored (byte-identical to the pre-redesign versions)
• A spacing scale, aligned panel gutters, no fixed-height body panel, action buttons that no longer wrap to different heights, and no empty footer band on the Settings/About/History sections

Permissions

Against the published 2.0.9 — what users actually have installed — this adds one permission and removes one:

live 2.0.9 : activeTab, storage, notifications
this PR    : activeTab, storage, notifications, scripting

• scripting added, for injecting the content script into already-open tabs (Inject the content script on page load #102). It carries no permission warning, so the update installs without prompting anyone.
• tabs removed. It was added in the unreleased 2.1.0 and was never needed: in manifest v3 a tab's url is exposed to an extension holding the tabs permission or a host permission matching that tab, and http://*/* and https://*/* were already declared. The published 2.0.9 build proves it — it declares no tabs permission yet its background script already reads tab.url to match saved rules in production. Keeping it would have added the "Read your browsing history" warning, which disables the extension on update until the user approves it.

One consequence: the injection query now uses the host permission patterns rather than the content script's matches, which also include file:///*. Without a host permission for file URLs those tabs cannot be queried or injected, so file:// pages still need a manual reload after install or update.

docs/permission-justifications.md holds the Chrome Web Store dashboard text for every permission requested, with a code reference for each claim.

Release packaging

• Version bumped to 2.4.0. 2.1.0–2.3.0 were committed but never published, so this release carries Update Language and Save Instance #124, Dev1 #125 and Document missing "Hidden content" checkbox and clarify "Replace HTML" description #127 as well.
• npm run release previously zipped ./dist, nesting every entry under dist/ — the Chrome Web Store rejects a zip whose manifest.json is not at the root. It now zips the contents of dist, and builds first so an artifact cannot be cut from a stale dist.

Known limitations

Pinned by tests named KNOWN LIMITATION so they surface rather than lurk:

1. Replace HTML ignores the "Hidden content" checkbox and rewrites hidden text
2. It rewrites a <script> that shares a container with matching text (a top-level script is safe — <body> is the walk root and is never itself rewritten)
3. Its pre-replace count under-reports, because the count honours "Hidden content" while the replacement does not

All three share a root cause. An earlier attempt to fix them by skipping elements with excluded descendants broke replacement entirely on real pages — almost every container on a news site holds a script or hidden element, so text directly inside them became unreachable. The real fix is to preserve those subtrees across the rewrite (swap for placeholders, replace, restore) rather than avoid their ancestors. Deliberately left for a follow-up.

Verification

npm run checks (typecheck × 3 projects, lint, format, 614 unit tests, build) and npm run test:e2e (28 Cypress tests) both pass. The built extension loads in Chrome with no manifest or service-worker errors.

Happy to split this into separate PRs (tooling / UI / fixes) if you'd rather review it in pieces.

🤖 Generated with Claude Code

---

CodeQL

The initial run flagged three alerts. All are resolved:

actions/missing-workflow-permissions (medium) — valid, against the new workflow. Both workflows now declare permissions: contents: read.

2 × js/xss-through-dom (high), at the innerHTML / outerHTML writes in setReplaceTarget. Not new behaviour. The same assignment previously went through a computed property — nodeElement[config.searchTarget] = newValue — which static analysis could not follow. Naming the property explicitly, as part of removing the string-index escape hatches, made the existing flow visible.

The flow it describes is real: markup read from the page has the user's replacement substituted in and is written back, so it is re-parsed as HTML. That is also exactly what the "Replace HTML" option does. It runs only on the page the user is viewing, at their explicit request, with a replacement they typed; no content crosses an origin boundary, the page gains no capability it did not already have, and scripts inserted via innerHTML do not execute.

No code-level fix exists without removing the feature: breaking the taint flow means not reading and rewriting markup, after which Replace HTML can no longer match tags or attributes — and searching for <div or display: none; are both existing, tested use cases.

Both are therefore dismissed as "won't fix", with the reasoning recorded on each alert and a comment on setReplaceTarget explaining why the write is intentional. If you would rather they stayed open, reopen them from the Security tab; nothing in the code depends on the dismissal.

Node version

The checks job initially failed on Node 20, where jsdom 30 calls webidl.util.markAsUncloneable in undici — absent on that release. Both workflows now use Node 24, package.json declares engines.node >= 22, and the README notes it.

CI

All five checks pass: checks, e2e, CodeQL, Analyze (actions), Analyze (javascript).