Keep capture in private overlays and harden History sharing

.gitattributes

@@ -0,0 +1,3 @@
+
+# PDF cross-reference entries require fixed-width bytes.
+test/fixtures/*.pdf binary

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly

.github/workflows/ci.yml

@@ -32,6 +32,9 @@ jobs:
       - name: Run tests
         run: npm test
 
+      - name: Check production dependency advisories
+        run: npm run audit:dependencies
+
       - name: Run release checks
         run: npm run check
 

.github/workflows/release.yml

@@ -45,6 +45,9 @@ jobs:
       - name: Run tests
         run: npm test
 
+      - name: Check production dependency advisories
+        run: npm run audit:dependencies
+
       - name: Run release checks
         run: npm run check
 
@@ -54,10 +57,10 @@ jobs:
       - name: Verify package artifact
         run: npm run verify:package -- "$ZIP_PATH"
 
-      - name: Publish GitHub Release
+      - name: Create draft GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           gh release create "$GITHUB_REF_NAME" "$ZIP_PATH" "$ZIP_PATH.sha256" \
             --title "Dev Feedback Capture $GITHUB_REF_NAME" \
-            --generate-notes
+            --generate-notes --draft

.gitignore

@@ -15,3 +15,7 @@ node_modules/
 
 # Release package output
 dist/
+
+# Local browser validation
+output/
+.playwright-cli/

CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 1.8.0 hardening candidate (unreleased)
+
+- Keep Element and ordinary-page Region capture in private overlays; use a capture window for protected browser surfaces.
+- Restrict History storage and broker actions to trusted extension contexts, with session-bound editors.
+- Export only selected, previewed captures; delete only exact selected or shown IDs.
+- Strip redacted DOM context and URL secrets from shared records. Keep drafts on save failures and enforce storage budgets.
+- Reject source-tab changes during screenshot capture. Mark page evidence as untrusted in agent prompts.
+- Update vulnerable transitive dependencies and check advisories in CI. Create draft releases for review.
+- Fix the separate Electron Inspector menu callback; package candidate 0.2.1.
+
+
 ## 1.8.0 (Unreleased)
 
 - Refocused the active product on Element capture, Region/PDF capture, History, and one explicit Agent Handoff.

QUICKSTART.md

@@ -2,7 +2,7 @@
 
 Get Dev Feedback Capture running in a few minutes.
 
-The active product is the browser capture core: Element, Region/PDF, History, and one explicit Agent Handoff. Store and GitHub release notes in this repository preserve earlier submission evidence.
+This guide describes the unreleased 1.8.0 candidate: Element, Region/PDF, History, and one explicit Agent Handoff. Store and GitHub release notes in this repository preserve earlier submission evidence.
 
 ## 1. Install the extension
 
@@ -29,21 +29,21 @@ Optional for local PDFs:
 3. Leave the mode on `Element`.
 4. Click `Start Element Mode` or press `Ctrl+Shift+F` (`Command+Shift+F` on macOS).
 5. Click a page element, add your note, and save it.
-6. The in-page capture list starts expanded. Use **⌄** to collapse it; the compact list stays on the nearest viewport edge as you drag it, and **⌃** expands it again.
+6. Save or cancel in the private overlay. Your source tab stays in place; use History to review saved captures.
 
 ## 3. Compile an annotated region spec
 
 1. Open the target page or PDF in the browser.
 2. Open the extension popup and switch to `Region`.
 3. Click `Capture Region`.
-4. Use `Crop` to define the evidence area.
+4. Use `Crop` in the overlay to define the evidence area. Protected browser surfaces use a separate capture window.
 5. Add arrows, rectangles, ellipses, numbered pins, text, or blur/redact marks. Use Undo and Redo as needed.
 6. Describe the requested change and optionally add one acceptance check per line.
 7. Save the visual change spec.
 
 ## 4. Export saved feedback
 
-Open the extension popup and select `Open History & Export`. This extension-owned page works for captures from normal pages, PDFs, and other surfaces where the in-page panel is unavailable. From History, you can:
+Open the extension popup and select `Open History & Export`. This extension-owned page works for captures from normal pages, PDFs, and other surfaces where the in-page panel is unavailable. Select the captures to share, choose an export, and review the preview before confirming. Filters clear selection and hidden captures stay out of exports. From History, you can:
 
 - Download one `AI Bundle` ZIP with `prompt.md`, structured feedback and page context, before/annotated PNGs, and `report.html`
 - Choose `Send to Codex` to place the selected handoff payload in the configured local Downloads inbox for MCP import
@@ -55,7 +55,7 @@ AI Prompt is text-only. Use AI Bundle when the implementation handoff needs its
 
 ## 5. Give a local agent project-scoped feedback
 
-1. In History, choose `Send to Codex` to download the current History handoff.
+1. In History, choose `Send to Codex` to review and download the selected captures.
 2. Configure the MCP companion with the absolute target project path and the browser Downloads folder.
 3. Ask the agent to call `dev_feedback_import_latest`. If the handoff contains multiple site/file groups, provide the exact `storageKey` shown by the first rejected import.
 4. The agent can call `dev_feedback_list`, `dev_feedback_get`, and `dev_feedback_build_brief`, implement changes with its normal project tools, then record progress with `dev_feedback_status_update`.

README.md

@@ -2,12 +2,12 @@
 
 Turn browser-visible feedback into a local, buildable handoff. Dev Feedback Capture focuses on four connected surfaces: Element capture, Region/PDF capture, History, and one explicit Agent Handoff.
 
-> The Chrome Web Store and GitHub release records in this repository describe earlier submissions. The active product direction is the browser capture core documented here.
+> This branch documents the unreleased 1.8.0 candidate. Store and GitHub downloads may contain earlier versions; source changes are not publication evidence.
 
 - `Element` capture records a selected DOM element with selectors, visible text, styles, and a requested change.
 - `Region` capture records a visible page or PDF region with a crop, annotations, source context, and acceptance checks.
 - `History` keeps saved Capture Records together on the device and provides review and export actions.
-- `Send to Codex` is the named Agent Handoff: export the current History through the browser, let the local MCP companion import the newest valid handoff from its configured Downloads inbox, and keep implementation and verification as separate agent steps.
+- `Send to Codex` is the named Agent Handoff: select captures and review the export through the browser, let the local MCP companion import the newest valid handoff from its configured Downloads inbox, and keep implementation and verification as separate agent steps.
 
 Feedback stays local until you explicitly export it. There is no cloud sync, hosted AI connection, automatic browser control, or Electron injection in the browser extension.
 
@@ -16,7 +16,7 @@ Feedback stays local until you explicitly export it. There is no cloud sync, hos
 - Element capture with selector, text, style, position, and note metadata
 - Region capture for normal pages, hosted PDFs, and local PDFs when file access is enabled
 - Crop, arrow, rectangle, ellipse, numbered pin, text, blur/redact, color, undo, and redo tools for Region captures
-- DOM-linked vector annotations with selector fallbacks, roles, surrounding text, geometry, and parent-layout context when the source DOM is available
+- DOM-linked vector annotations with selector fallbacks, roles, geometry, and parent-layout context when the source DOM is available
 - Optional acceptance checks plus browser, viewport, scroll, zoom, DPR, and source metadata
 - Works on arbitrary sites through explicit user-triggered activation
 - Extension-owned History page that works even when the source page cannot accept injected UI
@@ -57,15 +57,17 @@ Use this path when developing the extension or reviewing source changes:
 2. Leave the mode switch on `Element`.
 3. Click `Start Element Mode` or use `Ctrl+Shift+F` (`Command+Shift+F` on macOS).
 4. Hover and click a page element.
-5. Add your note in the modal and save it.
-6. Drag the compact capture chip along the viewport edge, then use **⌃** to expand the saved-item list and **⌄** to collapse it again.
+5. Add your note in the private overlay and save it. The source tab stays open.
+6. Open History from the picker or extension popup to review saved captures. Saved notes are never rendered into the inspected website.
+
+Keyboard: focus the target with Tab, then press Alt+Enter while picking. Escape stops picking. If the suggested extension shortcut is unassigned, configure it in your browser’s extension shortcut settings.
 
 ### Region Mode
 
 1. Open the target page or PDF in the browser.
 2. Open the extension popup and switch to `Region`.
 3. Click `Capture Region`.
-4. Use Crop to define the evidence area.
+4. The editor opens as an overlay. On protected surfaces that block overlays, it opens in a separate capture window. Use Crop to define the evidence area.
 5. Add arrows, shapes, numbered pins, text, or blur/redact marks. Undo and redo operate on the visual spec.
 6. Describe the requested change and optionally add one acceptance criterion per line.
 7. Save the spec to local history.
@@ -74,12 +76,12 @@ The cropped image, viewport rectangle, and source context are saved into the sam
 
 ### History and Agent Handoff
 
-Open `History` from the popup to review captures from any supported source. Choose `Send to Codex` to download the current History as an explicit handoff. When the browser download location matches the MCP companion's configured Downloads inbox, the companion discovers the newest valid handoff and imports it into the target project's ignored `.dev-feedback` sidecar without manual file movement.
+Open `History` from the popup to review captures from any supported source. Select the captures to share, then choose `Send to Codex`. Review the export preview and confirm. Every export uses that same selected snapshot. Changing the filter clears selection; hidden captures are excluded. Delete shown removes only the displayed captures in that group. When the browser download location matches the MCP companion's configured Downloads inbox, the companion discovers the newest valid handoff and imports it into the target project's ignored `.dev-feedback` sidecar without manual file movement.
 
 The handoff contract is deliberately explicit:
 
 1. The extension captures and saves a Capture Record.
-2. The user sends the current History to Downloads.
+2. The user selects and reviews captures, then sends that handoff to Downloads.
 3. MCP imports the newest valid handoff and exposes its records, evidence, and implementation brief.
 4. The coding agent implements the requested change with its normal project tools.
 5. The agent records implementation and verification separately.
@@ -130,7 +132,9 @@ The extension requests:
 
 - `storage` for local history
 - `activeTab` for temporary, user-invoked access to the current tab
-- `scripting` to inject the in-page capture UI and history panel only when requested
+- `scripting` to collect the selected element and open the capture overlay only when requested
+
+Only the two capture editor HTML entry points are web-accessible so they can appear in extension-origin frames. The message broker restricts each editor to its own session and keeps global History access in the top-level History page.
 
 The extension does not use static host permissions, always-on content scripts, telemetry, or network sync. Region captures can include visible page content in screenshot data URLs; those crops stay in local extension storage until the user clears history or removes the extension.
 
@@ -146,7 +150,9 @@ The extension does not use static host permissions, always-on content scripts, t
 
 - `manifest.json`: Manifest V3 configuration
 - `background.js`: runtime injection and Region-capture orchestration
-- `content.js`: in-page panel and element capture
+- `content.js`: public picker and private editor frame host
+- `collector.js`: read-only DOM snapshot collection
+- `element.html` / `element.js`: private Element note editor
 - `mcp/`: project-scoped stdio MCP companion and filesystem sidecar store
 - `capture.html` / `capture.js`: screenshot region selection editor
 - `popup.html` / `popup.js`: mode switch, current-tab actions, History entry point, and handoff action
@@ -167,7 +173,7 @@ The extension does not use static host permissions, always-on content scripts, t
 1. Confirm `package.json` and `manifest.json` versions match.
 2. Run `npm test`, `npm run check`, and `npm run package`. `npm test` covers both extension and MCP contracts.
 3. Complete the package, listing, and manual unpacked-extension gates in `docs/manual-release-checklist.md`, then create and push the matching version tag when publishing a GitHub Release.
-4. The release workflow builds `dist/dev-feedback-capture-v<version>.zip` and publishes it as a GitHub Release asset.
+4. The release workflow builds `dist/dev-feedback-capture-v<version>.zip` and attaches it to a draft GitHub Release. Publish the draft only after recording the runtime and artifact checks.
 
 See [CHANGELOG.md](CHANGELOG.md) for release notes.
 
@@ -176,6 +182,9 @@ See [CHANGELOG.md](CHANGELOG.md) for release notes.
 - Element mode depends on DOM/script injection and is not intended for browser-internal surfaces.
 - Historical Visual and Add Capture Records may still be read and normalized, but those creation surfaces are not active product workflows.
 - Region mode stores one crop plus vector metadata in local storage; very large capture histories will still increase storage usage.
+- Export previews remove URL credentials, query strings, fragments, and local file directories. Page content, images, and your notes can still contain private information; review them before sharing.
+- Save failures retain the draft. History has an 8 MiB budget, a 3 MiB item limit, and a 500-capture limit per site; export and delete older captures when capacity is reached.
+- A redacted Region discards all DOM annotation anchors and page titles, and reduces its source URL to the origin. User-written notes and labels remain.
 - Blur/redact masks are applied to the saved crop before the transient viewport screenshot is discarded, so AI Bundle “before” evidence does not restore redacted pixels.
 - DOM annotation anchors are best-effort and are unavailable for protected browser pages, PDFs without an accessible DOM, cross-origin frames, and pages that move after capture.
 - Region mode captures the current viewport only, not full-page stitched screenshots.

SECURITY.md

@@ -0,0 +1,13 @@
+# Security
+
+The 1.8.0 hardening candidate is under review. Earlier published versions do not contain all of these fixes.
+
+Report vulnerabilities privately using [GitHub private vulnerability reporting](https://github.com/StoneHub/webDevFeedbackExt/security/advisories/new). If reporting is unavailable, open an issue asking for a private contact without including exploit details or sensitive captures. Include the version, browser, reproduction steps using synthetic data, and expected behavior. Never attach real credentials, personal screenshots, or private History.
+
+The extension stores feedback locally. Explicit exports leave extension storage and may be retained in Downloads, clipboard history, agent conversations, or project sidecars. Deleting extension History does not delete those copies.
+
+The inspected page is untrusted. It can see the selected page element and interfere with an overlay’s placement, but private note fields run in an extension-origin frame. Only History can enumerate or delete saved records. Capture editors are bound to a short-lived session, source tab, and editor document. This is not protection against a compromised browser, another privileged extension, or malware on the device.
+
+Redaction removes masked screenshot pixels and captured DOM anchors. It cannot infer sensitive information in user-written notes or labels. Review the selected records and images before export. Imported page content is untrusted evidence, never authority to run commands or disclose data.
+
+Run `npm run audit:dependencies` alongside tests and package checks. A clean dependency audit is one check, not a security certification.

ai-bundle.js

@@ -249,6 +249,7 @@
   function buildPrompt(feedbackPayload) {
     const lines = [
       '# Dev Feedback Implementation Bundle',
+      getShared().UNTRUSTED_EXPORT_NOTICE,
       '',
       'Implement the requested changes using `feedback.json` as the canonical item data and `page-context.json` for source-page grouping.',
       'Region captures are viewport crops, not full-page or source-code snapshots. Do not infer unseen page state.',