feat: Add the new Keepiq browser extension (accounts, unlock, vault browsing)

[SudoThijn]

Summary

First version of the new Keepiq browser extension, built with WXT so one source ships to Chrome (MV3) and Firefox (MV2). It replaces the old extension setup, which is removed together with its tests, docs media and release workflows.

• Accounts and unlock (ext-accounts-and-unlock): add up to 5 accounts with a Nextcloud app password, unlock with the master password, lock and log out per account or all at once. Key material never touches disk.
• Vault browsing (ext-vault-browse): syncs the vault and lists it with search, folder and type filters; copy user name, password or one-time code and open the site.
• Toolbar icon states and badge spec (ext-toolbar-icon), Keepiq app icon.
• English and Dutch translations (ext-i18n), following the browser's language.
• Dev setup: npm run dev launches a browser with the extension loaded, plus a mock login test site.
• Docs: browser-extension/README.md, ARCHITECTURE.md, SECURITY.md and the user guide in docs/browser-extension/using.md. Autofill, generator, send, settings and editing are specced in browser-extension/openspec/changes/ but not built yet.

How to test

cd browser-extension
npm ci
npm run dev            # or: npm run dev:firefox

That's it: a browser opens with the extension already loaded and the test site on http://localhost:8100.

1. Open the Keepiq web app once and set a master password (if you haven't already).
2. In Nextcloud, create an app password under Settings → Security.
3. Click the Keepiq icon in the toolbar and add an account: your server URL, username and the app password. https is required, except for localhost, 127.0.0.1 and *.test.
4. Unlock with your master password.
5. Browse the Vault tab: search, filter by folder or type, copy a field.

The dev profile is kept in browser-extension/.wxt/chrome-data, so the account survives restarts.

Checks

• ✅ npm test (457 tests), npm run typecheck, npm run lint, npm run build and npm run build:firefox pass locally

Test plan

• CI passes
• Add an account, unlock, browse and copy in Chrome and Firefox
• Lock, unlock again and log out

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/keepiq @ 5c3083c

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
format		❌
check-l10n-js		✅
check-schema-l10n		✅
composer			✅	✅ 114/114
npm			✅	✅ 660/660
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					✅ 2130/2130 · 3 skipped
Newman					✅ 177/177 · 20 skipped
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-09 08:08 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/keepiq @ 282e84b

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
format		❌
check-l10n-js		✅
check-schema-l10n		✅
composer			✅	✅ 114/114
npm			✅	✅ 660/660
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					✅ 2130/2130 · 3 skipped
Newman					✅ 177/177 · 20 skipped
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-09 08:36 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/keepiq @ 8534540

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
format		❌
check-l10n-js		✅
check-schema-l10n		✅
composer			✅	✅ 114/114
npm			✅	✅ 660/660
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					✅ 2130/2130 · 3 skipped
Newman					✅ 177/177 · 20 skipped
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-12 10:24 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/keepiq @ 475b86f

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
format		❌
check-l10n-js		✅
check-schema-l10n		✅
composer			✅	✅ 114/114
npm			✅	✅ 660/660
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					✅ 2130/2130 · 3 skipped
Newman					✅ 177/177 · 20 skipped
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-12 12:14 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/keepiq @ c988b29

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
format		❌
check-l10n-js		✅
check-schema-l10n		✅
composer			✅	✅ 114/114
npm			✅	✅ 660/660
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					✅ 2136/2136 · 3 skipped
Newman					✅ 177/177 · 20 skipped
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-12 13:10 UTC

Download the full PDF report from the workflow artifacts.

[remko48]

Verdict: REQUEST CHANGES (Standard)

The new WXT extension is carefully built where it matters most. The KDF, envelope and RSA chunking match the web app byte for byte, the key lives in storage.session only, there is a guard for an unlock racing a logout, and API calls run from the background with credentials: 'omit'. Two things block the merge: one breaks an existing Keepiq security requirement, and one is the PR's own red CI. Each finding is an inline comment below, except the one about commit messages, which has no line to anchor on.

• 🔴 Blocker — The extension ignores useOnly, so it shows and copies the value of use-only shares (inline, ItemCard.tsx)
• 🔴 Blocker — The PR's own edit to crypto-vectors-kotlin.spec.js fails prettier, so CI is red (inline)
• 🟡 Concern — A content script that does nothing yet asks for every website at install (inline, content.ts)
• 🟡 Concern — The repo's records still describe the deleted extension (inline, tests/server/setup.sh)
• 🟡 Concern — The Firefox add-on ID changes to a personal handle (inline, wxt.config.ts)
• 🟡 Concern — No commit on the branch follows the Conventional Commit format (below)
• 🟢 Minor — The store description promises features this version lacks (inline, locales/en.yml)
• 🟢 Minor — Copied passwords are never cleared (inline, clipboard.ts)

🟡 Concern — No commit on the branch follows the Conventional Commit format

All 26 commits lack a type prefix, for example "replaced old bad setup with my setup", "updated claude.md" and "Implement accounts, unlock and lock (ext-accounts-and-unlock)". The PR is merged with a merge commit, so these enter history as they are, and the feat: title never becomes a commit.

Impact: the feature gets no version bump or changelog entry, and history keeps messages like "my setup".

Suggested fix: reword or squash on the branch before merging.

What was verified

• Read the full diff outside browser-extension/: workflows, root package.json, vitest.config.js, vectors, and the move of tests/server.
• Read the extension's core: src/crypto/*, src/vault/{key-store,unlock,sync,timeout,store,match,url}.ts, src/accounts/*, src/api/client.ts, src/background/*, src/clipboard.ts, the entrypoints, wxt.config.ts, package.json and .npmrc.
• Checked that the KDF (PBKDF2-SHA256, 600k iterations) and the envelope layout match src/crypto/aes.js and src/crypto/envelope.js.
• Ran the Hydra gates on feature/browser-extension (52c3754): 85 of 86 applicable gates green. Gate 4 (composer-audit) did not run.
• Reproduced the prettier failure locally, and read the logs of the failing CI jobs.

Not run or not reviewed

• The extension's npm test, typecheck, lint and builds. I relied on the green check-and-build CI job.
• Loading the extension in Chrome or Firefox. Chrome's permissions.contains behaviour with content-script matches is reasoned, not tested.
• The popup UI components, popup.css, the test files, the nested openspec/ documents and the committed .claude/ skills, beyond spot checks.
• The failing ios job (mobile-e2e accessibility audit). It ran because tests/server/** changed. I assume it is unrelated to this diff, but did not confirm that.

[remko48]

🟡 Concern — A content script that does nothing yet asks for every website at install

This matches *://*/*, and today it only sends page_ready, which the background drops. Content-script matches count as host access, so Chrome and Firefox show "read and change all your data on all websites" at install. That cancels the per-server grant ADR-003 designs around (optional_host_permissions in wxt.config.ts). I also expect Chrome to count those matches as granted hosts, which would make the permissions.contains guard in src/background/router.ts:49 always pass. I reasoned this from the diff and did not reproduce it.

Impact: a wider install prompt and a harder store review than this version needs, and the "nothing is sent to a server the user declined" check may no longer check anything.

Suggested fix: leave the content script out until ext-autofill ships, or register it at runtime (registration: 'runtime') once the user grants it.

[SudoThijn]

We're keeping the content script as it is, on purpose.

ext-autofill needs it. If we leave it out now and add it later, everyone who already installed the extension suddenly gets a new "all websites" permission prompt on an update, which looks far more suspicious than asking once at install. This version also isn't going to be published as it is.

On the guard: we checked the browser sources, and permissions.contains still reflects the user's per-server grant on both builds.

• Chrome MV3: PermissionsContainsFunction::Run (extensions/browser/api/permissions/permissions_api.cc) requires explicit_hosts to contain the origin, and UnpackOriginPermissions puts our origin in optional_explicit_hosts. Content-script matches only ever become scriptable_hosts, so contains is false until the user grants the server.
• Firefox MV2: contains checks extension.allowedOrigins (toolkit/components/extensions/parent/ext-permissions.js), which holds manifest host permissions (none), the extension's own URL and optional origins the user granted. Content-script matches are never added.

One caveat: in Firefox MV3 the install-time origins do include content-script matches, so the guard would need another look if Firefox ever moves to MV3. Today it builds as MV2.

[remko48]

🟡 Concern — The repo's records still describe the deleted extension

The test server moved here from browser-extension/capture, but "Remove references to the old browser extension" (321f529) missed these:

• mobile/README.md:97,100 and mobile/e2e/server.mjs:9,44 still point to browser-extension/capture. mobile/README.md:41 runs tests/vitest/autofill-vectors.spec.js, which this PR deletes.
• openspec/parity/capabilities.json (around lines 1396, 2364, 3804, 6632 and 8702) still cites deleted files as evidence that passkey creation, biometric unlock, use-only fill and the store release are delivered.
• Open root changes (clients-extension-firefox-and-safari-builds, vault-website-addresses task 1.5, health-site-security-checks task 3.1) have tasks against browser-extension/src/lib/match.js and build.mjs, which no longer exist.
• The Kotlin core names the deleted JS as its reference implementation (SiteMatch.kt, PinUnlock.kt, ItemCodec.kt, …). crypto-vectors-kotlin.spec.js still has a describe block "passkeys between the phone and the browser extension".

Impact: the parity record claims features that no longer exist in any browser client, and the mobile README commands fail.

Suggested fix: downgrade the affected entries in capabilities.json, fix the mobile README and server.mjs paths, and decide whether the open root changes move to the new extension's specs or close.

[SudoThijn]

Partly fixed, partly left on purpose.

• Fixed in 159fb53 (and 0689bce): openspec/parity/capabilities.json no longer cites the deleted extension. All 21 dead evidence paths are gone, and the browser rows are rated on what the new extension does: autofill, TOTP fill, passkeys, generator and send are back to specified against their ext-* changes, and use-only, unlock and browsing are partial where only part ships.
• Left as is: the mobile and Kotlin references. The mobile apps have nothing to do with the browser extension, so this PR changes only what their tests need, which is nothing: mobile-e2e.yml and standalone.yml already use tests/server, and the android and ios jobs pass. The leftovers are comments and README notes, not something that runs.
• Left as is: the open root changes. They belong to the old extension's work and get resolved as the new extension's specs take over those slices.

[remko48]

🟢 Minor — The store description promises features this version lacks

This text (also in package.json) says "Fill in logins, passkeys and one-time codes on any site, and save new ones as you go". This version only browses and copies.

Impact: store reviewers treat a description that overclaims as misleading.

Suggested fix: describe what ships now, and widen the text with ext-autofill.

[SudoThijn]

We're keeping the promise in this text on purpose. The store description is marketing for the product, not a changelog of what this build does, and we don't want to rewrite it every time a feature lands. This version also won't go to a store as it is.

Your comment did surface a real problem: the text was 248 characters (255 in Dutch), and Chrome caps the manifest description at 132. 5543af4 shortens it to 117 in both languages with the same message: "Keepiq for your browser. Fill in logins, passkeys and one-time codes from your Nextcloud vault, end-to-end encrypted."

[github-actions]

Quality Report — ConductionNL/keepiq @ dd28a4d

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
format		❌
check-l10n-js		✅
check-schema-l10n		✅
composer			✅	✅ 114/114
npm			✅	✅ 660/660
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					✅ 2321/2321 · 3 skipped
Newman					✅ 177/177 · 20 skipped
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-15 15:09 UTC

Download the full PDF report from the workflow artifacts.

[SudoThijn]

@remko48 on the commit-message concern from your review: every commit on the branch now follows the Conventional Commit format, merges included. Only the messages were rewritten (force-pushed); the trees and the merges from development are identical, so nothing in the diff changed.

[github-actions]

Quality Report — ConductionNL/keepiq @ a7ce2c2

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
format		✅
check-l10n-js		✅
check-schema-l10n		✅
composer			✅	✅ 114/114
npm			✅	✅ 660/660
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					✅ 2321/2321 · 3 skipped
Newman					✅ 177/177 · 20 skipped
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-16 08:27 UTC

Download the full PDF report from the workflow artifacts.

[remko48]

Verdict: APPROVE (Standard, re-review round 1)

Re-reviewed at 0689bce. Both blockers are fixed, with tests. Of the other findings, three are fixed, and three were declined or partly declined with reasons I can accept. Two small points remain as inline comments, and neither holds the PR.

Fixed

• 🔴 Use-only values (70abe72, 5966797, 0689bce): the background now enforces the rule. item.decrypt answers use_only for any field beyond login (USE_ONLY_FIELDS), and a batch leaves the row out. The card offers only "Copy username", and the detail shows the login, the site and a note, with no TOTP code or payload. useOnly does reach the snapshot: OfflineManifestService spreads $secret->jsonSerialize(), which carries it. Tests cover the refusal, the batch, toItemMeta and both views. The updatedAt gap for a share switched to use-only later is documented in SECURITY.md. It would help to link the server-side follow-up issue from there once it exists.
• 🔴 Prettier (525aea2): the format check is green.
• 🟡 Firefox ID (a3ce65f): keepiq@conduction.nl again.
• 🟡 Commit messages: all 25 branch commits are now Conventional Commits. I checked the rewrite: the rewritten pre-merge commit fbd4bf2c has the same tree as the reviewed 52c3754, and the merge from development (533059f) matches git's automatic resolution exactly.
• 🟢 Clipboard (f9ab717): 30 seconds by default, and 0 means Never. Each copy now replaces the pending clear, which also fixes an earlier clear wiping a newer copy.
• 🟡 Parity record (159fb53): capabilities.json is valid JSON and no longer cites any deleted extension file.

Accepted as left

• 🟡 Content script on *://*/*: the reasoning holds. Adding host access in a later update would disable the extension in Chrome until the user approves the new permission, which is worse than asking once at install. The source walk-through of permissions.contains (explicit hosts vs scriptable hosts in Chrome, allowedOrigins in Firefox MV2) answers my doubt about the guard.
• 🟢 Store description: fine as product copy, given this build won't go to a store as it is. The cut to 117 characters (Chrome caps it at 132) was a real catch.
• 🟡 Open root changes: fine to resolve them as the ext-* specs take over.

Remaining (inline)

• 🟢 Minor — The mobile README still points at paths this PR removed (on tests/server/compose.yaml)
• 🟢 Minor — The Firefox MV3 caveat on the permission guard exists only in this thread (on router.ts)

What was verified

• Read the full diff of the 9 fix commits (533059f..0689bce), including the new tests.
• Checked that the force-push only changed messages (same tree) and that the merge from development was clean.
• Hydra gates on 0689bce: 85 of 86 applicable gates green. Gate 4 (composer-audit) did not run.
• CI on 0689bce is green, including the android, ios and format jobs.

Not run

• The extension's own tests and builds were not run locally, and it was not loaded in a browser.
• The Chromium and Firefox source citations on permissions.contains were taken as given, not checked against the sources.

[remko48]

🟢 Minor — The mobile README still points at paths this PR removed

This file moved here from browser-extension/capture/compose.yaml, but mobile/README.md:97,100 and mobile/e2e/server.mjs:9,44 still name the old path. mobile/README.md:41 still lists tests/vitest/autofill-vectors.spec.js, which this PR deletes. These aren't code, but a developer who follows the README gets a missing file.

Suggested fix: a one-line path swap in each place. It can go in a follow-up if you'd rather keep this PR to the extension.

[remko48]

🟢 Minor — The Firefox MV3 caveat on the permission guard exists only in this thread

This guard holds because Firefox builds MV2. If Firefox moves to MV3, its install-time origins would include the content-script matches (your note on the content.ts thread), and contains would pass for every server.

Suggested fix: add a short comment next to the guard, so whoever switches the manifest version sees it.