From 8052c87c230568bc0efd7c988de243c9a4ca3dc4 Mon Sep 17 00:00:00 2001 From: golem Date: Sun, 18 Oct 2026 02:27:54 -0600 Subject: [PATCH] chore: prepare the 1.2.0 release Version 1.2.0 (manifest "1.2"): the release adds features without breaking changes, and 1.1.0 already exists in the changelog. The lockfile's root version, still 1.0.0, moves with it. Turn Unreleased into the 1.2.0 section, fold in the unheaded bullets beneath it, add the template-limit entry, note that 1.1.0 never reached addons.mozilla.org, and fix the stray ")" in the 1.0.0 heading. The manifest description now covers the menu, toolbar button and shortcut. Record in the design spec that ChatGPT auto-submits ?q= prompts again as of 2026-10-18, and what that means for Appendix B's selection-smuggling argument. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 26 ++++++++++-------- .../2026-07-29-extension-options-design.md | 27 ++++++++++++++++++- manifest.json | 4 +-- package-lock.json | 4 +-- package.json | 2 +- 5 files changed, 46 insertions(+), 17 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 08b2120..c2587e8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,10 +2,14 @@ All notable changes to this project will be documented in this file. See [commit-and-tag-version](https://github.com/absolute-version/commit-and-tag-version). -## Unreleased +## [1.2.0] (2026-10-18) + +The first update on addons.mozilla.org since 1.0. It also delivers everything +in 1.1.0, which was never published there. - Add an Ask ChatGPT toolbar button: use selected text or open a blank chat, honoring saved prompt and tab/window preferences. No new permissions. + Requires Firefox 112 or newer, like the other new entry points. - Add Off / Simple / Advanced context-menu modes with migration from the old visibility preference. Advanced provides selection presets and link/page URL actions, with optional translation and a preferred language or language dialog. @@ -15,15 +19,15 @@ All notable changes to this project will be documented in this file. See [commit model/effort URL probe, and document URL sharing. No new permissions. - Show up front, in the options panel and README, that ChatGPT may require signing in and that an unsent prompt needs Enter or Send. - - - * Options instructions now show the configured keyboard shortcut, update when - it changes, and indicate when no shortcut is assigned. Added a button to - open Firefox’s shortcut editor where supported. - * Shortened the context menu label to “Ask ChatGPT”. - * Added quick usage instructions and guidance for changing the search keyword - and default engine in Firefox to the options panel. - * Added a “Feedback or report a bug” link to the options panel and README. +- Limit the prompt template to 1,000 characters, so an oversized template can + no longer stop every other setting from saving. +- Show the configured keyboard shortcut in the options instructions, updating + when it changes and indicating when none is assigned, with a button to open + Firefox’s shortcut editor where supported. +- Shorten the context menu label to “Ask ChatGPT”. +- Add quick usage instructions and guidance for changing the search keyword + and default engine in Firefox to the options panel. +- Add a “Feedback or report a bug” link to the options panel and README. ## [1.1.0] (2026-07-30) @@ -44,7 +48,7 @@ Adds an options panel and two new ways to reach ChatGPT. * Permissions added: storage, menus, activeTab. None of them adds a line to Firefox's install prompt. -## [1.0.0]) (2024-06-09) +## [1.0.0] (2024-06-09) First release of software. diff --git a/docs/superpowers/specs/2026-07-29-extension-options-design.md b/docs/superpowers/specs/2026-07-29-extension-options-design.md index aa7279b..d353253 100644 --- a/docs/superpowers/specs/2026-07-29-extension-options-design.md +++ b/docs/superpowers/specs/2026-07-29-extension-options-design.md @@ -96,6 +96,21 @@ send. The hypothesis that address-bar navigation might still be favoured (`Sec-Fetch-Site: none` being the most-trusted value) **does not hold in practice**. +**Correction, 2026-10-18: `q` auto-submits again.** +- **Signed out:** in headless Firefox 157, `chatgpt.com/?q=` sent the prompt + and ChatGPT answered with no keypress. This happened even when an unrelated + page navigated to the URL (`Sec-Fetch-Site: cross-site`). +- **Maintainer's Firefox:** the same day, the maintainer reported that prompts + were sent without pressing Enter. +- **A week earlier:** on 2026-10-12 the signed-out path showed a verification + error and the signed-in path still needed Enter + (`docs/toolbar-verification.md`). + +So this changed within a week and may differ between accounts. Treat both +behaviours as possible. The copy rule below still applies, and the README +already says ChatGPT decides whether a prompt is sent. Appendix B covers what +this means for selection smuggling. + No copy in the options panel, README, or AMO listing may say the query is *searched*, *sent*, or *asked* — only that ChatGPT opens **with the query filled in**. The two-keypress behaviour is an upstream ChatGPT change, not a defect in @@ -698,7 +713,7 @@ by running commands against copies under `/tmp`; the repo itself was unmodified. | Parameter | Rating | Basis | |---|---|---| | `q` prefills | **Solid** | Dated 2026 sources; maintained tooling; OpenAI's own extension uses it; a live probe returned HTTP 200 with all parameters preserved. | -| `q` auto-submits | **Refuted, and confirmed by first-hand test** | Prefill-only in every dated report since 2025-11-11. Tenable TRA-2025-22 documents OpenAI gating auto-submit on `Sec-Fetch-Site`. Reproduced 2026-07-29 in the maintainer's logged-in Firefox via this extension's own search-provider path. | +| `q` auto-submits | **Varies; auto-submitting again as of 2026-10-18** | Prefill-only in every dated report from 2025-11-11, when Tenable TRA-2025-22 documented OpenAI gating auto-submit on `Sec-Fetch-Site`, and reproduced 2026-07-29 in the maintainer's logged-in Firefox. On 2026-10-18 it auto-submitted signed out, including after a cross-site navigation, and the maintainer reported the same in their own Firefox. See the correction under the `q` section. | | `model` honoured alongside `q` | **Uncertain** | An unresolved 2024-12-28 report says `q` forces GPT-4o regardless; counter-evidence exists from 2024–2025; no 2026 source positively confirms. Maintained tooling grades it experimental. | | Valid `model` slugs | **Uncertain** | No authoritative list; sightings rot (`gpt-4`, `o1-preview`, `gpt-4o`, `gpt-5-thinking`, `auto`, `instant`, `thinking`). | | `temporary-chat=true` | **Uncertain** | Community-confirmed originally; multiple reports of it not applying or reverting after the first message; OpenAI reworking the feature. | @@ -790,6 +805,16 @@ composer until a human presses Enter. **Auto-submit deletes that checkpoint.** This is also why the context menu and shortcut remain safe *as long as they only prefill*. +> **2026-10-18:** ChatGPT itself now auto-submits `?q=` prompts, at least for +> some accounts (see the correction under the `q` section). While that holds, +> the composer checkpoint above is gone for the context menu, toolbar button and +> shortcut alike: hidden text in a selection can reach an answered prompt +> without review. The extension still adds no submission of its own, and this +> appendix's rejection stands. 1.2.0 ships with the behaviour known. Possible +> mitigations, such as framing the default Ask prompt as data the way the preset +> actions already do, or an option to review page-sourced text first, are open +> follow-ups rather than part of this design. + **`webNavigation.transitionType` is not a security boundary.** The signal looks right — a `gpt` search emits `transitionType: "generated"` with `transitionQualifiers: ["from_address_bar"]`, and content cannot forge those diff --git a/manifest.json b/manifest.json index 715e2f8..8595b0f 100644 --- a/manifest.json +++ b/manifest.json @@ -1,10 +1,10 @@ { "name": "Search with ChatGPT powered by OpenAI!", - "description": "Adds a ChatGPT search engine", + "description": "Adds a ChatGPT search engine, plus a right-click menu, toolbar button and shortcut that open ChatGPT with your selected text.", "manifest_version": 2, "author": "Mathew Guest ", "homepage_url": "https://zavage-software.com/portfolio/search-with-ChatGPT", - "version": "1.1", + "version": "1.2", "icons": { "16": "icons/powered-by-openai-icon-16x16.png", "32": "icons/powered-by-openai-icon-32x32.png", diff --git a/package-lock.json b/package-lock.json index c7168c2..cef58a6 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "search-with-chatgpt-powered-by-openai-extension", - "version": "1.0.0", + "version": "1.2.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "search-with-chatgpt-powered-by-openai-extension", - "version": "1.0.0", + "version": "1.2.0", "devDependencies": { "web-ext": "10.5.0" }, diff --git a/package.json b/package.json index a865b96..0ad6b9f 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "search-with-chatgpt-powered-by-openai-extension", - "version": "1.1.0", + "version": "1.2.0", "private": true, "type": "module", "description": "Development tooling for the Search with ChatGPT Firefox extension.",