Merge pull request 'chore: prepare the 1.2.0 release' (#13) from chore/release-1.2.0 into develop

Reviewed-on: https://git.zavage.net/Zavage-Software/search-with-chatgpt-powered-by-openai-extension/pulls/13

CHANGELOG.md

@@ -2,10 +2,14 @@
 
 All notable changes to this project will be documented in this file. See [commit-and-tag-version](https://github.com/absolute-version/commit-and-tag-version).
 
-## Unreleased
+## [1.2.0] (2026-10-18)
+
+The first update on addons.mozilla.org since 1.0. It also delivers everything
+in 1.1.0, which was never published there.
 
 - Add an Ask ChatGPT toolbar button: use selected text or open a blank chat,
   honoring saved prompt and tab/window preferences. No new permissions.
+  Requires Firefox 112 or newer, like the other new entry points.
 - Add Off / Simple / Advanced context-menu modes with migration from the old
   visibility preference. Advanced provides selection presets and link/page URL
   actions, with optional translation and a preferred language or language dialog.
@@ -17,15 +21,15 @@ All notable changes to this project will be documented in this file. See [commit
   model/effort URL probe, and document URL sharing. No new permissions.
 - Show up front, in the options panel and README, that ChatGPT may require
   signing in and that an unsent prompt needs Enter or Send.
-
-
- * Options instructions now show the configured keyboard shortcut, update when
-   it changes, and indicate when no shortcut is assigned. Added a button to
-   open Firefox’s shortcut editor where supported.
- * Shortened the context menu label to “Ask ChatGPT”.
- * Added quick usage instructions and guidance for changing the search keyword
+- Limit the prompt template to 1,000 characters, so an oversized template can
+  no longer stop every other setting from saving.
+- Show the configured keyboard shortcut in the options instructions, updating
+  when it changes and indicating when none is assigned, with a button to open
+  Firefox’s shortcut editor where supported.
+- Shorten the context menu label to “Ask ChatGPT”.
+- Add quick usage instructions and guidance for changing the search keyword
   and default engine in Firefox to the options panel.
- * Added a “Feedback or report a bug” link to the options panel and README.
+- Add a “Feedback or report a bug” link to the options panel and README.
 
 ## [1.1.0] (2026-07-30)
 
@@ -46,7 +50,7 @@ Adds an options panel and two new ways to reach ChatGPT.
  * Permissions added: storage, menus, activeTab. None of them adds a line to
    Firefox's install prompt.
 
-## [1.0.0]) (2024-06-09)
+## [1.0.0] (2024-06-09)
 
 First release of software.
 

docs/superpowers/specs/2026-07-29-extension-options-design.md

@@ -96,6 +96,21 @@ send. The hypothesis that address-bar navigation might still be favoured
 (`Sec-Fetch-Site: none` being the most-trusted value) **does not hold in
 practice**.
 
+**Correction, 2026-10-18: `q` auto-submits again.**
+- **Signed out:** in headless Firefox 157, `chatgpt.com/?q=` sent the prompt
+  and ChatGPT answered with no keypress. This happened even when an unrelated
+  page navigated to the URL (`Sec-Fetch-Site: cross-site`).
+- **Maintainer's Firefox:** the same day, the maintainer reported that prompts
+  were sent without pressing Enter.
+- **A week earlier:** on 2026-10-12 the signed-out path showed a verification
+  error and the signed-in path still needed Enter
+  (`docs/toolbar-verification.md`).
+
+So this changed within a week and may differ between accounts. Treat both
+behaviours as possible. The copy rule below still applies, and the README
+already says ChatGPT decides whether a prompt is sent. Appendix B covers what
+this means for selection smuggling.
+
 No copy in the options panel, README, or AMO listing may say the query is
 *searched*, *sent*, or *asked* — only that ChatGPT opens **with the query filled
 in**. The two-keypress behaviour is an upstream ChatGPT change, not a defect in
@@ -698,7 +713,7 @@ by running commands against copies under `/tmp`; the repo itself was unmodified.
 | Parameter | Rating | Basis |
 |---|---|---|
 | `q` prefills | **Solid** | Dated 2026 sources; maintained tooling; OpenAI's own extension uses it; a live probe returned HTTP 200 with all parameters preserved. |
-| `q` auto-submits | **Refuted, and confirmed by first-hand test** | Prefill-only in every dated report since 2025-11-11. Tenable TRA-2025-22 documents OpenAI gating auto-submit on `Sec-Fetch-Site`. Reproduced 2026-07-29 in the maintainer's logged-in Firefox via this extension's own search-provider path. |
+| `q` auto-submits | **Varies; auto-submitting again as of 2026-10-18** | Prefill-only in every dated report from 2025-11-11, when Tenable TRA-2025-22 documented OpenAI gating auto-submit on `Sec-Fetch-Site`, and reproduced 2026-07-29 in the maintainer's logged-in Firefox. On 2026-10-18 it auto-submitted signed out, including after a cross-site navigation, and the maintainer reported the same in their own Firefox. See the correction under the `q` section. |
 | `model` honoured alongside `q` | **Uncertain** | An unresolved 2024-12-28 report says `q` forces GPT-4o regardless; counter-evidence exists from 2024–2025; no 2026 source positively confirms. Maintained tooling grades it experimental. |
 | Valid `model` slugs | **Uncertain** | No authoritative list; sightings rot (`gpt-4`, `o1-preview`, `gpt-4o`, `gpt-5-thinking`, `auto`, `instant`, `thinking`). |
 | `temporary-chat=true` | **Uncertain** | Community-confirmed originally; multiple reports of it not applying or reverting after the first message; OpenAI reworking the feature. |
@@ -790,6 +805,16 @@ composer until a human presses Enter. **Auto-submit deletes that checkpoint.**
 This is also why the context menu and shortcut remain safe *as long as they only
 prefill*.
 
+> **2026-10-18:** ChatGPT itself now auto-submits `?q=` prompts, at least for
+> some accounts (see the correction under the `q` section). While that holds,
+> the composer checkpoint above is gone for the context menu, toolbar button and
+> shortcut alike: hidden text in a selection can reach an answered prompt
+> without review. The extension still adds no submission of its own, and this
+> appendix's rejection stands. 1.2.0 ships with the behaviour known. Possible
+> mitigations, such as framing the default Ask prompt as data the way the preset
+> actions already do, or an option to review page-sourced text first, are open
+> follow-ups rather than part of this design.
+
 **`webNavigation.transitionType` is not a security boundary.** The signal looks
 right — a `gpt` search emits `transitionType: "generated"` with
 `transitionQualifiers: ["from_address_bar"]`, and content cannot forge those

manifest.json

@@ -1,10 +1,10 @@
 {
   "name": "Search with ChatGPT powered by OpenAI!",
-  "description": "Adds a ChatGPT search engine",
+  "description": "Adds a ChatGPT search engine, plus a right-click menu, toolbar button and shortcut that open ChatGPT with your selected text.",
   "manifest_version": 2,
   "author": "Mathew Guest <mat@zavage.net>",
   "homepage_url": "https://zavage-software.com/portfolio/search-with-ChatGPT",
-  "version": "1.1",
+  "version": "1.2",
   "icons": {
     "16": "icons/powered-by-openai-icon-16x16.png",
     "32": "icons/powered-by-openai-icon-32x32.png",

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "search-with-chatgpt-powered-by-openai-extension",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "search-with-chatgpt-powered-by-openai-extension",
-      "version": "1.0.0",
+      "version": "1.2.0",
       "devDependencies": {
         "web-ext": "10.5.0"
       },

package.json

@@ -1,6 +1,6 @@
 {
   "name": "search-with-chatgpt-powered-by-openai-extension",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "private": true,
   "type": "module",
   "description": "Development tooling for the Search with ChatGPT Firefox extension.",