diff --git a/CHANGELOG.md b/CHANGELOG.md index 08b2120..c2587e8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,10 +2,14 @@ All notable changes to this project will be documented in this file. See [commit-and-tag-version](https://github.com/absolute-version/commit-and-tag-version). -## Unreleased +## [1.2.0] (2026-10-18) + +The first update on addons.mozilla.org since 1.0. It also delivers everything +in 1.1.0, which was never published there. - Add an Ask ChatGPT toolbar button: use selected text or open a blank chat, honoring saved prompt and tab/window preferences. No new permissions. + Requires Firefox 112 or newer, like the other new entry points. - Add Off / Simple / Advanced context-menu modes with migration from the old visibility preference. Advanced provides selection presets and link/page URL actions, with optional translation and a preferred language or language dialog. @@ -15,15 +19,15 @@ All notable changes to this project will be documented in this file. See [commit model/effort URL probe, and document URL sharing. No new permissions. - Show up front, in the options panel and README, that ChatGPT may require signing in and that an unsent prompt needs Enter or Send. - - - * Options instructions now show the configured keyboard shortcut, update when - it changes, and indicate when no shortcut is assigned. Added a button to - open Firefox’s shortcut editor where supported. - * Shortened the context menu label to “Ask ChatGPT”. - * Added quick usage instructions and guidance for changing the search keyword - and default engine in Firefox to the options panel. - * Added a “Feedback or report a bug” link to the options panel and README. +- Limit the prompt template to 1,000 characters, so an oversized template can + no longer stop every other setting from saving. +- Show the configured keyboard shortcut in the options instructions, updating + when it changes and indicating when none is assigned, with a button to open + Firefox’s shortcut editor where supported. +- Shorten the context menu label to “Ask ChatGPT”. +- Add quick usage instructions and guidance for changing the search keyword + and default engine in Firefox to the options panel. +- Add a “Feedback or report a bug” link to the options panel and README. ## [1.1.0] (2026-07-30) @@ -44,7 +48,7 @@ Adds an options panel and two new ways to reach ChatGPT. * Permissions added: storage, menus, activeTab. None of them adds a line to Firefox's install prompt. -## [1.0.0]) (2024-06-09) +## [1.0.0] (2024-06-09) First release of software. diff --git a/docs/superpowers/specs/2026-07-29-extension-options-design.md b/docs/superpowers/specs/2026-07-29-extension-options-design.md index aa7279b..d353253 100644 --- a/docs/superpowers/specs/2026-07-29-extension-options-design.md +++ b/docs/superpowers/specs/2026-07-29-extension-options-design.md @@ -96,6 +96,21 @@ send. The hypothesis that address-bar navigation might still be favoured (`Sec-Fetch-Site: none` being the most-trusted value) **does not hold in practice**. +**Correction, 2026-10-18: `q` auto-submits again.** +- **Signed out:** in headless Firefox 157, `chatgpt.com/?q=` sent the prompt + and ChatGPT answered with no keypress. This happened even when an unrelated + page navigated to the URL (`Sec-Fetch-Site: cross-site`). +- **Maintainer's Firefox:** the same day, the maintainer reported that prompts + were sent without pressing Enter. +- **A week earlier:** on 2026-10-12 the signed-out path showed a verification + error and the signed-in path still needed Enter + (`docs/toolbar-verification.md`). + +So this changed within a week and may differ between accounts. Treat both +behaviours as possible. The copy rule below still applies, and the README +already says ChatGPT decides whether a prompt is sent. Appendix B covers what +this means for selection smuggling. + No copy in the options panel, README, or AMO listing may say the query is *searched*, *sent*, or *asked* — only that ChatGPT opens **with the query filled in**. The two-keypress behaviour is an upstream ChatGPT change, not a defect in @@ -698,7 +713,7 @@ by running commands against copies under `/tmp`; the repo itself was unmodified. | Parameter | Rating | Basis | |---|---|---| | `q` prefills | **Solid** | Dated 2026 sources; maintained tooling; OpenAI's own extension uses it; a live probe returned HTTP 200 with all parameters preserved. | -| `q` auto-submits | **Refuted, and confirmed by first-hand test** | Prefill-only in every dated report since 2025-11-11. Tenable TRA-2025-22 documents OpenAI gating auto-submit on `Sec-Fetch-Site`. Reproduced 2026-07-29 in the maintainer's logged-in Firefox via this extension's own search-provider path. | +| `q` auto-submits | **Varies; auto-submitting again as of 2026-10-18** | Prefill-only in every dated report from 2025-11-11, when Tenable TRA-2025-22 documented OpenAI gating auto-submit on `Sec-Fetch-Site`, and reproduced 2026-07-29 in the maintainer's logged-in Firefox. On 2026-10-18 it auto-submitted signed out, including after a cross-site navigation, and the maintainer reported the same in their own Firefox. See the correction under the `q` section. | | `model` honoured alongside `q` | **Uncertain** | An unresolved 2024-12-28 report says `q` forces GPT-4o regardless; counter-evidence exists from 2024–2025; no 2026 source positively confirms. Maintained tooling grades it experimental. | | Valid `model` slugs | **Uncertain** | No authoritative list; sightings rot (`gpt-4`, `o1-preview`, `gpt-4o`, `gpt-5-thinking`, `auto`, `instant`, `thinking`). | | `temporary-chat=true` | **Uncertain** | Community-confirmed originally; multiple reports of it not applying or reverting after the first message; OpenAI reworking the feature. | @@ -790,6 +805,16 @@ composer until a human presses Enter. **Auto-submit deletes that checkpoint.** This is also why the context menu and shortcut remain safe *as long as they only prefill*. +> **2026-10-18:** ChatGPT itself now auto-submits `?q=` prompts, at least for +> some accounts (see the correction under the `q` section). While that holds, +> the composer checkpoint above is gone for the context menu, toolbar button and +> shortcut alike: hidden text in a selection can reach an answered prompt +> without review. The extension still adds no submission of its own, and this +> appendix's rejection stands. 1.2.0 ships with the behaviour known. Possible +> mitigations, such as framing the default Ask prompt as data the way the preset +> actions already do, or an option to review page-sourced text first, are open +> follow-ups rather than part of this design. + **`webNavigation.transitionType` is not a security boundary.** The signal looks right — a `gpt` search emits `transitionType: "generated"` with `transitionQualifiers: ["from_address_bar"]`, and content cannot forge those diff --git a/manifest.json b/manifest.json index 715e2f8..8595b0f 100644 --- a/manifest.json +++ b/manifest.json @@ -1,10 +1,10 @@ { "name": "Search with ChatGPT powered by OpenAI!", - "description": "Adds a ChatGPT search engine", + "description": "Adds a ChatGPT search engine, plus a right-click menu, toolbar button and shortcut that open ChatGPT with your selected text.", "manifest_version": 2, "author": "Mathew Guest ", "homepage_url": "https://zavage-software.com/portfolio/search-with-ChatGPT", - "version": "1.1", + "version": "1.2", "icons": { "16": "icons/powered-by-openai-icon-16x16.png", "32": "icons/powered-by-openai-icon-32x32.png", diff --git a/package-lock.json b/package-lock.json index c7168c2..cef58a6 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "search-with-chatgpt-powered-by-openai-extension", - "version": "1.0.0", + "version": "1.2.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "search-with-chatgpt-powered-by-openai-extension", - "version": "1.0.0", + "version": "1.2.0", "devDependencies": { "web-ext": "10.5.0" }, diff --git a/package.json b/package.json index a865b96..0ad6b9f 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "search-with-chatgpt-powered-by-openai-extension", - "version": "1.1.0", + "version": "1.2.0", "private": true, "type": "module", "description": "Development tooling for the Search with ChatGPT Firefox extension.",