The release upload passed basename() raw in the name= query param, so a '+'
in the signed xpi filename (ismis-helper-1.4.0-an+fx.xpi) was URL-decoded to a
space ('ismis-helper-1.4.0-an fx.xpi'). Encode the name with
urllib.parse.quote before the request.
Passwords are now encrypted with Web Crypto AES-GCM (256-bit) before being
stored in browser.storage.local. The random key is persisted so it survives
browser/service-worker restarts (otherwise old ciphertext could never be
decrypted). Encryption/decryption happen in the background via
encrypt-password/decrypt-password messages; autoLogin decrypts on the fly and
falls back to a legacy plaintext password for pre-encryption profiles. The
popup never reveals a stored password and preserves it when editing with a
blank field.
Removes the plaintext-password-at-rest smell flagged in the design review.
Note: this is at-rest obfuscation-level security (the key ships with the
extension); the extension only talks to the school portal.
Adds a progress bar below the export buttons showing the current step
(reading table, fetching course descriptions i/N, profile, year level,
building file) with a 0-100% fill. Threads an onProgress callback through
scrapeStudyLoad and resolveYearLevel. Buttons disable during export to
prevent double-triggers; bar clears ~3s after success.
The grade-history method counted distinct academic years, which over-advanced
standing for students who repeated/failed a year (e.g. showing Year 5 when the
student is genuinely Year 4, since a partial 2025 year didn't advance them).
Reorder the hybrid so the UNITS math (total prospectus units minus still-lacking
units = units actually passed) is primary, and View Grades history is only a
fallback when units data is unavailable.
- Export modules (export-csv/json/xlsx) mirroring the PDF layout, plus a
Next Up import CSV matching the raycast/nextup column contract.
- Hybrid Year Level: View Grades history (exact per-semester standing),
falling back to units math (prospectus total - lacking), then profile.
Popup adds a year-mode setting (auto/custom/off).
- On-page button row now offers PDF / CSV / Excel / JSON / Next Up.
- Bump version to 1.4.0.
- Tag-only build workflow with an optional AMO sign step for a signed .xpi;
separate ci.yml keeps tests on pushes/PRs.
- Tests: year-standing parser tests + export tests (CSV quoting, JSON schema,
XLSX structure); CI validates XLSX via openpyxl.
adrianbonpin
adrianbonpin