From d8beb20eb3ba2a823b0b0aa08c6e8efaec164329 Mon Sep 17 00:00:00 2001 From: Jaron Rubenstein Date: Sun, 14 Jun 2026 21:00:05 -0400 Subject: [PATCH 1/2] redact key to avoid secrets leakage --- background/service-worker.js | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/background/service-worker.js b/background/service-worker.js index c427976..6b30f12 100644 --- a/background/service-worker.js +++ b/background/service-worker.js @@ -123,7 +123,9 @@ async function updateViaHttp(apiKey, plId, data, origin) { }); const text = await res.text(); if (typeof console !== 'undefined' && console.log) { - console.log('[Chrysalis] HTTP', res.status, plId, body, text.slice(0, 200)); + const logBody = { ...body }; + if (logBody.key) logBody.key = '[REDACTED]'; + console.log('[Chrysalis] HTTP', res.status, plId, logBody, text.slice(0, 200)); } if (!res.ok) { return { success: false, error: `HTTP ${res.status}: ${text.slice(0, 150)}` }; From 2187ddf533e9a8443d35a21f07c11007ff03b3fd Mon Sep 17 00:00:00 2001 From: Jaron Rubenstein Date: Sun, 14 Jun 2026 21:03:36 -0400 Subject: [PATCH 2/2] Since users can have multiple Monarch tabs open, taking the first queried tab arbitrarily in setup.js could select a stale or background tab, triggering host permission errors. This commit aligns setup.js with background/service-worker.js by sorting the queried tabs by lastAccessed to always select the active, in-focus tab. --- setup/setup.js | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/setup/setup.js b/setup/setup.js index bbb1d81..8b87500 100644 --- a/setup/setup.js +++ b/setup/setup.js @@ -697,8 +697,10 @@ }; async function findMonarchTab() { - const tabs = await chrome.tabs.query({ url: MONARCH_ORIGIN + '/*' }); - return tabs.length ? tabs[0] : null; + const tabs = await chrome.tabs.query({ url: MONARCH_ORIGINS.map((o) => o + '/*') }); + if (!tabs.length) return null; + const sorted = [...tabs].sort((a, b) => (b.lastAccessed || 0) - (a.lastAccessed || 0)); + return sorted[0] || null; } function isPLAppTab(url) {