ScriptVault v1.7.2: linter fixes, install page hardening, sort improvements

SysAdminDoc · SysAdminDoc · commit ffe0199eea1d · 2026-03-24T11:07:46.000-04:00
Linter severity fixes: - Unknown @grant values: warning -> error (won't work at runtime) - Invalid @sandbox values: warning -> error (breaks script execution) - @grant none + GM API usage: info -> warning (API calls will fail) - Removed duplicate entries from hint metaDirectives array - Added GM_webRequest to autocomplete hints and grant values Install page: - Fix XSS in icon error fallback (innerHTML -> textContent) - Fix auto-close race condition (cancel timer on user button click) Dashboard: - Default sort already updated/desc (newest first) — confirmed - Column click on 'updated' now defaults to desc (newest first) Other: - Network log cap increased from 500 to 2000 entries for better DevTools utility
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -4,7 +4,7 @@
 Modern userscript manager built with Chrome Manifest V3. Tampermonkey-inspired functionality with cloud sync, auto-updates, a full dashboard, Monaco editor, DevTools panel, and a persistent side panel.
 
 ## Version
-v1.7.1
+v1.7.2
 
 ## Tech Stack
 - Chrome MV3 extension (JavaScript)
@@ -194,7 +194,7 @@ v1.7.1
 - Fixed: NetworkLog duration calculation used `_netLogEntry.timestamp` which was undefined; replaced with dedicated `_netLogStartTime` variable
 - Fixed: `state.folders`, `state._collapsedFolders`, `state._lastCheckedId`, `state._quotaWarned` not initialized in dashboard state object
 - Fixed: `switchTab('help')` in command palette failed because help tab is a header icon, not a `.tm-tab`; added special case handling
-- Verified: All version strings match (v1.7.1 across manifest, manifest-firefox, content.js, popup.js, dashboard.js)
+- Verified: All version strings match (v1.7.2 across manifest, manifest-firefox, content.js, popup.js, dashboard.js)
 - Verified: All bg/ modules load before background.core.js in build output
 - Verified: `escapeHtml` available in popup.js (shared/utils.js loaded first)
 - Verified: Column index mapping still correct after pin button addition (pin is inside actions TD, not a new column)
diff --git a/README.md b/README.md
@@ -9,7 +9,7 @@
 </p>
 
 <p align="center">
-  <img src="https://img.shields.io/badge/version-1.7.1-22c55e?style=flat-square" alt="Version">
+  <img src="https://img.shields.io/badge/version-1.7.2-22c55e?style=flat-square" alt="Version">
   <img src="https://img.shields.io/badge/manifest-v3-60a5fa?style=flat-square" alt="Manifest V3">
   <img src="https://img.shields.io/badge/license-MIT-orange?style=flat-square" alt="License">
   <img src="https://img.shields.io/badge/chrome-120%2B-blue?style=flat-square" alt="Chrome 120+">
@@ -325,6 +325,6 @@ MIT License &mdash; see [LICENSE](LICENSE) for details.
 ---
 
 <p align="center">
-  <strong>ScriptVault v1.7.1</strong><br>
+  <strong>ScriptVault v1.7.2</strong><br>
   <em>Your scripts, your rules &mdash; locked down and loaded</em>
 </p>
diff --git a/background.js b/background.js
@@ -1,4 +1,4 @@
-// ScriptVault v1.7.1 - Background Service Worker
+// ScriptVault v1.7.2 - Background Service Worker
 // Comprehensive userscript manager with cloud sync and auto-updates
 // NOTE: This file is built from source modules. Edit the individual files in
 // shared/, modules/, and lib/, then run build-background.sh to regenerate.
@@ -4802,7 +4802,7 @@ const ScriptAnalyzer = {
 
 const NetworkLog = {
   _log: [],
-  _maxEntries: 500,
+  _maxEntries: 2000,
 
   add(entry) {
     this._log.unshift({
diff --git a/bg/netlog.js b/bg/netlog.js
@@ -3,7 +3,7 @@
 
 const NetworkLog = {
   _log: [],
-  _maxEntries: 500,
+  _maxEntries: 2000,
 
   add(entry) {
     this._log.unshift({
diff --git a/content.js b/content.js
@@ -1,4 +1,4 @@
-// ScriptVault v1.7.1 - Content Script Bridge
+// ScriptVault v1.7.2 - Content Script Bridge
 // Bridges messages between userscripts (USER_SCRIPT world) and background service worker
 
 (function() {
diff --git a/lib/codemirror/addon/hint/userscript-hint.js b/lib/codemirror/addon/hint/userscript-hint.js
@@ -42,6 +42,7 @@
     { text: "GM_addElement", displayText: "GM_addElement(tagName, attributes)", className: "CodeMirror-hint" },
     { text: "GM_loadScript", displayText: "GM_loadScript(url, options)", className: "CodeMirror-hint" },
     { text: "GM_audio", displayText: "GM_audio", className: "CodeMirror-hint" },
+    { text: "GM_webRequest", displayText: "GM_webRequest(rules, listener)", className: "CodeMirror-hint" },
     // Promise-based GM.* API
     { text: "GM.getValue", displayText: "GM.getValue(key, defaultValue)", className: "CodeMirror-hint" },
     { text: "GM.setValue", displayText: "GM.setValue(key, value)", className: "CodeMirror-hint" },
@@ -74,8 +75,7 @@
     "@run-in", "@top-level-await", "@license", "@copyright", "@priority",
     "@downloadURL", "@updateURL", "@homepageURL", "@supportURL",
     "@contributionURL", "@webRequest",
-    "@license", "@compatible", "@incompatible", "@sandbox",
-    "@inject-into", "@unwrap", "@antifeature"
+    "@compatible", "@incompatible", "@unwrap"
   ];
 
   // @grant values
@@ -92,7 +92,7 @@
     "GM_xmlhttpRequest", "GM_download", "GM_log", "GM_info",
     "GM_getTab", "GM_saveTab", "GM_getTabs",
     "GM_cookie", "GM_focusTab", "GM_closeTab",
-    "GM_audio", "GM_loadScript",
+    "GM_audio", "GM_loadScript", "GM_webRequest",
     "GM.getValue", "GM.setValue", "GM.deleteValue", "GM.listValues",
     "GM.getValues", "GM.setValues", "GM.deleteValues",
     "GM.xmlHttpRequest", "GM.notification", "GM.openInTab",
diff --git a/lib/codemirror/addon/lint/userscript-lint.js b/lib/codemirror/addon/lint/userscript-lint.js
@@ -287,8 +287,8 @@
           annotations.push({
             from: CodeMirror.Pos(i, line.indexOf(value)),
             to: CodeMirror.Pos(i, line.length),
-            message: `Unknown grant: ${value}`,
-            severity: 'warning'
+            message: `Unknown grant: ${value}. This will not work at runtime.`,
+            severity: 'error'
           });
         }
       }
@@ -331,7 +331,7 @@
             from: CodeMirror.Pos(i, line.indexOf(value)),
             to: CodeMirror.Pos(i, line.length),
             message: `Invalid @sandbox value. Valid values: ${VALID_SANDBOX.join(', ')}`,
-            severity: 'warning'
+            severity: 'error'
           });
         }
       }
@@ -497,8 +497,8 @@
           annotations.push({
             from: CodeMirror.Pos(i, match.index),
             to: CodeMirror.Pos(i, match.index + api.length),
-            message: `${api} may not be available with @grant none — add @grant ${api} if needed`,
-            severity: 'info'
+            message: `${api} will not work with @grant none — add @grant ${api}`,
+            severity: 'warning'
           });
         }
       }
diff --git a/manifest-firefox.json b/manifest-firefox.json
@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "__MSG_extName__",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "description": "__MSG_extDescription__",
   "default_locale": "en",
   "homepage_url": "https://github.com/SysAdminDoc/ScriptVault",
diff --git a/manifest.json b/manifest.json
@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "__MSG_extName__",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "description": "__MSG_extDescription__",
   "default_locale": "en",
   "minimum_chrome_version": "120",
diff --git a/offscreen.js b/offscreen.js
@@ -1,4 +1,4 @@
-// ScriptVault Offscreen Document v1.7.1
+// ScriptVault Offscreen Document v1.7.2
 // Handles CPU-intensive tasks off the service worker:
 //   - AST-based script analysis (via Acorn)
 //   - 3-way text merge for sync conflict resolution
diff --git a/pages/dashboard.js b/pages/dashboard.js
@@ -1,4 +1,4 @@
-// ScriptVault Dashboard v1.7.1 - Full-Featured Controller
+// ScriptVault Dashboard v1.7.2 - Full-Featured Controller
 (function() {
     'use strict';
 
@@ -1270,7 +1270,8 @@
             state.sortDirection = state.sortDirection === 'asc' ? 'desc' : 'asc';
         } else {
             state.sortColumn = column;
-            state.sortDirection = 'asc';
+            // Default to desc for time-based columns (newest first)
+            state.sortDirection = (column === 'updated' || column === 'perf') ? 'desc' : 'asc';
         }
         updateSortIndicators();
         renderScriptTable();
diff --git a/pages/devtools-panel.js b/pages/devtools-panel.js
@@ -1,4 +1,4 @@
-// ScriptVault DevTools Panel v1.7.1
+// ScriptVault DevTools Panel v1.7.2
 // Network inspection, execution profiling, and console capture
 
 (function () {
@@ -232,7 +232,7 @@
       comment: e.scriptName || ''
     }));
 
-    const har = { log: { version: '1.2', creator: { name: 'ScriptVault', version: '1.7.1' }, entries } };
+    const har = { log: { version: '1.2', creator: { name: 'ScriptVault', version: '1.7.2' }, entries } };
     const blob = new Blob([JSON.stringify(har, null, 2)], { type: 'application/json' });
     const url = URL.createObjectURL(blob);
     const a = document.createElement('a');
diff --git a/pages/install.js b/pages/install.js
@@ -1,4 +1,4 @@
-// ScriptVault Install Page v1.7.1
+// ScriptVault Install Page v1.7.2
 
 // Dangerous permissions that warrant security warnings
 const DANGEROUS_PERMISSIONS = [
@@ -46,7 +46,7 @@ async function init() {
       const fallback = e.target.getAttribute('data-icon-fallback');
       e.target.style.display = 'none';
       if (e.target.parentElement && fallback) {
-        e.target.parentElement.innerHTML = fallback;
+        e.target.parentElement.textContent = fallback;
       }
     }
   }, true);
@@ -672,22 +672,23 @@ function showSuccess(name, action, scriptId) {
     </div>
   `;
 
+  const autoCloseTimer = setTimeout(() => {
+    if (history.length > 1) history.back();
+    else window.close();
+  }, 5000);
+
   document.getElementById('btnSuccessClose')?.addEventListener('click', () => {
+    clearTimeout(autoCloseTimer);
     if (history.length > 1) history.back();
     else window.close();
   });
   document.getElementById('btnOpenDashboard')?.addEventListener('click', () => {
+    clearTimeout(autoCloseTimer);
     const url = scriptId
       ? chrome.runtime.getURL(`pages/dashboard.html#script_${scriptId}`)
       : chrome.runtime.getURL('pages/dashboard.html');
     chrome.tabs.update({ url });
   });
-
-  // Auto-close after 5s (longer than before)
-  setTimeout(() => {
-    if (history.length > 1) history.back();
-    else window.close();
-  }, 5000);
 }
 
 // Utilities
diff --git a/pages/monaco-adapter.js b/pages/monaco-adapter.js
@@ -1,4 +1,4 @@
-// ScriptVault Monaco Adapter v1.7.1
+// ScriptVault Monaco Adapter v1.7.2
 // Provides a CodeMirror-compatible API surface that delegates to the Monaco
 // sandboxed iframe. Dashboard.js calls state.editor.getValue/setValue/etc.,
 // which this adapter intercepts and routes via postMessage.
diff --git a/pages/popup.js b/pages/popup.js
@@ -1,4 +1,4 @@
-// ScriptVault Popup v1.7.1
+// ScriptVault Popup v1.7.2
 // Tampermonkey-style popup interface
 
 (function() {
diff --git a/pages/sidepanel.js b/pages/sidepanel.js
@@ -1,4 +1,4 @@
-// ScriptVault Side Panel v1.7.1
+// ScriptVault Side Panel v1.7.2
 // Persistent companion panel — always visible alongside the active page
 
 (function () {

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-// ScriptVault v1.7.1 - Content Script Bridge`
	`1`	`+// ScriptVault v1.7.2 - Content Script Bridge`
`2`	`2`	`// Bridges messages between userscripts (USER_SCRIPT world) and background service worker`
`3`	`3`
`4`	`4`	`(function() {`
Original file line number	Diff line number	Diff line change
`@@ -287,8 +287,8 @@`
`287`	`287`	`annotations.push({`
`288`	`288`	`from: CodeMirror.Pos(i, line.indexOf(value)),`
`289`	`289`	`to: CodeMirror.Pos(i, line.length),`
`290`		- message: `Unknown grant: ${value}`,
`291`		`- severity: 'warning'`
	`290`	+ message: `Unknown grant: ${value}. This will not work at runtime.`,
	`291`	`+ severity: 'error'`
`292`	`292`	`});`
`293`	`293`	`}`
`294`	`294`	`}`
`@@ -331,7 +331,7 @@`
`331`	`331`	`from: CodeMirror.Pos(i, line.indexOf(value)),`
`332`	`332`	`to: CodeMirror.Pos(i, line.length),`
`333`	`333`	message: `Invalid @sandbox value. Valid values: ${VALID_SANDBOX.join(', ')}`,
`334`		`- severity: 'warning'`
	`334`	`+ severity: 'error'`
`335`	`335`	`});`
`336`	`336`	`}`
`337`	`337`	`}`
`@@ -497,8 +497,8 @@`
`497`	`497`	`annotations.push({`
`498`	`498`	`from: CodeMirror.Pos(i, match.index),`
`499`	`499`	`to: CodeMirror.Pos(i, match.index + api.length),`
`500`		- message: `${api} may not be available with @grant none — add @grant ${api} if needed`,
`501`		`- severity: 'info'`
	`500`	+ message: `${api} will not work with @grant none — add @grant ${api}`,
	`501`	`+ severity: 'warning'`
`502`	`502`	`});`
`503`	`503`	`}`
`504`	`504`	`}`
Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,7 @@`
`1`	`1`	`{`
`2`	`2`	`"manifest_version": 3,`
`3`	`3`	`"name": "__MSG_extName__",`
`4`		`- "version": "1.7.1",`
	`4`	`+ "version": "1.7.2",`
`5`	`5`	`"description": "__MSG_extDescription__",`
`6`	`6`	`"default_locale": "en",`
`7`	`7`	`"homepage_url": "https://github.com/SysAdminDoc/ScriptVault",`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-// ScriptVault Offscreen Document v1.7.1`
	`1`	`+// ScriptVault Offscreen Document v1.7.2`
`2`	`2`	`// Handles CPU-intensive tasks off the service worker:`
`3`	`3`	`// - AST-based script analysis (via Acorn)`
`4`	`4`	`// - 3-way text merge for sync conflict resolution`