What's New

• Static package scanner — extended obfuscation heuristics (String.fromCharCode chains, atob payloads, hex/unicode escape sequences) and secret leakage detection (API keys, passwords, Google API keys)
• Richer import diagnostics — pre-import manifest metadata logging, settings change diff, and install failure tracking
• High-contrast theme — automatic Windows high contrast mode detection with full WCAG-compliant color overrides
• HTTP proxy support — configurable proxy URL in settings for corporate networks; applied to both HttpClient and Octokit
• Winget manifest export — generate a WinGet singleton YAML manifest for distribution packaging
• Release channel selection — include pre-release GitHub releases in discovery with a "Pre-release" badge on cards
• Local catalog-file source — load extensions from JSON catalog files in %APPDATA%\LocalChromeStore\catalogs\ without GitHub
• Local source UX fixes — risk panel shows manifest path for local sources, correct checksum description, and install button enabled

Tests: 287 → 299

What's New

• Framework build output resolution — local source folders now resolve manifest.json from framework outputs (.output/chrome-mv3, build/chrome-mv3-prod, dist, extension, public)
• Structured JSON event log — daily JSONL event files with timestamps, levels, and auto-classified categories
• DevTools/options quick links — card buttons and tooltips for manifest options_page/devtools_page
• Parallel batch downloads — Update all runs up to 3 downloads concurrently
• Offline catalog cache — last-discovered catalog loads on startup for instant extension list without GitHub
• Pinned/favorite repos — pin extensions to keep them at the top of the catalog
• License badges — SPDX license identifiers from GitHub metadata shown on cards
• Local usage stats — refresh/install/launch tallies persisted and included in diagnostics
• File watcher — local source folder manifest.json changes trigger reload notifications
• Historical version restore — environment import tries the exact requested release version first
• Permission-diff in policy consent — policy installs show permission changes in the consent dialog
• Source adapter interface — IExtensionSource abstracts discovery for future source types
• WPF smoke-test harness — headless integration tests for core services
• Chrome extension fixtures — parser and permission regression test data
• Octokit 14.0.0 — upgraded from 13.0.1 with zero breaking changes

Tests: 231 → 287

v0.3.12

• Added local source folders for unpacked extension development, surfaced as stable local catalog entries and linked directly without copying source files.
• Persisted local source folders through settings, environment import/export, diagnostics, catalog export, search, readiness, and update-all flows.
• Added regression coverage for source-folder discovery, linking, settings persistence, environment manifests, and install-source import classification.

Verification:

• dotnet test LocalChromeStore.sln -c Release: 231 tests passed
• Published framework-dependent win-x64 ZIP locally
• UI smoke screenshot captured from the published app
• SHA-256: adfb594ed68af45dfa5105f907508da98d4f5278e363e7c8c721817ff0db1141

Browser launch output capture for LocalChromeStore.

Command-line launch sessions now redirect browser stdout/stderr and stream output into the activity log. Nonzero process exits are logged with the browser name and exit code so startup and extension-load failures are visible after launch. Added regression coverage for stdout, stderr, and nonzero exit reporting through the retained output-capture path.

SHA256: 7d684a8ea28ae47f0790c997c36e6dc161d09b988c7d179cb3a598bea1a03873

Launch debug panel for LocalChromeStore.

Added a read-only launch debug panel that shows the selected browser path, resolved profile path, active extension set, startup URL, and launch arguments. The panel is derived from the same launch plan used by Launch session and Copy args, so it stays aligned with the actual browser command.

SHA256: 099bba45ceb210503159a10d7ce3405dd0c65c3670e633ea31b34b5a435e8d1e

Chrome for Testing downloader for LocalChromeStore.

Added a Get CfT toolbar action that resolves the official latest-Stable Chrome for Testing metadata feed, downloads the Windows Chrome ZIP, extracts it under LocalChromeStore cache, refreshes browser detection, and selects the installed CfT executable. Diagnostics now report the CfT cache path, and tests cover metadata selection, extraction, and existing-build reuse without live network calls.

SHA256: 837c6c7e50e8afa9e9e9a1e2f6ad1e92310e8c422923b052b28cf63838aa26de

Persistent launch profiles for LocalChromeStore.

Added Default, Persistent, and Clean temp browser profile modes. Persistent mode reuses a stable LocalChromeStore user-data-dir per browser/load set, and settings/environment export, diagnostics, launch preview, and CDP launches now preserve and report the selected profile mode.

SHA256: 51694d13cf7d2c4952b929ef2d84517ee2995cb70a9e0dfcfb41bc79d55006b0

Release asset provenance for LocalChromeStore.

Added GitHub release asset ID, content type, uploader, upload/update timestamps, size, digest, and download count capture. Cards, inspect review, diagnostics, catalog export, and environment manifests now show compact provenance and changed-since-install status.

SHA256: ee7727b7efba8d7627eedbbebb6007df988e9d378d10f4805217d6f1b522a4e5

Added

• Enterprise Policy apply now runs a local package-risk preflight after CRX packaging and before any HKLM policy write.
• The preflight blocks MV2 packages, remote executable JavaScript/WebAssembly patterns, eval/new Function/string timer execution, unsafe remote script CSP, and configured malicious extension ID matches.
• Diagnostics include package-risk summaries and findings for installed extensions, including derived policy extension IDs when a policy signing key exists.
• Optional malicious-extension ID feeds can be placed at %LOCALAPPDATA%\LocalChromeStore\cache\policy-risk\malicious-extension-ids.txt or app-local policy-risk\malicious-extension-ids.txt.

Added

• Browser loading conformance harness with an opt-in Conformance action that generates a tiny MV3 fixture extension, launches each detected Chromium-family browser and Chrome for Testing build in isolated profiles, records browser version, load strategy, effective arguments, command preview, process outcome, and CDP extension IDs/errors, and writes JSON plus text reports under the LocalChromeStore logs directory.
• Chrome for Testing detection for common local cache locations, with plain load-extension strategy selection for those builds.
• Diagnostics bundles now link the latest browser conformance JSON/text reports.

Fixed

• Browser launch controls now wrap at narrower desktop widths instead of clipping the rightmost action.