New features:
- HMAC-signed communication (F21): secure challenge-response handshake between extension and server. Lock icon in footer shows connection security status.
- Page Activity collector (F20): captures toasts, flash content, animation jank, and render thrashing via 30s mutation buffer. 17 enrichment collectors total.
- Reload hint: after agent resolves issues, sidebar prompts "Reload to verify" with button.
- All servers list inline in sidebar settings (no separate options page needed).
- Version info consolidated in settings panel with highlighted pills.

Security improvements:
- HMAC-SHA256 request signing with replay protection (30s timestamp window)
- F19 prompt injection wrapping complete on all 37 MCP tools
- STRIDE threat model: 9 threats, 9 mitigations. 0 open HIGH findings.
- 5 security reviews passed (SRR-001 through SRR-004 + focused reviews)
- Native messaging config whitelist enforced

Bug fixes:
- BUG-022: request_capture matches by requestId (fixes @vg-review flow)
- HMAC key encoding mismatch between server and extension
- Ghost border lines in footer removed
- Settings link restored on back button click
- Export buttons hidden in settings view
- Flaky continuous-capture test fixed

UI improvements:
- Auth lock indicator (🔒/🔓) in footer status row
- Consistent + button style across Review and Inspect tabs
- Filter label in review tab
- Improved offline banners with inline code and help links
- Comparison page with Cursor, Antigravity, and 5 other competitors

1620+ automated tests. All passing.

New features:
- 2 new enrichment collectors (16 total): client-side storage (with sensitive value redaction) and CSS custom properties
- Themed tooltip component replacing native browser titles across all sidebar buttons
- Status indicators (connection dot, trust shield) moved to footer for cleaner header
- Server lifecycle management: stdin close detection + 30-minute idle timeout

Improvements:
- Sidebar polish: keyboard navigation, incremental tab updates, empty state indicators
- Inspect tab decomposed into focused modules (diagnostics, toggles)
- Shared collector utilities extracted (walkDOM, isZeroSize, isVisuallyHidden)

Security:
- 5-layer prompt injection defense (sanitize, wrap, detect, harden, gate)
- 9 of 11 security review findings resolved
- 16 CodeQL alerts resolved
- Closed shadow DOM for extension isolation

Bug fixes:
- Trash button confirmation dialog (stale closure from incremental tab update)
- Status dot null reference crash in async callbacks
- Settings links now visually identifiable with icons and link color
- Header logo area no longer triggers sidebar collapse

v0.3.6 - Security & Intelligence Update

New features:
- URL trust indicator with shield icon in sidebar header
- Auto-inspect suggestions with 3-tier scan (accessibility, quality, testability)
- Prompt injection defense (5-layer: sanitize, wrap, detect, harden, gate)
- MCP server instructions for better agent behavior
- Session status tool (37 MCP tools total)
- Transport auto-detection (stdio vs HTTP)

Security improvements:
- innerHTML reduced to 6 safe usages (was 45)
- All user-controlled data removed from innerHTML
- Capture text wrapped in delimiters to prevent prompt injection
- Trust gate blocks untrusted URL captures from reaching AI agents
- STRIDE threat model with 8 identified and mitigated threats

Architecture & Organization:
- Complete extension directory reorganization (collectors/, capture/, session/, export/, ui/, sidebar/)
- Event bus system for inter-module communication
- WS message types use frozen constants instead of magic strings
- All test imports use #lib/ path aliases

New Features:
- Annotation type filter toggles: show/hide bugs, ideas, diagnostics, and notes
- Annotation type registry with standardized badge rendering
- Version display in help card (click ?) and advanced settings
- npm update check on init and status commands
- Server version mismatch detection with amber warning banner

Improvements:
- Node.js minimum updated to 22+
- Build script packages both Chrome and Firefox ZIPs in one command
- Debounce delay field now has explanation text in advanced settings
- Port allocation and auto-discovery documented
- GitHub issue templates for bug reports, feature requests, and questions

Bug Fixes:
- Fixed matchMedia not available in test environment
- Version check only warns when extension is older than server
- Diagnostic annotation properties persist through save/load cycle

Privacy: All data stays on your machine. No external servers, no analytics.
Documentation: https://chaoslabz.gitbook.io/viewgraph

ViewGraph v0.3.2 - Major update from v0.1.0

New Features:
- Idea mode: toggle the lightbulb icon to switch from bug reporting to feature ideation. Generates structured feature specs via @vg-ideate prompt.
- Smart annotation suggestions: clickable chips for detected issues (missing aria-label, no testid, low contrast)
- Keyboard shortcuts: Esc, Ctrl+Enter (send), Ctrl+Shift+C (copy markdown), 1/2/3 (severity), Ctrl+Shift+B (collapse), Ctrl+Shift+X (close)
- Help overlay: click ? in sidebar header for shortcut cheat sheet and documentation links
- Auto-audit: toggle in Inspect tab to automatically run accessibility, layout, and testid audits after each capture
- Diagnostic notes: click the sparkle icon on any Inspect section to create an annotation with diagnostic data attached
- Baseline management: set and compare baselines from the Inspect tab
- Annotation type filtering: toggle icons to show/hide bugs, ideas, diagnostics, and notes
- Section copy buttons: copy any diagnostic section data to clipboard
- Project config: .viewgraph/config.json for persistent feature flags
- HTML snapshots and screenshots now saved alongside captures when enabled in settings

Improvements:
- 36 MCP tools (up from 34) - new compare_styles and get_component_coverage
- Sidebar redesigned: VG icon in header, settings moved to footer, collapsed strip with annotation count
- Annotation badges: distinct icons and colors for bugs, ideas, diagnostics, and page notes
- Pending state: annotations show "Sent to agent - waiting for fix..." while agent works
- Resolution sync: annotations turn green in real-time as agent fixes them
- Failed network requests expand to show full URL, type, and duration
- Review tab shows open annotation count
- Version mismatch detection between extension and server

Privacy:
- All data stays on your machine. No external servers, no analytics, no tracking.
- Open source: https://github.com/sourjya/viewgraph

Documentation: https://chaoslabz.gitbook.io/viewgraph