Release v1.5.10 - Hotfix: PasswordCrypto.resolveCredential is not a function (+ code cleanup)

Fixes a runtime crash in v1.5.9 that broke login and Prowlarr API
calls. The new PasswordCrypto.resolveCredential helper added in
v1.5.9 was defined in js/crypto.js (used by options/popup pages)
but the service worker (js/background.js) embeds its own separate
PasswordCrypto object that never received the new method. Two call
sites in the service worker referenced it, throwing TypeError on
every login attempt and Prowlarr search.

Both call sites reverted to PasswordCrypto.decrypt(), which the
service worker's embedded PasswordCrypto already implements with
format auto-detection: encrypted blobs are decrypted, plaintext
passes through unchanged.

Bundled cleanup (no behavior change): removed dead CREDENTIAL_KEYS
constant, updated stale comments, marked resolveCredential helper
as optional in its docstring, documented lazy-migration assumption
in background.js, clarified options.html helper text on the
account-wide-toggle vs local-encrypted-credentials distinction.

Release v1.5.9 — Multi-Device Credentials: Plaintext Sync with Account-Wide Toggle

Reworks v1.5.7's 'Keep credentials on this device only' toggle so:
- Unchecked actually stores credentials as plaintext in storage.sync
(was a no-op encrypted mirror in v1.5.7)
- The toggle itself syncs via storage.sync.store_credentials_locally
(was per-device in v1.5.7), so unchecking on PC1 propagates the
mode flip and the plaintext to every device on the same account
- onChanged listener on each device routes the new plaintext to the
runtime field and clears the now-stale encrypted blob from local
- Migration moves the legacy per-device toggle from storage.local
to storage.sync; legacy encrypted blobs in sync get cleaned up

Helper text in options page documents the security trade-off and
the account-wide scope of the toggle. Re-checking the toggle still
requires per-device password re-entry (per-device keys can't
decrypt each other's blobs).

Reworks v1.5.7's 'Keep credentials on this device only' toggle so
its unchecked state actually does something useful for multi-device
users. In v1.5.7 both modes encrypted credentials and the toggle
only controlled whether to mirror the encrypted blob to sync — but
since the encryption key is per-install, mirroring didn't help
multi-device users. Effectively a no-op for its stated purpose.

v1.5.8 makes the modes genuinely different:
- Checked (default, more secure): AES-GCM encrypted in storage.local
only, never syncs.
- Unchecked (less secure): plaintext in storage.sync, shared across
all devices on the same browser account.

Storage layout uses _plain suffix on plaintext keys so format is
unambiguous from the key name. Helper text in options page makes
the trade-off explicit. Migration on upgrade from v1.5.7 cleans up
legacy encrypted sync blobs.

v1.5.7 — Per-Device Credential Storage (Multi-Device Sync Fix)

Fixed a credential-sync deadlock that caused repeated password prompts when using the extension on multiple PCs sharing a Firefox account.

What was happening:
The encryption key is generated per-install (stored only on each device, never synced), but encrypted credentials were going through Firefox Sync. Each device received the others' ciphertext, couldn't decrypt it with its own key, and re-encrypted on its own — creating an endless overwrite loop.

What's new:
- New "Keep credentials on this device only" checkbox in Basic Setup (default: enabled). Your Deluge password and Prowlarr API key now stay encrypted in local storage per-device.
- Disabling the checkbox restores synced-credential behavior for single-device users who want browser-account backup.
- Same fix applies to the Prowlarr API key.
- One-time migration on upgrade: your active device keeps working without re-prompting; other devices prompt once for the password and then work seamlessly.

No storage schema changes, no new permissions, no AMO-safety regression.

2026-04-21 v1.5.6 — Options Status Messages: Only Show What Actually Changed
- Fixed Apply announcing every setting as "updated" even when only one field was edited — the status block now shows only messages for keys whose value actually changed, and Apply with no edits is silent

v1.5.5 — Pagination Visibility & Prowlarr Options Polish
2026-04-21

2026-04-21 v1.5.4 — Pagination Settings Init Fix

• Fixed "Show per-page selector in popup" and "Always show pagination bar" not applying on popup open (settings saved and toggled correctly, but the initial render happened before storage finished loading)

2026-04-21 v1.5.3 — Pagination UX & Remember Indexer Selection
New per-page selector dropdown in the popup (optional, gated by Options checkbox)
Added "5" as a per-page option
New "Always show pagination bar" option (default off — opt-in for users who want it persistent)
Indexer selection on the Prowlarr Search tab now persists across popup close/reopen
background.js reorganized with section banners and table of contents

2026-04-21 v1.5.2 — Bug Fixes
Fixed torrent size showing "0.0 KiB of 0.0 KiB" — now uses Deluge's authoritative total_done / total_wanted fields instead of deriving from total_size × progress
Fixed HTTP 400 from Prowlarr when searching multiple indexers — now sends repeated indexerIds / categories query parameters instead of comma-joined values

2026-04-18 v1.5.1 — Prowlarr Search Table Fix

Fixed Prowlarr search result rows collapsing into the Title cell
buildRow() now returns a real <tr> built with createElement
No more DOMParser-based row construction (was hoisting table rows out of their wrapper)

2026-04-18 v1.5.0 — Prowlarr Integration & Optimistic Delete

Full Prowlarr search from the popup — tabbed UI (Torrents / Search Indexers / History)
Indexer multi-select, sortable results, one-click grab
Search history (last 50 queries persisted)
Encrypted Prowlarr API key (same AES-GCM as Deluge password)
Optimistic torrent deletion — instant row removal with server reconciliation
Auto-reconnect to daemon after WebUI disconnects
All Prowlarr UI uses AMO-safe DOM methods (no innerHTML)

Bug Fixes
Removed innerHTML in options.js — AMO validator flagged an unsafe innerHTML assignment in the status message handler (line 205). Replaced with safe DOM construction using createElement("br"), createTextNode(), and appendChild(). Functionally identical — the status message displays the same way, just built from safe DOM nodes instead of HTML string concatenation.

Fixed pagination bar appearing light in dark themes (including System/OS dark mode)

New Features
Search by Name
New search input at the top of the popup filters the torrent list in real time (150ms debounce). Press Escape to clear. Combines with existing State, Tracker, and Label filters.

Setup Page Polish
Live URL preview — As you type, a preview box shows the exact endpoint URL being built (e.g. http://192.168.1.14:8112/json). Helps catch typos before saving.
Password show/hide toggle — Eye icon next to the password field.
Clearer base path help — Inline hint explains the base path field is only needed for reverse proxies, with examples.
HTTP warning panel — When HTTP protocol is selected, an inline warning appears with instructions for adding a Firefox HTTPS-Only Mode exception.
Enhanced Test Connection feedback — Color-coded result (green ✓ / red ✗) with specific error messages.
Label Plugin Detection
The extension now queries core.get_enabled_plugins on the first successful connection. If the Label plugin is not enabled on the Deluge server, the entire Label UI is hidden (per-row dropdowns + toolbar filter).

Performance
Diff-Based Polling
Subsequent polls use core.get_torrents_status with diff=true, returning only fields that changed. For large libraries (1000+ torrents) this reduces payload by 80-95%.

Event-Driven Updates
Subscribes to Deluge's event system — TorrentAddedEvent, TorrentRemovedEvent, TorrentStateChangedEvent, TorrentFinishedEvent, SessionPausedEvent, SessionResumedEvent — and polls web.get_events every second.

Trimmed Request Payload
Removed 5 unused fields — about 22% less data per torrent.

Bug Fixes
Fixed AbortError: signal is aborted without reason uncaught rejection from API timeouts
Raised API timeouts from 1500-2000ms to 5000ms

v1.3.0 — Pagination & Test Connection Fix

2026-04-15

New Features

• Torrent list pagination — The popup now paginates the torrent list instead of rendering every torrent at once. Default is no paging. Previous/Next buttons appear automatically when needed and hide when all torrents fit on a single page.
• Configurable page size — New "Torrents per page" dropdown in Options → Extras lets you choose 10, 20, 50, 100, or All (no paging).

Bug Fixes

• Test Connection now saves settings first — Previously the "Test Connection" button on the Options page had no handler wired up. It now calls saveOptions() before sending check_status, so it tests against the values currently in the form rather than stale stored values. Shows clear feedback: green "Connected!", or red "Failed (reason)".

Behavior Details

• Changing sort, filters, or adding/removing torrents resets pagination to page 1.
• Pagination bar is fully themed — works with all 6 themes and system auto dark mode.
• Page size setting takes effect immediately on the next popup open (or next render cycle if the options page is open alongside the popup).

v1.2.0 Changes:
- Removed all innerHTML usage — replaced with safe DOM methods (createElement, textContent, DOMParser)
- Added "Test Connection" button to Options page
- Raised minimum Firefox version to 140 (required for data collection permissions)
- Added Android support (min version 142)