fix: improve hostname parsing logic in getSiteName function

.eslintignore

@@ -1,5 +1,5 @@
 node_modules
-dist
+js
 firefox
 chrome
 scripts

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -36,3 +36,22 @@ body:
       description: The extension version is found by clicking the cog at the top left and looking at the bottom of the page.
     validations:
       required: true
+  - type: dropdown
+    attributes:
+      label: Affected area
+      description: Optional — helps us triage which part of the extension is involved.
+      options:
+        - Not sure / general
+        - Generating codes
+        - Cloud backup (Dropbox)
+        - Autofill on websites
+        - Import / export
+        - Security advisor
+    validations:
+      required: false
+  - type: textarea
+    attributes:
+      label: Console errors
+      description: Optional. Open the extension page, press F12 → Console, and paste any red errors. Remove any OTP codes or secrets before posting.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -1,7 +1,4 @@
 contact_links:
   - name: Feature Request
-    url: https://github.com/Authenticator-Extension/Authenticator/discussions/new
+    url: https://github.com/Hank076/Authenticator/discussions/new
     about: Please request features here.
-  - name: Translation Issues
-    url: https://crowdin.com/project/authenticator-firefox
-    about: Please correct translation issues on Crowdin.

.github/workflows/codeql-analysis.yml

@@ -13,42 +13,18 @@ jobs:
   analyse:
     name: Analyse
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v2
-      with:
-        # We must fetch at least the immediate parents so that if this is
-        # a pull request then we can checkout the head.
-        fetch-depth: 2
-
-    # If this run was triggered by a pull request event, then checkout
-    # the head of the pull request instead of the merge commit.
-    - run: git checkout HEAD^2
-      if: ${{ github.event_name == 'pull_request' }}
+      uses: actions/checkout@v5
 
-    # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
-      # Override language selection by uncommenting this and choosing your languages
-      # with:
-      #   languages: go, javascript, csharp, python, cpp, java
-
-    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-    # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
-
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 https://git.io/JvXDl
-
-    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
-    #    and modify them (or add more) to build your code if your project
-    #    uses a compiled language
-
-    #- run: |
-    #   make bootstrap
-    #   make release
+      uses: github/codeql-action/init@v3
+      with:
+        languages: javascript-typescript
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      uses: github/codeql-action/analyze@v3

.github/workflows/i18n.yml

@@ -1,17 +1,11 @@
 name: i18n
 
-on:
-  push:
-    branches: [ dev ]
+on: [push, pull_request]
 
 jobs:
-  i18n-strings:
+  key-parity:
     runs-on: ubuntu-latest
-    name: Process new i18n strings
-
+    name: Check locale key parity
     steps:
-      - uses: actions/checkout@v2
-
-      - run: bash scripts/i18n.sh
-        env:
-          DEPLOY_KEY_PASSWORD: ${{ secrets.DEPLOY_KEY_PASSWORD }}
+      - uses: actions/checkout@v5
+      - run: node scripts/check-i18n.js

.github/workflows/main.yml

@@ -8,10 +8,12 @@ jobs:
     name: Style checks
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v5
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v2.1.2
+        uses: actions/setup-node@v5
+        with:
+          node-version: 22
 
       - name: Install dependencies
         run: |
@@ -29,10 +31,13 @@ jobs:
         platform: ["chrome", "firefox"]
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v5
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v2.1.2
+        uses: actions/setup-node@v5
+        with:
+          node-version: 22
+          cache: npm
 
       - name: Install dependencies
         run: npm ci
@@ -45,17 +50,16 @@ jobs:
     needs: [build]
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v5
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v2.1.2
+        uses: actions/setup-node@v5
+        with:
+          node-version: 22
+          cache: npm
 
       - name: Install dependencies
         run: npm ci
-        env:
-          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
 
       - name: Test code
-        uses: mymindstorm/puppeteer-headful@8f745c770f7f4c0f9f332d7c43a775f90e53779a
-        with:
-          args: npm test
+        run: xvfb-run --auto-servernum -- npm test

.github/workflows/release.yml

@@ -2,45 +2,40 @@ name: Release
 
 on:
   push:
-    tags: 
-      - 'v*'
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
 
 jobs:
   release:
     runs-on: ubuntu-latest
-    name: Publish release build
-    
+    name: Build and publish Chrome extension ZIP
+
     steps:
-      - uses: actions/checkout@v2
-      
+      - uses: actions/checkout@v5
+
       - name: Setup Node.js environment
-        uses: actions/setup-node@v2.1.2
-
+        uses: actions/setup-node@v5
+        with:
+          node-version: 22
+          cache: npm
+
       - name: Install dependencies
         run: npm ci
-
-      - name: Build
-        run: bash scripts/release.sh
-        env:
-          CREDS_FILE_PASSWORD: ${{ secrets.CREDS_FILE_PASSWORD }}
-
-      - name: Create a release
-        id: create_release
-        uses: actions/create-release@v1.1.4
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          tag_name: ${{ github.ref }}
-          release_name: Release ${{ github.ref }}
-          draft: false
-          prerelease: false
-      - name: Upload Release Asset
-        id: upload-release-asset 
-        uses: actions/upload-release-asset@v1
+          PUPPETEER_SKIP_DOWNLOAD: "true"
+
+      - name: Build
+        run: npm run chrome
+
+      - name: Package
+        run: cd chrome && zip -r "../OTPilot-Authenticator-chrome-${GITHUB_REF_NAME}.zip" .
+
+      - name: Create release
+        run: |
+          git fetch --force origin "refs/tags/${GITHUB_REF_NAME}:refs/tags/${GITHUB_REF_NAME}"
+          gh release create "$GITHUB_REF_NAME" "OTPilot-Authenticator-chrome-${GITHUB_REF_NAME}.zip" --title "$GITHUB_REF_NAME" --notes-from-tag
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: ./release.tar.gz
-          asset_name: release.tar.gz
-          asset_content_type: application/gzip
+          GH_TOKEN: ${{ github.token }}

.gitignore

@@ -1,16 +1,34 @@
+# dependencies
 node_modules
+
+# build output
 build
 chrome*
 firefox*
 edge*
-dist
-.vscode
-.atom-build.yml
-scripts/authenticator-build-key.enc
-cert.pfx
+js
 css
+/test
 .license-gen-tmp
 view/licenses.html
-./test
+scripts/test-runner.js
+
+# release credentials
 scripts/authenticator-build-key
-scripts/test-runner.js
+scripts/authenticator-build-key.enc
+cert.pfx
+
+# local docs / AI working notes
+docs/
+
+# editor & local tool settings
+.vscode
+.claude/settings.local.json
+
+# OS
+Thumbs.db
+Desktop.ini
+.DS_Store
+
+# npm logs
+npm-debug.log*

README.md

@@ -1,54 +1,56 @@
-# Authenticator [![Build Status](https://travis-ci.com/Authenticator-Extension/Authenticator.svg?branch=dev)](https://travis-ci.com/Authenticator-Extension/Authenticator) [![Crowdin](https://d322cqt584bo4o.cloudfront.net/authenticator-firefox/localized.svg)](https://crowdin.com/project/authenticator-firefox) <img align="right" width="100" height="100" src="https://github.com/Authenticator-Extension/Authenticator/raw/dev/images/icon.svg">
+# OTPilot Authenticator <img align="right" width="100" height="100" src="https://github.com/Hank076/Authenticator/blob/dev/images/icon.svg">
 
-> Authenticator generates 2-Step Verification codes in your browser.
+> OTPilot Authenticator generates 2-Step Verification (OTP) codes in your browser.
 
-## Available for Chrome, Firefox, and Microsoft Edge
+[**Install from the Chrome Web Store**](https://chromewebstore.google.com/detail/otpilot-authenticator/compmlfocdmifebgiecbajaidkmgkonc)
 
-[<img src="https://raw.githubusercontent.com/wiki/Authenticator-Extension/Authenticator/readme-images/chrome-web-store.png" title="Chrome Web Store" width="170" height="48" />](https://chrome.google.com/webstore/detail/authenticator/bhghoamapcdpbohphigoooaddinpkbai) [<img src="https://raw.githubusercontent.com/wiki/Authenticator-Extension/Authenticator/readme-images/firefox-add-ons.png" title="Firefox Add-ons" width="170" height="48" />](https://addons.mozilla.org/en-US/firefox/addon/auth-helper?src=external-github) [<img src="https://raw.githubusercontent.com/wiki/Authenticator-Extension/Authenticator/readme-images/microsoft-store.png" title="Microsoft Store" height="48">](https://microsoftedge.microsoft.com/addons/detail/ocglkepbibnalbgmbachknglpdipeoio)
+This is a fork of [Authenticator-Extension/Authenticator](https://github.com/Authenticator-Extension/Authenticator) ([source of this fork](https://github.com/Hank076/Authenticator)). On top of upstream, this fork adds:
 
-
-### Safari Edition
-
-A Safari edition of Authenticator is available on the App Store. We do not provide official support for the Safari edition.
-
-[<img width="150" alt="Download on the App Store" src="https://developer.apple.com/assets/elements/badges/download-on-the-app-store.svg"/>](https://apps.apple.com/us/app/authen/id1602945200?mt=12)
+- **Encrypted cloud backup to Dropbox** — OAuth Authorization Code + PKCE via `chrome.identity.launchWebAuthFlow`; no client secret ships in the extension. (Google Drive backup was removed in 2026-07; OneDrive is a disabled placeholder.)
+- **Advisor** — security recommendations for your accounts.
+- **Host-bound autofill** — codes are only injected when the page host matches the account.
+- **Redesigned import flow** and a CSS custom-property design system (`sass/_tokens.scss`).
 
 ## Build Setup
 
-``` bash
-# install development dependencies
-npm install
-# compile
-npm run [chrome, firefox, prod]
-```
-
-To reproduce a build:
-
-``` bash
+```bash
+# install dependencies (~2 min, downloads puppeteer Chromium)
 npm ci
-npm run prod
+
+# build for a target
+npm run [chrome, firefox, edge, prod]
 ```
 
-To reproduce a build for Safari, please follow contribution guidance in [Authenticator-Extension/Authen](https://github.com/Authenticator-Extension/Authen#how-to-contribute)
+Notes:
+
+- Build output goes to `chrome/` (bundles under `chrome/js/`); these directories are gitignored.
+- `npm run prod` aborts if `src/models/credentials.ts` is empty (OAuth credentials are kept out of the repo). `chrome`/`test` builds only warn — everything works except live cloud backup.
+- **Windows**: builds run through `bash scripts/build.sh`, so use a full [Git Bash](https://git-scm.com/download/win) (with complete coreutils). Running `npm test` from plain PowerShell fails with `'bash' is not recognized`.
 
 ## Development (Chrome)
 
-``` bash
-# install development dependencies
-npm install
-# compiles the Chrome extension to the `./test/chrome` directory
+```bash
+# watch build
 npm run dev:chrome
-# load the unpacked extension from the `./test/chrome/ directory in Chrome
+# then load the unpacked extension from the `chrome/` directory
 ```
 
-Note that Windows users should download a tool like [Git Bash](https://git-scm.com/download/win) or [Cygwin](http://cygwin.com/) to build.
+## Testing
 
-## Acknowledgment
+```bash
+npm test
+```
+
+Runs the extension in a real browser via puppeteer with in-browser mocha (`headless: false`, so a GUI is required).
 
-We would like to extend our heartfelt thanks to Laurent, the Chief Information Security Officer (CISO) of the University of Luxembourg, for the invaluable support and contribution to this project. During the development process, the CISO team provided critical security recommendations that helped us identify and address potential vulnerabilities, significantly enhancing the security and reliability of the project.
+## i18n
 
-We especially want to acknowledge the University of Luxembourg's information security team for their selfless contribution, which not only facilitated the progress of this project but also had a positive impact on the broader open-source community. We recognize that the success of open-source software depends heavily on collaboration and support from various stakeholders, and the involvement of the University of Luxembourg has allowed us to offer a more secure and dependable product to a wider audience.
+`_locales/en/messages.json` is the source of truth for keys. Crowdin is no longer used; other locales are maintained by hand. All locales must have the exact same key set as `en`, enforced by:
 
-We understand that while open-source software is free, maintaining and improving these projects requires significant resources. The University of Luxembourg’s information security team has demonstrated their strong commitment to the open-source community, contributing not just within their university but to users and developers globally. We hope this acknowledgment will help them continue to secure the support and resources necessary to further advance open-source initiatives.
+```bash
+node scripts/check-i18n.js
+```
+
+## Acknowledgment
 
-Once again, we express our sincere gratitude to the University of Luxembourg's CISO team for their valuable advice and assistance.
+We would like to extend our heartfelt thanks to Laurent, the Chief Information Security Officer (CISO) of the University of Luxembourg, and the university's information security team for their invaluable security recommendations to the upstream project.