Resolves all items from the community review of commit ee9e7a6.
Suspicious behavior (setInterval + network):
- Remove telemetry entirely (delete src/telemetry.ts and all wiring in
main.ts, types, settings tab, esbuild defines). The telemetry fetch was
the plugin's only network call, so this eliminates the periodic
background-transmission flag and the bundled API key.
Popout-window compatibility:
- setTimeout/setInterval/clearTimeout/clearInterval -> activeWindow.*
- document -> activeDocument
- document.createElement('div') -> createDiv()
- instanceof HTMLElement -> .instanceOf(HTMLElement)
- Timer handle types NodeJS.Timeout -> number
Source code / dependencies:
- builtin-modules -> node:module builtinModules
- Remove unused eslint-plugin-react (no react/* rules were enabled)
- Drop vibe-tools (dev tool, source of most transitive CVEs) and swiper
(unused, only shipping dep flagged). pnpm audit --prod is now clean;
remaining warnings are dev-only transitives that are not bundled.
CSS lint:
- Remove all 83 !important (modal widths via .modal compounding, layout
overrides via view-container specificity / class repetition, plugin-own
rules dropped plainly) with the effective cascade preserved
- Consolidate ~20 duplicate selectors into single rules (last-wins union)
- Fix redundant margin/padding shorthand
Release:
- Add actions/attest-build-provenance@v2 (+ id-token/attestations perms)
for main.js and styles.css
Tests:
- Polyfill activeWindow/activeDocument/createDiv in the jest setup
Verified: production build, lint, and 128 unit tests all pass.
e89d251b04