feat: Smart Key Extraction confirmation dialog + universal toggles

[easyvibecoding]

Summary

• Three-tier confidence strategy for captured API keys: auto-store (>= 0.7), confirmation dialog (0.35~0.7), ignore (< 0.35)
• Two popup toggles (Universal Masking / Detection) to extend masking and detection to non-supported platforms
• Fix GitHub Turbo navigation key flash with turbo:before-render pre-hide
• Fix OpenAI pre-hide CSS hiding truncated key previews permanently

Changes

Smart Key Extraction Confirmation Dialog

• masker.ts: three-tier routing in submitCapturedKey(), inline confirmation dialog UI with editable service name, 30s
  auto-dismiss, Escape support, dialog queue for multiple pending keys
• masker.ts: removeMaskForValue() restores original text on reject, rejectedKeys Set prevents re-detection for page lifetime
• masker.ts: isAlreadyStoredKey() skips values matching existing Core patterns, generateMaskedPreview() extracted as reusable
  function
• service-worker.ts: _sender → sender, confirm_captured_key handler resubmits with confidence 1.0, relays key_confirmed
  back to content script tab
• ipc-protocol: add submit_captured_key to RequestAction

Universal Masking / Detection Toggles

• popup.html/ts: two toggle switches (purple theme, default OFF)
• service-worker.ts: isUniversalMasking / isUniversalDetection state, persisted in chrome.storage.local
• masker.ts: shouldAutoCapture() extended with isUniversalDetection, bootstrap and state_changed add else if (shouldAutoCapture()) for non-supported platforms. Supported platform behavior unchanged.

Bug Fixes

• capture-patterns.ts: remove td.api-key-token .api-key-token-value from OpenAI preHideCSS — truncated previews never match
  patterns, causing permanent hidden state
• capture-patterns.ts: filter empty prefix from KEY_PREFIXES — generic-key pattern's prefix: '' caused containsFullKey() to
  match ALL text via indexOf('')
• pre-hide.ts: add turbo:before-render listener to hide key elements in incoming Turbo body before render, preventing GitHub PAT
  flash
• masker.ts: toast duration changed from 10s to 25s

Generic Key Pattern

• capture-patterns.ts: new generic-key pattern (confidence 0.50) matches common prefixes (key-, token-, api-, secret-,
  sk-, pk-, rk-) + 30+ char alphanumeric strings

Design Decisions

• Supported platforms unaffected: shouldMask() and shouldAutoCapture() preserve original isOnSupportedPlatform() behavior.
  Universal toggles only extend to non-supported platforms.
• No original guard changes: isDemoMode guards on scanAndMask(), debouncedScan(), enablePreHide() remain untouched. New
  logic added as else if branches only.
• Medium confidence masks first: prevents key leak while user decides. Reject removes mask and restores DOM.
• No plaintext queue: rejected/failed keys are not stored anywhere (security red line).

Test Results

Platform	Capture	Toast	Mask/Pre-hide	Flash	Result
OpenAI	✅	✅	✅ input hidden	None	PASS
HuggingFace	✅	✅ hf_ZODVY****...	✅ input hidden	None	PASS
GitHub	✅	✅ ghp_dF9g****...	✅ text replaced	Fixed	PASS
Anthropic	✅	✅ sk-ant-a****...	✅ font-mono hidden	None	PASS

Test plan

• High confidence (>= 0.7): auto-mask + toast + store (unchanged)
• Medium confidence (0.35~0.7): mask first → confirmation dialog → Confirm stores / Reject restores
• Low confidence (< 0.35): silently ignored
• Rejected keys not re-detected (rejectedKeys Set)
• Already-stored keys skipped (isAlreadyStoredKey)
• Dialog queue: multiple pending shown one by one
• OpenAI dialog displays normally (pre-hide fix)
• GitHub no key flash (Turbo pre-hide fix)
• Universal toggles default OFF, supported platforms unaffected
• TypeScript type-check + ESLint + build pass

🤖 Generated with Claude Code