fix: style extension language selector

README.md

@@ -39,14 +39,45 @@ domains such as `youtube.com` or `x.com`.
 Manual “Send page”, selection, link and file actions are separate. They create
 Browser Inbox captures; they do not create a workspace or a journal entry.
 
-## Firefox Release
+## Firefox download and updates
+
+The signed XPI is published on the [GitHub Releases page](https://github.com/mirivlad/verstak-browser-extension/releases).
+Download the Firefox asset named `verstak-firefox-<version>.xpi` from the latest
+release and open it in Firefox to install it.
+
+After the first public release, installed copies check GitHub Releases for
+updates through the release's `updates.json` asset. During the alpha phase each
+published release is the current update channel.
+
+## Firefox release publishing
 
 Firefox signing uses `web-ext` and AMO credentials from an env file. The script
 requires `WEB_EXT_API_PROXY`; AMO upload and approval polling run through that
 proxy.
 
+Create the signed XPI locally, without publishing it:
+
 ```bash
-VERSTAK_BROWSER_ENV=/home/mirivlad/git/verstak/.env npm run release:firefox
+VERSTAK_BROWSER_ENV=/path/to/.env npm run release:firefox
+```
+
+Publish the signed XPI and `updates.json` as the current GitHub Release:
+
+```bash
+VERSTAK_BROWSER_ENV=/path/to/.env npm run publish:github
+```
+
+The publisher reads the version from `package.json` and requires an
+authenticated GitHub CLI plus a clean local `main` equal to `origin/main`. It
+creates and pushes the version tag if needed, then creates or updates the
+GitHub Release. Re-running it for the same tag replaces the XPI and
+`updates.json` assets. `npm run publish:firefox` remains as a compatible alias
+for the same Firefox publishing flow.
+
+For an explicit version check, pass the current tag after `--`:
+
+```bash
+VERSTAK_BROWSER_ENV=/path/to/.env npm run publish:github -- v2.0.3
 ```
 
 Release output:
@@ -54,8 +85,9 @@ Release output:
 - `release/firefox/verstak-firefox-<version>.xpi`
 - `release/firefox/updates.json`
 
-The XPI is signed as an unlisted/self-distributed Firefox extension. Build and
-release artifacts are local outputs and are not committed.
+The XPI is signed as an unlisted/self-distributed Firefox extension; GitHub
+Releases distribute that signed file. Build and release artifacts are local
+outputs and are not committed.
 
 ## Reproducible local package
 

chromium/manifest.json

@@ -1,10 +1,10 @@
 {
   "manifest_version": 3,
   "name": "Verstak Bridge",
-  "version": "2.0.2",
+  "version": "2.0.3",
   "description": "Send pages, selections, links, and files to the local Verstak browser inbox.",
   "author": "Verstak",
-  "homepage_url": "https://git.mirv.top/verstak/verstak-browser-extension",
+  "homepage_url": "https://github.com/mirivlad/verstak-browser-extension",
   "permissions": ["alarms", "contextMenus", "idle", "storage", "tabs", "windows"],
   "host_permissions": ["http://127.0.0.1/*", "http://localhost/*"],
   "background": {

docs/superpowers/plans/2026-07-12-github-firefox-updates.md

@@ -0,0 +1,329 @@
+# GitHub Firefox Updates Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Publish signed Firefox XPI releases to GitHub Releases and let installed alpha extensions discover them through a GitHub-hosted update manifest.
+
+**Architecture:** Firefox keeps one immutable `update_url` targeting the current GitHub Release's `updates.json` asset. A small Node helper owns the tag, asset URL and update-manifest formatting so it has focused unit tests. The existing local signing command remains local; an explicit publishing command uploads its two artifacts to the public GitHub release.
+
+**Tech Stack:** Manifest V2 JSON, Node.js CommonJS tests, Bash, `web-ext`, GitHub CLI (`gh`).
+
+## Global Constraints
+
+- Publish repository: `mirivlad/verstak-browser-extension`.
+- Firefox addon ID: `verstak-bridge@verstak.app`.
+- Initial GitHub release: `v2.0.3`; package and both browser manifests are version `2.0.3`.
+- Every alpha GitHub release is ordinary/latest, not a prerelease.
+- XPI remains Mozilla-signed as an unlisted/self-distributed addon before upload.
+- `npm run release:firefox` remains a local sign-and-package action.
+- `npm run publish:firefox` is the only command allowed to create or modify a GitHub Release.
+- Generated `release/` output remains untracked.
+
+---
+
+### Task 1: Make GitHub update metadata testable
+
+**Files:**
+- Create: `scripts/firefox-github-release.js`
+- Create: `scripts/test-firefox-github-release.js`
+- Modify: `package.json:8-15`
+
+**Interfaces:**
+- Produces `releaseTag(version)`, `releaseAssetURL(version, assetName)`, and `updateManifest(addonID, version, assetName)` from `scripts/firefox-github-release.js`.
+- `updateManifest` returns the object written as `updates.json` and uses the fixed GitHub repository.
+- Later shell scripts invoke `node scripts/firefox-github-release.js write-updates <addon-id> <version> <asset-name> <output-path>`.
+
+- [ ] **Step 1: Write the failing metadata test**
+
+Create `scripts/test-firefox-github-release.js` with:
+
+```js
+const assert = require('assert');
+const release = require('./firefox-github-release');
+
+const version = '2.0.3';
+const asset = 'verstak-firefox-2.0.3.xpi';
+assert.equal(release.releaseTag(version), 'v2.0.3');
+assert.equal(
+  release.releaseAssetURL(version, asset),
+  'https://github.com/mirivlad/verstak-browser-extension/releases/download/v2.0.3/verstak-firefox-2.0.3.xpi',
+);
+assert.deepEqual(release.updateManifest('verstak-bridge@verstak.app', version, asset), {
+  addons: {
+    'verstak-bridge@verstak.app': {
+      updates: [{
+        version: '2.0.3',
+        update_link: 'https://github.com/mirivlad/verstak-browser-extension/releases/download/v2.0.3/verstak-firefox-2.0.3.xpi',
+      }],
+    },
+  },
+});
+console.log('Firefox GitHub release metadata tests passed');
+```
+
+- [ ] **Step 2: Run the focused test and verify it fails**
+
+Run: `node scripts/test-firefox-github-release.js`
+
+Expected: failure because `scripts/firefox-github-release.js` does not yet exist.
+
+- [ ] **Step 3: Implement the metadata helper**
+
+Create `scripts/firefox-github-release.js` with these exact exports and CLI:
+
+```js
+const fs = require('fs');
+const REPOSITORY = 'mirivlad/verstak-browser-extension';
+
+function releaseTag(version) { return `v${version}`; }
+function releaseAssetURL(version, assetName) {
+  return `https://github.com/${REPOSITORY}/releases/download/${releaseTag(version)}/${assetName}`;
+}
+function updateManifest(addonID, version, assetName) {
+  return { addons: { [addonID]: { updates: [{ version, update_link: releaseAssetURL(version, assetName) }] } } };
+}
+
+if (require.main === module) {
+  const [, , command, addonID, version, assetName, outputPath] = process.argv;
+  if (command !== 'write-updates' || !addonID || !version || !assetName || !outputPath) process.exitCode = 2;
+  else fs.writeFileSync(outputPath, `${JSON.stringify(updateManifest(addonID, version, assetName), null, 2)}\n`);
+}
+
+module.exports = { REPOSITORY, releaseTag, releaseAssetURL, updateManifest };
+```
+
+- [ ] **Step 4: Register and run the test**
+
+Append `node scripts/test-firefox-github-release.js` to the existing `test`
+script in `package.json`, then run:
+
+```bash
+npm test
+```
+
+Expected: all existing tests and `Firefox GitHub release metadata tests passed`.
+
+- [ ] **Step 5: Commit and push**
+
+```bash
+git add package.json scripts/firefox-github-release.js scripts/test-firefox-github-release.js
+git commit -m "test: cover Firefox GitHub release metadata"
+git push origin main
+```
+
+### Task 2: Point Firefox and local release artifacts at GitHub
+
+**Files:**
+- Modify: `firefox/manifest.json:8-17`
+- Modify: `scripts/release-firefox-xpi.sh:29-70`
+- Test: `scripts/test-firefox-github-release.js`
+
+**Interfaces:**
+- Firefox reads `https://github.com/mirivlad/verstak-browser-extension/releases/latest/download/updates.json`.
+- `release-firefox-xpi.sh` invokes the Task 1 helper to write a versioned update manifest.
+- It continues producing `release/firefox/verstak-firefox-<version>.xpi` and `release/firefox/updates.json` locally.
+
+- [ ] **Step 1: Extend the failing test with the stable manifest URL**
+
+Add this assertion to `scripts/test-firefox-github-release.js` before its final
+success message:
+
+```js
+const firefoxManifest = require('../firefox/manifest.json');
+assert.equal(
+  firefoxManifest.browser_specific_settings.gecko.update_url,
+  'https://github.com/mirivlad/verstak-browser-extension/releases/latest/download/updates.json',
+);
+```
+
+- [ ] **Step 2: Run the focused test and verify it fails**
+
+Run: `node scripts/test-firefox-github-release.js`
+
+Expected: assertion failure because the manifest still uses `mirv.top`.
+
+- [ ] **Step 3: Replace the update endpoint and JSON writer**
+
+In `firefox/manifest.json`, replace only the Gecko `update_url` value with:
+
+```json
+"update_url": "https://github.com/mirivlad/verstak-browser-extension/releases/latest/download/updates.json"
+```
+
+In `scripts/release-firefox-xpi.sh`, remove `UPDATE_BASE_URL` and replace the
+heredoc that writes `updates.json` with:
+
+```bash
+node scripts/firefox-github-release.js write-updates \
+  "$ADDON_ID" "$VERSION" "$RELEASE_XPI" "$RELEASE_DIR/updates.json"
+```
+
+- [ ] **Step 4: Run targeted checks**
+
+Run:
+
+```bash
+node scripts/test-firefox-github-release.js
+bash -n scripts/release-firefox-xpi.sh
+npm test
+npm run build
+```
+
+Expected: all commands succeed; `dist/firefox/manifest.json` contains the
+GitHub update URL after the build.
+
+- [ ] **Step 5: Commit and push**
+
+```bash
+git add firefox/manifest.json scripts/release-firefox-xpi.sh scripts/test-firefox-github-release.js
+git commit -m "feat: host Firefox updates on GitHub Releases"
+git push origin main
+```
+
+### Task 3: Add explicit GitHub publishing and public instructions
+
+**Files:**
+- Create: `scripts/publish-firefox-github-release.sh`
+- Modify: `package.json:8-15`
+- Modify: `README.md:42-68`
+- Test: `scripts/publish-firefox-github-release.sh`
+
+**Interfaces:**
+- `npm run publish:firefox` calls `scripts/publish-firefox-github-release.sh`.
+- The script runs the existing local release command, then uploads
+  `verstak-firefox-<version>.xpi` and `updates.json` to release tag
+  `v<version>` in `mirivlad/verstak-browser-extension`.
+- A pre-existing tag receives asset replacement through `gh release upload --clobber`.
+
+- [ ] **Step 1: Write the shell-contract test**
+
+Create a Node test that reads the publish script and asserts the mandatory
+commands are present:
+
+```js
+const assert = require('assert');
+const fs = require('fs');
+const source = fs.readFileSync('scripts/publish-firefox-github-release.sh', 'utf8');
+assert.match(source, /gh auth status/);
+assert.match(source, /gh release create/);
+assert.match(source, /gh release upload/);
+assert.match(source, /--clobber/);
+assert.match(source, /--latest/);
+```
+
+Place those assertions in `scripts/test-firefox-github-release.js` and run the
+test. Expected: it fails before the publish script exists.
+
+- [ ] **Step 2: Implement an explicit idempotent publisher**
+
+Create `scripts/publish-firefox-github-release.sh` with this behavior:
+
+1. Set `ROOT_DIR`, `cd` to it and run `gh auth status`.
+2. Run `./scripts/release-firefox-xpi.sh`.
+3. Read `VERSION` from `dist/firefox/manifest.json`, set `TAG="v${VERSION}"`,
+   `REPOSITORY="mirivlad/verstak-browser-extension"`, and locate the two local
+   release assets by exact names.
+4. Run `gh release view "$TAG" --repo "$REPOSITORY"`; when it is absent, run
+   `gh release create "$TAG" "$XPI" "$UPDATES" --repo "$REPOSITORY" --title
+   "Verstak Browser Extension $VERSION" --generate-notes --latest --target
+   "$(git rev-parse HEAD)"`.
+5. When the release already exists, run `gh release upload "$TAG" "$XPI"
+   "$UPDATES" --repo "$REPOSITORY" --clobber`.
+6. Print the GitHub release URL with `gh release view "$TAG" --repo
+   "$REPOSITORY" --json url --jq .url`.
+
+- [ ] **Step 3: Register the command and document it**
+
+Add to `package.json`:
+
+```json
+"publish:firefox": "./scripts/publish-firefox-github-release.sh"
+```
+
+Rewrite the Firefox Release README section so it documents:
+
+- the public [GitHub Releases](https://github.com/mirivlad/verstak-browser-extension/releases) page;
+- `VERSTAK_BROWSER_ENV=/path/to/.env npm run publish:firefox`;
+- that signing remains unlisted with Mozilla but distribution and automatic
+  updates use GitHub Release assets;
+- that the first `v2.0.3` publish bootstraps the `latest/download/updates.json`
+  endpoint.
+
+- [ ] **Step 4: Run checks without publishing**
+
+Run:
+
+```bash
+bash -n scripts/publish-firefox-github-release.sh
+node scripts/test-firefox-github-release.js
+npm test
+npm run build
+git diff --check
+```
+
+Expected: all commands succeed. Do not invoke `npm run publish:firefox` in this
+task; it creates a public GitHub Release and needs available AMO credentials.
+
+- [ ] **Step 5: Commit and push**
+
+```bash
+git add README.md package.json scripts/publish-firefox-github-release.sh scripts/test-firefox-github-release.js
+git commit -m "feat: publish Firefox releases to GitHub"
+git push origin main
+```
+
+### Task 4: Bootstrap and verify the first public update release
+
+**Files:**
+- Generated: `release/firefox/verstak-firefox-2.0.3.xpi` (untracked)
+- Generated: `release/firefox/updates.json` (untracked)
+
+**Interfaces:**
+- Consumes the Task 3 `npm run publish:firefox` command and valid AMO signing credentials.
+- Produces GitHub Release tag `v2.0.3` and public XPI/update-manifest assets.
+
+- [ ] **Step 1: Verify release credentials before write operations**
+
+Run:
+
+```bash
+gh auth status
+test -n "${VERSTAK_BROWSER_ENV:-}" || test -f .env
+```
+
+Expected: authenticated GitHub CLI and a configured environment file path for
+the existing AMO signing command.
+
+- [ ] **Step 2: Publish the first release**
+
+Run:
+
+```bash
+npm run publish:firefox
+```
+
+Expected: Mozilla signing succeeds, GitHub Release `v2.0.3` is latest, and it
+contains `verstak-firefox-2.0.3.xpi` plus `updates.json`.
+
+- [ ] **Step 3: Verify public delivery**
+
+Run:
+
+```bash
+gh release view v2.0.3 --repo mirivlad/verstak-browser-extension --json isLatest,url,assets
+curl -fsSL https://github.com/mirivlad/verstak-browser-extension/releases/latest/download/updates.json
+```
+
+Expected: the release is latest and the JSON contains addon ID
+`verstak-bridge@verstak.app`, version `2.0.3`, and the versioned GitHub XPI
+asset URL.
+
+- [ ] **Step 4: Record release verification without committing assets**
+
+Run:
+
+```bash
+git status --short
+```
+
+Expected: no generated `release/` assets are staged or committed.

docs/superpowers/specs/2026-07-12-github-firefox-updates-design.md

@@ -0,0 +1,66 @@
+# GitHub Releases for Firefox Updates
+
+## Decision
+
+Firefox XPI releases are published as ordinary public GitHub Releases in
+`mirivlad/verstak-browser-extension`. During the alpha phase every such release
+is marked as the repository's latest release, including alpha versions. There
+are no other Verstak users whose automatic updates need a separate stable
+channel yet.
+
+## Update protocol
+
+The Firefox manifest uses this stable endpoint:
+
+```text
+https://github.com/mirivlad/verstak-browser-extension/releases/latest/download/updates.json
+```
+
+Each release uploads two assets:
+
+- `verstak-firefox-<version>.xpi`, signed by Mozilla as an unlisted addon;
+- `updates.json`, whose `update_link` points to that same release tag's XPI
+  asset.
+
+For version `2.0.3`, the versioned link is:
+
+```text
+https://github.com/mirivlad/verstak-browser-extension/releases/download/v2.0.3/verstak-firefox-2.0.3.xpi
+```
+
+The stable `latest/download` endpoint lets already installed extensions discover
+the next version without changing the manifest on each release.
+
+## Release commands
+
+`npm run release:firefox` remains the local sign-and-package command. A new
+explicit `npm run publish:firefox` command runs it, verifies `gh`
+authentication, creates or reuses the `v<manifest-version>` GitHub Release,
+and uploads the XPI plus `updates.json`. Re-running the command replaces only
+those two assets, so a failed network upload can be retried safely.
+
+Publishing requires the existing AMO credentials used for signing and a
+GitHub-authenticated `gh` CLI. It does not use the invalid `mirv.top` update
+endpoint.
+
+## Bootstrap
+
+There is currently no GitHub Release in this repository. After the code change,
+the first `v2.0.3` signed release must be published before shipping a manifest
+that points to `latest/download/updates.json`; until then that URL is a 404.
+The current package, Chromium manifest and Firefox manifest all use version
+`2.0.3`, so the initial tag and XPI asset name are unambiguous.
+
+## Documentation
+
+The README links users to the GitHub Releases page for downloading the signed
+Firefox XPI and documents that releases are currently the auto-update channel.
+
+## Verification
+
+- add a focused script test for versioned GitHub URLs and generated
+  `updates.json`;
+- run the existing extension test suite and build;
+- run shell syntax validation for the publish script;
+- verify a published release's assets and `latest/download/updates.json` with
+  unauthenticated HTTPS requests.

firefox/manifest.json

@@ -1,15 +1,15 @@
 {
   "manifest_version": 2,
   "name": "Verstak Bridge",
-  "version": "2.0.2",
+  "version": "2.0.3",
   "description": "Send pages, selections, links, and files to the local Verstak browser inbox.",
   "author": "Verstak",
-  "homepage_url": "https://git.mirv.top/verstak/verstak-browser-extension",
+  "homepage_url": "https://github.com/mirivlad/verstak-browser-extension",
   "browser_specific_settings": {
     "gecko": {
       "id": "verstak-bridge@verstak.app",
       "strict_min_version": "115.0",
-      "update_url": "https://mirv.top/verstak/firefox/updates.json",
+      "update_url": "https://github.com/mirivlad/verstak-browser-extension/releases/latest/download/updates.json",
       "data_collection_permissions": {
         "required": ["none"]
       }

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "verstak-browser-extension",
-  "version": "2.0.2",
+  "version": "2.0.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "verstak-browser-extension",
-      "version": "2.0.2",
+      "version": "2.0.3",
       "devDependencies": {
         "web-ext": "^8.3.0"
       }

package.json

@@ -1,14 +1,16 @@
 {
   "name": "verstak-browser-extension",
-  "version": "2.0.2",
+  "version": "2.0.3",
   "private": true,
   "description": "Verstak browser capture extension for Chromium and Firefox",
   "license": "AGPL-3.0-or-later",
   "scripts": {
     "build": "node scripts/build-extension.js",
-    "test": "node scripts/test-hostname.js && node scripts/test-activity-tracker.js && node scripts/test-protocol.js && node scripts/test-i18n.js && node scripts/test-popup-settings.js && node scripts/test-popup-catalog-fallback.js && node scripts/test-background-i18n.js",
+    "test": "node scripts/test-hostname.js && node scripts/test-activity-tracker.js && node scripts/test-protocol.js && node scripts/test-i18n.js && node scripts/test-popup-settings.js && node scripts/test-popup-select-style.js && node scripts/test-popup-catalog-fallback.js && node scripts/test-background-i18n.js && node scripts/test-firefox-github-release.js",
     "sign:firefox": "./scripts/sign-firefox-xpi.sh",
     "release:firefox": "./scripts/release-firefox-xpi.sh",
+    "publish:firefox": "./scripts/publish-firefox-github-release.sh",
+    "publish:github": "./scripts/publish-github-release.sh",
     "release:package": "./scripts/package-release.sh"
   },
   "devDependencies": {

scripts/firefox-github-release.js

@@ -0,0 +1,40 @@
+const fs = require('fs');
+
+const REPOSITORY = 'mirivlad/verstak-browser-extension';
+
+function releaseTag(version) {
+  return `v${version}`;
+}
+
+function releaseAssetURL(version, assetName) {
+  return `https://github.com/${REPOSITORY}/releases/download/${releaseTag(version)}/${assetName}`;
+}
+
+function updateManifest(addonID, version, assetName) {
+  return {
+    addons: {
+      [addonID]: {
+        updates: [{
+          version,
+          update_link: releaseAssetURL(version, assetName),
+        }],
+      },
+    },
+  };
+}
+
+function writeUpdates(addonID, version, assetName, outputPath) {
+  fs.writeFileSync(outputPath, `${JSON.stringify(updateManifest(addonID, version, assetName), null, 2)}\n`);
+}
+
+if (require.main === module) {
+  const [, , command, addonID, version, assetName, outputPath] = process.argv;
+  if (command !== 'write-updates' || !addonID || !version || !assetName || !outputPath) {
+    console.error('usage: node scripts/firefox-github-release.js write-updates <addon-id> <version> <asset-name> <output-path>');
+    process.exitCode = 2;
+  } else {
+    writeUpdates(addonID, version, assetName, outputPath);
+  }
+}
+
+module.exports = { REPOSITORY, releaseTag, releaseAssetURL, updateManifest, writeUpdates };

scripts/publish-firefox-github-release.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT_DIR"
+
+REPOSITORY="mirivlad/verstak-browser-extension"
+SOURCE_DIR="${VERSTAK_FIREFOX_SOURCE_DIR:-dist/firefox}"
+RELEASE_DIR="${VERSTAK_FIREFOX_RELEASE_DIR:-release/firefox}"
+GIT_BIN="${GIT_BIN:-git}"
+GH_BIN="${GH_BIN:-gh}"
+
+if ! command -v "$GH_BIN" >/dev/null; then
+  echo "ERROR: gh CLI is required to publish a GitHub Release" >&2
+  exit 1
+fi
+if [[ "$("$GIT_BIN" branch --show-current)" != "main" ]]; then
+  echo "ERROR: GitHub releases must be published from main" >&2
+  exit 1
+fi
+if [[ -n "$("$GIT_BIN" status --porcelain)" ]]; then
+  echo "ERROR: working tree must be clean before publishing a release" >&2
+  exit 1
+fi
+
+"$GH_BIN" auth status
+"$GIT_BIN" fetch origin main --tags
+HEAD="$("$GIT_BIN" rev-parse HEAD)"
+if [[ "$HEAD" != "$("$GIT_BIN" rev-parse origin/main)" ]]; then
+  echo "ERROR: local main must match origin/main before publishing a release" >&2
+  exit 1
+fi
+./scripts/release-firefox-xpi.sh
+
+VERSION="$(node -e "console.log(require('./${SOURCE_DIR}/manifest.json').version)")"
+TAG="v${VERSION}"
+XPI="$RELEASE_DIR/verstak-firefox-${VERSION}.xpi"
+UPDATES="$RELEASE_DIR/updates.json"
+
+for artifact in "$XPI" "$UPDATES"; do
+  if [[ ! -f "$artifact" ]]; then
+    echo "ERROR: release artifact not found: $artifact" >&2
+    exit 1
+  fi
+done
+
+if "$GIT_BIN" rev-parse -q --verify "refs/tags/$TAG" >/dev/null; then
+  if [[ "$("$GIT_BIN" rev-parse "${TAG}^{commit}")" != "$HEAD" ]]; then
+    echo "ERROR: existing tag $TAG does not point at HEAD" >&2
+    exit 1
+  fi
+else
+  "$GIT_BIN" tag -a "$TAG" -m "Release $TAG"
+  "$GIT_BIN" push origin "refs/tags/$TAG"
+fi
+
+if "$GH_BIN" release view "$TAG" --repo "$REPOSITORY" >/dev/null 2>&1; then
+  "$GH_BIN" release upload "$TAG" "$XPI" "$UPDATES" --repo "$REPOSITORY" --clobber
+else
+  "$GH_BIN" release create "$TAG" "$XPI" "$UPDATES" \
+    --repo "$REPOSITORY" \
+    --title "Verstak Browser Extension $VERSION" \
+    --generate-notes \
+    --latest \
+    --verify-tag
+fi
+
+echo "GitHub release:"
+"$GH_BIN" release view "$TAG" --repo "$REPOSITORY" --json url --jq .url

scripts/publish-github-release.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+VERSION="$(node -p "require('$ROOT/package.json').version")"
+
+if [[ $# -gt 1 || ( $# -eq 1 && "$1" != "v$VERSION" && "$1" != "$VERSION" ) ]]; then
+  echo "usage: $0 [v$VERSION]" >&2
+  exit 2
+fi
+
+exec "$ROOT/scripts/publish-firefox-github-release.sh"

scripts/release-firefox-xpi.sh

@@ -32,7 +32,6 @@ load_env_file "$ENV_FILE"
 SOURCE_DIR="${VERSTAK_FIREFOX_SOURCE_DIR:-dist/firefox}"
 ARTIFACTS_DIR="${WEB_EXT_ARTIFACTS_DIR:-web-ext-artifacts}"
 RELEASE_DIR="${VERSTAK_FIREFOX_RELEASE_DIR:-release/firefox}"
-UPDATE_BASE_URL="${VERSTAK_FIREFOX_UPDATE_BASE_URL:-https://mirv.top/verstak/firefox}"
 
 ./scripts/sign-firefox-xpi.sh
 
@@ -54,20 +53,8 @@ mkdir -p "$RELEASE_DIR"
 RELEASE_XPI="verstak-firefox-${VERSION}.xpi"
 cp "$SIGNED_XPI" "$RELEASE_DIR/$RELEASE_XPI"
 
-cat > "$RELEASE_DIR/updates.json" <<EOF
-{
-  "addons": {
-    "${ADDON_ID}": {
-      "updates": [
-        {
-          "version": "${VERSION}",
-          "update_link": "${UPDATE_BASE_URL}/${RELEASE_XPI}"
-        }
-      ]
-    }
-  }
-}
-EOF
+node scripts/firefox-github-release.js write-updates \
+  "$ADDON_ID" "$VERSION" "$RELEASE_XPI" "$RELEASE_DIR/updates.json"
 
 echo "Firefox release artifacts:"
 echo "$RELEASE_DIR/$RELEASE_XPI"

scripts/test-firefox-github-release.js

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+const assert = require('assert');
+const fs = require('fs');
+const release = require('./firefox-github-release');
+const packageManifest = require('../package.json');
+const chromiumManifest = require('../chromium/manifest.json');
+const firefoxManifest = require('../firefox/manifest.json');
+
+const version = '2.0.3';
+const asset = 'verstak-firefox-2.0.3.xpi';
+
+assert.equal(packageManifest.version, version);
+assert.equal(chromiumManifest.version, version);
+assert.equal(firefoxManifest.version, version);
+assert.equal(release.releaseTag(version), 'v2.0.3');
+assert.equal(
+  release.releaseAssetURL(version, asset),
+  'https://github.com/mirivlad/verstak-browser-extension/releases/download/v2.0.3/verstak-firefox-2.0.3.xpi',
+);
+assert.deepEqual(release.updateManifest('verstak-bridge@verstak.app', version, asset), {
+  addons: {
+    'verstak-bridge@verstak.app': {
+      updates: [{
+        version: '2.0.3',
+        update_link: 'https://github.com/mirivlad/verstak-browser-extension/releases/download/v2.0.3/verstak-firefox-2.0.3.xpi',
+      }],
+    },
+  },
+});
+
+assert.equal(firefoxManifest.homepage_url, 'https://github.com/mirivlad/verstak-browser-extension');
+assert.equal(
+  firefoxManifest.browser_specific_settings.gecko.update_url,
+  'https://github.com/mirivlad/verstak-browser-extension/releases/latest/download/updates.json',
+);
+
+const publisher = fs.readFileSync('scripts/publish-firefox-github-release.sh', 'utf8');
+assert.match(publisher, /auth status/);
+assert.match(publisher, /branch --show-current/);
+assert.match(publisher, /tag -a/);
+assert.match(publisher, /push origin/);
+assert.match(publisher, /release create/);
+assert.match(publisher, /release upload/);
+assert.match(publisher, /--clobber/);
+assert.match(publisher, /--latest/);
+
+const genericPublisher = fs.readFileSync('scripts/publish-github-release.sh', 'utf8');
+assert.match(genericPublisher, /publish-firefox-github-release\.sh/);
+
+console.log('Firefox GitHub release metadata tests passed');

scripts/test-popup-select-style.js

@@ -0,0 +1,10 @@
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+
+const css = fs.readFileSync(path.join(__dirname, '..', 'shared', 'popup', 'popup.css'), 'utf8');
+
+assert.match(css, /select\s*\{[^}]*appearance:\s*none/, 'popup select must hide the native arrow');
+assert.match(css, /select option\s*\{[^}]*background/, 'popup options must use the extension surface');
+
+console.log('browser extension popup select style test passed');

shared/hostname-normalization-v1.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.mirv.top/verstak/verstak-sdk/schemas/hostname-normalization-v1.json",
+  "$id": "https://raw.githubusercontent.com/mirivlad/verstak-sdk/main/schemas/hostname-normalization-v1.json",
   "title": "Verstak canonical hostname normalization v1 test vectors",
   "description": "Canonical hostnames are lowercase ASCII A-labels without a port or trailing DNS dot. Bare hostnames accept DNS names, IPv4, bracketed IPv6, localhost, and internal single-label names. URL inputs accept only HTTP(S). Invalid or excessively long input normalizes to an empty string.",
   "version": 1,

shared/popup/popup.css

@@ -145,7 +145,17 @@ select {
   margin-top: 5px;
   border: 1px solid #374151;
   border-radius: 4px;
-  padding: 7px 8px;
+  padding: 7px 30px 7px 8px;
+  appearance: none;
+  background-color: #0f172a;
+  background-image: linear-gradient(45deg, transparent 50%, #94a3b8 50%), linear-gradient(135deg, #94a3b8 50%, transparent 50%);
+  background-position: calc(100% - 16px) 50%, calc(100% - 11px) 50%;
+  background-size: 5px 5px, 5px 5px;
+  background-repeat: no-repeat;
+  color: #e5e7eb;
+}
+
+select option {
   background: #0f172a;
   color: #e5e7eb;
 }