feat: v1.2.0 SRS flashcards, tone controls, test suite, and CI improvements

.github/ISSUE_TEMPLATE/feature_request.md

@@ -22,6 +22,7 @@ What would you like to happen?
 - [ ] Flashcards
 - [ ] New module
 - [ ] UI / Popup
+- [ ] Server (grammar proxy)
 - [ ] Docs / Translations
 
 ## Alternatives considered

.github/PULL_REQUEST_TEMPLATE.md

@@ -14,18 +14,23 @@ The motivation or issue this addresses (link an issue if one exists).
 - [ ] Flashcards (`content_scripts/flashcard.js`)
 - [ ] Config files (`config/`)
 - [ ] UI (`ui/`)
+- [ ] Server (`server/`)
+- [ ] Tests (`tests/`)
 - [ ] Docs / Translations (`sources/`, `README.md`)
 - [ ] GitHub / repo files
 
 ## Testing done
 
+- [ ] `npm test` passes
 - [ ] Tested in Firefox
 - [ ] Tested in Chrome
 - Tested on: (list the sites or scenarios you checked)
 
 ## Checklist
 
+- [ ] PR title follows `type: description` format (feat / fix / chore / ci / docs / refactor / test / security)
 - [ ] No new external dependencies added
 - [ ] No user data sent anywhere without opt-in
 - [ ] Config changes are backwards-compatible (old keys still work)
 - [ ] If CSS selectors changed: verified they work on the live site today
+- [ ] CHANGELOG.md updated if this is a user-facing change

.github/labeler.yml

@@ -29,3 +29,11 @@ docs:
 config:
   - changed-files:
     - any-glob-to-any-file: ['config/**']
+
+server:
+  - changed-files:
+    - any-glob-to-any-file: ['server/**']
+
+tests:
+  - changed-files:
+    - any-glob-to-any-file: ['tests/**']

.github/workflows/auto-label.yml

@@ -12,6 +12,6 @@ jobs:
   label:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@v5
+      - uses: actions/labeler@v6
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/codeql.yml

@@ -0,0 +1,33 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Weekly scan every Monday at 08:00 UTC
+    - cron: '0 8 * * 1'
+
+jobs:
+  analyze:
+    name: Analyze JavaScript
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: javascript
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: /language:javascript

.github/workflows/lint.yml

@@ -1,4 +1,4 @@
-name: Lint
+name: Lint & Test
 
 on:
   pull_request:
@@ -10,17 +10,33 @@ permissions:
 
 jobs:
   web-ext-lint:
+    name: web-ext lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version: '20'
-      - run: npm install -g web-ext
+          cache: 'npm'
+      - run: npm ci
       - run: |
-          web-ext lint \
+          npx web-ext lint \
             --source-dir . \
             --ignore-files "server/**" \
             --ignore-files "sources/**" \
             --ignore-files ".github/**" \
+            --ignore-files "tests/**" \
+            --ignore-files "node_modules/**" \
             --ignore-files "*.md"
+
+  test:
+    name: Vitest unit tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '20'
+          cache: 'npm'
+      - run: npm ci
+      - run: npm test

.github/workflows/pr-check.yml

@@ -9,11 +9,28 @@ permissions:
   pull-requests: read
 
 jobs:
+  title-check:
+    name: PR title follows conventional commits
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/github-script@v9
+        with:
+          script: |
+            const title = context.payload.pull_request.title || '';
+            const valid = /^(feat|fix|chore|ci|docs|refactor|test|security)(\(.+\))?!?:\s.+/.test(title);
+            if (!valid) {
+              core.setFailed(
+                `PR title "${title}" does not follow the conventional commit format.\n` +
+                'Expected: <type>: <description>  (e.g. "fix: handle empty filter list")\n' +
+                'Valid types: feat, fix, chore, ci, docs, refactor, test, security'
+              );
+            }
+
   description-check:
     name: PR has description
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v9
         with:
           script: |
             const body = context.payload.pull_request.body || '';
@@ -28,11 +45,11 @@ jobs:
     name: Version bump has changelog entry
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v9
         with:
           script: |
             const { execSync } = require('child_process');

.github/workflows/selector-check.yml

@@ -14,9 +14,10 @@ jobs:
     name: Validate CSS selectors
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version: '20'
-      - run: npm install --no-save jsdom
+          cache: 'npm'
+      - run: npm ci
       - run: node .github/scripts/check-selectors.js

.github/workflows/stale.yml

@@ -2,7 +2,8 @@ name: Stale
 
 on:
   schedule:
-    - cron: '0 0 * * *'
+    # Weekly on Mondays at 00:00 UTC
+    - cron: '0 0 * * 1'
   workflow_dispatch:
 
 permissions:
@@ -13,7 +14,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@v10
         with:
           days-before-stale: 60
           days-before-close: 7
@@ -28,4 +29,4 @@ jobs:
           close-issue-message: Closed due to inactivity. Feel free to reopen if this is still relevant.
           close-pr-message: Closed due to inactivity. Feel free to reopen if still relevant.
           exempt-issue-labels: 'pinned,security'
-          exempt-pr-labels: 'pinned'
+          exempt-pr-labels: 'pinned,security'

.github/workflows/sync-labels.yml

@@ -14,7 +14,7 @@ jobs:
   sync:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v9
         with:
           script: |
             const labels = [
@@ -34,6 +34,12 @@ jobs:
               { name: 'background',      color: '1abc9c', description: 'background.js or utils.js changes'             },
               { name: 'config',          color: 'f0932b', description: 'Changes to config/ JSON files'                 },
               { name: 'docs',            color: '95a5a6', description: 'Documentation or translation changes'          },
+              { name: 'server',          color: '2980b9', description: 'Changes to the LanguageTool proxy server'      },
+              { name: 'tests',           color: '27ae60', description: 'Changes to the test suite'                     },
+              // Type (mirrors conventional commit prefixes)
+              { name: 'ci',              color: '0075ca', description: 'CI/CD workflow changes'                        },
+              { name: 'refactor',        color: 'e2e2e2', description: 'Code restructuring, no behaviour change'       },
+              { name: 'test',            color: 'c5def5', description: 'New or updated tests only'                     },
             ];
 
             for (const label of labels) {

.gitignore

@@ -25,7 +25,6 @@ web-ext-artifacts/
 # Node (if build tooling is added later)
 node_modules/
 npm-debug.log*
-package-lock.json
 
 # Safari Xcode conversion output
 *.xcodeproj/

CHANGELOG.md

@@ -7,6 +7,30 @@ MindTab uses [Semantic Versioning](https://semver.org/).
 
 ---
 
+## [1.2.0] — 2026-05-16
+
+### Added
+
+- **Spaced repetition (SM-2)** — Flashcards now use a lightweight SM-2 algorithm. "Got it" increases a card's interval; "Skip" or timeout resets it. Due cards are shown first, and a badge on the overlay shows how many cards are currently due
+- **Flashcard export / import** — Custom cards can now be exported as JSON and imported back (or shared as a deck). Import merges into existing cards, with schema validation
+- **Writing check controls** — Settings page now lets you toggle each Tone Translator check independently (passive voice, hedge words, long sentences, filler words, repeated words) and configure the long-sentence word threshold (15–50 words)
+- **Manual theme override** — Settings page has a System / Light / Dark segmented control that overrides `prefers-color-scheme`; preference persisted in sync storage
+- **Custom filter list sources** — Settings page exposes the three filter list URLs with add/remove UI; previously only configurable programmatically. Changes take effect on next update
+- **CodeQL security scanning** — Added `.github/workflows/codeql.yml` for automated JavaScript SAST on every PR and weekly
+- **CONTRIBUTING.md** — Architecture overview, local dev setup, code style and security guidelines, PR checklist
+- **Vitest test suite** — 43 unit tests across tone analysis (`mtDetectTone`, `mtAnalyzeLocally`, `mtReadability`, `mtSyllables`), filter list parser (`parseFilterList`), and CORS origin validation
+
+### Changed
+
+- **Keyboard shortcuts** — `Esc` closes the Tone Translator panel; `Alt+Shift+F` triggers a flashcard on demand
+- **ARIA improvements** — Tone panel has `role="complementary"` + `aria-label`; flashcard overlay has `role="dialog"` + `aria-modal="true"`; flashcard buttons receive focus on card show
+- **Grammar server cooldown** — Added a 750 ms post-analysis cooldown to prevent hammering the grammar server during rapid typing (on top of the existing debounce)
+- **Filter list integrity check** — If a fetched update drops the total selector count by more than 30% vs. the cached set, the update is rejected and the cache is preserved
+- **Branding** — Credit updated to AetherAssembly across all UI pages, linking to `https://aetherassembly.org/about`
+- Bump version to 1.2.0
+
+---
+
 ## [1.1.2] — 2026-05-12
 
 ### Added