Extension UI/UX modernization + PWA polish (tokens, popup redesign, Shadow DOM, iOS Safari verified)

.dockerignore

@@ -0,0 +1,30 @@
+# Docker does NOT read .gitignore — anything not excluded here enters the build
+# context and can end up in image layers. Keep it slim; keep secrets + internal
+# archives OUT.
+
+# Dependencies / build outputs (reinstalled + rebuilt inside the image)
+**/node_modules
+**/.next
+**/.turbo
+**/dist
+**/coverage
+**/playwright-report
+**/test-results
+out
+
+# Secrets & local env — never bake a secret into a layer (.env.example is public)
+**/.env
+**/.env.*
+!**/.env.example
+.secrets
+
+# Internal, gitignored-local archives — secrecy forward-rule (DESIGN.md §2(k))
+audit
+apps/caramel-app/scripts/internal
+
+# VCS / editor / OS
+.git
+.claude
+.idea
+.vscode
+**/.DS_Store

.gitattributes

@@ -0,0 +1,16 @@
+# NF-04: pin line endings so byte-exact gates (generated-file sync test) and
+# prettier are deterministic on every OS regardless of core.autocrlf.
+* text=auto eol=lf
+
+# Binaries — never touch line endings.
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.ico binary
+*.webp binary
+*.woff binary
+*.woff2 binary
+*.ttf binary
+*.zip binary
+*.pdf binary

.github/ISSUE_TEMPLATE/bug-report.md

@@ -7,23 +7,29 @@ assignees: ''
 ---
 
 ## 🐛 Bug Description
+
 A clear and concise description of what the bug is.
 
 ## 🔄 Steps to Reproduce
+
 1. Go to '...'
 2. Click on '...'
 3. See error
 
 ## ✅ Expected Behavior
+
 What you expected to happen.
 
 ## 📱 Environment
+
 - **Browser:** (Chrome, Firefox, Safari)
 - **Version:** (e.g., v1.2.3)
 - **OS:** (Windows, macOS, Linux)
 
 ## 📸 Screenshots
+
 If applicable, add screenshots.
 
 ## 📋 Additional Context
-Any other context about the problem.
+
+Any other context about the problem.

.github/ISSUE_TEMPLATE/contribution.md

@@ -7,7 +7,9 @@ assignees: ''
 ---
 
 ## 🤝 Contribution Type
+
 **What would you like to contribute?**
+
 - [ ] Code (algorithms, features, bug fixes)
 - [ ] Documentation (README, guides, tutorials)
 - [ ] Testing (manual testing, automated tests)
@@ -16,26 +18,33 @@ assignees: ''
 - [ ] Community (Discord moderation, user support)
 
 ## 🛠️ Your Experience
+
 **Technical background:**
+
 - [ ] Beginner developer
 - [ ] Intermediate developer
 - [ ] Senior developer
 - [ ] Non-technical contributor
 
 **Relevant skills:**
+
 - Programming languages:
 - Tools/frameworks:
 - Previous open source experience:
 
 ## ⏰ Availability
+
 **How much time can you commit?**
+
 - [ ] A few hours per week
 - [ ] Several hours per week
 - [ ] Several hours per month
 - [ ] One-time contribution
 
 ## 🎯 Specific Interests
+
 **What areas interest you most?**
+
 - [ ] Frontend development (React, CSS)
 - [ ] Backend development (APIs, databases)
 - [ ] Browser extension development
@@ -45,7 +54,9 @@ assignees: ''
 - [ ] Documentation and guides
 
 ## 📋 Questions or Ideas
+
 **Any specific questions about contributing or ideas you'd like to discuss?**
 
 ---
-*Welcome to the Caramel community! We're excited to have you contribute! 🎉*
+
+_Welcome to the Caramel community! We're excited to have you contribute! 🎉_

.github/ISSUE_TEMPLATE/feature-request.md

@@ -7,14 +7,17 @@ assignees: ''
 ---
 
 ## 💡 Feature Description
+
 **Is your feature request related to a problem?**
 A clear description of what the problem is. Ex. I'm frustrated when [...]
 
 **Describe the solution you'd like:**
 A clear description of what you want to happen.
 
 ## 🎯 Use Case
+
 **Who would benefit from this feature?**
+
 - [ ] Regular shoppers
 - [ ] Power users
 - [ ] Developers
@@ -24,19 +27,25 @@ A clear description of what you want to happen.
 Describe the typical workflow or scenario.
 
 ## 🔧 Technical Details
+
 **Implementation suggestions** (if you have any):
+
 - API changes needed
 - UI/UX considerations
 - Performance implications
 
 ## 📊 Priority
+
 **How important is this feature to you?**
+
 - [ ] Nice to have
 - [ ] Would be helpful
 - [ ] Essential for my workflow
 
 ## 📋 Additional Context
+
 Add any other context, mockups, or examples about the feature request here.
 
 ---
-*Thank you for helping make Caramel better! 🎉*
+
+_Thank you for helping make Caramel better! 🎉_

.github/ISSUE_TEMPLATE/store-request.md

@@ -7,39 +7,48 @@ assignees: ''
 ---
 
 ## 🏪 Store Information
+
 **Store Name:**
 **Store URL:**
 **Store Category:** (e.g., fashion, electronics, retail, marketplace, education)
 **Country/Region:** (e.g., US, EU, Global)
 
 ## 📊 Store Popularity
+
 **Why should we prioritize this store?**
+
 - [ ] Very popular in my region
 - [ ] Frequently requested by users
 - [ ] Has good coupon/discount programs
 - [ ] Large user base
 - [ ] Personal preference
 
 **Estimated demand:**
+
 - [ ] High (many users would benefit)
 - [ ] Medium (some users would benefit)
 - [ ] Low (niche audience)
 
 ## 🔗 Store Details
+
 **Does this store have:**
+
 - [ ] Regular sales/promotions
 - [ ] Coupon codes
 - [ ] Membership discounts
 - [ ] Seasonal sales
 - [ ] Student discounts
 
 **Store size:**
+
 - [ ] Large retailer (Amazon, Walmart level)
 - [ ] Medium retailer (regional chain)
 - [ ] Small/niche retailer
 
 ## 📋 Additional Context
+
 **Any specific challenges or considerations:**
+
 - Special checkout processes
 - Regional restrictions
 - Known coupon sources
@@ -49,4 +58,5 @@ assignees: ''
 (Add any helpful context about the store)
 
 ---
-*Thank you for helping make Caramel better! 🎉*
+
+_Thank you for helping make Caramel better! 🎉_

.github/workflows/ai-evals.yml

@@ -0,0 +1,122 @@
+name: AI Evals – Cart Classifier
+
+# F-012 — standing eval gate for the repo's only LLM surface (cartClassifier
+# -> openrouter -> /api/classify-cart). Mirrors checks-app.yml's setup
+# steps and coupons-schema-drift.yml's loud-secret-check convention (no
+# silent skip when a required secret is missing — see PLAN-F-012.md).
+#
+# PR: path-filtered to the AI surface so unrelated PRs never pay for (or
+# see a stochastic red from) a live OpenRouter call. Nightly: catches a
+# provider silently degrading/swapping the model with zero code change —
+# the only thing that can. Dispatch: manual re-run / future model-swap
+# comparisons.
+on:
+  pull_request:
+    # audit/dev-2026-07-10 is TEMPORARY — remove when the audit branch
+    # merges (mirrors checks-app.yml's F-009 convention).
+    branches: [main, dev, audit/dev-2026-07-10]
+    paths:
+      - 'apps/caramel-app/src/lib/cartClassifier.ts'
+      - 'apps/caramel-app/src/lib/openrouter.ts'
+      - 'apps/caramel-app/src/lib/env.ts'
+      - 'apps/caramel-app/src/app/api/classify-cart/**'
+      - 'apps/caramel-app/evals/**'
+      - 'apps/caramel-app/vitest.eval.config.ts'
+      - 'apps/caramel-app/package.json'
+      - '.github/workflows/ai-evals.yml'
+  schedule:
+    # 09:00 UTC daily. Only actually arms once this workflow is on the
+    # default branch — GitHub only evaluates `schedule` there (see
+    # PLAN-F-012.md's "Human handoff").
+    - cron: '0 9 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ai-evals-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  eval:
+    name: Cart classifier eval
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    # Fork guard — a `pull_request` (not `pull_request_target`) from a fork
+    # never receives repo secrets anyway, but this makes the intent
+    # explicit and fails fast with a clear reason instead of a confusing
+    # downstream "secret missing" error on every fork PR.
+    if: |
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          run_install: false
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Verify OPENROUTER_API_KEY secret is configured
+        env:
+          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+        run: |
+          if [ -z "$OPENROUTER_API_KEY" ]; then
+            echo "::error::OPENROUTER_API_KEY secret is not set on this repository. Add it under Settings -> Secrets and variables -> Actions before this workflow can pass. See PLAN-F-012.md."
+            exit 1
+          fi
+
+      - name: Run cart-classifier evals
+        working-directory: ./apps/caramel-app
+        shell: bash
+        env:
+          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+        # Raw vitest invocation, NOT the `eval` package.json script — that
+        # script's env-loading targets a local .env file, which CI never
+        # has; OPENROUTER_API_KEY above is real process env already.
+        # OPENROUTER_MODEL is deliberately NOT set here — leaving it unset
+        # means src/lib/env.ts's own zod default ('openai/gpt-5-mini') is
+        # the single source of truth for which model gets tested, so this
+        # workflow can never itself become a second, silently-drifting
+        # pin (exactly the failure mode F-012 exists to catch).
+        run: pnpm exec vitest run --config vitest.eval.config.ts | tee eval-report.txt
+
+      - name: Upload eval report
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: cart-classifier-eval-report
+          path: apps/caramel-app/eval-report.txt
+          retention-days: 14
+
+  notify-on-nightly-failure:
+    name: Open issue on nightly failure
+    needs: eval
+    if: failure() && github.event_name == 'schedule'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - name: Open provider-drift issue
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        # No --label: this repo's label set (checked via `gh label list`)
+        # has no AI/eval-specific label, and creating one out-of-band here
+        # would be a second silent failure mode (gh errors on an unknown
+        # label) if it ever drifted. The title makes the issue findable.
+        run: |
+          gh issue create \
+            --repo "${{ github.repository }}" \
+            --title "Nightly AI eval failed: cart classifier ($(date -u +%F))" \
+            --body "The nightly cart-classifier eval run failed on $(date -u +%F' '%T' UTC'). This can mean the OpenRouter model degraded/drifted, the OPENROUTER_API_KEY secret expired or was revoked, or a real regression landed in cartClassifier/openrouter. See the failed run: $RUN_URL"