From 150bf32cbd691ad04242e5588afb700d94a38d84 Mon Sep 17 00:00:00 2001
From: Claude Code <github@thedreamlab.uk>
Date: Fri, 25 Sep 2026 10:29:47 +0000
Subject: [PATCH] feat(popup): a quiet version line on every screen, with the
 commit CI built
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every CI build of main shares the manifest version, so the version alone
cannot tell two downloads apart. CI stamps build.json with the commit it
built (the PR head on a pull request, not GitHub's temporary merge commit),
and the popup shows 'v0.0.9 · 2cf8fe8' at the foot of every screen, the full
commit and build time on hover. A source build has no build.json and shows
the version alone.

Co-Authored-By: jjohare <github@thedreamlab.uk>
---
 .github/workflows/ci.yml |  5 +++++
 .gitignore               |  1 +
 popup/popup.css          | 14 ++++++++++++++
 popup/popup.html         |  3 +++
 popup/popup.js           | 25 +++++++++++++++++++++++++
 5 files changed, 48 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a4e24d2..915632c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -38,11 +38,16 @@ jobs:
       # folder once, so the download unzips straight to the folder Chrome loads
       # (uploading a .zip would hand people a zip inside a zip).
       - name: Stage extension (unpacked folder)
+        env:
+          # on a pull request, the PR's own head (github.sha there is a temporary merge commit)
+          BUILD_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
         run: |
           mkdir -p dist/podkey
           # vendor/ holds the sidestr engine the spend window imports (MV3 forbids remote code)
           cp -r manifest.json src popup vendor $([ -d icons ] && echo icons) LICENSE PRIVACY.md dist/podkey/
           find dist/podkey -name '*.test.js' -delete
+          # the commit this package was built from, shown beside the version in the popup
+          printf '{"commit":"%s","built":"%s"}\n' "$BUILD_COMMIT" "$(date -u +%Y-%m-%dT%H:%MZ)" > dist/podkey/build.json
 
       - name: Check the folder holds every file the extension loads
         run: |
diff --git a/.gitignore b/.gitignore
index 5afa9ee..b996138 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,3 +10,4 @@ dist/
 .idea/
 src/background.bundle.js
 popup/popup.bundle.js
+build.json
diff --git a/popup/popup.css b/popup/popup.css
index 299d032..6c9de6b 100644
--- a/popup/popup.css
+++ b/popup/popup.css
@@ -702,6 +702,20 @@ input:focus-visible + .slider {
   color: var(--text-faint);
 }
 
+/* ---- Version: quiet, on every screen ---- */
+.version {
+  text-align: center;
+  padding: 6px 0 2px;
+  font-family: var(--mono);
+  font-size: 10.5px;
+  color: var(--text-faint);
+  user-select: text;
+}
+
+.version:empty {
+  display: none;
+}
+
 /* ---- Scrollbars ---- */
 .trusted-list::-webkit-scrollbar,
 .event-preview::-webkit-scrollbar {
diff --git a/popup/popup.html b/popup/popup.html
index 11da8f4..f4c2b89 100644
--- a/popup/popup.html
+++ b/popup/popup.html
@@ -314,6 +314,9 @@ <h1>Podkey</h1>
       </div>
     </div>
 
+    <!-- Version, on every screen. CI stamps build.json with the commit it built. -->
+    <div class="version" id="version" aria-label="Podkey version"></div>
+
     <script src="popup.bundle.js"></script>
   </body>
 </html>
diff --git a/popup/popup.js b/popup/popup.js
index 898175f..6f50061 100644
--- a/popup/popup.js
+++ b/popup/popup.js
@@ -26,8 +26,33 @@ let currentScreen = 'setup';
 // (cancel or closing the window) leaves no partial state anywhere.
 let pendingDerivedIdentity = null;
 
+/**
+ * Show the version quietly at the foot of every screen: the manifest's version,
+ * plus the commit CI built it from when the package carries build.json (a
+ * source build has none and shows the version alone). Every CI build of main
+ * shares a version, so the commit is what tells two downloads apart.
+ */
+async function showVersion () {
+  const el = document.getElementById('version');
+  if (!el) return;
+  const version = chrome.runtime.getManifest().version;
+  el.textContent = `v${version}`;
+  el.title = `Podkey ${version}`;
+  try {
+    const res = await fetch(chrome.runtime.getURL('build.json'));
+    if (!res.ok) return;
+    const build = await res.json();
+    if (typeof build.commit !== 'string' || !/^[0-9a-f]{7,40}$/.test(build.commit)) return;
+    el.textContent = `v${version} · ${build.commit.slice(0, 7)}`;
+    el.title = `Podkey ${version}, built from ${build.commit}${build.built ? ` on ${build.built}` : ''}`;
+  } catch {
+    // no build.json: a source build, version alone
+  }
+}
+
 // Initialize
 document.addEventListener('DOMContentLoaded', async () => {
+  showVersion();
   await checkKeypairStatus();
   setupEventListeners();