Bug Fixes
Adding a torrent from a link no longer fails until the popup is opened — a link or magnet click could wake the background before settings had loaded (request went to an empty address), and the Deluge web session (1 h by default) or the daemon connection could have expired. Each add now waits for settings, logs in and connects to the daemon first.
Credentials no longer wiped on a version upgrade — the options page re-saved settings before the stored password and Prowlarr API key had been decrypted into the form, saving them as empty. Every save (Save, Apply, Test connection) now waits until they are loaded.
One encryption key on first save — saving a password and a Prowlarr API key at the same time on a fresh install could create two keys, leaving one credential unreadable. An unreadable credential is now sent as empty instead of as the encrypted text.
Torrent list no longer freezes — after one slow or failed refresh, auto-refresh never restarted until the popup was reopened.
Delete options and label dropdown stay open — event polling redrew the list every second, closing them. It now redraws only when Deluge reports events, and not while refresh is paused.
"" label and tracker filters work again — selecting them showed all torrents.
Magnet and .torrent links work normally before a server is set up — with no Deluge address configured, clicks on them were blocked.
Manual add accepts any http(s) URL — URLs such as .../file.torrent?passkey=... or dl.php?id=5 were silently ignored; invalid input now shows a message.
Deluge 2 host handling — host and status fields were read in the Deluge 1.3 layout, so a stopped daemon was never started and a connected host was not preferred. Both layouts are now supported.
Credential mode switch — toggling "Keep credentials on this device only" could leave the background without a password until the browser restarted.
Status checks use alarms — the periodic connection check stopped when the background was suspended, so the toolbar icon could show connected while the server was down; parallel checks no longer stack up timers.
Slower servers — the popup connection check waited only 1 s and did not retry; it now waits 5 s and retries every 5 s while the server is unreachable.
Sorting — descending sort swapped torrents with equal values on every refresh.
Refresh interval setting — the popup used the default interval because it read the setting before it was loaded.
HTTP errors and login retries — an HTTP error from a reverse proxy (e.g. 502) is reported as such instead of as a daemon error, and login is retried once instead of without limit.
Torrent names and labels are shown as text — they were inserted into the list as HTML, so a name containing markup could change the layout or load remote content.
Firefox for Android — the background no longer fails at startup on Android, where the context menu API does not exist.

Bug Fixes
Dark mode and icon pack no longer change the data-theme / data-icons attributes on websites you visit; they only apply to the extension's own pages. — js/global_options.js also runs as a content script on every http(s) page, and applyDarkMode() / applyIconPack() set or removed data-theme / data-icons on the page's element. Sites whose own dark mode uses data-theme broke. Both functions now return early unless the page is an extension page.

v1.5.12 — Fix: no torrents shown when the Deluge Label plugin is disabled

• Fixed: the popup showed an empty torrent list if the Label plugin was not enabled in Deluge. Torrents now show whether or not the plugin is enabled.
• Fixed: a remembered label filter for a label that no longer exists in Deluge could hide all torrents. It now falls back to "All".
• The Label filter and the per-torrent label dropdown are now hidden when the Label plugin is disabled.

Release v1.5.10 - Hotfix: PasswordCrypto.resolveCredential is not a function (+ code cleanup)

Fixes a runtime crash in v1.5.9 that broke login and Prowlarr API
calls. The new PasswordCrypto.resolveCredential helper added in
v1.5.9 was defined in js/crypto.js (used by options/popup pages)
but the service worker (js/background.js) embeds its own separate
PasswordCrypto object that never received the new method. Two call
sites in the service worker referenced it, throwing TypeError on
every login attempt and Prowlarr search.

Both call sites reverted to PasswordCrypto.decrypt(), which the
service worker's embedded PasswordCrypto already implements with
format auto-detection: encrypted blobs are decrypted, plaintext
passes through unchanged.

Bundled cleanup (no behavior change): removed dead CREDENTIAL_KEYS
constant, updated stale comments, marked resolveCredential helper
as optional in its docstring, documented lazy-migration assumption
in background.js, clarified options.html helper text on the
account-wide-toggle vs local-encrypted-credentials distinction.

Release v1.5.9 — Multi-Device Credentials: Plaintext Sync with Account-Wide Toggle

Reworks v1.5.7's 'Keep credentials on this device only' toggle so:
- Unchecked actually stores credentials as plaintext in storage.sync
(was a no-op encrypted mirror in v1.5.7)
- The toggle itself syncs via storage.sync.store_credentials_locally
(was per-device in v1.5.7), so unchecking on PC1 propagates the
mode flip and the plaintext to every device on the same account
- onChanged listener on each device routes the new plaintext to the
runtime field and clears the now-stale encrypted blob from local
- Migration moves the legacy per-device toggle from storage.local
to storage.sync; legacy encrypted blobs in sync get cleaned up

Helper text in options page documents the security trade-off and
the account-wide scope of the toggle. Re-checking the toggle still
requires per-device password re-entry (per-device keys can't
decrypt each other's blobs).

Reworks v1.5.7's 'Keep credentials on this device only' toggle so
its unchecked state actually does something useful for multi-device
users. In v1.5.7 both modes encrypted credentials and the toggle
only controlled whether to mirror the encrypted blob to sync — but
since the encryption key is per-install, mirroring didn't help
multi-device users. Effectively a no-op for its stated purpose.

v1.5.8 makes the modes genuinely different:
- Checked (default, more secure): AES-GCM encrypted in storage.local
only, never syncs.
- Unchecked (less secure): plaintext in storage.sync, shared across
all devices on the same browser account.

Storage layout uses _plain suffix on plaintext keys so format is
unambiguous from the key name. Helper text in options page makes
the trade-off explicit. Migration on upgrade from v1.5.7 cleans up
legacy encrypted sync blobs.

v1.5.7 — Per-Device Credential Storage (Multi-Device Sync Fix)

Fixed a credential-sync deadlock that caused repeated password prompts when using the extension on multiple PCs sharing a Firefox account.

What was happening:
The encryption key is generated per-install (stored only on each device, never synced), but encrypted credentials were going through Firefox Sync. Each device received the others' ciphertext, couldn't decrypt it with its own key, and re-encrypted on its own — creating an endless overwrite loop.

What's new:
- New "Keep credentials on this device only" checkbox in Basic Setup (default: enabled). Your Deluge password and Prowlarr API key now stay encrypted in local storage per-device.
- Disabling the checkbox restores synced-credential behavior for single-device users who want browser-account backup.
- Same fix applies to the Prowlarr API key.
- One-time migration on upgrade: your active device keeps working without re-prompting; other devices prompt once for the password and then work seamlessly.

No storage schema changes, no new permissions, no AMO-safety regression.

2026-04-21 v1.5.6 — Options Status Messages: Only Show What Actually Changed
- Fixed Apply announcing every setting as "updated" even when only one field was edited — the status block now shows only messages for keys whose value actually changed, and Apply with no edits is silent

v1.5.5 — Pagination Visibility & Prowlarr Options Polish
2026-04-21

2026-04-21 v1.5.4 — Pagination Settings Init Fix

• Fixed "Show per-page selector in popup" and "Always show pagination bar" not applying on popup open (settings saved and toggled correctly, but the initial render happened before storage finished loading)

2026-04-21 v1.5.3 — Pagination UX & Remember Indexer Selection
New per-page selector dropdown in the popup (optional, gated by Options checkbox)
Added "5" as a per-page option
New "Always show pagination bar" option (default off — opt-in for users who want it persistent)
Indexer selection on the Prowlarr Search tab now persists across popup close/reopen
background.js reorganized with section banners and table of contents

2026-04-21 v1.5.2 — Bug Fixes
Fixed torrent size showing "0.0 KiB of 0.0 KiB" — now uses Deluge's authoritative total_done / total_wanted fields instead of deriving from total_size × progress
Fixed HTTP 400 from Prowlarr when searching multiple indexers — now sends repeated indexerIds / categories query parameters instead of comma-joined values

2026-04-18 v1.5.1 — Prowlarr Search Table Fix

Fixed Prowlarr search result rows collapsing into the Title cell
buildRow() now returns a real <tr> built with createElement
No more DOMParser-based row construction (was hoisting table rows out of their wrapper)

2026-04-18 v1.5.0 — Prowlarr Integration & Optimistic Delete

Full Prowlarr search from the popup — tabbed UI (Torrents / Search Indexers / History)
Indexer multi-select, sortable results, one-click grab
Search history (last 50 queries persisted)
Encrypted Prowlarr API key (same AES-GCM as Deluge password)
Optimistic torrent deletion — instant row removal with server reconciliation
Auto-reconnect to daemon after WebUI disconnects
All Prowlarr UI uses AMO-safe DOM methods (no innerHTML)

Bug Fixes
Removed innerHTML in options.js — AMO validator flagged an unsafe innerHTML assignment in the status message handler (line 205). Replaced with safe DOM construction using createElement("br"), createTextNode(), and appendChild(). Functionally identical — the status message displays the same way, just built from safe DOM nodes instead of HTML string concatenation.

Fixed pagination bar appearing light in dark themes (including System/OS dark mode)

New Features
Search by Name
New search input at the top of the popup filters the torrent list in real time (150ms debounce). Press Escape to clear. Combines with existing State, Tracker, and Label filters.

Setup Page Polish
Live URL preview — As you type, a preview box shows the exact endpoint URL being built (e.g. http://192.168.1.14:8112/json). Helps catch typos before saving.
Password show/hide toggle — Eye icon next to the password field.
Clearer base path help — Inline hint explains the base path field is only needed for reverse proxies, with examples.
HTTP warning panel — When HTTP protocol is selected, an inline warning appears with instructions for adding a Firefox HTTPS-Only Mode exception.
Enhanced Test Connection feedback — Color-coded result (green ✓ / red ✗) with specific error messages.
Label Plugin Detection
The extension now queries core.get_enabled_plugins on the first successful connection. If the Label plugin is not enabled on the Deluge server, the entire Label UI is hidden (per-row dropdowns + toolbar filter).

Performance
Diff-Based Polling
Subsequent polls use core.get_torrents_status with diff=true, returning only fields that changed. For large libraries (1000+ torrents) this reduces payload by 80-95%.

Event-Driven Updates
Subscribes to Deluge's event system — TorrentAddedEvent, TorrentRemovedEvent, TorrentStateChangedEvent, TorrentFinishedEvent, SessionPausedEvent, SessionResumedEvent — and polls web.get_events every second.

Trimmed Request Payload
Removed 5 unused fields — about 22% less data per torrent.

Bug Fixes
Fixed AbortError: signal is aborted without reason uncaught rejection from API timeouts
Raised API timeouts from 1500-2000ms to 5000ms

v1.3.0 — Pagination & Test Connection Fix

2026-04-15

New Features

• Torrent list pagination — The popup now paginates the torrent list instead of rendering every torrent at once. Default is no paging. Previous/Next buttons appear automatically when needed and hide when all torrents fit on a single page.
• Configurable page size — New "Torrents per page" dropdown in Options → Extras lets you choose 10, 20, 50, 100, or All (no paging).

Bug Fixes

• Test Connection now saves settings first — Previously the "Test Connection" button on the Options page had no handler wired up. It now calls saveOptions() before sending check_status, so it tests against the values currently in the form rather than stale stored values. Shows clear feedback: green "Connected!", or red "Failed (reason)".

Behavior Details

• Changing sort, filters, or adding/removing torrents resets pagination to page 1.
• Pagination bar is fully themed — works with all 6 themes and system auto dark mode.
• Page size setting takes effect immediately on the next popup open (or next render cycle if the options page is open alongside the popup).

v1.2.0 Changes:
- Removed all innerHTML usage — replaced with safe DOM methods (createElement, textContent, DOMParser)
- Added "Test Connection" button to Options page
- Raised minimum Firefox version to 140 (required for data collection permissions)
- Added Android support (min version 142)