# Tab Vault — Chrome tab / session manager

A Manifest V3 extension that saves, tags and searches tab sessions, with a small
PHP + MySQL backend for encrypted cross-device sync. Built to fix the three things
people complain about in OneTab / Session Buddy / Tab Wrangler:

| Common complaint | What Tab Vault does |
|---|---|
| **Data loss** on a crash or update | Nothing is ever hard-deleted without a snapshot. Soft-delete **Trash** (30-day retention), per-session **version history** with **Undo** (`Ctrl+Z`), rolling **local safety backups** in IndexedDB (10 kept, one written after every save and daily), plus one-click **JSON export/import**. |
| **Dated UI**, no search/tags/projects | Full-page manager with instant multi-term **search** across titles, tags, tab titles and URLs; **tags** with a filter bar; sort options; keyboard shortcuts (`/`, `n`, `Ctrl+Z`, arrows, `Enter`, `Delete`). Light/dark, responsive. |
| **No reliable / encrypted sync** | Account-based sync to your own server. Optional **end-to-end AES-GCM encryption** — the passphrase is derived locally (PBKDF2, 210k) and never sent; the server only stores ciphertext + IV. Last-write-wins merge with tombstones. |

```
tab-manager/
├── extension/            # load this folder as an unpacked extension
│   ├── manifest.json
│   ├── background.js     # service worker: shortcuts, menus, alarms, capture
│   ├── popup.{html,js,css}
│   ├── manager.{html,js,css}
│   ├── lib/{db,api,sync}.js
│   └── icons/
└── api/                  # PHP 8.1+ / MySQL backend
    ├── index.php  db.php  schema.sql
    ├── config.sample.php  → copy to config.php
    └── .htaccess
```

## 1. Install the extension (local)

1. `chrome://extensions` → enable **Developer mode**.
2. **Load unpacked** → select `tab-manager/extension/`.
3. Pin it. `Ctrl/Cmd+Shift+S` saves the current window, `Ctrl/Cmd+Shift+E` opens the manager.

Works fully offline at this point — sync is optional.

## 2. Backend (local, MAMP)

```bash
cd /Applications/MAMP/htdocs/tab-manager/api
cp config.sample.php config.php          # edit db_user/db_pass if not root/root
/Applications/MAMP/Library/bin/mysql -u root -proot -e "CREATE DATABASE tabvault CHARACTER SET utf8mb4;"
/Applications/MAMP/Library/bin/mysql -u root -proot tabvault < schema.sql
```

Health check: open `http://localhost:8888/tab-manager/api/` → `{"ok":true,...}`.

## 3. Connect the extension to the backend

Manager → **⚙ Settings** → *Cloud sync*:

1. **Backend URL**: `http://localhost:8888/tab-manager/api` (no trailing slash).
2. Fill email + password, optionally an **encryption passphrase** (enables E2E).
3. **Create account**, then **Sign in**. First sync runs automatically; thereafter it
   syncs every 5 min, on each save, and on demand.

On another device: install the extension, set the same Backend URL, sign in with the
**same email + password + passphrase**. Without the exact passphrase, E2E sessions
can't be decrypted (by design).

## 4. Deploy the backend to Hostinger

Upload only the `api/` folder to the target domain, e.g. `~/domains/<domain>/public_html/tab-manager/api/`,
create a MySQL database + user in hPanel, put those credentials in `config.php`, import `schema.sql`,
and set the extension's Backend URL to `https://<domain>/tab-manager/api`. Serve it over HTTPS.
After you've created your accounts, set `'allow_register' => false` in `config.php`.

## Notes / trade-offs

- **E2E key at rest**: the derived AES key is cached in the browser's IndexedDB so
  background sync works without re-prompting. It never leaves the device and is never
  sent to the server, but it is not encrypted at rest locally. Sign out to wipe it.
- **Merge model** is last-write-wins per session by `updatedAt` (ms). Concurrent edits
  to the *same* session from two offline devices keep the later save; tab-level merging
  is out of scope for this MVP.
- Internal pages (`chrome://`, extension pages, `about:`) are skipped when saving.
- The backend has no rate limiting or email verification — add those before exposing
  registration publicly, or disable `allow_register`.