Fixed
Keep explicit media fetches on Firelink's configured yt-dlp cookie source instead of forwarding a potentially oversized raw browser cookie header.
Keep ordinary captured downloads able to use their browser session while preventing explicit media requests from carrying stale or oversized cookies into metadata fetching.

New
* Add Fetch media actions in the popup and page/video/audio context menus.
Improved
* Compact the popup layout so pairing, capture, per-site controls, and media fetch fit without long guidance text.
* Require Firelink local protocol v4 for explicit Fetch media handoffs so older desktop builds do not silently treat them as normal downloads.
* Forward container-aware cookies only for explicit single-page media fetches and automatic single-download captures.
**Fixed
* Fall back to selected-text URL parsing when the browser cannot expose a tab for the selected-link context menu.

• Require the Firelink 1.0 desktop app and its local protocol v3 for automatic download capture.
• Older desktop builds are rejected before the extension can cancel an automatic browser download.

• Add stronger desktop-server identity checks before trusting localhost responses.
• Add dynamic port discovery across Firelink's 127.0.0.1:6412-6422 listener range.
• Add safer explicit launch behavior through firelink://launch when the app is closed.
• Add clearer offline, invalid-token, and update-required behavior for browser handoff failures.

• Route automatic captures through Firelink's Add window while preserving the browser download unless Firelink confirms acceptance.
• Keep manual context-menu downloads free of browser cookies by default.
• Forward browser cookies only for automatic single-download captures that need the browser session.
• Avoid sharing one site's cookies across multi-link batches.
• Keep the extension package self-contained for Mozilla review by removing remote font loading.
• Update Firefox compatibility metadata and data-collection declarations for the current add-on store requirements.

• Fix event-page startup races so capture settings are respected after the background worker wakes up.
• Fix unsupported Firefox notification-button usage that could prevent capture listeners from registering.
• Fix protocol fallback paths that could open unnecessary tabs or lose the original browser download.
• Fix host permissions and local API port metadata so the extension matches the Firelink 1.0 desktop listener.

Security Fixes:

Upgraded the Firelink app connection protocol to use HMAC-SHA256 signatures, preventing unauthenticated access to the local extension server.
The extension now correctly signs the payload and a timestamp using the pairing token instead of passing it as a simple HTTP header.

Fixes:

Prevented the extension from falling back to deep linking if the pairing token hasn't been set, fully closing a token bypass vulnerability.
Added a silent flag to the payload when capturing background downloads to explicitly differentiate auto-captures from manual context-menu clicks, restoring the intended "Add Downloads" bypass behavior.
**Updated the connection status check in the popup to correctly sign the /ping request, resolving an issue where it incorrectly displayed "App is closed".

**Fixes:
- Fix Manifest V3 service worker/event page state race condition to ensure user settings (like disabling global capture) are strictly respected upon wakeup.
- Pause browser downloads while pinging the Firelink app to reliably prevent duplicate files from being downloaded.
- Remove inline onerror attribute in the popup to ensure 100% compliance with Firefox's strict Manifest V3 Content Security Policy (CSP).

Improvements

• Polish the pairing-token popup UI by moving inline styles into the extension stylesheet and masking the token input by default.
• Document that Firelink app updates now use GitHub Releases while the browser extension remains a separate add-on release.

Changes

• Remove stale references to the old static firelink-extension-v1 token from the background script.

Improvements

**Update connection check to correctly handle empty pairing tokens by displaying a "Setup Required" state.

Fixes

**Fix notification spam by suppressing the "Firelink Setup Required" alert on automatic background downloads when the token is missing.

Improvements

• Preserved the custom protocol fallback for manual "Download with Firelink" actions, ensuring resilience when the local Firelink API is unavailable.

Changes

• Updated release note generation to use the changelog entry for GitHub release page descriptions, ensuring consistency across the source tree and published notes.

Fixes

• Prevented global download capture from canceling or erasing the browser download unless the native Firelink app explicitly confirms the local API handoff.

Version 1.0.7 introduces several reliability and UI improvements:

• Redesigned extension icons for a more modern look and better high-resolution scaling.
• Optimized connection latency and silenced unnecessary interruptions from the native app.
• Improved link interception by using hidden iframes, completely eliminating blank tabs when capturing downloads.
• Added multiple connection fallbacks and port probing to ensure reliable communication with the Firelink native app.
• Enabled "Capture Downloads" by default to provide a smoother onboarding experience.
• Aligned naming and terminology to "Firelink Companion" throughout the extension.
• Various under-the-hood UI improvements, stability upgrades, and backward compatibility measures.

Fixes: Hardened the local Firelink bridge to ensure more secure and reliable communication between the extension and the local download manager client.