FlowHunni Veo Flow Extension v0.8.36
Artifact: SINGLE PRODUCTION ZIP
Phase: v0.8.36 clean logout, dirty-disable device lock, genuine Lower Priority default, edit-composer hide
Build ID: fh-prod-v0.8.36-8d164b65f2682e0b9c1a27d0
Server/API: guarded device-binding login, bootstrap, dirty-disable lock, and verified manual logout; existing heartbeat contract retained
bfcache defense: declarativeNetRequestWithHostAccess static rule sets Cache-Control no-store on labs.google Flow main_frame; Back = full reload, never a live restore
Restore-race defense: pageshow persisted re-locks synchronously before revalidation; UI paint gate is fail-closed (hidden until entitlement confirmed)
Generation gate: MAIN-world acquire is fail-closed for generation endpoints unless a fresh entitled policy snapshot exists
Provider cookies: trusted-context crash checkpoint only until injection; values never logged and checkpoint is cleared on completion
Cookie cleanup: exact extension-owned labs.google identities only
Usage journal: chrome.storage.local crash-durable lifecycle; secrets and prompts excluded
Control cycle: one-minute overview, reconciliation, heartbeat order on existing routes
Idle/background: 15-minute Flow idle, 30-minute background grace, active-job protection
Cookie continuity: fixed 5-minute local TTL, opportunistic half-life renewal, one-minute control alarm backup
Pending close backstop: 22 minutes without active work, 122 minutes when active work existed at close
Sticky close: last-tab close allows one 90-second same-assignment reconnect before automatic release
Dead-man: one-second local runtime identity check locks the page, requests worker tab-close while alive, and navigates orphaned Flow pages to an inert locked screen
Message boundary: exact extension ID, popup/Flow sender, active tab binding, schema, age, size and replay checks
Risk preflight: exact cookie-tool IDs plus cookies and broad Google host capability pair; owner allowlist preserved
Native exit: secure cleanup precedes browser disable/uninstall confirmation
Install types: development, normal, admin
Distribution: flowhoney.com ZIP, permanent folder, Developer Mode, Load unpacked
Build: deterministic, minified, obfuscated, no source maps, no remote code, binary integrity metadata included
Obfuscation budget: 726640/299347 bytes (2.427x)
DOM query budget: 30 querySelectorAll call sites; wildcard hot scans zero
Client-side integrity is deterrence and fail-closed policy, not a substitute for server enforcement
