my-provider-dash-manager 0.6.3 → 0.8.0

package/README.md

@@ -1,23 +1,30 @@
-# My Provider Dash Manager
+# My Provider Dash Manager — multi-account manager for 37 cloud services
 
-**One desktop app for every account you own.** Keep several Google, Microsoft, AWS, Vercel, Netlify,
-Cloudflare, Supabase, GitHub, npm, Stripe, Gmail, Outlook and Proton Mail accounts (37 services built
-in, any site by URL) signed in at the same time, each in a fully isolated session, and switch between
-them instantly — the way a browser handles tabs, but built around *accounts* instead of pages.
+[![version](https://img.shields.io/github/v/release/FiredMosquito831/my-provider-dash-manager?label=version)](https://github.com/FiredMosquito831/my-provider-dash-manager/releases/latest)
+[![npm](https://img.shields.io/npm/v/my-provider-dash-manager)](https://www.npmjs.com/package/my-provider-dash-manager)
+[![downloads](https://img.shields.io/npm/dm/my-provider-dash-manager)](https://www.npmjs.com/package/my-provider-dash-manager)
+[![stars](https://img.shields.io/github/stars/FiredMosquito831/my-provider-dash-manager)](https://github.com/FiredMosquito831/my-provider-dash-manager)
+[![licence](https://img.shields.io/badge/licence-source--available-green)](LICENSE)
+
+**For freelancers, agencies and developers running client plus personal infrastructure:** one desktop
+app for every account you own. Keep several Google, Microsoft, AWS, Vercel, Netlify, Cloudflare,
+Supabase, GitHub, npm, Stripe, Gmail, Outlook and Proton Mail accounts (37 services built in, any
+site by URL) signed in at the same time, each in a fully isolated session, and switch between them
+instantly — the way a browser handles tabs, but built around *accounts* instead of pages.
 
 <sub>Windows desktop app · Electron 43 · local-first · no telemetry, no account, no server ·
 source-available licence: free for personal and commercial use</sub>
 
-![Home — the account rail on the left, every account as a card, the installed version bottom-left](docs/screenshots/home.png)
+![Home — the account rail on the left, every account as a card, the installed version bottom-left](https://raw.githubusercontent.com/FiredMosquito831/my-provider-dash-manager/main/docs/screenshots/home.png)
 
 Further down Home: the **Add an account** picker with every built-in service you are not using yet
 (37 in total, or add any site by URL), the **Updates** panel with the installed version, and the
 saved-login controls. Install with `npx my-provider-dash-manager` or straight from
 [Releases](https://github.com/FiredMosquito831/my-provider-dash-manager/releases) — see [Install](#install).
 
-![Home, scrolled down — the service picker grouped by category, the Updates panel and saved logins](docs/screenshots/services.png)
+![Home, scrolled down — the service picker grouped by category, the Updates panel and saved logins](https://raw.githubusercontent.com/FiredMosquito831/my-provider-dash-manager/main/docs/screenshots/services.png)
 
-![A Gmail account open in the app, with back / forward / reload / dashboard and the address bar in the strip](docs/screenshots/navigation.png)
+![A Gmail account open in the app, with back / forward / reload / dashboard and the address bar in the strip](https://raw.githubusercontent.com/FiredMosquito831/my-provider-dash-manager/main/docs/screenshots/navigation.png)
 
 <sub>Screenshots use a demo profile with placeholder account names.</sub>
 
@@ -46,14 +53,14 @@ Start Menu and Desktop shortcuts. Your accounts, sessions and saved logins live
 
 Three ways, all ending in the same place:
 
-- **Inside the app.** The version is always shown bottom-left in the rail. When a newer release
-  exists it turns into an **Update x.y.z** button; click it to open the Updates panel on Home, which
-  shows the release notes and offers **Download** and **Restart & install** with progress. The app
-  checks quietly on startup and once an hour after that. Nothing is downloaded or installed until you
-  press the button.
+- **Automatically, inside the app (default).** The app checks on startup and hourly. A newer release
+  downloads in the background and installs silently, with no wizard, the next time you close the app;
+  the rail badge bottom-left turns into **Restart to update x.y.z** if you would rather do it now.
+  Turn **Auto-update** off in the Updates panel on Home and every step waits for a button press
+  instead (Check, Download, Restart & update), with release notes and progress shown.
 - **From the command line.** `npx my-provider-dash-manager` (or `mpdm update` if installed globally)
-  installs the newest release over the current one. Close the app first, or the running copy keeps
-  showing the old version until you restart it.
+  updates an existing install silently and in place; add `--interactive` if you want the wizard.
+  Close the app first, or the running copy keeps showing the old version until you restart it.
 - **From the release page.** Run the newest installer; it upgrades in place.
 
 The repository is public, so updates need no token or account.
@@ -72,7 +79,7 @@ and it is also available as `mpdm`:
 | `… where` | Print the install and data paths |
 | `… uninstall` | Run the uninstaller (accounts and sessions are kept) |
 
-Flags: `--silent` (no wizard), `--download-only`, `--force`, `--version`, `--help`.
+Flags: `--silent` (no wizard on a first install), `--interactive` (wizard for an update), `--download-only`, `--force`, `--version`, `--help`.
 From a checkout of this repository the equivalent is `npm run install:latest`.
 
 ### Run from source
@@ -127,7 +134,9 @@ Keyboard: `Ctrl+W` sleep tab · `Ctrl+Shift+W` sleep all · `Ctrl+Tab` cycle ·
 ## Features
 
 ### Accounts and sessions
-- **Unlimited accounts per service.** Each account gets its own Chromium storage partition — separate
+
+**Multi-account session isolation** — every account in its own Chromium partition:
+- **Unlimited accounts per service.** Each account gets its own storage partition — separate
   cookies, localStorage, IndexedDB and cache. Accounts can never see each other's session.
 - **Sessions persist across restarts.** Sign in once; you stay signed in (verified by an automated
   restart test that counts real cookies after relaunch).
@@ -170,10 +179,15 @@ Every login page is verified to load inside an isolated partition, landing on a
 guard trusts (`npm run smoke:services`). Google sign-in was verified against Google's own flow and
 works in the app. Anything else can be added by URL or as a plugin.
 
-### Saved logins
+### Password manager with per-service import
 - **Remembers logins you type** inside an account tab, bound to *that* account, so two accounts on the
   same service refill with different credentials.
 - **Auto-fills sign-in pages** when it recognises one (toggleable), plus a manual fill action.
+- **Manage logins** from Home → Saved logins → *Manage logins…*: every stored login grouped by
+  service, with delete. No password is ever shown.
+- **Choose which login fills:** when more than one matches a site the app asks instead of guessing,
+  and your choice is remembered as that account's default (marked ★ in the manager).
+- **Re-importing updates changed passwords** instead of silently keeping the old one.
 - **Imports existing passwords** from installed Chromium browsers (Chrome, Edge, Brave, Vivaldi,
   Opera) or from a CSV exported by any browser, including Firefox.
 - Encrypted at rest with Windows DPAPI. Passwords never reach the app's own UI process.
@@ -188,18 +202,26 @@ are upload-only), latest deploy state on Vercel, account name plus charges/payou
 The token field says which credential each service expects. Tokens are validated before being stored,
 encrypted with DPAPI, revocable in one click, and never leave the main process.
 
-### Updates
-- Version always visible in the rail; an **Update** button appears when a newer release exists.
-- Updates panel on Home: installed vs latest, release notes, Check / Download / Restart & install with
-  progress. Nothing installs itself.
-- Startup and hourly checks against the public release feed.
+### Automatic silent updates
+- **Silent in-place updates** by default: downloaded in the background, installed without a wizard
+  when the app closes or on **Restart & update**, relaunched on the new version.
+- **Auto-update toggle** for people who want to press every button themselves.
+- Version always visible in the rail; it becomes **Update x.y.z** / **Restart to update** as the
+  release moves through found → downloaded.
+- Updates panel on Home: installed vs latest, release notes, progress. Startup and hourly checks
+  against the public release feed. The interactive installer is only for first installs.
 
-### Content
+### Built-in ad-blocking and dark mode
 - **Ad-blocking** driven by EasyList (~52,000 blocked hosts plus generic cosmetic rules, refreshed
   weekly), applied per account partition. Main-frame navigation and sign-in infrastructure are never
-  blocked.
-- **Dark mode**: sites that support `prefers-color-scheme` go dark natively, and an optional
-  force-dark inversion covers the ones that don't.
+  blocked. uBlock Origin cannot run inside Electron — its service worker needs browser APIs Electron
+  does not expose — so this built-in blocker covers that need.
+- **Dark mode** for every account tab, powered by Dark Reader's own engine: one toggle on Home
+  applies it everywhere. Flipping it is instant — pages do not reload, so your scroll position and
+  anything half-typed into a form is preserved. It runs Dark Reader inside each tab's isolated
+  session, costing roughly 2 MB per open account. Dark Reader's browser extension cannot run in
+  Electron (its background worker needs APIs Electron does not expose, and its content script
+  would touch the page's own JavaScript), so the engine is bundled and driven directly.
 
 ### Extensibility
 - **Add any service by URL** — it gets its own rail row and isolated per-account sessions.
@@ -239,6 +261,78 @@ http/https only. Nothing syncs anywhere: there is no server, no account and no t
 
 ---
 
+## Requirements
+
+- **Windows 10 or 11** (64-bit). The app is Windows-only today; macOS and Linux are not supported yet.
+- About **350 MB** of memory with all tabs asleep, plus roughly **125 MB per live dashboard** and
+  **2 MB per open account** when dark mode is on. A machine with 8 GB of RAM handles the default
+  five warm tabs comfortably.
+- **Node.js 18+ only for the `npx` route** — the app itself is a standalone Windows executable and
+  needs nothing else installed.
+
+## Frequently asked questions
+
+**Can I be signed into two accounts on the same service at once?**
+Yes. Each account gets its own Chromium storage partition, so both stay signed in simultaneously and
+you switch between them like tabs. Nothing is ever signed out to reach the other.
+
+**How much memory does an extra account use?**
+Roughly 125 MB of private memory per live dashboard (the figure Task Manager reports), on a ~350 MB
+baseline with everything asleep. The app keeps five tabs warm by default and sleeps the rest; slept
+tabs stay in the strip and resume on click.
+
+**Is it safe to store my passwords?**
+Saved logins are encrypted with Windows DPAPI and bound to the account *and* the service's own
+domains — a password typed on an unrelated page reached from a tab is never captured, and a saved
+password is never filled into a page outside the service's domains. DPAPI protects against another
+user on the machine, a stolen disk and casual copying; it does not protect against malware running as
+you, which no desktop app can. Passwords never reach the app's own UI process.
+
+**Does it work on macOS or Linux?**
+Not yet — the app and its installer are Windows-only. The architecture is cross-platform, so other
+operating systems stay open as future work.
+
+**How do I import passwords from Chrome or Edge?**
+Home → *Import from browser* reads installed Chromium browsers directly. Chrome 127 and newer lock
+some entries with app-bound encryption that no other app can read; export those to CSV from the
+browser and use *Import CSV* instead. Firefox always uses the CSV path. Re-importing updates
+passwords you have changed.
+
+**Why does SmartScreen warn me?**
+The installer is not code-signed yet, so Windows shows a warning the first time. Choose **More info →
+Run anyway**. Code signing is planned and removes the warning entirely.
+
+**Can I add a service that is not on the list?**
+Yes — *Add service by URL* gives any site its own rail row and isolated per-account sessions, and
+JSON plugin manifests can define a service plus how to read its API for status cards.
+
+**What happens to my accounts when I update?**
+Nothing is lost. Accounts, sessions, saved logins and settings live in
+`%APPDATA%\multi-acc-manager` and survive updates and reinstalls. Updates install silently in place
+and relaunch the app.
+
+## Compared to the alternatives
+
+| Approach | What it gives you | What it does not |
+|---|---|---|
+| Separate browser profiles | Isolated sessions per profile | One window each, no single place to see every account, no per-account password management |
+| Incognito / private windows | A throwaway session | Nothing persists — you sign in again every time, and juggling windows is manual |
+| Other multi-account managers | Similar switching | Usually extension-based in a normal browser, so one crash or update can take every session with it |
+| **This app** | One window, persistent isolated sessions, a password manager, ad-blocking, dark mode and silent updates | Windows-only, unsigned installer, and no Chrome Web Store extensions (Electron cannot run them) |
+
+## Troubleshooting
+
+- **SmartScreen warns on first run.** Expected while the installer is unsigned: **More info → Run
+  anyway**.
+- **A service will not load inside the app** (Google Cloud Console is a known case). Use the
+  **Browser** button in the strip to open that page in your system browser — it keeps working from
+  there, and the rest of the app is unaffected.
+- **"Which account am I in right now?"** Every tab and rail row is colour-coded and labelled by
+  account, and the tab strip shows the service and account name together. The active tab is
+  highlighted; slept tabs are dimmed.
+
+---
+
 ## Development
 
 ```bash
@@ -246,10 +340,11 @@ npm start              # run the app
 npm run smoke          # sessions, registry, partitions, tab navigation (12 checks)
 npm run smoke:restore  # sessions survive a restart (real cookies)
 npm run smoke:tokens   # DPAPI round-trip + live fake-token rejection per provider (15)
-npm run smoke:creds    # import, per-account recall, encryption at rest (7)
+npm run smoke:creds    # import, per-account recall/selection, defaults, encryption at rest (16)
 npm run smoke:autofill # real page: form detection, fill, capture, origin guard (10)
-npm run smoke:updates  # version comparison + real release-feed check (8)
+npm run smoke:updates  # version comparison, silent-install mode, auto-update toggle, real release-feed check (11)
 npm run smoke:services # every built-in login page loads inside an isolated partition (42)
+npm run smoke:dark     # Dark Reader darkens a white page, stays out of the page's own JS, re-injects after navigation (9)
 npm run capture        # screenshot the running shell (--capture-out, --capture-open svc::id, --capture-js)
 npm run spike          # memory benchmark
 npm run dist           # build the Windows installer locally
@@ -258,7 +353,7 @@ npm start -- --print-paths            # show the app name, version and data fold
 npm start -- --open vercel::personal  # open an account on launch
 ```
 
-The suite is 108 checks across seven modes. `MAM_USER_DATA=<dir>` points any command at an isolated
+The suite is 115 checks across eight modes. `MAM_USER_DATA=<dir>` points any command at an isolated
 profile.
 
 Releases are cut by pushing a `v*` tag: GitHub Actions checks the tag against `package.json`, builds

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "my-provider-dash-manager",
-  "version": "0.6.3",
-  "description": "Manage many accounts per cloud service (Vercel, Netlify, Supabase, Cloudflare, Railway, Render, GitHub) in one desktop app \u2014 isolated persistent sessions, one tab per account.",
+  "version": "0.8.0",
+  "description": "CLI to install and update My Provider Dash Manager: a free Windows desktop app that keeps many accounts per service (Vercel, Netlify, Supabase, Cloudflare, AWS, Google, Microsoft, GitHub, Gmail) signed in at once, each in a fully isolated session. Also available as mpdm.",
   "main": "src/main.js",
   "scripts": {
     "start": "electron .",
@@ -17,6 +17,7 @@
     "internal:log": "git --git-dir=.internal-git --work-tree=. log --oneline",
     "smoke:updates": "electron . --smoke-updates",
     "smoke:services": "electron . --smoke-services",
+    "smoke:dark": "electron . --smoke-dark",
     "install:latest": "node scripts/install-latest.js"
   },
   "devDependencies": {
@@ -31,6 +32,7 @@
     "productName": "My Provider Dash Manager",
     "files": [
       "src/**/*",
+      "vendor/**/*",
       "package.json"
     ],
     "win": {
@@ -57,6 +59,7 @@
   "files": [
     "scripts/cli.js",
     "scripts/install-latest.js",
+    "docs/screenshots",
     "README.md",
     "LICENSE"
   ],
@@ -72,17 +75,36 @@
   "keywords": [
     "multi-account",
     "account-manager",
+    "account-switcher",
+    "session-isolation",
+    "browser-profiles",
+    "isolated-sessions",
+    "desktop-app",
+    "electron",
+    "windows",
+    "developer-tools",
+    "dashboard",
+    "ad-block",
+    "adblocker",
+    "dark-mode",
+    "password-manager",
+    "password-importer",
     "vercel",
     "netlify",
     "supabase",
     "cloudflare",
-    "railway",
-    "render",
+    "aws",
+    "azure",
+    "google",
+    "microsoft",
+    "google-cloud",
     "github",
-    "electron",
-    "dashboard",
-    "sessions",
-    "windows"
+    "gitlab",
+    "npm",
+    "stripe",
+    "gmail",
+    "proton-mail",
+    "cli"
   ],
   "os": [
     "win32"

package/scripts/cli.js

@@ -9,7 +9,7 @@
 //   npx my-provider-dash-manager uninstall  run the app's uninstaller
 //   npx my-provider-dash-manager where      print the install and data paths
 //
-// Flags: --silent (no wizard) · --download-only · --version · --help
+// Flags: --silent (no wizard) · --interactive (wizard even for an update) · --download-only · --version · --help
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
@@ -82,11 +82,15 @@ async function install({ launchAfter }) {
   if (rel.notes) console.log(`\n${rel.notes.split('\n').slice(0, 10).join('\n')}\n`);
   const dest = await downloadAsset(rel);
   if (flags.has('--download-only')) { console.log(`\nSaved to ${dest}`); return; }
-  console.log(`\nRunning the installer${flags.has('--silent') ? ' (silent)' : ''}…`);
-  const child = spawn(dest, flags.has('--silent') ? ['/S'] : [], { detached: true, stdio: 'ignore' });
+  // An update over an existing install runs silently (no wizard) unless --interactive is given;
+  // a first install shows the wizard unless --silent is given.
+  const silent = flags.has('--silent') || (!!have && !flags.has('--interactive'));
+  console.log(`\nRunning the installer${silent ? ' (silent, in place)' : ''}…`);
+  if (silent && have) console.log('Close the app if it is running, or the running copy keeps the old version until restarted.');
+  const child = spawn(dest, silent ? ['/S'] : [], { detached: true, stdio: 'ignore' });
   child.unref();
-  console.log('The installer is unsigned, so SmartScreen may ask you to confirm.');
-  if (launchAfter && flags.has('--silent')) {
+  if (!silent) console.log('The installer is unsigned, so SmartScreen may ask you to confirm.');
+  if (launchAfter && silent) {
     setTimeout(() => { try { launch(); } catch (e) { console.error(e.message); } }, 15000);
   }
 }
@@ -131,7 +135,8 @@ function help() {
   npx my-provider-dash-manager where       print install and data paths
   npx my-provider-dash-manager uninstall   run the uninstaller (keeps your data)
 
-Flags: --silent  --download-only  --force  --version  --help
+Flags: --silent  --interactive  --download-only  --force  --version  --help
+Updates over an existing install run silently; first installs show the wizard.
 Windows only. https://github.com/FiredMosquito831/my-provider-dash-manager`);
 }
 

package/src/main.js

@@ -5,6 +5,7 @@ const SERVICES = require('./services');
 const tokens = require('./api-tokens');
 const { PROVIDERS } = require('./providers');
 const content = require('./content');
+const dark = require('./darkmode');
 const creds = require('./credentials');
 const plugins = require('./plugins');
 const updater = require('./updater');
@@ -35,9 +36,15 @@ function writeJson(file, data) {
   fs.writeFileSync(file, JSON.stringify(data, null, 2));
 }
 
+// ---------- dark mode: Dark Reader's API build, in each account view's isolated world ----------
+// Deliberately NOT a browser extension. Dark Reader's MV3 extension cannot work here: its
+// background service worker dies on the chrome.* APIs Electron 43 does not expose, and its
+// content script declares world:"MAIN", which mutates page prototypes the account's own
+// JavaScript can observe — a breach of invariant 2. See src/darkmode.js for the measurements.
+
 const store = {
   accounts: [], // {svc, id, label, colorIdx, proxy, createdAt, lastState}
-  settings: { warmLimit: 5, groupTabs: false, collapsed: [], stripCollapsed: [], adBlock: true, darkMode: true, forceDark: false, saveLogins: true, autofill: true },
+  settings: { warmLimit: 5, groupTabs: false, collapsed: [], stripCollapsed: [], adBlock: true, darkMode: true, saveLogins: true, autofill: true },
   openTabs: [], // session memory: [{svc, id, url, lastActivated, active}] — survives restarts
   customServices: [], // Phase 2: user-added services {key,name,dashboardUrl,loginUrl,color,custom:true}
   save() {
@@ -48,7 +55,12 @@ const store = {
   saveSession() { writeJson(userDataPath('session.json'), this.openTabs); },
   load() {
     this.accounts = readJson(userDataPath('accounts.json'), []);
-    this.settings = Object.assign({ warmLimit: 5, groupTabs: false, collapsed: [], stripCollapsed: [], adBlock: true, darkMode: true, forceDark: false, saveLogins: true, autofill: true }, readJson(userDataPath('settings.json'), {}));
+    const saved = readJson(userDataPath('settings.json'), {});
+    // 0.8.0: the force-dark CSS invert is replaced by bundled Dark Reader. A profile that had it
+    // on keeps dark mode on, and the dead key is dropped rather than left in the file.
+    if (saved.forceDark) saved.darkMode = true;
+    delete saved.forceDark;
+    this.settings = Object.assign({ warmLimit: 5, groupTabs: false, collapsed: [], stripCollapsed: [], adBlock: true, darkMode: true, saveLogins: true, autofill: true, autoUpdate: true }, saved);
     this.openTabs = readJson(userDataPath('session.json'), []);
     this.customServices = readJson(userDataPath('services.json'), []);
   },
@@ -258,6 +270,8 @@ class ViewManager {
     this.trackSession(svc, id, tab.url); // tab joins the remembered open set
     this.window.contentView.addChildView(view);
     if (show) this.activate(key);
+    // Dark mode is enabled per document from did-navigate below (the isolated world cannot exist
+    // before its page does), so there is nothing to attach before the first load.
     view.webContents.loadURL(tab.url).catch(err => console.error(`load failed ${key}:`, err.message));
     view.webContents.on('page-title-updated', (_e, title) => { tab.title = title; this.emitState(); });
     // Escape must reach Home even while the dashboard page has focus (the renderer's keydown
@@ -266,7 +280,13 @@ class ViewManager {
       if (input.type === 'keyDown' && input.key === 'Escape' && !this.modalOpen) this.deactivate();
     });
     view.webContents.on('did-finish-load', () => {
-      content.applyToPage(view.webContents, { adBlock: !!store.settings.adBlock, forceDark: !!store.settings.forceDark });
+      content.applyToPage(view.webContents, { adBlock: !!store.settings.adBlock });
+      // Enable dark mode once the document's styles exist. did-navigate fires too early: the
+      // dynamic engine finds no stylesheets to transform yet, so enabling there leaves the page
+      // white. This fires again after every cross-origin navigation, which is exactly what the
+      // isolated-world reset requires — the world (and Dark Reader in it) is gone by then and must
+      // be re-injected. Same-document (pushState) routing never reaches here, so it never re-injects.
+      if (store.settings.darkMode) dark.enable(view.webContents);
     });
     const onNav = (_e, url2) => {
       tab.url = url2;
@@ -280,6 +300,10 @@ class ViewManager {
       if (a) { a.lastState = tab.lastState; store.save(); }
       this.emitState();
     };
+    // Dark mode is (re-)enabled from did-finish-load above, not here: that handler runs after the
+    // document's styles exist and after every cross-origin navigation, which is exactly when the
+    // isolated-world engine needs (re-)injecting. did-navigate-in-page (pushState) keeps the world,
+    // so it deliberately does not re-inject.
     view.webContents.on('did-navigate', onNav);
     view.webContents.on('did-navigate-in-page', onNav); // dashboards route client-side (pushState) — must track too
     view.webContents.on('did-start-loading', () => this.emitState());
@@ -366,6 +390,9 @@ class ViewManager {
     try { this.window.contentView.removeChildView(tab.view); } catch {}
     try { tab.view.webContents.close(); } catch {} // separate: a dead contentView must not skip closing the renderer
     this.tabs.delete(key);
+    // Nothing to undo for dark mode here: closing the renderer above discards its isolated world
+    // and the Dark Reader inside it. darkmode.js tracks state in a WeakMap, so the dead view is
+    // collected with it — no per-tab teardown, and reopening re-enables on its first navigation.
     // NOTE: the session entry is intentionally kept — a slept tab stays in the strip and can be resumed.
     if (this.activeKey === key) {
       this.activeKey = null;
@@ -389,6 +416,7 @@ class ViewManager {
       this.tabs.delete(key);
     }
     this.untrackSession(svc, id); // also drop it from the remembered tab set
+    try { creds.removeForAccount(svc, id); } catch {} // a deleted account's captured login must not linger for a future account with the same id
     store.accounts = store.accounts.filter(a => !(a.svc === svc && a.id === id));
     store.save();
     try {
@@ -719,6 +747,35 @@ async function runSmokeCreds() {
     const fb = creds.forAccount('vercel', 'never-signed-in', 'https://vercel.com/login');
     check('host-fallback-from-import', !!fb && fb.username === 'alice@example.com', fb ? fb.username : 'none');
 
+    // a second username captured for the same account is a SECOND candidate — no silent first-wins
+    creds.rememberForAccount('vercel', 'acc9', { url: 'https://vercel.com/login', username: 'second@example.com', password: 'second-pw' });
+    const cands = creds.candidatesForAccount('vercel', 'acc9', 'https://vercel.com/login');
+    check('candidates-include-both-usernames', cands.length === 3 && cands.filter(c => c.accountKey === 'vercel::acc9').length === 2 && cands.every(c => !!c.id), `${cands.length} candidates (2 own + 1 imported)`);
+    check('ambiguous-own-never-guesses', creds.credentialForAccount('vercel', 'acc9', 'https://vercel.com/login') === null);
+    const pick = cands.find(c => c.username === 'second@example.com');
+    creds.setDefaultForAccount(pick.id, 'vercel', 'acc9', 'https://vercel.com/login');
+    check('chosen-default-wins', (creds.credentialForAccount('vercel', 'acc9', 'https://vercel.com/login') || {}).username === 'second@example.com');
+    // the chooser projection must carry no password — invariant 3
+    const sums = creds.candidateSummariesForAccount('vercel', 'acc9', 'https://vercel.com/login');
+    check('chooser-summaries-have-no-passwords', sums.length === 3 && sums.every(c => !('password' in c) && !!c.id && c.isDefault === (c.username === 'second@example.com')), `${sums.length} summaries`);
+    check('delete-credential', creds.deleteCredential(pick.id) === true && !creds.listCredentials().some(c => c.id === pick.id) && (creds.credentialForAccount('vercel', 'acc9', 'https://vercel.com/login') || {}).username === 'typed@example.com');
+    check('manager-list-has-no-passwords', creds.listCredentials().every(c => !('password' in c) && !!c.id));
+
+    // two imported logins on one host are ambiguous: autofill asks instead of guessing
+    const csv2 = path.join(app.getPath('temp'), `mam-creds2-${process.pid}.csv`);
+    fs.writeFileSync(csv2, 'url,username,password\nhttps://vercel.com/login,carol@example.com,carol-pw\n');
+    try {
+      const r2 = creds.importFromCsv(csv2);
+      check('second-import-added', r2.added === 1, JSON.stringify(r2));
+      check('ambiguous-import-never-guesses', creds.credentialForAccount('vercel', 'third-account', 'https://vercel.com/login') === null);
+    } finally { try { fs.rmSync(csv2, { force: true }); } catch {} }
+
+    // deleting an account drops its captured logins AND its defaults
+    creds.rememberForAccount('vercel', 'acc9', { url: 'https://vercel.com/login', username: 'third@example.com', password: 'third-pw' });
+    creds.setDefaultForAccount(creds.candidatesForAccount('vercel', 'acc9', 'https://vercel.com/login').find(c => c.username === 'third@example.com').id, 'vercel', 'acc9', 'https://vercel.com/login');
+    const removed = creds.removeForAccount('vercel', 'acc9');
+    check('account-delete-drops-captures-and-defaults', removed === 2 && !creds.listCredentials().some(c => (c.accountKey === 'vercel::acc9') || (c.defaultForAccounts || []).includes('vercel::acc9')), `removed=${removed}`);
+
     const raw = fs.readFileSync(path.join(app.getPath('userData'), 'credentials.json'), 'utf8');
     check('encrypted-at-rest', !raw.includes('hunter2') && !raw.includes('typed-pw'));
 
@@ -816,6 +873,9 @@ async function runSmokeUpdates() {
   const init = updater.init(() => {});
   check('reports-current-version', init.currentVersion === app.getVersion(), init.currentVersion);
   check('knows-it-cannot-install-in-dev', init.canDownload === false && init.packaged === false);
+  check('update-installs-silently-and-relaunches', updater.INSTALL_MODE.isSilent === true && updater.INSTALL_MODE.isForceRunAfter === true);
+  check('auto-update-defaults-on', store.settings.autoUpdate === true && init.autoUpdate === true);
+  check('auto-update-toggle', updater.setAutoUpdate(false) === false && updater.snapshot().autoUpdate === false && updater.setAutoUpdate(true) === true);
 
   const s = await updater.check();
   check('check-completes-with-a-verdict', ['available', 'up-to-date', 'error'].includes(s.status), `status=${s.status}`);
@@ -827,6 +887,79 @@ async function runSmokeUpdates() {
   app.exit(results.checks.every(c => c.ok) ? 0 : 1);
 }
 
+// ---------- smoke dark: Dark Reader's API build really darkens, and only inside the isolated world ----------
+// The old check asserted a Dark Reader extension was LOADED, which was vacuous: its MV3 worker
+// crashed on Electron 43 and only the OS-preference fallback CSS ever ran. This one asserts the
+// engine actually changes computed colours AND that the page's own main world is left untouched
+// (invariant 2), which is the whole reason the engine is not shipped as a browser extension.
+async function runSmokeDark() {
+  const results = { mode: 'dark', checks: [] };
+  const check = (name, ok, detail = '') => { results.checks.push({ name, ok, detail }); console.log(`[smoke:dark] ${ok ? 'PASS' : 'FAIL'} ${name} ${detail}`); };
+  const win = new BaseWindow({ width: 900, height: 700, show: false });
+  const vm = new ViewManager();
+  vm.attach(win);
+  const sleep = ms => new Promise(r => setTimeout(r, ms));
+
+  // The vendored bundle must be the exact self-contained build the app ships.
+  const vroot = path.join(__dirname, '..', 'vendor', 'darkreader');
+  let bytes = 0; let version = '';
+  try { bytes = fs.statSync(path.join(vroot, 'darkreader.js')).size; } catch {}
+  try { version = JSON.parse(fs.readFileSync(path.join(vroot, 'package.json'), 'utf8')).version || ''; } catch {}
+  check('vendored-bundle-present', bytes > 300000, `${bytes} bytes`);
+  check('vendored-version', version === '4.9.133', version || 'unreadable');
+  check('vendored-license-mit', (() => { try { return /MIT License/.test(fs.readFileSync(path.join(vroot, 'LICENSE'), 'utf8')); } catch { return false; } })());
+
+  // A local page whose background is explicitly WHITE. Its baseline colour is known, so "it got
+  // dark" can never be vacuous (a real dashboard that already honours prefers-color-scheme would).
+  // Served over file://, so this check needs no network.
+  const html = '<!doctype html><html><head><style>html,body{background:#ffffff;color:#111111}</style></head><body><h1>probe</h1></body></html>';
+  const p1 = path.join(app.getPath('temp'), 'mam-dark-white.html');
+  const p2 = path.join(app.getPath('temp'), 'mam-dark-white2.html');
+  fs.writeFileSync(p1, html); fs.writeFileSync(p2, html);
+  const toUrl = p => require('url').pathToFileURL(p).href;
+
+  store.settings.darkMode = true; // the create path injects only when this is on
+  vm.create('vercel', 'darkprobe', toUrl(p1), { show: false });
+  const probe = vm.tabs.get(accountKey('vercel', 'darkprobe'));
+  const wc = probe.view.webContents;
+  const bgOf = async () => {
+    try { return await wc.executeJavaScript(`getComputedStyle(document.documentElement).backgroundColor`); } catch { return ''; }
+  };
+  const inWorld = async code => {
+    try { return await wc.executeJavaScriptInIsolatedWorld(dark.DARK_WORLD_ID, [{ code }]); } catch { return undefined; }
+  };
+  await new Promise(r => wc.once('did-finish-load', r));
+  await sleep(3000); // let the engine compute and apply
+
+  const bgOn = await bgOf();
+  check('page-darkens-with-dark-reader', !!bgOn && bgOn !== '' && !/255,\s*255,\s*255/.test(bgOn), bgOn);
+
+  // Invariant 2: the page's own main world must be untouched while darkening is active.
+  const mainGlobal = await wc.executeJavaScript(`typeof window.DarkReader`).catch(() => '');
+  check('main-world-has-no-darkreader-global', mainGlobal === 'undefined', `typeof window.DarkReader = ${mainGlobal}`);
+  const sheetsGetter = await wc.executeJavaScript(`String(Object.getOwnPropertyDescriptor(Document.prototype,'styleSheets').get)`).catch(() => '');
+  check('main-world-stylesheets-getter-native', /native code/.test(sheetsGetter), sheetsGetter.slice(0, 40));
+  // The engine itself lives in the isolated world — exactly where it is supposed to be.
+  const worldType = await inWorld('typeof window.DarkReader');
+  check('engine-runs-in-isolated-world', worldType === 'object', `isolated world typeof = ${worldType}`);
+
+  // Toggling OFF restores the page's own colours, in place (no reload).
+  await dark.disable(wc);
+  await sleep(1500);
+  const bgOff = await bgOf();
+  check('disable-restores-native-colours', /255,\s*255,\s*255/.test(bgOff), `off=${bgOff}`);
+
+  // A cross-origin navigation discards the isolated world and the Dark Reader inside it; the
+  // did-navigate hook must re-inject and re-darken. A second local file is a different origin.
+  await new Promise(r => { wc.once('did-finish-load', r); wc.loadURL(toUrl(p2)).catch(() => {}); });
+  await sleep(3000);
+  const bgNav = await bgOf();
+  check('re-darkens-after-cross-origin-navigation', !!bgNav && !/255,\s*255,\s*255/.test(bgNav), bgNav);
+
+  fs.writeFileSync(path.join(__dirname, '..', 'smoke-report.json'), JSON.stringify(results, null, 2));
+  app.exit(results.checks.every(c => c.ok) ? 0 : 1);
+}
+
 // ---------- smoke restore: app restart, verify partitions persisted ----------
 async function runSmokeRestore() {
   const win = new BaseWindow({ width: 1280, height: 800, show: false });
@@ -872,12 +1005,11 @@ function runInteractive(captureMode = false) {
   const vm = new ViewManager();
   vm.attach(win);
   reloadPlugins(); // Phase 3: service manifests from <userData>/plugins
-  content.setNativeDark(!!store.settings.darkMode); // sites with their own dark theme follow it
   content.loadFilters().then(src => console.log(`[adblock] filters from ${src}: ${content.filters.hosts.size} hosts, ${content.filters.cosmetic.length} cosmetic`));
   win.loadFile(path.join(__dirname, 'ui.html'));
   // Update system: version tracking + release info + explicit user-driven download/install.
   // Nothing downloads or installs on its own; the UI shows what is available and you decide.
-  updater.init(s => { if (win && win.webContents && !win.webContents.isDestroyed()) win.webContents.send('update-state', s); });
+  updater.init(s => { if (win && win.webContents && !win.webContents.isDestroyed()) win.webContents.send('update-state', s); }, { autoUpdate: store.settings.autoUpdate !== false });
   updater.check().catch(() => {});                                 // one check at startup
   setInterval(() => updater.check().catch(() => {}), 60 * 60 * 1000); // and hourly after that
   const applyBounds = () => {
@@ -971,7 +1103,7 @@ function runInteractive(captureMode = false) {
     });
   }
   win.on('resize', applyBounds);
-  win.on('close', () => { vm.hibernateAll(); }); // 'close' fires before destruction — contentView is still usable here
+  win.on('close', () => { vm.hibernateAll(); vm.flushSession(); }); // 'close' fires before destruction — contentView is still usable here
 
   // keyboard accelerators work even when a webview has focus
   const menu = Menu.buildFromTemplate([
@@ -1091,6 +1223,14 @@ function runInteractive(captureMode = false) {
     if (!store.settings.saveLogins) return;
     const found = tabForSender(e.sender);
     if (!found || !data || !data.password) return;
+    // A username-less capture (an autofilled form, a stray Enter) must never overwrite a real login
+    // for THIS account. Only this account's own captures count — an imported fallback row belongs to
+    // no account and must not block the user recording their own login.
+    if (!data.username) {
+      const own = creds.candidatesForAccount(found.tab.svc, found.tab.id, data.url)
+        .some(c => c.accountKey === found.key && c.username);
+      if (own) return;
+    }
     // Origin guard: only a login typed on the service's OWN domain may be bound to this account.
     // Without this, a password typed on an OAuth/phishing page reached from the tab would overwrite
     // the account's saved login and later be autofilled into the real service.
@@ -1124,7 +1264,7 @@ function runInteractive(captureMode = false) {
   });
   ipcMain.on('fill-result', () => {});
 
-  ipcMain.handle('fill-login', (_e, key) => {
+  ipcMain.handle('fill-login', (_e, key, credentialId = null) => {
     const t = vm.tabs.get(key);
     if (!t) throw new Error('That tab is asleep — open it first');
     const [svc, id] = key.split('::');
@@ -1132,10 +1272,19 @@ function runInteractive(captureMode = false) {
     if (!originAllowed(svc, pageUrl)) {
       throw new Error(`This tab is on ${creds.hostOf(pageUrl) || 'another site'}, not ${serviceHosts(svc)[0] || 'the service'} — refusing to fill a saved password here`);
     }
-    const cred = creds.forAccount(svc, id, pageUrl);
-    if (!cred) throw new Error('No saved login for this account yet — sign in once and it will be remembered');
+    if (!creds.candidatesForAccount(svc, id, pageUrl).length) throw new Error('No saved login for this account yet — sign in once and it will be remembered');
+    const candidates = creds.candidatesForAccount(svc, id, pageUrl);
+    if (!candidates.length) throw new Error('No saved login matches this account and site');
+    // The user may have navigated since the chooser was rendered. Recompute from the LIVE URL;
+    // if the picked id no longer belongs here, return fresh summaries instead of persisting a stale default.
+    if (credentialId && !candidates.some(c => c.id === credentialId)) {
+      return { choose: creds.candidateSummariesForAccount(svc, id, pageUrl) };
+    }
+    const cred = creds.credentialForAccount(svc, id, pageUrl, credentialId || null);
+    if (!cred) return { choose: creds.candidateSummariesForAccount(svc, id, pageUrl) };
+    if (credentialId) creds.setDefaultForAccount(credentialId, svc, id, pageUrl); // remember only a live-host candidate
     t.view.webContents.send('fill-credential', { username: cred.username, password: cred.password, submit: false });
-    return true;
+    return { filled: cred.username };
   });
   ipcMain.handle('creds-stats', () => creds.stats());
   ipcMain.handle('creds-browsers', () => creds.listChromiumProfiles().map(p => ({ browser: p.browser, profile: p.profile, id: p.loginData })));
@@ -1153,9 +1302,21 @@ function runInteractive(captureMode = false) {
   ipcMain.handle('creds-clear', () => creds.clearAll());
   ipcMain.handle('creds-for-account', (_e, svc, id) => {
     const svcCfg = serviceByKey(svc);
-    const c = creds.forAccount(svc, id, svcCfg && svcCfg.loginUrl);
+    const c = creds.credentialForAccount(svc, id, svcCfg && svcCfg.loginUrl);
     return c ? { username: c.username, host: c.host, source: c.source } : null; // never the password
   });
+  // Credential manager: summaries only, never passwords — the renderer must not hold one.
+  // Imported passwords are classified by host so the manager can filter/group them per service.
+  ipcMain.handle('creds-list', () => creds.listCredentials().map(c => {
+    const accountSvc = c.accountKey ? c.accountKey.split('::')[0] : null;
+    const serviceKeys = accountSvc ? [accountSvc] : allServices()
+      .filter(s => serviceHosts(s.key).some(h => creds.hostRelated(c.host, h)))
+      .map(s => s.key);
+    return { ...c, serviceKeys };
+  }));
+  ipcMain.handle('creds-default', (_e, credentialId, svc, id, hostHint) =>
+    creds.setDefaultForAccount(credentialId, svc, id, hostHint));
+  ipcMain.handle('creds-delete', (_e, credentialId) => creds.deleteCredential(credentialId));
   // ---------- Phase 3: service plugins (JSON manifests) ----------
   ipcMain.handle('plugins-list', () => ({
     dir: plugins.pluginsDir(),
@@ -1225,18 +1386,26 @@ function runInteractive(captureMode = false) {
     return true;
   });
   ipcMain.handle('set-content-setting', (_e, name, value) => {
-    if (!['adBlock', 'darkMode', 'forceDark', 'saveLogins', 'autofill'].includes(name)) throw new Error(`unknown setting: ${name}`);
+    if (!['adBlock', 'darkMode', 'saveLogins', 'autofill', 'autoUpdate'].includes(name)) throw new Error(`unknown setting: ${name}`);
     store.settings[name] = !!value;
-    // Inverting a page that is already dark produces a washed-out light page, so the two modes
-    // are mutually exclusive.
-    if (name === 'forceDark' && value) store.settings.darkMode = false;
-    if (name === 'darkMode' && value) store.settings.forceDark = false;
+    if (name === 'autoUpdate') { store.save(); updater.setAutoUpdate(!!value); vm.emitState(); return !!value; }
     store.save();
-    content.setNativeDark(!!store.settings.darkMode);
-    // re-apply to every live tab so the change is visible immediately
-    for (const t of vm.tabs.values()) {
-      if ((name === 'forceDark' || name === 'adBlock') && !value) t.view.webContents.reload(); // injected CSS can only be undone by reloading
-      else content.applyToPage(t.view.webContents, { adBlock: !!store.settings.adBlock, forceDark: !!store.settings.forceDark });
+    if (name === 'darkMode') {
+      // The engine runs in each view's isolated world, so a flip is one enable/disable call per
+      // live tab — no reload. The previous extension path forced a reload of every open tab, which
+      // threw away scroll position and anything typed into a half-filled form.
+      const on = !!value;
+      for (const t of vm.tabs.values()) {
+        if (on) dark.enable(t.view.webContents);
+        else dark.disable(t.view.webContents);
+      }
+    } else if (name === 'adBlock') {
+      // the network layer flips live through its closure; cosmetic CSS needs a re-apply on, and a
+      // reload off (injected CSS can only be undone by reloading)
+      for (const t of vm.tabs.values()) {
+        if (value) content.applyToPage(t.view.webContents, { adBlock: true });
+        else t.view.webContents.reload();
+      }
     }
     vm.emitState();
     return store.settings[name];
@@ -1338,7 +1507,7 @@ function cycleTab(vm, dir) {
 }
 
 // test modes default to an isolated userData: they can never pollute the real registry/partitions
-const TEST_FLAGS = ['--spike', '--smoke', '--smoke-restore', '--smoke-tokens', '--smoke-creds', '--smoke-autofill', '--smoke-updates', '--smoke-services'];
+const TEST_FLAGS = ['--spike', '--smoke', '--smoke-restore', '--smoke-tokens', '--smoke-creds', '--smoke-autofill', '--smoke-updates', '--smoke-services', '--smoke-dark'];
 const testFlag = TEST_FLAGS.find(f => process.argv.includes(f));
 if (testFlag && !process.env.MAM_USER_DATA) {
   const dirName = testFlag === '--smoke-restore' ? 'mam-test-smoke' : `mam-test-${testFlag.slice(2)}`;
@@ -1373,6 +1542,7 @@ if (!gotLock) {
     else if (process.argv.includes('--smoke-autofill')) runSmokeAutofill().catch(err => { console.error(err); app.exit(1); });
     else if (process.argv.includes('--smoke-updates')) runSmokeUpdates().catch(err => { console.error(err); app.exit(1); });
     else if (process.argv.includes('--smoke-services')) runSmokeServices().catch(err => { console.error(err); app.exit(1); });
+    else if (process.argv.includes('--smoke-dark')) runSmokeDark().catch(err => { console.error(err); app.exit(1); });
     else if (process.argv.includes('--capture')) runInteractive(true);
     else runInteractive();
   });