On those seven hosts, if a data-layer adapter ever fails at runtime, capture falls back to a generic DOM reader that scrapes the visible messages. It is lower fidelity and labels itself honestly (read from screen), so you always know whether the capture was complete. (The extension injects only on the seven supported hosts; the DOM reader is a per-platform safety net, not a way to capture arbitrary sites.)

Tiers

Nobody hits a "key or nothing" wall.

No accounts. No daily limits. No length caps. No middleman server. Your chat is read locally and sent only to the provider you chose with your own key.

How it works

Capture (packages/core/src/capture)

Ports-and-adapters. A small shared contract (CaptureAdapter) and one folder per platform under capture/platforms/. Adapters never import each other; they share only capture/shared/ and the top-level types. The boundary is enforced by a guard test (capture/platforms/isolation.test.ts) that fails CI if any adapter reaches into a sibling, so working on one chatbot's quirks can never break another. Each adapter normalizes its platform's wire format into one NormalizedTranscript, and emits an integrity report so completeness is provable rather than assumed (every content block is either classified or surfaced loudly, never dropped silently).

Distill (packages/core/src/distiller)

Two tiers over the same normalized transcript:

• Tier 0, deterministic. Pure functions, no model. Extract tables, images, code, spreadsheet formulas, numbers, API contracts, and the files-to-attach list. Reconstruct the true final state of sandbox files by replaying their edit operations (create_file, str_replace, mv), so a file built over ten edits is captured once, finished, under its delivered name.
• Tier 2, language model. Chunk the transcript, distill each chunk into a mini-brief concurrently, then merge with latest-state-wins and supersession (a decision later reversed moves to Rejected; an answered question moves to Decided; an unresolved caveat stays Open). The model output is then reconciled against the deterministic facts: produced files are authoritative, tables and images are force-guaranteed, the produced-file count is enforced in Now, and remarks about the brief itself are stripped. On a parse failure it falls back to the deterministic brief and says so loudly rather than inventing structure.

The distiller is fully unit-tested with a fake model client, so the whole pipeline (chunking, merge, supersession, the guarantees) runs in CI without a key.

Brief (packages/core/src/brief)

Renders the brief state into two text framings from one engine: a clean markdown brief and a "resume in a new chat" prompt with framing headers.

The eval (the proof)

Give a fresh model only the brief, and separately the full chat. Ask both the same next question. If the brief-only answer makes the same next move, the brief kept everything load-bearing.

pnpm eval                          # shape + size report, no key needed
PROMPTFOLD_API_KEY=... pnpm eval   # full same-next-move judgement

Results land in eval/scorecard.md and render in the web viewer (apps/web).

Architecture

A pnpm + Turborepo monorepo. The signal worth noticing is packages/core: one framework-agnostic brain (no DOM, no Date.now, no UI) consumed by both the extension's vanilla content script and the React web app.

PromptFold/
  packages/core/      the brain: capture (per-platform adapters), distiller, brief, types
  apps/extension/     MV3 extension: vanilla TS + Shadow DOM injected UI, React options page
  apps/web/           Next.js + Tailwind: landing + live eval-results viewer
  eval/               the proof harness (brief vs full chat)
  scripts/            secret-scan + git-hook installer

Three boundaries, each testable on its own: capture (platform data to a normalized transcript), distiller (transcript to brief state), brief (state to text). The injected UI mounts in a Shadow DOM, so the host page's CSS and PromptFold's never collide, and it is built with textContent only (never innerHTML), so untrusted chat content cannot inject markup or script.

Run it locally

pnpm install                                  # also installs the secret-scan git hook
pnpm test                                     # 100+ unit tests, no key needed
pnpm --filter @promptfold/extension build     # bundles to apps/extension/dist

Then load the extension: open chrome://extensions, turn on Developer mode, click Load unpacked, and pick apps/extension/dist. Open a supported chat and click Fold in the bottom corner. Without a key you get the Tier 0 brief immediately. To unlock the reasoned sections, open the options page and add your own Anthropic, OpenAI, or free Google Gemini key.

Honesty note. The live captures and the BYOK model call can only run in a real logged-in browser with a real key. They are built to each platform's documented endpoint shapes and covered by unit tests against recorded fixtures, but this repo's CI does not, and cannot, hit live providers. The Gemini adapter in particular reads an undocumented internal RPC and is marked experimental.

Security and privacy

Security is a first-class concern: the extension reads chat content and this repo is public. Full detail in SECURITY.md and PRIVACY.md. Short version:

• BYOK key lives in chrome.storage.local only, is read only by the service worker, is never logged, and is sent only to the provider you chose.
• Free-tier Google Gemini. If you use the free Google Gemini key, Google may use submitted data to improve their models. See PRIVACY.md for details.
• No PromptFold server. Capture happens in your browser; distillation is a direct call from the extension to your provider. There is no backend in the data path, so there is nothing to ration, log, or breach.
• No remote code. MV3's rule is enforced: everything is bundled by esbuild; the extension never loads or evals external script.
• Secrets cannot enter git. A .gitignore written before any code, plus a secret-scan pre-commit hook and the same scan in CI.
• Least privilege. The only standard permission is storage. Host permissions cover only the seven supported chat hosts and the two LLM API hosts. No <all_urls>, no broad optional permissions. See SECURITY.md for the exact set.

Tech stack

TypeScript, pnpm + Turborepo, esbuild (extension bundle), React with Next.js and Tailwind (web and options pages), Vitest, GitHub Actions CI, an MV3 service worker. Zero runtime dependencies in packages/core.

Status

Working: seven data-layer adapters plus the DOM fallback, Tier 0 and Tier 2, the full strict brief, the eval, and the security tooling. On the roadmap: an on-device small-model Tier 1, a "simplify for a non-technical reader" framing, and share links.

License

MIT