TheOrangeForce/TOFfeDevTools
27
1
Fork 0
Code Issues 1 Pull requests Projects Releases 11 Packages Wiki Activity Actions
11 releases 11 tags
  • v0.114.1 cc0fa28582

    TOFfe Dev Tools v0.114.1
    All checks were successful
    CI / build-and-test (push) Successful in 37s
    Details
    Release / publish (push) Successful in 26s
    Details
    Stable

    Chendo released this 2026-08-18 16:09:02 +00:00 | 33 commits to main since this release

    ⬇ Downloads

    Version 0.114.1

    • IMPROVED Store-review hygiene for the public listings. The extension now declares explicitly that it collects no data, and every reviewer warning in our own code was resolved. Firefox minimum version is now 140 (the current extended-support release).
    Earlier versions (v0.114.0 … v0.114.0)

    Version 0.114.0

    • NEW Firefox installs from the official Mozilla Add-ons page. The extension moved to a public AMO listing: install it like any other Firefox add-on and updates arrive automatically. If you installed the 0.113.0 .xpi by hand, reinstall once from the AMO page to get back on auto-updates.
    Downloads
  • v0.113.0 2f13559824

    TOFfe Dev Tools v0.113.0
    All checks were successful
    CI / build-and-test (push) Successful in 37s
    Details
    Release / publish (push) Successful in 4m46s
    Details
    Stable

    Chendo released this 2026-08-18 12:13:21 +00:00 | 41 commits to main since this release

    ⬇ Downloads

    Version 0.113.0

    • NEW Firefox installs like a normal extension. Releases now ship a signed .xpi next to the zips: download it and install via Add-ons → Install Add-on From File… (or drag it into Firefox) — no more "could not be verified" and no temporary about:debugging load that vanishes on restart. Signed installs also update themselves when a new version is published.
    Earlier versions (v0.112.0 … v0.109.0)

    Version 0.112.0

    • IMPROVED Data has three lenses instead of five, grouped by where the data comes from. Database: Records and Model. Client: Client memory. Schema and Access merged into Model — the fields of an entity and what you may do with them, in one place, with a switch between the two halves so neither hides below the other — rights are only loaded when you pick them, so opening the lens never fires access probes.
    • IMPROVED Relations open on the record you are looking at. The ⋔ button on a row opens the relations explorer rooted on that object, instead of a separate lens where you first had to pick a start object.
    • NEW A chip tells you where rows came from: live database (queried with your permissions) or intercepted (read from traffic this panel saw). Two grids that used to look identical.
    • IMPROVED Design has three views instead of four, and its page tools are always in reach. Inspector, tab order, 8px grid, freeze, simulations and responsive preview now sit in one bar that stays visible in every view — including which ones are still running. CSS cascade and HTML moved to the Element view, where the element you pinned already is.
    • IMPROVED Runs sit under Microflows. You read what a run returned while looking at the flow you ran, instead of switching to a separate lens and back.
    • IMPROVED Network & console ▸ Requests is readable again. One toolbar with a search box (action, entity, operation, status), an errors and a slow toggle, a count of what is filtering and a button to clear it. The four analysis blocks that used to stack above the list — operations, timeline, resources — are one card row now, one open at a time, so the request list starts at the top instead of below the fold.
    • IMPROVED The request table keeps its columns. Fixed widths with the target truncated (full value in the tooltip), so a long XPath no longer pushes ms, objects, size and status off screen. Time is relative to the newest request (the absolute time is in the tooltip), slow rows are marked, and ms and size sort on click.
    • IMPROVED One Export button instead of four. ⬇ Export asks what you already meant: this page or every row of the query, as CSV or JSON.
    • IMPROVED The command palette is a menu you can browse. Open it and see tabs, lenses, tools and actions grouped and clickable — no need to know what to type. Typing narrows it and adds entities, microflows and pages. Every tool is in there, so nothing that moved got lost.
    • IMPROVED Client memory opens on the objects. Session and Uncommitted start collapsed, with the number of uncommitted objects right after the label, so the object grid is the first thing you see. The lens says it is live from the app's traffic and never fetches from the server, with a ↻ to re-read it.
    • FIXED Readability fixes: an active Design tool chip no longer turns its own label invisible on hover (worst in light mode), the source labels on the Data lens bar read as part of the switch instead of loose text, and the Model lens scrolls.
    • FIXED Scrolling works everywhere. Views with a fixed height (Data, Security, API) now always scroll when their content does not fit — the API tab could not scroll a long endpoint or response at all, and a tall filter used to squeeze the record grid instead of scrolling.
    • FIXED Statistics no longer go stale after an edit. Saving a record or generating test data now drops a computed full-table figure instead of showing yesterday's number under "over all N rows".
    • FIXED A network link no longer changes your Microflows view. Opening a shared Console link used to overwrite which Flows lens you had open.
    • FIXED The relations panel stays closed once you close it, instead of reappearing empty after switching entity or lens. An Access link now opens the rights half of Model, not the domain model.
    • FIXED Old links and saved screens keep working. A stored Schema or Access lens lands on Model, Graph on Records, Runs on Microflows, and shared links from earlier versions resolve the same way.

    Version 0.110.1

    • IMPROVED The filter builder says "filter", not "condition". The add button reads ＋ filter, and inside an association block ＋ filter on Customer, so it still tells you what you are adding.

    Version 0.110.0

    • IMPROVED Column statistics now cover every row you are looking at, not just the page. The Σ card reads the whole result of your current query — filter included, so a filter that shows 120 of 200 rows gives you the figures over those 120 — in pages of 1000, and says which it is. There is no row limit: a table of any size is counted, and no rows are kept in memory while it counts.
    • NEW Large tables ask first. Up to 5.000 rows the card computes on open. Above that it shows the page figures right away and offers a "Σ over all N rows" button, with live progress and a cancel while it runs — so a big table never starts fetching without your say.
    • IMPROVED One count serves the whole grid. The scan computes every visible column at once, so opening a second column's Σ is instant. Change the filter, refresh, save or delete and the figures are dropped rather than shown stale.

    Version 0.109.0

    • NEW Search for empty associations. Pick an association in the filter and you now get the same operator list as any other field: matches › (constrain the related object, as before), is empty, has value, or = a specific object you choose from a searchable picker. Finding every order without a customer is two clicks.
    • NEW Column statistics. Hover a column header and click the Σ: numbers show SUM, AVG, MEDIAN, MIN, MAX, standard deviation and distinct count; dates show oldest, newest and the span; text and enums show the most frequent values; associations show how many rows are linked and how many are empty. Every card states its scope (the rows on the current page) and copies in one click.
    • NEW Filter on empty straight from a column. The Σ card of a text column or association offers filter: is empty and filter: has value. The filter is built for you and stays visible and editable in the bar.
    • NEW Clear your filters. A ✕ Clear button empties every condition and shows all rows again, and a counter tells you how many conditions are actually constraining the query — nested association levels included.
    • IMPROVED The filter builder reads better. The add button is small and says what it adds ("＋ condition on Customer" inside an association block), nested blocks name the entity they constrain, and an association row you have not filled in now says so instead of silently filtering nothing.
    • FIXED Association conditions produce correct XPath. Empty and has-value checks on an association now compile with the full association path, and switching operators keeps the sub-filter you already built.
    Downloads
  • v0.108.1 0c04d66960

    TOFfe Dev Tools v0.108.1
    All checks were successful
    CI / build-and-test (push) Successful in 36s
    Details
    Release / publish (push) Successful in 16s
    Details
    Stable

    Chendo released this 2026-08-12 12:36:40 +00:00 | 54 commits to main since this release

    ⬇ Downloads

    Version 0.108.1

    • IMPROVED Third-party license notices now ship inside the extension. A THIRD_PARTY_NOTICES.txt with the full license texts of the bundled open-source components (preact and @preact/signals under MIT, axe-core under MPL-2.0) is included in the package and regenerated on every build, so attribution travels with every download.
    Earlier versions (v0.108.0 … v0.90.0)

    Version 0.108.0

    • FIXED Sharper security checks. Sensitive field/attribute names are now caught anywhere in the name, not only at the start (e.g. AccessToken, OrderStatus, UnitPrice); the internal-IP leak scan now matches the common 192.168.x and 172.16–31.x ranges; and a false-positive "inline script" flag on empty-named widgets is gone.
    • FIXED Reliable per-element restyle. Editing several elements no longer lets two look-alike widgets overwrite each other in the export, and re-selecting an element you already changed now resets it fully.

    Version 0.107.0

    • NEW Export your restyle as SCSS (Design ▸ Restyle ▸ Per element). Every element you tweaked is collected into one copy-paste SCSS patch. Where a colour matches a design token, the patch points at the token and its source file — so you change the token in the theme instead of hard-coding a hex. Export to a file or copy to the clipboard.
    • IMPROVED Less clutter in the element editor. The common controls (colours, size, weight, padding, text) stay up front; line height, letter spacing and margin move behind "More options".

    Version 0.106.0

    • NEW Restyle a single element (Design ▸ Restyle ▸ Per element). Pick any element in the running app and tweak its colours, font size/weight, line height, letter spacing, padding, margin and even its text — live. Changes are non-destructive (F5 or "Reset element" puts it back). The old theme playground is now the Whole page scope of the same tab.
    • IMPROVED Playground is now "Restyle". The Design tab's live editor got a clearer name and a scope switch — Whole page (remap a colour everywhere, swap the font, free CSS) or Per element.

    Version 0.105.0

    • NEW Measure on the page (Design ▸ Tools ▸ Element inspector). Pin one element, then hover another: the spacing between them is drawn as lines with pixel labels, and edges that line up show dashed alignment guides. The hovered element also gets its margin (orange) and padding (teal) frame. Design review without leaving the running app.
    • IMPROVED Plainer names in Design ▸ Audit. The extra-checks now explain themselves: "axe-core" is labelled Deep WCAG scan, and every check has a one-line tooltip in plain language (what "headings & landmarks", touch targets and contrast actually mean) — so non-developers know what each one does.

    Version 0.104.1

    • IMPROVED Active tests are compact now (Advanced build). Each test is a single row you expand for its description and results, with a "Run all tests" button that runs them one by one and a running total of findings. A test that finds something expands itself.

    Version 0.104.0

    • NEW Secret in browser storage. Flags a localStorage/sessionStorage entry holding a secret-looking value (token, key, password) — readable by any script on the page. Keep secrets out of web storage.
    • NEW Anonymous data reach (Advanced build only). A new active test retrieves entities without logging in and flags which the anonymous role can read — the classic over-permissioned Anonymous role. Read-only; microflows are not executed.

    Version 0.103.1

    • FIXED S-Unit finding links now open the exact topic. Clicking an S-Unit tag on a finding used to open the general Top-10 page; it now links straight to that item's detail page (e.g. TSU-04 → its "Insecure published integrations" page), which has the fuller explanation.

    Version 0.103.0

    • NEW Sensitive field in a published service. Flags a published REST/OData resource that exposes a field named like a secret (password, hash, token, IBAN…) — published attributes do not inherit entity access, so consumers can read them.
    • NEW Write access to a security/status attribute. Flags attributes your role can write whose name suggests security or status (status, role, is_admin, owner, amount…) — a client can tamper with them (privilege escalation / mass assignment). Set those only in a microflow.
    • NEW Information disclosure in responses. Flags a response that leaks a stack trace, internal IP or private key — verbose errors that should stay server-side.
    • IMPROVED Strict-mode hardening tip when the app allows ad-hoc client queries.
    • NEW Active tests: cross-tenant row exposure & file entities (Advanced build only). Cross-tenant retrieves rows and flags entities that return other users' data — a missing owner XPath constraint (the classic data-exposure bug). File entities lists downloadable document types to check their access. Read-only, behind the authorisation you sign.

    Version 0.102.1

    • IMPROVED Security checks focus on what you configure, not on the platform. Removed the "auth posture" active test (CSRF and sessions are enforced by the Mendix runtime, not by your config, so it added no actionable value), and grouped the security-header tips into a single low-priority hardening note (most Mendix apps lack a custom CSP by default — it is a hardening opportunity, not a mistake you made).

    Version 0.102.0

    • NEW Active tests completed (Advanced build only). Alongside the unauthenticated-access check, the Active tests view now also does: reflected XSS (a unique marker in query parameters, flagged if it returns unescaped), injection signatures (crafted input that leaks a server error), privileged microflows (lists client-callable microflows with a privileged-looking name — enumeration only, nothing is executed), and an auth posture check. All same-origin and non-destructive, behind the per-target authorisation you sign. Use it on your own apps, responsibly. None of this ships in the store build.

    Version 0.101.0

    • NEW First active test: unauthenticated access (Advanced build only). Once you confirm you are authorised, the Active tests view can call an app's published GET endpoints without logging in and report which return real data — confirmed exposure, not just reachability. Read-only, same-origin, capped. Use it on your own apps, responsibly.
    • IMPROVED The store build no longer contains any active-test code. The Advanced build is now compiled separately, so the offensive code ships only there — the normal (store) build is built without it entirely.

    Version 0.100.0

    • NEW Active tests — foundation (Advanced build only). The Advanced build gets a new Security ▸ Active tests view for confirming findings by actively probing an app. This first step is the safety framework only: before anything can run you must confirm you are authorised to test the app (that confirmation is logged and is your risk sign-off). The actual tests arrive in a later build. Core rule, as everywhere in this tool: use it on your own apps, and use it responsibly. Not present in the store build.

    Version 0.99.1

    • IMPROVED Security ▸ Checks looks tidier before you run it. Instead of a large empty area, the tab now shows a compact intro with the run button; the results and their scroll appear once you run the checks.

    Version 0.99.0

    • IMPROVED Access moved back to the Data tab. The entity-access matrix is a lens under Data ▸ Access again (where it shares the entity sidebar), and the Security tab now focuses purely on the Checks. If you had it open in Security, the tool takes you to Data ▸ Access automatically.
    • FIXED Calling a published endpoint no longer fails on the declared address. Some OpenAPI docs declare an internal address that is not where the app actually runs. The tool now always calls the endpoint's path on the app's own origin, so a call works regardless of what the doc claims — and still never leaves the app's origin.
    • NEW Filter and collapse in Security ▸ Checks. Click a severity in the summary to filter the findings to it (click again to clear), click a finding's header to collapse it, and collapse/expand all at once.

    Version 0.98.1

    • FIXED Security ▸ Checks now scrolls and keeps its results. The findings list scrolls when it is long, and the results stay put when you switch to another tab in the tool and back (they are kept for the session — but never written to disk, since a finding can contain a secret value).

    Version 0.98.0

    • FIXED API calls to your own app are no longer wrongly refused. When a published service's documentation declared an http:// address while the app runs on https:// (same server, different scheme), the call was blocked as "not the app's own origin". The tool now recognises the same host and calls it on the page's own origin — only a genuinely different host is refused.
    • FIXED Development mode is no longer flagged on localhost. Running locally is supposed to be in development mode, so the security checks no longer raise it there — only on a reachable, deployed environment.
    • NEW XSS-sink hint. The security checks now point out suspicious client-side spots — javascript: links, inline event handlers, a <script> inside content — that may render unsanitised input. Heuristic: it flags spots to review, it does not confirm a vulnerability.
    • NEW Outdated client-library check. Flags a legacy front-end library on the page (e.g. an old jQuery, or Dojo from the classic client) whose version carries known vulnerabilities.

    Version 0.97.0

    • NEW Excessive-read hint. The security checks now point out attributes your role can read but that the app never actually fetched in the traffic seen this session — a hint that a read right may not be needed. It is coverage-bounded (only what you visited), so it is a guided pointer, not a verdict.

    Version 0.96.0

    • NEW End-of-life runtime check. The security checks now flag an app running on a Mendix major version that is past support (no more security fixes) — checked offline against a bundled list that ships with each release, so no data ever leaves your browser.

    Version 0.95.0

    • FIXED The Security tab no longer follows the Data tab's selection. The Access lens now keeps its own focused entity, so opening it always starts on the matrix and clicking an entity there no longer changes what the Data tab shows. No more confusing cross-tab coupling.
    • IMPROVED The secret-constant check now shows the value. When a client constant holds a secret-looking value it is already readable by every user, so the finding now shows it (truncated) next to the constant name — you see exactly what is leaking and can act on it.

    Version 0.94.0

    • NEW Transport & session checks. The security checks now flag an app served over plain HTTP, a missing HSTS header on an HTTPS app, and mixed content (http resources loaded on an https page). Rounds out the connection-security checks.

    Version 0.93.0

    • NEW Secrets-in-constants check. The security checks now flag Mendix constants delivered to the client that hold a secret-looking value — API keys, tokens, a JWT, a private key. Anything in a client constant is readable by any user, so it is effectively public. The finding lists the constant names only and never reprints the secret value.

    Version 0.92.0

    • NEW Security is now its own tab. The access matrix and the security checks moved out of Data into a dedicated Security tab with two lenses: Checks (configuration & exposure findings) and Access (the entity-access matrix). Data now focuses purely on your records, model, graph and client state. If you had the Access lens open, the tool takes you to the new tab automatically.

    Version 0.91.0

    • NEW Anonymous-exposure checks. The security checks now also probe your app without logging in (credentials-less, same-origin) and flag — as critical — anything that answers anyway: service documentation (/rest-doc/, /odata-doc/, /ws-doc/) or an OData model ($metadata) reachable by anyone on the internet. It only flags a real response, never a login page.
    • IMPROVED Finding labels link to the standard. Each finding's standard tag (OWASP, OWASP Low-Code, and the S-Unit Top 10) is now a link, so you can click straight through to read more about the risk.

    Version 0.90.0

    • NEW Security checks in the Data ▸ Access lens. A new "Run security checks" button scans your deployed app — as the logged-in session, same-origin and read-only — for common Mendix security issues and lists them ranked by severity, each tagged with the public standard it maps to (OWASP / OWASP Low-Code & the S-Unit Top 10). First checks: exposed service documentation (/rest-doc/, /odata-doc/, /ws-doc/), OData $metadata exposing your model, development mode still on, a default/demo account in use, a session cookie readable by JavaScript, and missing security headers (CSP, clickjacking protection, nosniff). It is an aid, not a full audit — tip: run it while logged out too, to see what anonymous users reach.
    Downloads
  • v0.89.1 6b2afc0e70

    TOFfe Dev Tools v0.89.1
    All checks were successful
    CI / build-and-test (push) Successful in 45s
    Details
    Release / publish (push) Successful in 14s
    Details
    Stable

    Chendo released this 2026-07-22 13:00:35 +00:00 | 82 commits to main since this release

    Version 0.89.1

    • FIXED API & State sidebars readable again in the dark theme. The keyboard-accessibility change in 0.89.0 gave these rows the browser's default light button background, making the text unreadable in the dark theme. They now look exactly like the Data sidebar again.

    Version 0.89.0

    • FIXED Keyboard accessibility. The State and API sidebars are now real buttons, so you can focus and operate them from the keyboard.
    • FIXED Safer edits & deletes. A failed field write during a save is rolled back; bulk create-rights discovery now asks first; request replay confirms before firing; State-view save/delete surface errors instead of silently succeeding.
    • FIXED Privacy accuracy. The privacy policy and store listing now precisely describe what the tool keeps locally (preferences, plus per-app query/run history and design baselines) — nothing is ever transmitted. Same-origin guarantees were tightened further (source-map fetches, the colour-blindness/axe bridges).
    • FIXED Smaller correctness fixes. Copy buttons report honest success, filter autocomplete recovers after a blocked query, the command palette closes with the panel, repeated var() references resolve, and several export/format details were corrected.
    • IMPROVED Release safety. Packaging now runs the full verify gate (types, lint, build, all tests) before it can produce a zip.

    Version 0.88.0

    • FIXED Editing a record only writes the fields you changed. Previously saving from the detail panel rewrote every field, which could silently alter untouched date/time and large-number values. It now saves just your edits.
    • FIXED Large numbers and dates are stored precisely. Long/Decimal values keep full precision, and a date is stored on the day you picked regardless of timezone.
    • FIXED Bulk delete shows exactly what it will remove. The confirmation now lists every selected record and flags the ones that are not on the current page — a selection survives paging, so nothing gets deleted unseen.
    • FIXED Request replay asks before it writes. Re-firing a captured request now goes behind a confirmation, like every other write action.
    • FIXED Anonymised export keeps relationships. Association GUIDs are no longer masked, so an anonymised CSV/JSON still shows how records link. Your column-order and anonymisation preferences now really do follow you across apps.
    • FIXED Privacy & safety hardening. Traffic capture and REST calls are strictly same-origin (no cross-origin data or token ever leaves the app); the design audit no longer counts the tool's own animations; copy buttons only report success when something was actually copied; filter autocomplete recovers after a blocked query; Esc stops the focus test; and the debugger/prefs bridges were tightened.

    Version 0.87.0

    • NEW Filter lint. When you filter, the tool now warns about XPath that typically can't use a database index — contains(), negation, or deep association chains — so you can spot a slow query before running it on production. Advice only; Search always still works.
    • NEW Anonymise output. A new toggle in ⚙ Settings masks e-mails, UUIDs, IP addresses, long numbers and your own keywords in exports and copied data — so you can safely share a CSV or a row without leaking customer PII. Record GUIDs stay intact so you can still re-query with them. Off by default; the choice travels with you across apps.
    • NEW N+1 traffic warning. The Network & console tab now flags when the same operation fires many times in a short burst — the classic per-row retrieve behind a slow list. Click it to filter the request table to that operation.

    Version 0.86.0

    • IMPROVED The Records view now puts the records first. The header shrank from seven rows to three: the selected entity moved onto the lens bar, the filter and Advanced (XPath) controls share one row together with refresh and the edit switch, the status text and RO/RW chips share a line, and the pager/export buttons join ⚙ Columns on a single bar with a clear divider. Everything still works exactly the same — it just takes far less space.

    Version 0.85.1

    • IMPROVED Column order moved to the ⚙ settings menu. The Model / A→Z choice now lives with the general settings instead of inside the Columns popover, and it travels with you — the preference is remembered across apps, not per app.

    Version 0.85.0

    • NEW Choose your column order. Data tables follow the domain-model order by default; via ⚙ Columns you can now switch to A→Z — all attributes alphabetically first, then the associations. The edit panel follows the same order, the setting is remembered, and your own dragged column order still wins.
    • FIXED Edit mode now closes after saving from the detail panel. Opening a record, clicking ✎ Edit and saving no longer leaves the whole page in edit mode — a quick one-off edit returns you safely to read-only.

    Version 0.84.0

    • NEW Copy an association's GUID. Reference and reference-set cells now show the same hover copy button, so you can grab the linked record's GUID (all of them for a reference set) when you need it. (Follow-up to Git issue #2.)
    • NEW Click a design finding to select it on the page. In Design ▸ Checks, clicking a finding (or one of its elements) now scrolls to that element and puts a persistent, bright selection box around it on the page — so you see exactly which button, image or field the contrast/accessibility check is about. Click again or press Esc to clear.

    Version 0.83.0

    • NEW Copy a value in one click. Hover any cell in a data table and a small copy button appears — grab a single value without selecting text. (Requested via Git issue #2.)
    • NEW Copy a whole row as JSON. Each row now has a ⧉ action that copies the record (all shown columns + GUID) as formatted JSON, ready to paste.
    Downloads
  • v0.82.0 29b59c7be7

    TOFfe Dev Tools v0.82.0
    All checks were successful
    CI / build-and-test (push) Successful in 39s
    Details
    Release / publish (push) Successful in 12s
    Details
    Stable

    Chendo released this 2026-07-10 11:43:41 +00:00 | 95 commits to main since this release

    Version 0.82.0

    • NEW Value suggestions when filtering. When you filter a text attribute (including inside a nested association search), the field now suggests the existing values — sampled from the data, so you can pick instead of type. Large tables may not list every value; free typing still works.

    Version 0.81.0

    • NEW Pick associations without typing a GUID. In the edit screen (and inline grid) a reference now opens a searchable dropdown of records. You can also choose a key attribute (e.g. Name) to search and show candidates by, instead of the GUID. (Requested via Git issue #1.)
    • NEW Nested association search. In the Data filter you can now filter across associations multiple levels deep — e.g. Order → Customer → Country → Name — by picking an association and searching within its target, recursively.

    Version 0.80.0

    • NEW Works on any page (generic mode). Start the tool from the toolbar popup on a non-Mendix site and the Design tools (inspector, accessibility audit, contrast, design tokens, CSS cascade…), Web Vitals and the Console all work — handy for designers reviewing any web page. Data, Microflows and the domain model still need a Mendix app; those tabs show a short note there.

    Version 0.79.6

    • IMPROVED A little more variety in the fun. ✨

    Version 0.79.5

    • NEW The settings menu (⚙) now shows the installed extension version — handy when reporting an issue.

    Version 0.79.4

    • NEW Added something fun. 🎉

    Version 0.79.3

    • FIXED Saving now closes edit mode. After a successful save the staged changes clear and Records leaves edit mode — previously it stayed open. A failed save keeps your edits so you can retry.
    • IMPROVED Clearer wording when Mendix refuses a change (change-hash security), listing the likely causes instead of blaming your role.

    Version 0.79.2

    • FIXED Editing a read-only attribute failed silently. Some attributes are read-only for your role; the runtime rightly refuses the change (Mendix change-hash security). That refusal now shows as a clear message in the State lens too (it already did in Data ▸ Records), instead of only a cryptic error in the browser console. Nothing was ever changed server-side.
    Downloads
  • v0.79.1 a693e76e54

    TOFfe Dev Tools v0.79.1
    All checks were successful
    CI / build-and-test (push) Successful in 39s
    Details
    Release / publish (push) Successful in 12s
    Details
    Stable

    Chendo released this 2026-07-09 11:50:32 +00:00 | 104 commits to main since this release

    Version 0.79.1

    • IMPROVED Tunnel vision now follows your mouse. The clear spot tracks the cursor, so you look around by moving the mouse — a fixed-size spotlight instead of a static centre.

    Version 0.79.0

    • NEW WCAG checks link to the spec. In Design ▸ Audit, hover a WCAG chip for what it checks; click it to open the official W3C "Understanding" page for that criterion.
    • NEW Tunnel vision simulation. Design ▸ Tools ▸ Simulations adds a restricted field-of-view mode (dark vignette) next to blur — check whether key controls sit where a user can still see them.
    • IMPROVED Network & console opens on Vitals by default — the health numbers first, the request table one click away.
    • IMPROVED On/off options (freeze, HTML "cleaned", access-scan create test, OData $count, test-data links, "don't ask again") are now brand-coloured switches instead of checkboxes.
    • IMPROVED Tidier: the tab bar no longer shows a scrollbar, and the Overview cards no longer mix an icon with plain ones.
    • NEW 🥃 The party got bigger — a couple of new words summon a couple of new drinks. Cheers. 🍺

    Version 0.78.2

    • FIXED The "?" help popover was overlapped by the content below it on tabs with a sticky toolbar (e.g. Microflows). It now sits on top, fully readable.

    Version 0.78.1

    • IMPROVED Overview bottom row: App info is now the first card (open by default), Deliverables the last, and the duplicate App-info status card is gone.

    Version 0.78.0

    • NEW Logo in the panel header. The TOF mark now sits next to the "TOFfe Dev Tools" title when the panel is open.
    • IMPROVED Overview bottom section as tab cards. Deliverables, App info, Constants, Enumerations and Widgets are now cards in a row with the content below — App info opens by default. Same pattern as Design.
    • IMPROVED Trimmed the joke line on inline styling — it was funnier short.

    Version 0.77.0

    • IMPROVED Design ▸ Style and Tools cards now work like tabs. Clicking a card no longer replaces the whole screen — the cards stay in place as a row and the content opens right below them, with the active card highlighted. Click it again to close. Same look, less jumping around.

    Version 0.76.0

    • IMPROVED Design ▸ Tools is now launcher cards. The quick on-page toggles (inspector, tab order, 8px grid) stay one click away; the heavier tools (freeze, CSS cascade, HTML, colour-blindness simulation, responsive preview) are cards you open one at a time. A running tool keeps running when you close its card — the card shows a live status pill — and Esc still stops everything.

    Version 0.75.0

    • IMPROVED Design ▸ Style is now two levels. Instead of ten sections stacked on one screen, you get compact topic cards with the key figures (colours, tokens + hygiene warnings, !important, inline styles, typography, spacing, shapes, breakpoints, sources). Click a card to drill into that one topic; the signals stay on top. Search and the 📍 "where does this come from?" panel work inside a topic.

    Version 0.74.0

    • NEW A “?” on every tab. Each lens and view has a help button that explains, in one line, what it is for — plus a couple of concrete Mendix use-cases. The old always-on intro lines moved into it, so the screen is cleaner while the answer to “what do I do here?” is one click away.

    Version 0.73.0

    • IMPROVED State is now a lens inside Data. Everything about your objects — Schema, Records, Graph, Access and now State (client memory, session, uncommitted changes) — lives under one tab instead of two.
    • IMPROVED The tool opens on Overview. The app-review landing is the first thing you see; a saved State view still opens on Data ▸ State automatically.

    Version 0.72.0

    • IMPROVED Fewer, clearer tabs. Network & performance, Console and Sources are now one Netwerk & console tab with lenses: Requests, Vitals, Console and — in the Advanced build — Debug. Less to scan, everything about a running session in one place.
    • IMPROVED Old links and bookmarks keep working: a saved Console, Sources or Performance view lands on the matching lens automatically.
    Downloads
  • v0.71.0 b3846d6dec

    TOFfe Dev Tools v0.71.0
    All checks were successful
    CI / build-and-test (push) Successful in 36s
    Details
    Release / publish (push) Successful in 17s
    Details
    Stable

    Chendo released this 2026-07-08 19:14:25 +00:00 | 116 commits to main since this release

    Version 0.71.0

    • FIXED CSS cascade now shows the real SCSS too. The cascade view reused the same row across rules and could keep a stale source; it now resolves each rule to its authored SCSS via the theme source map, like the 📍 panel.
    • IMPROVED More objects in State/Data. The intercepted-object mirror was capped at 5,000; raised to 50,000 so large grids/pages show their full object set (still bounded, memory-only).

    Version 0.70.0

    • IMPROVED CSS origin now points at the real SCSS. Instead of "theme.compiled.css", the 📍 where-panel and the cascade view resolve each rule through the theme's source map to its actual authored file — e.g. themesource/atlas_core/web/core/widgets/_button.scss:42 — with an origin tag (your own theme vs Atlas/module, generated) and an expandable snippet of the real SCSS. Falls back to the old label when no source map is served.

    Version 0.69.0

    • NEW Console REPL (Advanced build): an input line in the Console to evaluate JavaScript against the running app — e.g. mx.session.getUserName(). It runs as the logged-in user, so the first run asks for confirmation. Advanced build only.

    Version 0.68.0

    • NEW Sources + breakpoints (Advanced build): pick a loaded script, read its source, and click the line gutter to set a breakpoint. When execution pauses you get a paused bar with the call stack and resume / step over / into / out — all inside the tool, no F12.

    Version 0.67.0

    • NEW Sources tab: the scripts, stylesheets and fonts the page loaded, in one place. Viewing source and breakpoints need the debugger, which the standard build deliberately doesn't request.
    • NEW Advanced build (Chrome-only, opt-in): a separate install that adds the debugger for source viewing and (coming next) breakpoints and a REPL. The standard build stays debugger-free. See the Advanced runbook.

    Version 0.66.0

    • NEW Console tab: everything the app logs — plus JS errors and failed server calls — in one live stream, correlated to the operation that was running. Level and text filters, expandable details, clear. Captured from page load, in memory only. No more F12 for the console.
    • IMPROVED The Flows lens formerly called "Console" is now "Runs" — it was the microflow run history all along; the name now says so.

    Version 0.65.0

    • IMPROVED Performance became "Network & performance" with two lenses: Requests (the decoded traffic table, operations, timeline) and Vitals (Web Vitals + diagnostics) — no more scrolling past one to reach the other.
    • NEW All of the app's own traffic: REST/OData/file calls now appear as rows next to XAS (metadata only; response bodies stay XAS-only). Cross-origin traffic is deliberately never captured.
    • NEW Loaded resources: the scripts, stylesheets and fonts the page loaded, with timing and size — the "Sources light" a browser's DevTools would give you, without opening F12.

    Version 0.64.0

    • NEW Decoded network detail: click any captured request and see what it meant — the action (retrieve, operation, commit…), the entity or microflow, the parameters and the returned objects — instead of an opaque /xas/ blob. With Response/Request/Headers tabs, pretty-printed bodies and search-within-body. The first step in replacing the browser's DevTools with something that speaks Mendix.
    • IMPROVED Response bodies and headers are captured in memory only, within a fixed byte budget (oldest dropped first) — nothing is stored or transmitted. See PRIVACY.md.

    Version 0.63.0

    • FIXED Running a discovered operation gave HTTP 560. The tool now replays the exact request the client sent (including the page/selection context), instead of a stripped params-only call the runtime rejected. Re-run a flow you triggered in the app and it opens as expected.
    • IMPROVED Memory stays bounded: the discovered-operations store is now capped (oldest evicted), and captured request bodies are size-limited — a long session no longer grows unchecked.
    • IMPROVED Clearer error when an operation throws server-side, instead of a raw status dump.

    Version 0.62.0

    • IMPROVED Run results are formatted like the app: a microflow's return value now uses the Mendix client's own formatter (locale-aware numbers/dates) instead of raw JSON.
    • IMPROVED Opening pages works on the classic (Dojo) client too via its documented openForm, next to the React path — previously page-open silently failed there.

    Version 0.61.0

    • IMPROVED Microflows & Pages reworked into lenses: Microflows, Pages and Console are now three switchable views instead of one long scroll. Pages are no longer buried below 100+ microflows.
    • IMPROVED Scales to large apps: microflow groups start collapsed above 50 flows, with a collapse-all / expand-all toggle. Operations discovered from clicks appear in a pinned "Recently discovered" group; a flow that was clicked no longer shows up twice.
    • IMPROVED Pages lens has its own search and the page scan, plus a source pill (seen / declared) per page.
    • NEW Command palette & deep links now cover the flows lenses and jump straight to a page.

    Version 0.60.0

    • NEW Assessment report: endpoints & flows. The report now also inventories published REST/OData/SOAP services (discovery runs automatically at export) and the microflows and pages the client exposes — with captured friendly labels where a flow has been triggered, and an honest note that the client masks the real names.
    • IMPROVED Diagnostics export now bundles the endpoint inventory and flow/page inventory alongside the raw requests, errors and scans — one JSON with all the evidence.
    • IMPROVED Colour-blind-friendly verdicts: Web Vitals tiles, overview indicators and report tables now carry a ✓/△/✗ glyph next to the colour, so good/attention/poor is readable without colour vision. Container elements (like body) no longer show their boilerplate text in the LCP/INP attribution.
    • FIXED SOAP links gave HTTP 400: the runtime's webservices index links with absolute URLs, which ended up glued behind /ws-doc/. Links are now normalised and service roots point at their WSDL.

    Version 0.59.0

    • NEW 🧾 Assessment report (Overview ▸ Deliverables): one self-contained HTML report across every area — executive summary with a per-domain scorecard, domain model with the interactive ERD diagrams, entity access, performance & traffic, design/accessibility and app info, closed by an honest method-and-limits appendix. Areas you have not measured yet are reported as such; a pre-flight check lists them before you export.

    Version 0.58.0

    • NEW 🗺 ERD diagrams (Data ▸ Schema ▸ "🗺 ERD"): a module overview showing all modules and their cross-module associations, plus a full entity-relationship diagram per module — attributes, associations with cardinality, inheritance, cascade markers. Pan and zoom right in the panel.
    • NEW Interactive ERD report: one self-contained HTML file with the clickable module overview and a diagram per module — marketplace modules folded shut, print-ready per module. Plus SVG export of any single diagram.
    • NEW Module classification: known marketplace modules are recognised automatically and de-emphasised; flip any module between own ↔ marketplace with one click (saved per app).
    • IMPROVED CSS cascade view: the winning rule (highest specificity) now sits at the top instead of the bottom — the answer first, the also-rans below it.

    Version 0.57.0

    • IMPROVED One report foundation. The design, overview and access reports now share a single TOF document scaffold: identical branding, consistent typography and tables, print rules and a viewport meta on every export. Report content is unchanged — this is the groundwork for the upcoming application assessment report.
    • IMPROVED Shorter UI texts. Panel and popup copy has been tightened across the board — same information, fewer words.

    Version 0.56.0

    • NEW 🥃 Easter egg. Something salty-sweet found its way into the panel — a company-party tradition, in tool form. Liquorice lovers know what to type. (Three is the magic number; nobody drives home after.)

    Version 0.55.0

    • NEW Chrome Web Store preparation (unlisted publication, when we're ready): the extension id is now pinned via a manifest key — unpacked installs, shared zips and the future store version share the same id, so preferences survive the switch. Paste-ready listing texts, permission justifications, a privacy policy and a publish runbook live in store/. Nothing is published yet.
    Downloads
  • v0.54.0 4778b7b7b9

    TOFfe Dev Tools v0.54.0
    All checks were successful
    CI / build-and-test (push) Successful in 15s
    Details
    Release / publish (push) Successful in 11s
    Details
    Stable

    Chendo released this 2026-07-07 12:22:34 +00:00 | 142 commits to main since this release

    Version 0.54.0

    • NEW 🦊 Firefox support (Firefox 128+): every release now also ships a …-firefox.zip — the same build with a Firefox-ready manifest (event-page background, gecko id). Install temporarily via about:debugging, or sign once via AMO (self-distributed) for a permanent .xpi; see the README. Firefox treats site access as opt-in, so the toolbar popup now asks for permission to the current site on first use.
    • IMPROVED Release notes on git are cumulative: when a release is published, its notes now cover every version since the previous published release — intermediate versions no longer disappear.

    Version 0.53.0

    • NEW 📍 "Where does this come from?" — click any palette swatch, any row in the "hardcoded although a token exists" table, or any variable in the hygiene tables, and a panel lists every declaration with selector, file and line number, each with a copy button (theme.compiled.css:1234 .btn { color: … }). Line numbers are read from the stylesheet source itself; compiled Mendix CSS gets a hint to fix it in theme/web or app/styling (SCSS).
    • IMPROVED The CSS-cascade view now shows file:line for every matched rule, with a copy button per rule — send the developer straight to the place to correct it.

    Version 0.52.0

    • NEW Variable hygiene (Design ▸ Style ▸ CSS variables): two new tables — used but never declared (per variable: usage count, whether a fallback catches it, and whether it is only defined at runtime by JavaScript) and declared but unused (candidates — JS reads are invisible, so no death sentence). Both also appear as signals and in the client report.
    • IMPROVED The CSS-cascade view flags a declaration that references an undeclared variable with a red "⚠ --x undeclared" pill, telling you whether the fallback saves it or the declaration does nothing.

    Version 0.51.0

    • NEW 🚔 Inline-styling detection (Design ▸ Style): every style="…" attribute on the page, split into presentational properties (colour, font, spacing — the offence that, per house rules, authorises UX/UI designers to administer corporal punishment) and runtime properties (display/position, legitimately set by widgets). Click a row to highlight the element; svg internals and the tool itself are excluded.
    • NEW Inline styling also surfaces as an audit finding (and thus in the client report, phrased professionally), as a 🚔-pill on inspected elements, and in the CSS-cascade view.

    Version 0.50.0

    • NEW 🧊 Freeze / delay tool (Design ▸ Tools): start a 2/5/10-second countdown, open the menu, tooltip or dropdown you want to study — at zero the page freezes: CSS animations and transitions pause, and everything that opened during the countdown is captured as a readable, copyable HTML tree. Esc restores the page; the captures stay.
    • NEW Optional debugger break at zero — a real breakpoint, the "setTimeout(() => { debugger }, 3000)" console trick without the console. Only pauses when DevTools (F12) is open.

    Version 0.49.0

    • NEW Easy HTML inspection: pinning an element with the Element inspector now also shows its markup in a new 📄 HTML section (Design ▸ Tools) — a collapsible tree with syntax colours, cleaned of framework attributes (widgetid, data-mendix-id, …) by default, with a raw toggle and a "Copy HTML" button that produces neatly indented source.

    Version 0.48.0

    • NEW Page-wide contrast scan: one click in the contrast checker scans every text/background combination that actually occurs on the page — worst first, with WCAG AA/APCA verdicts, occurrence counts and design-token names. The checks-strip chip shows the verdict (✗ failing count / ✓ AA) at a glance.
    • IMPROVED Contrast in the client report: the report now leads with a summary ("N of M combinations below AA"), lists all failing pairs (up to 25) instead of a fixed top-10, and shows token names next to the colours.

    Version 0.47.0

    • NEW Design tokens everywhere: wherever the tool shows a flat colour it now also shows the CSS variable it comes from — in the element inspector, on the palette swatches (Design ▸ Style) and in the client report. A new "CSS variables (design tokens)" section lists every token with its usage count.
    • NEW Hardcoded-value detection: token-driven and hardcoded usage are counted separately — a colour that is hardcoded somewhere although a token with that exact value exists gets a ⚠ on its swatch, a dedicated table, a signal and a block in the client report. The CSS cascade view flags such declarations inline ("⚠ = var(--token)").
    • NEW !important insight: a new section counts every !important declaration (per property, with example selectors), the cascade view badges them, and the report summarises them under "Design tokens & CSS hygiene".
    Downloads
  • v0.46.1 da16eb55e0

    TOFfe Dev Tools v0.46.1
    Some checks failed
    CI / build-and-test (push) Failing after 33s
    Details
    Stable

    Chendo released this 2026-07-07 09:04:28 +00:00 | 155 commits to main since this release

    • NEW "＋?" discover-create-rights icon next to the entity search box: one click tests the create permission of all entities at once (create + rollback, nothing is saved), with live progress — the ＋ quick-create icons then appear for every allowed entity, and the icon turns into ✓ when everything is known. On demand only: denied attempts log a warning in the app's server console, so you choose when that's worth it.
    Downloads
  • v0.43.0 2410a21149

    TOFfe Dev Tools v0.43.0
    Some checks failed
    CI / build-and-test (push) Failing after 25s
    Details
    Stable

    Chendo released this 2026-07-06 19:58:25 +00:00 | 163 commits to main since this release

    Big release: full inline editing, a clearer Design tab with four new checks, a redesigned Overview, first-run onboarding, and accountability docs on the repo.

    New

    • Inline editing for every attribute type in Records (edit mode): text/number/boolean + enums, dates, single associations (searchable picker) and reference sets (multi-select with chips).
    • Bulk actions: select rows ? set one attribute across all, or bulk-delete (confirm-gated).
    • Design ? Audit extra checks in an always-visible chip strip: axe-core second opinion, heading & landmark outline, touch-target scan + 200% zoom, contrast checker � each chip carries its result badge.
    • CSS cascade (Design ? Tools): pin an element to see every matching rule by specificity, winner highlighted.
    • First-run welcome + guided tour (replay via ? ? Tour).
    • Per-role access export: scan results labeled with user + roles for side-by-side comparison.
    • Accountability on the repo: SECURITY.md, THIRD-PARTY.md, CycloneDX SBOM, LICENSE. CI workflow for Forgejo Actions.
    • ?? There may or may not be an easter egg in the simulations.

    Improved

    • Overview redesigned: app-identity hero with a review-progress meter, status-coloured cards with run buttons, App info card, and a clear Deliverables section ("Support bundle" ? Diagnostics export with explanation).
    • Save/create/delete/bulk now show a persistent ? confirmation.
    • Long usernames are never truncated in the header.

    Fixed

    • Objects can be opened in read-only mode again (view popup + ? Edit).
    • Switching the detail popup between rows shows the right values.
    • No more console errors after switching entity with an open detail popup.

    Install: unzip the asset, then load via chrome://extensions ? Load unpacked. Upgrading? Reload the extension and refresh the app page.

    Downloads