feat: add cross-origin frame protection and Safari permission guidance

Block window.nostr injection in cross-origin iframes by default (defense-in-depth).
Add toggle in Settings > Security to control the behavior. Add Safari "Always Allow"
guidance to the support page so users understand per-site permission prompts.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: vveerrgg

distros/chrome/background-sw.build.js

@@ -233,11 +233,11 @@
                 </div>
                 </div>
                 <div style="flex-shrink:0;padding:12px 16px;border-top:1px solid #49483e;background:#3e3d32;text-align:center;font-size:0.75rem;">
-                    <a href="https://nostrkey.com" target="_blank" rel="noopener" style="color:#b0b0a8;text-decoration:none;">NostrKey.com</a>
+                    <a id="footer-home-link" href="https://nostrkey.com" style="color:#b0b0a8;text-decoration:none;cursor:pointer;">NostrKey.com</a>
                     <span style="color:#49483e;margin:0 6px;">|</span>
-                    <a href="https://nostrkey.com/terms.html" target="_blank" rel="noopener" style="color:#b0b0a8;text-decoration:none;">Ts &amp; Cs</a>
+                    <a id="footer-terms-link" href="https://nostrkey.com/terms.html" style="color:#b0b0a8;text-decoration:none;cursor:pointer;">Ts &amp; Cs</a>
                     <span style="color:#49483e;margin:0 6px;">|</span>
-                    <a href="https://nostrkey.com/support.html#donate" target="_blank" rel="noopener" style="color:#a6e22e;text-decoration:none;">Donate</a>
+                    <a id="footer-donate-link" href="https://nostrkey.com/support.html#donate" style="color:#a6e22e;text-decoration:none;cursor:pointer;">Donate</a>
                 </div>
             </div>
 
@@ -510,6 +510,12 @@ <h2 class="section-title">API Keys</h2>
                             <h2 class="section-title">Security</h2>
                             <button id="settings-security-btn" class="button w-full mb-2">Master Password</button>
                             <button id="settings-autolock-btn" class="button w-full">Auto-lock Settings</button>
+                            <label class="flex items-center gap-3 cursor-pointer" style="padding:4px 0;margin-top:8px;">
+                                <input id="frame-protection-toggle" type="checkbox"
+                                       style="width:18px;height:18px;accent-color:#a6e22e;" />
+                                <span style="color:#f8f8f2;font-size:14px;">Block cross-origin frames</span>
+                            </label>
+                            <p id="frame-protection-status" style="color:#b0b0a8;font-size:0.8rem;margin-top:4px;"></p>
                         </div>
                         <div class="section-card">
                             <h2 class="section-title">Sync</h2>

distros/chrome/background.build.js

@@ -102,11 +102,12 @@ let encryptionEnabled = false; // cached encryption state for fast lookups
 let autoLockTimeout = 15 * 60 * 1000; // 15 minutes default
 let autoLockTimer = null;
 let nostrAccessWhileLocked = false;
+let blockCrossOriginFrames = true;
 
 // Load persisted state on startup
 (async () => {
     log('[STARTUP] Reading persisted state...');
-    const data = await storage.get({ autoLockMinutes: 15, isEncrypted: false, passwordHash: null, nostrAccessWhileLocked: false });
+    const data = await storage.get({ autoLockMinutes: 15, isEncrypted: false, passwordHash: null, nostrAccessWhileLocked: false, blockCrossOriginFrames: true });
     log(`[STARTUP] isEncrypted=${data.isEncrypted}, passwordHash=${data.passwordHash ? 'EXISTS' : 'null'}, autoLockMinutes=${data.autoLockMinutes}`);
     autoLockTimeout = data.autoLockMinutes * 60 * 1000;
     // Defensive: if passwordHash exists but flag is stale, self-heal
@@ -117,6 +118,7 @@ let nostrAccessWhileLocked = false;
     }
     encryptionEnabled = data.isEncrypted;
     nostrAccessWhileLocked = !!data.nostrAccessWhileLocked;
+    blockCrossOriginFrames = data.blockCrossOriginFrames !== false;
     // If encryption is enabled, we start locked
     locked = encryptionEnabled;
     log(`[STARTUP] Final state: encryptionEnabled=${encryptionEnabled}, locked=${locked}`);
@@ -415,6 +417,7 @@ api.runtime.onMessage.addListener((message, _sender, sendResponse) => {
                     locked = false;
                     encryptionEnabled = false;
                     nostrAccessWhileLocked = false;
+                    blockCrossOriginFrames = true;
                     // Re-initialize with default profile
                     await storage.set({
                         profiles: [{ name: 'Default Nostr Profile', privKey: '', pubKey: '' }],
@@ -459,6 +462,14 @@ api.runtime.onMessage.addListener((message, _sender, sendResponse) => {
             }
             sendResponse(true);
             return true;
+        case 'getBlockCrossOriginFrames':
+            sendResponse(blockCrossOriginFrames);
+            return true;
+        case 'setBlockCrossOriginFrames':
+            blockCrossOriginFrames = !!message.payload;
+            storage.set({ blockCrossOriginFrames: !!message.payload });
+            sendResponse(true);
+            return true;
         case 'getActiveProfileInfo':
             (async () => {
                 try {

distros/chrome/content.build.js

@@ -1,8 +1,27 @@
 import { api } from './utilities/browser-polyfill';
 
-let script = document.createElement('script');
-script.setAttribute('src', api.runtime.getURL('nostr.build.js'));
-document.body.appendChild(script);
+async function shouldInject() {
+    if (window === window.top) return true;
+    try {
+        const data = await api.storage.local.get({ blockCrossOriginFrames: true });
+        if (!data.blockCrossOriginFrames) return true;
+    } catch {
+        return false;
+    }
+    try {
+        void window.top.location.href; // throws for cross-origin frames
+        return true;
+    } catch {
+        return false;
+    }
+}
+
+shouldInject().then(inject => {
+    if (!inject) return;
+    let script = document.createElement('script');
+    script.setAttribute('src', api.runtime.getURL('nostr.build.js'));
+    document.body.appendChild(script);
+});
 
 // Permission bottom sheet
 let permissionSheet = null;