Languages: English · 简体中文 · 繁體中文 · 日本語 · 한국어 · Français · Deutsch · Español · Português (Brasil) · Русский · العربية · हिन्दी · ไทย · Tiếng Việt — see TRANSLATIONS.md
Your new tab is a spatial bookmark board. Organize bookmarks into labeled boxes on an infinite, hierarchical canvas — drag, connect, and nest them spatially.
Install · Screenshots · Why · Usage · Privacy · Store rollout
Think Obsidian canvas meets bookmarks.
Proof — the new tab page, out of the box:
Infinite Canvas — Pan and zoom freely (Ctrl+scroll). Create unlimited boxes on a single canvas. Connect boxes with lines to show relationships. Set parent-child relationships — move a parent and its children follow.
Two-Level Hierarchy — Large boxes hold small boxes. Small boxes hold bookmarks. Click into a box to enter its sub-canvas. Breadcrumb navigation shows your path. Nest as deep as needed.
Bookmark Management — Each box has its own bookmark collection with list and grid views. Add, edit, delete with a clean dialog. Open in current tab or new tab (configurable). Drag to reorder.
Connectivity — Visual SVG connection lines between boxes. Alt+Click a line to delete it (configurable: single-click or double-click). Parent-child movement propagation with elastic boundary clamping.
Design & Theme — Beige/cream minimalist aesthetic. Light and dark mode with automatic system detection. Adjustable font size and zoom. Square or rounded corners toggle.
14 Languages — en, zh_CN, zh_TW, ja, ko, fr, de, es, pt_BR, ru, ar, hi, th, vi with auto browser-language detection.
| Canvas | Boxes & Bookmarks | Connections |
|---|---|---|
|
 |
 |
| Settings | Bookmark Editing |
|---|---|
 |
 |
Light/dark logos, extension icons, favicons, store tiles, and the variants showcase are vendored in docs/brand/ (24 files, from the box_png asset kit). Reuse these for store listings, docs, and the GitHub social preview.
Important
Install from official store pages (recommended). GitHub Releases are a user-facing
changelog and optional source/sideload zips — they no longer ship .xpi / .crx.
For the current published version see docs/release-status.md
(single source of truth — this README deliberately does not restate a version literal,
so it cannot go stale; the badges above are workflow-backed and always live).
Gate background: ADR-0017. Publisher workflow:
publishing guide · store plan.
- Open Firefox Browser ADD-ONS — Boxing New Tab
- Click Add to Firefox and follow the browser prompts to finish installing
- Open Edge Add-ons — Boxing
- Click Get to install (Chromium browsers should use the Edge store page)
git clone https://github.com/Xxx91n/boxing.git
cd boxing
npm ci
npm run build- Chrome/Edge:
chrome://extensions→ Developer mode → Load unpacked → selectdist/boxing-chrome/ - Firefox:
about:debugging#/runtime/this-firefox→ Load Temporary Add-on → selectdist/boxing-firefox/manifest.json
Note
Build output zips are for store upload or local debugging only, not the official end-user install path. Install from the store links above.
Signing is handled by the stores; this repository's GitHub Releases no longer ship .xpi / .crx.
- Double-click empty canvas → create a new box
- Drag box title bar → move box
- Ctrl+scroll → zoom canvas (30% to 200%)
- Drag empty canvas → pan
- Right-click → go back to parent canvas level
- Click a box → enter its sub-canvas
- Drag from box edge midpoint → connect to another box
- Alt+Click a connection line → delete it
- Star icon on a box → mark as parent (children move together)
- Pin icon → lock box position
- Canvas top-right circle button → unpin header for fullscreen mode
- All data stored locally in
chrome.storage.local— nothing leaves your device unless you configure optional cloud backup - Optional WebDAV / GitHub Gist backup is the only outbound network usage
- WebDAV targets must be public HTTPS endpoints. Private, loopback, and link-local hosts are refused by design:
localhost,127.0.0.0/8,10.0.0.0/8,192.168.0.0/16,169.254.0.0/16(including the cloud metadata address169.254.169.254),172.16.0.0/12,*.local, and*.internal.- Why: a WebDAV URL you enter is later fetched by the extension background proxy. Allowing private addresses would turn a mistyped or hand-supplied URL into a request originating from inside your network (SSRF-style exposure) — router admin pages, NAS interfaces, cloud metadata endpoints — so the refusal is unconditional rather than a warning.
- Also refused: non-HTTPS URLs, URLs longer than 2048 characters, and URLs with an embedded username/password. The check runs in the settings UI and again in the background proxy before any request leaves the browser.
- Self-hosted WebDAV on your LAN or on
localhostis refused by default and can be allowed by an explicit opt-in: Settings → Sync → WebDAV → Allow private / local network hosts (advanced). The checkbox ships off. Turning it on relaxes the private-host refusal above and nothing else — the HTTPS requirement, the no-embedded-credentials rule, and the 2048-character URL limit all still apply. - Why the opt-in is explicit: enabling it removes the only barrier between a mistyped or hand-supplied URL and a request that Boxing issues from inside your network, addressed to router admin pages, NAS interfaces, or cloud metadata endpoints such as
169.254.169.254. Enable it only for a server you own, and prefer a name you control on a public HTTPS endpoint wherever that option exists.
- No analytics, no tracking, no third-party services
- Credential storage is obfuscation, not user-keyed encryption: WebDAV passwords and GitHub tokens are wrapped in an AES-GCM envelope whose key is derived from a random per-install key that is generated on first use and never leaves your browser profile — it is not part of the layout, JSON exports, WebDAV/Gist backups, or snapshots, so a copy of an export or backup read in isolation cannot unlock it. The key does live in
chrome.storage.localnext to the ciphertext, so anyone who can read your browser profile (or the running extension) can still recover your credentials. Boxing never asks for a passphrase and holds no user-supplied key. - Full privacy policy: docs/privacy-policy.md
- Node.js >= 18
- npm
git clone https://github.com/Xxx91n/boxing.git
cd boxing
npm install
npx playwright install firefox chromium
npm run buildnpm run build # Dev build → dist/boxing-chrome + dist/boxing-firefox
npm run dev:chrome # Build + launch Chrome with extension loaded (web-ext)
npm run dev:firefox # Build + launch Firefox with extension loaded (web-ext)
npm run dev:chrome:no-build # Fast reload without rebuilding (requires prior build)
npm run dev:firefox:no-build # Fast reload without rebuilding (requires prior build)
npm test # Playwright tests (Chrome + Firefox)See CONTRIBUTING.md for the full development guide.
The quarantine register, its expiry rule, and the host-environment incident register are no longer inlined in this product-facing entry: they are English-only governance records (all 13 localized READMEs omit them) that carried agent work-log paths.
See docs/testing-governance.md.
Contributions are welcome! See CONTRIBUTING.md for setup, workflow, and code style.
New to the repository? docs/START-HERE.md routes users, contributors, and agents to the right entry point.
Apache-2.0 — see LICENSE