inline popup: + button, always-show 2FA tray, cap width at 400px (v2.29.0)

@@ -1,7 +1,7 @@11 {22   "manifest_version": 3,33   "name": "Peach",4-  "version": "2.28.0",4+  "version": "2.29.0",55   "description": "Zero-knowledge password manager",66   "browser_specific_settings": {77     "gecko": {

@@ -1,7 +1,7 @@11 {22   "manifest_version": 3,33   "name": "Peach",4-  "version": "2.28.0",4+  "version": "2.29.0",55   "description": "Zero-knowledge password manager",66   "action": {77     "default_popup": "src/popup/index.html",

@@ -1,6 +1,6 @@11 {22   "name": "peach",3-  "version": "2.28.0",3+  "version": "2.29.0",44   "description": "Zero-knowledge password manager",55   "type": "module",66   "scripts": {

@@ -1121,7 +1121,7 @@11211121   host.style.left = `${rect.left + window.scrollX}px`;11221122   // Spec §1.1: 320px width. The Math.max() floor preserves usability on11231123   // wide single-input fields (e.g. centered email input on signup pages).1124-  host.style.width = `${Math.max(rect.width, 320)}px`;1124+  host.style.width = `${Math.min(Math.max(rect.width, 320), 400)}px`;11251125 11261126   const container = shadow.appendChild(document.createElement("div"));11271127   container.className = "peach-inline-popup";@@ -1824,25 +1824,6 @@18241824       platter.appendChild(trayEl);18251825     }18261826 1827-    if (entry.hasTotp) {1828-      const moreBtn = document.createElement("button");1829-      moreBtn.className = "sp-action-btn";1830-      moreBtn.type = "button";1831-      moreBtn.title = "Show 2FA code";1832-      moreBtn.textContent = "···";1833-      moreBtn.addEventListener("click", (e) => {1834-        e.stopPropagation();1835-        if (trayEl) {1836-          closeTray();1837-          moreBtn.classList.remove("flashed");1838-        } else {1839-          moreBtn.classList.add("flashed");1840-          void openTOTPTray();1841-        }1842-      });1843-      actions.appendChild(moreBtn);1844-    }1845-18461827     const editBtn = document.createElement("button");18471828     editBtn.className = "sp-action-btn sp-action-edit";18481829     editBtn.type = "button";@@ -1855,6 +1836,11 @@18551836     });18561837     actions.appendChild(editBtn);18571838 1839+    // Always show the 2FA tray when the entry has TOTP — hiding it behind a1840+    // "···" toggle was zero-savings (the toggle button took the same space1841+    // the "2FA" label needed) and made the code one extra click away.1842+    if (entry.hasTotp) void openTOTPTray();1843+18581844     platter.appendChild(actions);18591845     container.appendChild(platter);18601846   }@@ -2190,7 +2176,7 @@21902176     const r = anchorEl.getBoundingClientRect();21912177     host.style.top = `${r.bottom + window.scrollY + 5}px`;21922178     host.style.left = `${r.left + window.scrollX}px`;2193-    host.style.width = `${Math.max(r.width, 260)}px`;2179+    host.style.width = `${Math.min(Math.max(r.width, 260), 400)}px`;21942180   }21952181   // These bindings are referenced from renderLocked()/dismiss() — they MUST21962182   // be initialized before renderLocked() runs, or the synchronous assignment@@ -2868,7 +2854,7 @@28682854   const rect = anchorEl.getBoundingClientRect();28692855   host.style.top = `${rect.bottom + window.scrollY + 5}px`;28702856   host.style.left = `${rect.left + window.scrollX}px`;2871-  host.style.width = `${Math.max(rect.width, 320)}px`;2857+  host.style.width = `${Math.min(Math.max(rect.width, 320), 400)}px`;28722858 28732859   const container = shadow.appendChild(document.createElement("div"));28742860   container.className = "peach-inline-popup";@@ -3024,7 +3010,7 @@30243010     const r = anchorEl.getBoundingClientRect();30253011     host.style.top = `${r.bottom + window.scrollY + 5}px`;30263012     host.style.left = `${r.left + window.scrollX}px`;3027-    host.style.width = `${Math.max(r.width, 320)}px`;3013+    host.style.width = `${Math.min(Math.max(r.width, 320), 400)}px`;30283014   }30293015   const stopObserving = observeAnchorPosition(anchorEl, updatePosition);30303016