1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
|
# Message Catalog
All message handlers extracted from static analysis. Messages flow via `chrome.runtime.sendMessage` / `chrome.runtime.onMessage`.
## Background Message Router
The main handler registration (`m5({...})`) in `background.js` registers these content-script → background handlers:
### Core / Account
| Message | Notes |
|---------|-------|
| `get-account-list` | Also exported as `b5xHandlers` for b5 web app |
| `get-default-account-info` | |
| `open-extension-welcome-page-for-onboarding` | |
### b5 Web App Integration
| Message | Notes |
|---------|-------|
| `open-swe-native-wrapper` | Open native app wrapper from SWE |
| `sign-in-succeeded` | b5 web app sign-in completed |
| `b5-session-init` | Initialize session from b5 web app |
| `b5x-request-session-init` | Extension requests session from b5 |
| `b5-sso-complete` | SSO flow completed on b5 |
| `b5x-credential-hydration` | Hydrate credentials from b5 |
### Frame/Inline Management
| Message | Notes |
|---------|-------|
| `relay-message-to-frames` | **Background relays messages between frames** — attack surface |
| `targeted-message-to-inline-menu` | Send message to specific inline menu |
| `refresh-can-request-unlock` | |
| `get-frame-manager-configuration` | |
### Autofill / Inline Suggestions
| Message | Notes |
|---------|-------|
| `get-inline-suggestions` | Content script requests fill suggestions |
| `perform-inline-action` | User selected an inline action |
| `record-inline-menu-render-event-all-accounts` | Telemetry for inline menu render |
### Save Flow
| Message | Notes |
|---------|-------|
| `add-save-object` | Content script submits credential to save |
| `get-save-object-public-key` | Get public key for encrypting save objects |
### WebAuthn / Passkeys
| Message | Notes |
|---------|-------|
| `create-credential` | Passkey creation request |
| `get-credential` | Passkey authentication request |
| `should-intercept-webauthn-request` | Content script asks if it should intercept WebAuthn |
### Privacy.com Integration
| Message | Notes |
|---------|-------|
| `enable-privacy-integration` | |
| `get-privacy-enable-dialog-configuration` | |
| `get-privacy-create-dialog-configuration` | |
| `fill-new-privacy-card` | |
### Email Alias (Fastmail)
| Message | Notes |
|---------|-------|
| `get-email-alias-dialog-configuration` | |
| `start-email-alias-session` | |
| `generate-email-alias` | |
| `cancel-email-alias-session` | |
| `fill-new-email-alias` | |
### Brex Integration
| Message | Notes |
|---------|-------|
| `get-brex-dialog-configuration` | |
| `fill-new-brex-card` | |
### Shell Plugins (AI Agent Integration)
| Message | Notes |
|---------|-------|
| `shell-plugins-notification-config` | |
| `shell-plugins-dismiss-notifications` | |
| `shell-plugins-save-in-1password-notification` | Credential detected in AI browsing agent |
| `shell-plugins-fallback-notification` | |
| `shell-plugins-site-config` | |
| `shell-plugins-item-saving-prompt` | |
| `shell-plugins-get-last-detected-credentials` | |
| `shell-plugins-set-last-detected-credentials` | |
### Error/Logging
| Message | Notes |
|---------|-------|
| `report-error` | Structured error reporting from any context |
| `health-check-request` | (in health-check.js) Returns `health-check-response` with `"alive"` |
## Content Script → Background Messages (from inline scripts)
### inject-content-scripts.js
- `login-detection-is-enabled` — query feature flag
- `new-log-event` — log from popup context
- `new-tab-log-event` — log from content/extension page context
- `report-error` — structured error report
### injected.js (page managers)
Sends all of the `m5` handler messages listed above, plus internal frame management:
- `forward-active-field-details`
- `forward-inline-menu-position`
- `frame-takes-focus`
- `provide-frame-origin`
- `filter-inline-menu`
- `focus-inline-menu`
- `add-scroll-and-resize-event-listeners`
- `remove-scroll-and-resize-event-listeners`
- `edited-state-changed`
### b5.js (1Password web app pages)
- `b5-session-init`, `b5x-request-session-init`, `b5-sso-complete`
- `b5x-credential-hydration`
- `open-swe-native-wrapper`, `sign-in-succeeded`
- `open-extension-welcome-page-for-onboarding`
### heuristics.js (login detection)
- `LOGIN_EVENT`, `LOGIN_STEP` — login heuristic detection events
### modal.js (dialogs)
- `can-request-unlock` — check if unlock is requestable
- Privacy.com, email alias, Brex dialog messages (listed above)
### notification.js
- `DeviceTrust` — device trust notification
- `report-error`
### menu.js (inline menu)
- `get-inline-suggestions`, `perform-inline-action`
- `focus-page`, `save-item`, `request-verification-token`
## Background → Content Script Messages
Background uses `chrome.tabs.sendMessage` (7 occurrences) to push messages to tabs. Also uses `chrome.scripting.executeScript` (4 occurrences) for direct injection. Specific message names sent to tabs need deeper analysis of the minified code.
## Background Broadcast Events (internal)
Observed event names used in background's internal pub/sub system:
- `accounts-and-vaults-changed`
- `accounts-locked`
- `can-request-unlock-changed`
- `unleash-features-changed`
- `extension-first-survey`
- `unified-panel-update`
## Message Volume
Total unique `name:"..."` strings in background.js: **829** (includes API method names, crypto algorithm names, vault/group names, etc. — not all are message handler names).
|
