Languages: English · 简体中文 · 繁體中文 · 日本語 · 한국어 · Français · Deutsch · Español · Português (Brasil) · Русский · العربية · हिन्दी · ไทย · Tiếng Việt — see TRANSLATIONS.md

Boxing

Your new tab is a spatial bookmark board. Organize bookmarks into labeled boxes on an infinite, hierarchical canvas — drag, connect, and nest them spatially.

Think Obsidian canvas meets bookmarks.

Proof — the new tab page, out of the box:

What Makes It Different

Infinite Canvas — Pan and zoom freely (Ctrl+scroll). Create unlimited boxes on a single canvas. Connect boxes with lines to show relationships. Set parent-child relationships — move a parent and its children follow.

Two-Level Hierarchy — Large boxes hold small boxes. Small boxes hold bookmarks. Click into a box to enter its sub-canvas. Breadcrumb navigation shows your path. Nest as deep as needed.

Bookmark Management — Each box has its own bookmark collection with list and grid views. Add, edit, delete with a clean dialog. Open in current tab or new tab (configurable). Drag to reorder.

Connectivity — Visual SVG connection lines between boxes. Alt+Click a line to delete it (configurable: single-click or double-click). Parent-child movement propagation with elastic boundary clamping.

Design & Theme — Beige/cream minimalist aesthetic. Light and dark mode with automatic system detection. Adjustable font size and zoom. Square or rounded corners toggle.

14 Languages — en, zh_CN, zh_TW, ja, ko, fr, de, es, pt_BR, ru, ar, hi, th, vi with auto browser-language detection.

Screenshots

Canvas	Boxes & Bookmarks	Connections

Settings	Bookmark Editing

Brand Assets

Light/dark logos, extension icons, favicons, store tiles, and the variants showcase are vendored in docs/brand/ (24 files, from the box_png asset kit). Reuse these for store listings, docs, and the GitHub social preview.

Install

[!IMPORTANT] Install from official store pages (recommended). GitHub Releases are a user-facing changelog and optional source/sideload zips — they no longer ship .xpi / .crx. For the current published version see the store listings linked above (single source of truth — this README deliberately does not restate a version literal, so it cannot go stale; the badges above are workflow-backed and always live). Gate background: CI gate ∧ manual store golden path ∧ Pages check. Publisher workflow: publishing guide · store plan.

Firefox (official install)

1. Open Firefox Browser ADD-ONS — Boxing New Tab
2. Click Add to Firefox and follow the browser prompts to finish installing

Edge / Chromium (official install)

1. Open Edge Add-ons — Boxing
2. Click Get to install (Chromium browsers should use the Edge store page)

Developers: build from source

git clone https://github.com/Xxx91n/boxing.git
cd boxing
npm ci
npm run build

• Chrome/Edge: chrome://extensions → Developer mode → Load unpacked → select dist/boxing-chrome/
• Firefox: about:debugging#/runtime/this-firefox → Load Temporary Add-on → select dist/boxing-firefox/manifest.json

[!NOTE] Build output zips are for store upload or local debugging only, not the official end-user install path. Install from the store links above. Signing is handled by the stores; this repository's GitHub Releases no longer ship .xpi / .crx.

Usage

• Double-click empty canvas → create a new box
• Drag box title bar → move box
• Ctrl+scroll → zoom canvas (30% to 200%)
• Drag empty canvas → pan
• Right-click → go back to parent canvas level
• Click a box → enter its sub-canvas
• Drag from box edge midpoint → connect to another box
• Alt+Click a connection line → delete it
• Star icon on a box → mark as parent (children move together)
• Pin icon → lock box position
• Canvas top-right circle button → unpin header for fullscreen mode

Privacy

• All data stored locally in chrome.storage.local — nothing leaves your device unless you configure optional cloud backup
• Optional WebDAV / GitHub Gist backup is the only outbound network usage
• WebDAV targets must be public HTTPS endpoints. Private, loopback, and link-local hosts are refused by design: localhost, 127.0.0.0/8, 10.0.0.0/8, 192.168.0.0/16, 169.254.0.0/16 (including the cloud metadata address 169.254.169.254), 172.16.0.0/12, *.local, and *.internal.
  • Why: a WebDAV URL you enter is later fetched by the extension background proxy. Allowing private addresses would turn a mistyped or hand-supplied URL into a request originating from inside your network (SSRF-style exposure) — router admin pages, NAS interfaces, cloud metadata endpoints — so the refusal is unconditional rather than a warning.
  • Also refused: non-HTTPS URLs, URLs longer than 2048 characters, and URLs with an embedded username/password. The check runs in the settings UI and again in the background proxy before any request leaves the browser.
  • Self-hosted WebDAV on your LAN or on localhost is refused by default and can be allowed by an explicit opt-in: Settings → Sync → WebDAV → Allow private / local network hosts (advanced). The checkbox ships off. Turning it on relaxes the private-host refusal above and nothing else — the HTTPS requirement, the no-embedded-credentials rule, and the 2048-character URL limit all still apply.
  • Why the opt-in is explicit: enabling it removes the only barrier between a mistyped or hand-supplied URL and a request that Boxing issues from inside your network, addressed to router admin pages, NAS interfaces, or cloud metadata endpoints such as 169.254.169.254. Enable it only for a server you own, and prefer a name you control on a public HTTPS endpoint wherever that option exists.
• No analytics, no tracking, no third-party services
• Credential storage is obfuscation, not user-keyed encryption: WebDAV passwords and GitHub tokens are wrapped in an AES-GCM envelope whose key is derived from a random per-install key that is generated on first use and never leaves your browser profile — it is not part of the layout, JSON exports, WebDAV/Gist backups, or snapshots, so a copy of an export or backup read in isolation cannot unlock it. The key does live in chrome.storage.local next to the ciphertext, so anyone who can read your browser profile (or the running extension) can still recover your credentials. That credential path never asks for a passphrase, and the per-install key is never used to protect a backup file. The one place a passphrase is used is the optional : Settings → Data → seals a manually exported backup with a passphrase you type, in a envelope (PBKDF2-SHA-256 → AES-GCM). Boxing does not store that passphrase and cannot recover it — lose it and the file stays unreadable — and it is what makes the file openable on another install, where the sync credentials still have to be typed in again.

Development

Prerequisites

• Node.js >=22.9.0
• npm >= 11.10.0 (required so the 7-day release-age guard in .npmrc takes effect; see .nvmrc)

Setup

git clone https://github.com/Xxx91n/boxing.git
cd boxing
npm install
npx playwright install firefox chromium
npm run build

Build

npm run build     # Dev build → dist/boxing-chrome + dist/boxing-firefox
npm run dev:chrome   # Build + launch Chrome with extension loaded (web-ext)
npm run dev:firefox  # Build + launch Firefox with extension loaded (web-ext)
npm run dev:chrome:no-build   # Fast reload without rebuilding (requires prior build)
npm run dev:firefox:no-build  # Fast reload without rebuilding (requires prior build)
npm test          # Playwright tests (Chrome + Firefox)

See CONTRIBUTING.md for the full development guide.

Contributing

Contributions are welcome! See CONTRIBUTING.md for setup, workflow, and code style.

New to the repository? docs/START-HERE.md routes users, contributors, and agents to the right entry point.

License

Apache-2.0 — see LICENSE