# Devthink

Devthink is a **consent-first browser-agent bridge** distributed as a TypeScript library and a Chromium Manifest V3 extension. It turns a user-provided browser objective into a bounded, reviewable plan. The user must start the active-tab session and approve the plan before any page action reaches the browser.

Version: **2.0.13**. License: **GPL-3.0-only**. The repository is `wenathlan/extension`; the npm-compatible scoped package identifier is `@wenathlan/extension`.

**Platform release status:** 2.0.0 is the closing release of the chain from 1.1.31 — the agentic browser platform with the frozen protocolv2 contract, the deprecation window closed (protocol major two only, with the migrateplan bridge and `docs/migrationguide.md` carrying version one assets forward), the example gallery of thirty six runnable recipes (`docs/gallery.md`), the readiness review with the go decision (`docs/readiness.md`) and every candidate gate green with its evidence in `tests/artifacts/`. The library ships on five package channels — npm, maven, nuget, the container image and the rubygems gem. The full chain from 1.1.31 to 2.0.0 lives in `docs/releasenotes.md`.

## What it does

| Capability | Behavior in 2.0.13 |
| --- | --- |
| Active-tab session | The user starts a short-lived session for one HTTPS tab and one origin; the session records its origin grants. |
| Page observation | The extension captures the complete semantic inventory: every interactive element, every form control, every select option and the full page text. |
| Plan proposal | A local plan can be created immediately; an optional user-configured HTTPS endpoint can return a typed plan proposal of any length. |
| Documentation | The kind documentation (`docs/kinddocs.md`) covers every action kind of the immutable vocabulary with its consent class and a schema valid example, the flow documentation (`docs/flowdocs.md`) draws every execution flow in the shared mermaid style, and the reference documentation (`docs/refdocs.md`) mirrors the cli, protocol, audit, configuration, schema, capability, tool, trigger and permission tables the doccheck gate verifies. |
| Example gallery | The gallery documentation (`docs/gallery.md`) is the fastest way to start with the library: 36 runnable recipes (scraping, forms, testing, monitoring and agents) validated against four bundled fixture pages, with the recipe format reference and the authoring guide. |
| Surface catalog | Every surface the capability manifests serve — background, sidepanel, popup, pagebridge, cli, library and mcp — speaks the frozen protocolv2 contract with its own capmanifest; the pagebridge content script stays the only injected file. |
| Review gate | Every remote proposal starts in `pending`; it cannot reach the page bridge before explicit approval. |
| Browser tools | Reviewed plans cover three hundred thirty four action kinds: pointer paths and coordinate clicks, text, aria, name, xpath, index and point target resolution, timed typing, key holds, sliders, dates, colors, shadow dom piercing, iframe entry, dialog answering, retry rules, a complete read vocabulary with clickable maps and verification reads, page mutation under review, and browser-level tab, window, zoom, snapshot and download commands. |
| Forms and data | The agent fills forms with review: `fillform` fills from a structured record of field matches, kinds and values, `filllabel` and `fillplaceholder` match controls by label, placeholder or aria label, `detectfields` reports the form map with field kinds, `generatevalues` seeds locale aware values per field kind while real looking card numbers and personal identifiers are refused, `saveprofiles` stores profiles behind origin grants, `asksubmit` opens the submission prompt with the values diff, `submitform` submits only under an approved consent ref, `readerrors` associates inline validation messages with fields, `retryform` retries with reviewed backoff windows, `runwizard`, `selectchain`, `picktypeahead` and `pickdate` drive wizards, dependent selects, typeaheads and calendars, `attachfile` attaches run store artifacts, `fillcard`, `fillcode` and `consentpassword` handle payment and secret fields behind explicit consent, `skiphoneypot` skips trap fields, `detectlogin` and `detecttemplate` flag login, signup and checkout shapes, and `handoffcaptcha` pauses the plan and hands control back to the user. |
| Media capture | The agent sees the page as evidence: `shotview` captures the visible viewport in the reviewed format, quality and pixel ratio, `shotfullpage` stitches viewport tiles on an offscreencanvas with linear overlap blending, fixed header skipping, hidden capture scrollbars and a stitching scroll budget kept inside the reviewed wait window, `shotelement` crops the pixel ratio scaled element rect with a tiled fallback when the element crosses the viewport edge, `shotregion` requires the explicit reviewed flag for every reviewed region rectangle and walks scrollable containers in reviewed steps, `contactsheet` tiles element captures into one labeled grid, annotated captures carry the step number marker, the target outline and a time and url footer, beforeafter capture pairs a before and after shot around every page moving action with the dom snapshot id of the same moment, capture names stamp from run, step, sequence and kind segments with per run counters, and export routing stays consent layered: memory keeps the bytes under the user configured capture retention window while the metadata survives, clipboard export needs clipboardwrite and download export runs through the reviewed download flow. |
| Documents and moving media | The agent captures documents and moving media behind the same gates: `capturepdf` composes a derived pdf report from page segments with reviewed paper size, margins, scale, landscape orientation and break point pagination named with the capture naming rule, `recordscreen` and `captureaudio` are sensitive recordings of user activity that need an approved recording consent prompt per start, run inside the user configured recording window and stop cleanly at run end — deriving an ordered frame sequence and an honest manifest from viewport captures instead of encoded screencast bytes because tabCapture stays outside the manifest — `captureframe` seeks a video to the reviewed timestamp and grabs the still frame, `downloadimages` matches a reviewed imagefilter, deduplicates urls and downloads through the reviewed flow, `shotcanvas` reads 2d and webgl canvas buffers, `probestream` reports webrtc track details read only, `readmedia` and `readassets` extract embedded media sources and page assets, `timelapse` captures an ordered lapse inside the reviewed wait budget, and `convertimage` and `makethumbs` transform stored captures between formats and into reviewed thumbnails. |
| Network observation | The agent speaks to the network with consent: `fetchurl` retrieves a reviewed HTTPS url from the extension context behind the origin grants with reviewed timeout, retries, backoff and redirect follow limits kept inside the reviewed wait budget, custom header allowlists need a per origin consent that names them (credential bearing headers always), large bodies stream chunk by chunk inside a user configured byte budget, `parsejson` extracts named fields from stored bodies through dotted json paths with reviewed defaults and honest miss outcomes, `parsehtml` runs reviewed selectors over fetched markup through the page bridge domparser, and the sensitive `callrest` and `callgraphql` kinds run typed endpoint calls with payload schemas, url templating, reviewed success status classes and graphql data and error unwrapping, with stored api key references attaching secrets only inside their origin scope; header values and body bytes never enter the audit trail. |
| Sockets, streams and page apis | The agent listens to the network with consent: `opensocket` opens a wss websocket channel behind the socket gate with reviewed protocols, reconnect budget and exponential backoff capped at the user configured ceiling, `sendmessage` publishes a reviewed payload on a named stream of an open channel (sensitive), `waitmessage` waits on the reviewed stream, json path and match limit filter, `subscribesse` opens a server sent events stream that resumes from the last event id and cancels on its reviewed path, `longpoll` walks a reviewed cursor loop that stops on its stop condition, cancellation or plan expiry, `watchrequests` observes the requests of the run tab derived from the page timing buffers behind the webrequest grant with one correlation id per request and honest error classes, `readheaders` reads captured headers through a required allowlist and redaction list, `capturebodies` stores matched bodies inside the reviewed byte ceiling (sensitive when private mime types are listed), `mapapi` ranks the page api endpoints by frequency, json share and payload stability, and `extractapi` replays a captured endpoint with reviewed overrides and extraction paths, read only when the replay verb is read; the network view lists every exchange with correlation ids, live channel state, event names and poll cursors, and payload values, header values and body bytes never enter the audit trail. |
| Network control | The agent takes the steering wheel with consent: `blockrequest` registers reviewed block rules with origin patterns and the explicit reviewed flag behind the blockgate, `mockresponse` serves reviewed fixtures with their full body, `rewriteheaders` applies set, append and remove header rules with audited provenance, `setcookies`, `readcookies` and `clearcookies` run behind the cookiegate through the page cookie jar of the granted domain, `authflow` runs a reviewed oauth flow with a consent tab, code capture on the granted redirect origin, token exchange and refresh behind storage ids, `saveapikey` stores key entries behind explicit consent with last use timestamps, `routeproxy` applies a run-scoped route with a bypass list behind the proxygate, and `postform` and `postfiles` submit rate limited urlencoded forms and streamed multipart uploads of reviewed files; every rule reverts the moment the run ends, fails or is cancelled, and header values, cookie values, key material, token values and file contents never enter the audit trail. |
| Run timeline | The agent records what pages say and how they misbehave: `watchconsole` captures console output at every reviewed level through page-injected console hooks with a required redaction pattern list applied before any text leaves the page bridge, object arguments serialize through a reviewed depth bound, spam detection collapses repeats into counts with flagged thresholds and log rotation moves overflow to the reviewed target store without data loss, `watcherrors` captures javascript errors with stack frames, unhandled rejections with reasons and resource load failures with element context behind the stack gate, and `watchtasks` observes longtask entries with attribution names and blocking duration per step window; every watch runs read only behind the timeline gate that scopes capture to the run tab with a reviewed window kept inside the reviewed wait budget, console capture prompts once per origin, watchers cancel on run cancel and the killswitch and detach when the tab navigates or closes, failed requests of the run join the timeline, and the console diff view compares two runs into added, removed and repeated lines while level count summaries survive the retention window. |
| Debugger attach | The agent attaches a devtools-style session with consent: `attachcdp` enables only the reviewed domains of the reviewed domain grammar behind the debuggate and the per origin debugger consent prompt that shows the domain allowlist, every attach carries its reviewed teardown plan of revert steps and resume policy, `cdpcmd` sends raw reviewed commands of the `Domain.method` form that serialize per session in send order with duration and error class results (protocol errors fail the step), `watchcdp` forwards matched domain events into the run timeline for a reviewed lifetime window, `setbreakpoint` registers reviewed instrumentation hooks with conditions of the reviewed expression grammar behind the user configured breakpoint ceiling, `stepcode` steps paused probes through stepover, stepinto, stepout and resume while capturing pause states with call frames and the dom snapshot through the page bridge, `watchexpr` evaluates reviewed expressions at every pause and stores the values with their pause scope, and `overridescript` applies reviewed page script fixtures on new document evaluation that revert at run end; the debugger permission deliberately stays outside the manifest, so the whole family runs through the page-instrumented harness injected by the scripting api with the honest derivation recorded on every session, every breakpoint and override reverts on run end, failure, cancellation, tab navigation and the user detaching the debugger — which pauses the run for review — and command params, fixture sources and token values never enter any report or the audit trail. |
| Profiling | The agent measures what the run is made of with consent: `measureflow` marks the start and end of every step of the reviewed flow window and measures navigation, paint, largest contentful paint, first input delay, interaction timings and the blocking time summed per step window from the performance buffers, `heapshot` snapshots the used and limit heap bytes with the dom node count on demand under the user chosen interval only, `trackmemory` samples the heap beside every following step, computes the growth trend slope and flags the steps above the reviewed slope with timeline warnings, `profilecpu` ranks the hot functions of the profiled window by accumulated sampled time, `watchshifts` records layout shift scores with their impacted selectors, `traceload` records a trace under the reviewed category list that stops at the reviewed window end and exports through the reviewed download flow under the user configured byte ceiling, `annotatetrace` aligns step ids and labels with the run timeline so exported traces never lose their annotations, `replaytrace` renders the stored file offline grouped by category and step, and `capturesourcemaps` fetches and parses the map files of the loaded same origin scripts behind the per origin consent with stack rewriting through a minimal mapping lookup; every profiling kind runs behind the targetgate with the approved debugger grant of the origin, attachcdp accepts reviewed iframe, worker and service worker targets with flattened sub sessions inside the granted origins, the heavy bytes expire after the user configured profile retention while the counts, hot functions, category lists and annotations survive, and the debugger permission deliberately stays outside the manifest — every derivation is recorded on each record and the changelog says so. |
| Emulation | The agent wears reviewed masks with consent: `emulatedevice` applies a user curated device preset of width, height, pixel ratio and the mobile flag to the run tab and reloads only when the reviewed plan asks, `emulatenetwork` applies latency, download and upload bounds and the offline window of the reviewed plan to the traffic the extension itself initiates, `emulatelocate` overrides navigator geolocation with the reviewed coordinates behind an explicit per origin location consent whose prompt shows the exact latitude and longitude, `setuseragent` applies the reviewed user agent string, platform and brand list together scoped to the run tab only, `overridepermission` answers navigator permission queries of the reviewed browser permission set with the granted, denied or prompt state graded by name while the prior state restores at run end, and `blackboxscripts` marks third party url patterns as blackboxed in traces and hides their frames from captured stack traces, read only; every emulation kind runs behind the emugate (live session on the run tab, approved plan, the explicit reviewed flag and a reviewed revert plan beside every layer), layers stack only while the reviewed plan lists their steps with the last applied winning conflicts, every layer records the prior page state for the exact revert and the whole stack reverts in reverse order at run end, failure, cancellation, tab navigation and tab drop, the emulation state survives service worker restarts through the run record, the device, network, location and agent preset libraries stay user curated data with versioned import and export files through review, and the reverted prior states expire after the user configured retention while the layer history always survives — the debugger, geolocation and notifications permissions deliberately stay outside the manifest, so every mask is a page-injected derivation recorded honestly on each layer and in the changelog. |
| Session memory | Every run becomes survivable with consent: `persiststate` checkpoints the task state of the run after every completed step with a checksum that detects corruption before any resume and the run resumes from the checkpoint after a service worker or browser restart, `capturesession` snapshots the full browsing session beyond tabs and windows into per tab scroll positions, non password form state, and the local storage and cookie names of granted origins through the reviewed section toggles, `restoresession` reopens the saved tabs in their recorded order with the scroll and form state restored behind an explicit restore review that lists every tab, form field and capture first and skips origins whose grants expired with a report, `namedsessions` files sessions under unique names, folders and tags, `diffsessions` classifies tab, url, form and storage changes of two saved sessions as read only evidence, `searchsessions` matches urls, titles, names and captured text inside a reviewed time window, `exportsessions` packs records into a versioned checksummed session file through the reviewed download flow and `importsessions` adds records only after the full record review of the known format version — the auto snapshot interval, snapshot count, expiry and retention stay pure user choices with no code ceiling, crash restore prompts stay inside the session consent model, and the manifest permissions stay unchanged. |
| Workflow engine | Steps compose into workflows with consent: `composeworkflow` validates the name, version, granted HTTPS origins, steps and reusable blocks, expands every nested block before review so no step stays hidden, grades the record by its worst step and freezes it, `savetemplate` shares one reviewed step across workflows, `runworkflow` executes the expanded list one step at a time behind the live session, approved plan, origin grants and the explicit run review flag with a checkpoint after every completed step that survives service worker restarts, `dryrun` evaluates every step read only through per kind projections and refuses mutation steps without one, `delay` sleeps a seeded jitter window with long delays riding the alarms api when the browser exposes it, `waitelement` polls a selector until appearance, the reviewed timeout or a clean abort on tab navigation, `compute` evaluates expressions of arithmetic, comparison, logic, text, contains and length operators with operand coercion, and `extractvars` stores regex named captures as variables with the no match case reported honestly — typed scopes stack per block with shadowing, bindings link earlier outcomes to named variables, `${name}` interpolation substitutes scope values into targets, values and options, and 1.1.51 adds the control flow family: `condition` evaluates a reviewed boolean expression over the extracted values with no page side effect, `branch` chooses the first matching path by page state (pageurl, pagetitle and pageready) with a mandatory else path so every branch terminates, `loop`, `repeatuntil`, `whileloop` and `foreach` iterate lists, convergence conditions, bounded while conditions and matched elements rebinding the deep copied item and index variables per iteration inside user configured safety bounds with no code ceiling, `parallel` runs branches concurrently in isolated scopes that the join merges under the first, last or fail strategy over conflicting writes with cancel or continue on branch failure, and `trycatch` wraps fragile steps with a catch handler, rerun option, retry policy of user configured attempts over fixed or exponential seeded backoff and the reviewed error classes, and per step and per run timeout budgets whose aborts carry the cancelled error class — composition validates every control payload, collects every nested child step so no construct hides a step and grades the record by its worst child, single step execution runs one chosen step outside the run loop, pause, resume and cancel record their reasons, runlogs keep under the user configured retention with no code ceiling, control decisions persist for audit, and the manifest permissions stay unchanged. |
| Triggers and scheduling | Reviewed workflows start themselves with consent: `visitrule` fires on navigations to reviewed HTTPS origins, `urlrule` matches glob patterns where `*` spans one path segment and `**` spans across segments with explicit ports honored, `menurule` binds a context menu entry, `keyrule` binds a keyboard shortcut command, `buttonrule` binds the toolbar button, `cronrule` schedules five field cron expressions with named weekdays and months and optional timezones resolved through the runtime database, `intervalrule` fires every reviewed period with a seeded jitter spread, `urllistrule` plans one run per url of a reviewed list, `webhookrule` verifies a shared secret over the entropy floor and a payload schema in constant time before anything persists, and `eventrule` subscribes to observed page events of the catalog (mutate, focus, banner, console, error, navigate) — every rule arms behind the explicit arm review that renders its match fields and bound workflow first, grades sensitive, and every launch re-passes the live session, approved plan and origin gates through the same run machinery as a reviewed runworkflow step with the triggering url, title and payload as seed variables; cooldown windows, interval periods with jitter and the fire record retention stay user choices with no code ceiling, the dedupe keeps one pending fire per rule while a run is active, the queue holds fires that arrive while the run is busy or the session is paused and drains in arrival order on resume, the manual run step preview renders every expanded step with its control summaries before confirmation, scheduling persists through chrome.storage and opportunistic wakes with the alarms api riding the browser only when exposed without a declared permission, and the manifest permissions stay unchanged. |
| Workflow editor | Reviewed workflows get a visual home with consent: the canvas renders steps as nodes with typed binding sockets and blocks as containers with nested child steps, drag and drop snaps onto the reviewed grid and the nearest block column, the palette lists curated drop blocks across actions, control flow, waits, variables and triggers with search, the step library browses every reviewed kind grouped by category with its option schema, the step inspector edits options, bindings and nested params, the variable inspector lists scopes and values, the mini map projects the full canvas with click navigation and the zoom keeps step labels readable, undo and redo cover every canvas edit, and every save passes the editorsavegate of a live session, an approved plan, unique node ids, forward only edges and the full composeworkflow grammar so no editor artifact bypasses review — breakpoints mark any step for debug runs that pause before it and resume exactly there, version timelines carry change notes with diffs of added, removed and changed steps and rollbacks that grade unreviewed until the rollback review approves them, imports grade unreviewed until the import review approves the expanded step list, exports and share bundles ship as json or yaml with the export content review refusing any secret, token, api key, password or authorization field so secrets never leave the browser, background runs keep executing with the panel closed while every step checkpoints and every worker wake restores them through the same gates, the watchdog recovers stalled runs by the user configured retry, pause or cancel and reaps zombie runs of browser shutdowns with thresholds and windows as pure user choices with no code ceiling, run history keeps outcome, duration and trigger cause under a user configured retention, and per site overrides adjust only the reviewed knobs of loop bounds, step and run timeouts, element wait timeouts and delay bases per https origin pattern or subdomain glob — no new action kinds, the manifest permissions stay unchanged. |
| Multi agent swarm | Several agents work at once over one shared context with consent: each agent binds to its own tab with its own role (planner, worker, observer, critic, verifier or any custom role, one agent per tab), the shared task queue carries user configured lanes, priorities, claims and work stealing inside one approved swarm with lane ownership rules, dead agents release their tasks through claim heartbeat expiry and requeue, agent mailboxes route direct, broadcast and role addressed messages, the blackboard holds the goals, facts, findings and scratch sections every agent reads with the consent class of the source extraction, per agent budgets halt at the user configured token, cost and step ceilings, per agent scopes stay inside the session grants, sub agents spawn under a user configured depth limit, and the killswitch halts every agent at once with no configuration barrier — no agent count, lane or ceiling is hardcoded and every agent proposal passes the same human review. |
| Multi agent orchestration | The swarm organizes itself under consent: a leader worker topology elects its leader by the user rule (first registration or one named agent) with worker, critic and verifier lanes, the leader slices tasks across workers and scales the worker lane by load under the user configured bound with no engine cap, the planner executor split keeps plan drafting and execution in different agents while the executor reports every step outcome back, critics review agent outputs read only with verdicts and required changes, verifiers mark result claims pass or fail with the method they used, tab handoffs move a task between agents mid run from its packaged state while preserving the original session grants, resource locks keyed by one origin and one selector serialize parallel writes with exclusive and shared kinds and expiry sweeps, conflict scans detect overlapping writes with a suggested ordering, parallel results merge into one report under first, last, preferagent or fail rules with provenance for every merged value, escalations lift stalled decisions to the user who alone decides them, arbitration orders competing lock claims by the user rule, consensus rounds carry at the user configured quorum, verified lessons land on the blackboard, shared cost accounting sums the per agent usage, and the progressboard shows every agent at once with the interleaved timeline and replay — coordination never bypasses the review. |
| Fleet control | The 1.1.72 family gives the fleet control and accountability: every agent registers through agentname into a fleet registry of agentrecords with unique lowercase names, roles and home origins (the reserved identities never belong to an agent) while every session, run and step attributes to its agentid, the agentscope narrows the action kinds and origins to the session grants with a read only observer scope, the per agent budget grants from user configuration with no hardcoded cap and spends one unit per executed step with refusal past the ceiling and a remaining report, pauseagent holds one agent without stopping its peers or touching their run records, the engagekillswitch cancels every agent run, clears every queue and stops every record in one user triggered call with one audit event per stopped agent (an agent never triggers it and a pause never shields an agent from the stop), escalations block the raising agent until the human answers with the step context beside the agent question, review records carry one agent output to a peer of the shared origin with the verdict recorded beside the original output forever, every completed agent run captures its runreplay under the user retention and reconstructs from the audit trail when the memory is gone, outputcompare aligns two competing outputs field by field into matching, conflicting and missing, and the consensusvote collects one vote per agent under the user quorum with the dissent kept — outputcompare and consensusvote grade read only and never touch the page, and no fleet path ever bypasses a review. |
| Agent work | The 1.1.73 family scales the coordination itself: sub agents spawn on demand under the user configured depth limit with the parent scope copied into the child unless narrowed (a narrowing that widens past the parent refuses and a subset gate re-validates every child scope), parallel results aggregate into one report with per agent sections, run provenance and conflicts resolved by the user configured policy order or sent to the escalation, the interleaved timeline orders the actions of every agent into one merged view with the per agent lanes kept visible for the audit, lessons of finished runs spread across the fleet with origin matched serving, reuse counts, secret refusal, sanitization before storage and user configured decay, resources arbitrate under prioritized lanes (the first requester holds by default, a higher priority lane wins the verdict, the release frees the resource when the holder finishes and the verdict never bypasses the sessionlock or the origin grants), the priority lanes keep sensitive steps in the interactive lane and prevent lane starvation through the round robin fallback, workers scale by site load through the collected load reports with spawn and pause suggestions that never act without the user consent, and the shared cost ledger attributes every unit to its requesting agent while shared costs split equally among their causers — no work path ever bypasses a review. |
| Navigation intelligence | The 1.1.74 family moves through the page with prediction and proof: navintent reads the approved plan in step order, weighs every navigation candidate by the urlhistory of the run and ranks the predicted next urls by the combined confidence while navintent and prefetchpage grade read only observations that issue no request of their own, prefetchpage warms only the granted urls through speculative dns with no mutating request ever firing during the warming and drops every stored prediction the moment the plan it came from changes, preconnectorigin opens read only and revocable sockets to the expected origins ahead of the steps under the host grants, deeplinkapp builds the common web app routes (github, youtube, maps, wikipedia, amazon, x beside the user stored patterns) from the reviewed parameters only after the pattern origin grant, every tab removal lands a closedtabrecord under the user retention window and reopentab restores it after the grant recheck (a record whose origin lost its grant refuses and a reopened record never reopens twice), restoretrail rebuilds the navtrail of the run from the urlhistory with duplicates folded and replays it into one fresh tab behind the audit consent, pausenavconsent freezes every navigation kind while a consent prompt is open and queues the pending navigation until the answer, navratelimit counts every navigation per domain inside the user configured sliding window and delays a full window by naming the wait in the response envelope instead of dropping it silently, openclipboardurl opens the clipboard url only behind the explicit user gesture and the origin grant, checksafeurl refuses the weak schemes, embedded credentials, private and raw hosts and the lookalike hosts that imitate a granted origin with the reasons shown before anything opens, and batchopenlinks verifies every url, bounds the batch by the user ceiling only and opens one tab per link across the rate windows — no window, ceiling or retention is ever hardcoded and no navigation path bypasses a review. |
| Data pipelines | The 1.1.75 family grows the extraction into full data pipelines: streamdisk streams the large extracts to disk chunk by chunk under the user chosen chunk size with only the active chunk riding the write, the rows and the bytes reported per chunk and the streamcursor checkpointed after every chunk while the streamgate allows the disk writes only through the reviewed download flow, the streamchunkgate bounds the chunk by the user ceiling only and the streamnamespacegate binds every stream file to the runid namespace, resumeextract continues an interrupted pipeline from its streamcursor by skipping the rows the offset and the persisted keys already cover while refusing a finished pipeline, a foreign cursor, another plan or another origin, transformvalues applies the reviewed rules (trim, case, number, date) one value at a time with the raw value always beside the transformed one and an unknown operation refusing without ever dropping a row, deduperows compares the configured key columns under the chosen normalization while the first occurrence stays and the dropped rows report by count and by key, samplerows previews the subset through the first, seeded random and stratified strategies without ever mutating the stored extract, sourcestamp attaches the url, the step and the capture time to every row and every cell while a stamped timestamp never rewrites, gridpreview projects the read only grid with its column kinds inferred from the sampled values, its sorting and filtering and its stamped, transformed and deduplicated marks behind the export confirmation gate, provlog keeps the append only provenance log with one entry per stream, transform, dedupe, sample and resume pass, its secret shaped summaries redacted before any entry lands and its provenance queries answered by row key, the provgate requires the provenance on every exported row, and the background runs the extract steps through the whole pipeline with the sidepanel grid view, the resume controls, the transform editing, the dedupe report and the provlog of a selected row while the popup counts the active pipelines per run — no chunk bound, retention or sample size is ever hardcoded and no pipeline path bypasses a review. |
| Web api transports | The 1.1.76 family widens the transport surface to the web api: subevents runs the server sent events lifecycle through a stream open seam with every block parsed into its event, data, id and retry fields, the last event id persisted for the reconnect resume, a clean cancel and channel errors surfaced to the run state machine under the channel origin grant and the user configured subscription ceiling, longpoll issues the request the reviewed cursor builds, retries a timed out request under the user configured backoff and stops on the reviewed stop condition, the cancellation flag, the plan expiry or the reviewed poll ceiling with the timeout and backoff as user choices, graphqlsubscribeframe and parsegraphqlmessage map the graphql-ws subscription grammar (next, error and complete frames) into step results, formpost encodes the reviewed fields with the urlencoded content type and multipartpost streams the fields and files into ordered chunks under one boundary with per chunk upload progress and no whole payload buffering while an unreviewed file or an ungranted origin refuses before any byte moves, correlateids assigns one request id per outbound request of the run and joins the response pairs through the shared correlation id with the per run map exported to the audit trail read only, ratelimitdirectiveof parses the remaining, reset and retry-after facts into one directive per origin that ratelimitrespect sleeps before the next call so a call never crosses a limit the endpoint published, cacheresponse keys the per run entries by the run namespace, method, url and body hash while only read only methods store, credential carrying responses refuse through the cachegate and a mutation on the origin invalidates its entries, cacheserv serves the repeated reads with hit counters and cacheexpiryof derives the expiry from the cache-control, expires and user retention — no timeout, backoff, ceiling or retention is ever hardcoded and no transport path bypasses a review. |
| Vision and ocr | The 1.1.77 family teaches the agent to see: imageocr reads the words with their boxes and confidences off a captured image through an ocr read seam and merges the word boxes into lines (the lowest word confidence drags its line down) and paragraphs by their own geometry, regionocr reads one sidepanel drawn ocrregion clamped into the viewport with the word boxes offset to absolute screenshot coordinates under the regionboundsgate, pdfocr reads one scanned pdf one page at a time through the rasterize seam with the streamcursor checkpointing after every page, frameocr refuses the frame of a playing video before any pixel moves and seeks a paused video to its reviewed position inside the user configured wait budget, visionshot carries the reviewed prompt with the image to the configured vision model and returns a visiondescription with labeled regions under the visiongate consent and the sensitive audit grade, cropshot scales the element crop with device pixel ratio awareness, redactshot applies a redactionmask through the mask fill seam before any sharing (the redactgate refuses an unredacted external share while proposeredactionmasks derives the proposals from the sensitive field shapes), groundshot scores the candidate elements by the averaged text and geometry match and returns the ranked selectors while the grounding feeds the observation vision block, pairshot pairs every screenshot with the nearest same viewport dom snapshot under the session boundary and pairquery searches the text of both sides, the visioncache stores every recognition and description by its image hash so repeated reads serve without a model call under the user retention window, and visioncost counts the model calls for the local costshare ledger — no recognition ships inside the extension, every model, endpoint, retention, budget and cache window stays the user's choice, and no vision path bypasses a review. |
| Capture forensics | The 1.1.78 family records what a run changed: beforeafter pairs the pre and post captures around every action step through a capture grab seam (the same tabshot and the same redaction pipeline the capture steps ride) while a read only step skips its pre capture because a page a read never changed needs no before state, both captures link to the stepid they wrap and the pair records the heartbeat beat of the run under the forensicscopegate plan scope and the forensicsreadonlygate read only grade, consoletimeline collects the console entries in capture order with the stepid active at each entry and the run wide sequence numbers preserved across page reloads (the page bridge queues the hooked console lines behind the consented debugger capability and flushconsole hands them over on every step completion while the consolemaskgate keeps the masked text only), nettimeline attaches every traced request to the step running at its timestamp and joins the request with its response through the correlateids map of the run under the nettraceorigingate origin grants, diffbase freezes one stored screenshot for one page state under the user threshold with the diffbasegate user confirmation, diffshot compares a new capture against the baseline through the pixel diff seam with the changed regions merged from the changed pixel blocks, the similarity score between zero and one and the regression flag answering the user threshold alone (every sensitive step runs the comparison with the diffscore of the last step riding the proposal requestbody), thumbshot sizes the thumbnails inside the user edge with the aspect held and every thumbnailrecord linking back to its full capture, timelapse captures the changing page on the user interval with the timelapsegate explicit start and no code floor while the lapse stops on the duration end, the plan completion or the user stop and assemblelapse orders the frames for the playback, namecaptures builds the lowercase file names from the plan, step, timestamp and sequence parts of the user naming rule with a counter bump keeping them unique per run, and exportcaptures bundles the captures, the timelines, the diffs, the thumbnails and the lapse frames with the provlog provenance of every capture aboard under the captureexportgate explicit user action, the redactshot masks and the provenance refusal while the captureretentiongrade keeps the retention a user choice pruned only through the explicit cleanup pass — no threshold, interval, edge or retention is ever hardcoded and no forensic path bypasses a review. || Execution environments | Every reviewed step names where it runs with consent: the pagecontext keeps dom actions inside the live page because page events only fire there, the isolatedworld runs evaluate steps through the scripting api with reviewed arguments only while page globals stay unreachable from step code, the offscreenworker moves the six heavy parse families (html snapshots, network json payloads, table row reductions, accessibility tree shaping, complex selector evaluation and screenshot stitching) into an offscreen document worker pool behind the optional user granted offscreen capability with an inline fallback inside the page, and the sandboxframe renders untrusted markup inside a sandboxed page with no extension privileges after stripping scripts and event handlers and answering only per render nonces — the environment grants join the origin grants of the session, a keepalive port holds the service worker alive for the whole run of an approved plan with a heartbeat every user configured interval, the persisted run state resumes exactly the pending step after a service worker restart, zombie runs whose heartbeat fell silent reap past the tolerated intervals, a storage level run lock holds one session against concurrent runs, steps sharing one tab serialize across parallel branches, and every navigation lands a url history entry — no pool size, interval or tolerance is hardcoded and no environment ever bypasses the review. |
| Data minimization | The 1.1.79 family keeps the data footprint the smallest it can be: localfirst processes every extraction on the device before any export with the identity fields stripped unless the reviewed plan listed them and the localrule fields of the origin held always because a field the user marked local never leaves the device (the localgate refuses any outbound payload that carries one at every boundary and the outboundpayloadcheck enforces the same refusal at the protocol boundary), the telemetrypolicy type fixes the enabled literal to false so an on state is unrepresentable by construction while every counter keeps living inside the local memory and the requestbody omits every telemetry field by construction, optinsync stays disabled until the user lists every data class and turns each one on with the consent stamp per class recorded for the audit trail, encryptsync derives the key from the user passphrase through the webcrypto seam (the passphrase never persists), encrypts every payload before the transport, stamps the format tag and refuses a sync without the passphrase while the syncgate requires the opt in and the encryptsyncgate refuses plaintext, purgeonrequest deletes the stored families by scope with the typed confirmation demanded for the full scope while the audit hashes survive and every deleted key enters the audit trail, exportall bundles the runs, memory, captures, settings and provenance into one portable file that streams without a size cap, the cookie jar arithmetic assigns one jar per task run with every cookie read and write bound to the active jar under the jargate, the jar sealing at the run completion under the user expiry window, cleanupafterrun clears the task artifacts under the user schedule while the flagged retention stays, and enforcequarantine holds every download in the sandbox folder until the scanner verdict releases or deletes it with the quarantineopengate blocking every open without a clean verdict — no cadence, delay, expiry, scope or timing is ever hardcoded and no minimization path bypasses a review. |
| Security foundations | Automation runs behind a per origin allowlist under a denydefault posture that refuses every ungranted origin with exact origin matching and no wildcard expansion while the active tab counts as one explicit single origin grant; per site originprofiles grant and deny single action kinds, consentwindows bind every sensitive grant in time with a user chosen duration and a named boundary that never defaults to unlimited (a window past its boundary suspends the run mid step and renews only through a new explicit prompt), revokerun halts the pending step and every queued step as a terminal session event, sensitive kinds classify into the payment, credential, delete and publish classes refined by their options so each class needs one fresh consent prompt per origin, every decision lands in an append only immutablelog whose loghash chains each entry to its predecessor at append time and whose completion seal writes the final hash while the audit accessor verifies the chain and refuses reads of a broken link, and maskinputs keeps typed values, form values and stored values out of every log, observation and export behind the documented password, token, card and secret shapes the user extends. |
| Security hardening | Secrets, messages and money run behind human gates: a secretvault keeps values behind a seam whose persisted records carry labels, scopes, provenance and digests only while the leak scan refuses plaintext secrets in plan texts and step options, redactshots mask sensitive capture regions across viewport, element and stitched captures, schemastrict rejects unknown fields of every registered inbound command with the path and expected shape, origincheck guards every runtime message and port connection while connectallow drops unknown senders from the user managed list that ships empty, ratelimit buckets defer automation commands past their user configured bound until the window resets, confirmpay, confirmdelete and confirmcreds hold payments (amount, payee origin, target), destructive deletions (target, scope, irreversibility) and credential use (label only) until one distinct human action resolves them with no timeout and no batch approval, phishguard blocks login origins whose lookalike distance to a granted origin crosses the user threshold and names the matched origin, safedefaults profile unknown origins as reads only, and the declared transparencypage lists every grant, consent window, sender, permdiff and vault label with a revoke action beside each grant. |
| Session interface | The session becomes the primary interface: a sessiongrid lists every live and saved run with its origin set, step count, state, outcome, per tab lock state and seal hash link, historysearch indexes sessions, site notes and run summaries into one corpus with matched term highlighting, emptystate guidance covers every empty surface, errorsurface payloads classify failed step causes as page, network, policy or gate with retry hints that pass only through new reviewed dispatches, sitenotes keep one record per origin with sensitive bodies sealed at rest, the scratchpad holds append only per task entries with step provenance, runsummary distills completed runs inside the user configured window as an offscreen worker task, semanticrecall ranks past extractions by text similarity inside the run scope with run and step provenance, correctionmemory captures plan review edits and rejections, consentmemory keeps every grant, denial, expiry and revocation advisory, and cancelrun rolls only the queued steps back while the executed steps stay untouched in the sealed log. |
| Interface surfaces | The interface becomes five surfaces: the popup command surface with the taskinput, the quick run actions and the commandpalette, the sidepanel workspace with plan, run and review tabs, the dashboardpage full page view, the optionspage gathering every setting and the onboarding walkthrough with its single consent scoped event; the commandpalette registers from every module, lists only the capability allowed commands, fuzzy searches ids, labels and keywords and ranks the recent commands first; the taskinput routes through the same proposal flow as the api with the active origin and page outline attached; plancards group by risk class with sensitive classes expanded, stepapprove resolves one step per distinct human action with approve, reject and edit written into the immutable log, diffpreview compares the observed before state with the predicted after state of write class steps with mask verdicts, the stepstimeline derives its nodes from progress with no new state, and the logstream chains live events with mask verdicts, verifies its chain as entries arrive and copies verified ranges as audit excerpts; one command bus routes every surface action through the same policy gates and one broadcast channel carries run state to every surface. |
| Ecosystem part one | The 1.1.66 family opens the ecosystem: the flowlibrary browses, installs, forks and shares workflow templates behind schemastrict manifests with their kinds inside the installed capability set, their required grants surfaced as a diff that maps onto originprofiles before any import completes, a fresh consent for sensitive entries, unverified publishers quarantined and present publisher signatures verified against the manifest digest while every install lands as a pending import that still passes the same review; syncbridge hooks move manifests between machines behind an explicit opt in with no default on (the file provider through manual import and export payloads that never carry secrets or logs, the web provider an honest stub) with digest based conflicts surfacing both versions instead of a silent overwrite; the background run queue executes reviewed workflows with the keepalive signal held for their whole duration and its state persisted for restart recovery; the attentionfeed collects every gate wait, phishguard block, deferral and failure with its deep link, deduplicates repeated causes per run, ranks by severity and counts on the statusbadge; the runreplay walks a sealed verified chain step by step with the restored observation and capture of each step and its gate resolutions; and the outputcompare joins two runs that share a task input signature, grades agreement, divergence and duration deltas per step and highlights the first divergence without ever executing a step. |
| Interface finishing | The 1.1.65 family completes the surface: the datagrid previews extraction results with inferred column types, local sort and filter and masked csv, json and clipboard exports; quickactions, user editable shortcutkeys and the omniboxtask parser shorten the path to a run behind the same gates; the statusbadge counts waiting gates on the toolbar icon while done and attention notifications carry deep links behind the content consent and the do not disturb respect; the recenttray and the stetoasts keep the user informed without watching; the pickeroverlay with stability scored selectors, the targethalo, the guidedtips, the shotpanel, the compareviewer and the pagechips cover selection and evidence with resolutions in the immutable log; and the siteprofiles, the darklight tokens, the locale bundles with english fallback, the importexport bundles that never carry secrets or unmasked logs, the dropimport detection, the featuretour stops and the localized a11ylabels round out the interface. |
| Performance part one | The 1.1.68 family streamlines and caches the hot paths under review: lazymods keep the heavy parsers and the capture, compare and export families out of the startup path behind the same capability checks the eager path runs with a user prewarm set and a startup budget that reports without ever refusing; debouncedom coalesces scroll, input, resize and mutation storms per user configured window while batchquery folds repeated selectors into one offscreen worker pass; incrsnapshot computes deltas against the same run base with region fingerprints and the user cadence while an empty delta skips the recomputation in full; selcache caches selector resolutions per generation, revalidates hits before dispatch and refuses stale generations with a reviewed retry hint; virtlist renders the datagrid, the logstream, the stepstimeline and the compareviewer through a virtualized window with measured height maps; streamparse tokenizes oversized pages chunk by chunk inside the worker pool without ever holding the full text; chunkextract slices big tables into resumable fingerprint verified row windows; the worker queue gains backpressure that defers instead of refusing and cancels abandoned tasks of a halted run; every step records a perf record with duration, queries, cache hits and provenance beside its outcome — every window, depth, cadence and budget stays the user's choice and no performance path bypasses a review. |
| Performance part two | The 1.1.69 family paces, measures and bounds the run under review: batch run queues pause their enqueueing past the user backpressure window while every queued step stays queued, every domain runs at most its user concurrency slots with the overflow queued per lane, politedelay spaces batch requests per domain above the siteprofile floors with jitter, adaptivepoll widens and narrows its interval inside the user floor and ceiling, requestcoalesce merges identical pending queries into one dispatch whose result fans out to every waiter, and the snapshot cadence widens under memory pressure and restores when it clears; the runbudget tracker reports the step usage and the memory pressure against the user budgets with budgetalerts that report at the warning threshold and pause the run pending a user choice at the critical threshold, timeoutcancel aborts a slow step at the user bound with its cancel event recorded in the immutable log, and tabsuspend suspends an idle tab only during a wait longer than the user window with the run state preserved across the restore; the runcache serves repeat fetches of one run by digest and clears at the run end unless the user pins the profile cache, stepprefetch warms only the pages and selectors the reviewed plan names, efficientresume checkpoints every step boundary and revalidates the page fingerprint before it resumes, navdedupe skips navigations to the already active url, and sessionreuse attaches an authenticated profile only through its per profile consent prompt with the cookies isolated per task; the durationmeter writes monotonic step samples into the perf records, the selectorprofile flags the selectors above the user latency threshold, steptrace spans nest per step and per worker task and export as one trace file, the startupmeter measures the cold start against the user target, artifactcompress keeps stored bytes deflated at rest with lazy reads, logprune removes whole sealed runs past the user windows only, batteryaware defers non urgent scheduled runs on a low battery, networkaware retries honor the server signals, readparallel groups independent reads into parallel lanes and slowmo replays a recorded run at the user factor with its pauses linked to their steptrace spans — every limit, delay, window and budget stays the user's choice, the pause waits for the user, and no scheduling path ever bypasses a review. |
| Resilience | The 1.1.70 family survives every interruption: approved plans open runrecords tracked by the runstatemachine through queued, running, paused, awaitingapproval, completed, failed, cancelled and rolledback, queue offline with monotonic sequences when the endpoint is unreachable and replay in order once connectivity returns while expired plans fail for the audit trail, steps carry idempotencykeys so replays deduplicate, checkpoints capture the completed steps with a page digest and resume only against the matching page, heartbeats time the running runs with the zombiecheck reaping the silent ones, failed runs offer typed rollback compensations that run only behind the explicit user choice inside the approved origin, and cancellations pair with their optional rollback — the heartbeat window, the queue depth and the failed run retention stay user choices and no recovery path bypasses a review. |
| State depth | The 1.1.71 family makes the run state observable and safe: every run keeps its own urlhistory of urlvisit records with the final url after redirects and consecutive duplicates folded inside the approved origin, the runtimeline merges the step results, the audit events and the visits into one ordered stream with phase buckets rendered read only, tabisolate namespaces the run memory per tabid, the sessionlock serializes concurrent runs on one session while naming its holder and expiring its abandoned locks under the user window, memory items carry provenance and user configured expiry with the purge behind an explicit confirmation and its summaries kept for the audit trail, encryptrest encrypts the sensitive classes at rest through the webcrypto derived key whose secret entry stays a consent prompt, quotawatch ranks the cleanup candidates and reclaims bytes only behind the per batch approval, and the auditexport streams the whole bundle without a size cap behind the explicit user action — no window, interval or lifetime is ever hardcoded and no state path bypasses a review. |
| Any LLM connection | Any model drives the extension with consent: the user connects a gateway, a base url, an api key and any model — nothing is hardcoded, no provider allowlist exists and the openai chat completions, openai responses, anthropic messages and google gemini shapes are protocol styles the user picks; model routes map task kinds to provider and model pairs with user configured fallbacks, a local loopback endpoint keeps sensitive work on the machine, natural language commands parse into intents with entities and confidence, model drafted plans lint against the action grammar and pass the same human review (draft review plus plan review) local plans pass, failed runs replan their tail under a fresh review, executed steps reflect their lessons into the next prompt, cost budgets halt at the user configured token and currency ceilings and ask, the prompt library versions user templates with consent notices, and the guardrails strip code fences, validate model text against the schema, retry and refuse invalid output before anything executes. |
| Agent protocol | The browser becomes a tool server with consent: the mcp server of the agent protocol lists every reviewed browser, workflow, memory and system tool over `tools/list` with its version, json schema inputs, risk grade and full consent metadata, negotiates capabilities and the per client tool floor with any client the user pairs, frames messages in json rpc with newline delimited and http post envelopes, and answers parse, method, params, internal and consentrefused errors with their codes — read only tools run under the dryrun risk class once the session is approved while every tool with side effects executes exactly the approved plan step it names, so no paired client widens what the human approved; the stdio bridge relays frames for local client processes through the native messaging host manifest with restart on demand, the http listener binds localhost by default with any other bind graded sensitive behind the explicit remote review, the server starts only after the user enables it, and the bind, port, transports, frame size, queue depth and call retention all stay user configured with no code ceiling. Since 1.1.55 the stream http transport opens for remote clients behind the full remote gates: one time pairing codes exchanged for session tokens that persist only as sha-256 digests, token scopes per namespace, a client allowlist with grant history, tls required for any non localhost transport with user configured certificate fingerprints, an ordered frame intake where tls terminates before token verification and namespace checks run before consent checks, auth failures that answer with one fixed message leaking no pairing state, a user configured client ceiling, and approval gates that hold every sensitive remote call with its full arguments (secret fields redacted) until the user decides — refusing by default when the configurable window closes. |
| Files and downloads | The agent moves bytes with review: `batchdownload` downloads reviewed url lists in waves under a user configured concurrent window with per file states and sequence suffixes for filename conflicts, `pausedownload` and `resumedownload` walk the queue through the downloads api, `verifydownload` compares state, size and checksum against reviewed expectations, `interceptmime` arms include, exclude and deny default mime filters that reroute matching downloads into quarantine, `exportnetlog` exports the step correlated network log with every header value redacted, `readclipboard` needs an approved single use consent prompt per read and never persists the payload text, `writeclipboard` writes reviewed text through the page bridge with payload hashes for audit, `copyscreen` copies the visible tab to the clipboard, `quarantinedownload` and `scanvirus` keep files outside the downloads folder until a clean scan verdict releases them, `namecaptures` stamps task, step and sequence filenames with per task counters, and `cleanupartifacts` sweeps artifacts by reviewed age and kind rules while keeping open review references. |
| Datasets and exports | The agent turns pages into data with audit: `scrapetable` reads tables into normalized column keys with rowspan and colspan expansion and nested child datasets, `paginateextract` follows next controls while waiting for fresh rows, `mergepages` aligns columns across pages, `transformvalues` applies reviewed expressions with per rule error surfacing, `deduperows` deduplicates by reviewed keys, `stamplerows` stamps every row with its source url, timestamp and step ref, `previewgrid` previews the grid before export, `importcsv` parses quoted csv with column mappings for fill loops, `looprows` interpolates `{{column}}` row variables into the wrapped inner step, `exportcsv`, `exportjson` and `exportexcel` write checksummed artifacts into the task artifact store with provenance records, `copytable` uses the clipboard under the optional clipboardWrite capability, `pushsheets` pushes only to a reviewed HTTPS endpoint behind its origin grant and the explicit reviewed flag, `streamdisk` streams chunk by chunk with backpressure and a persisted resume state, `resumeextract` continues an interrupted extraction from its stored cursor, and `logprovenance` logs provenance for audit; exports refuse to leave local memory while the session origin grants do not cover the active origin. |
| Tabs and windows command | The agent commands the whole browser surface with review: `querytabs` resolves reviewed url, title, id and pattern matchers against the live tab set, `closepattern` closes matching tabs only under the explicit reviewed flag, `pintab`, `mutetab`, `movetab`, `movetabwindow`, `duplicatetab`, `reloadtabs`, `discardtab`, `zoomin`, `zoomout` and `switchtab` mutate tabs, `grouptabs`, `colorgroup` and `collapsegroup` keep group registries, `savelayout` and `restorelayout` save and restore named tab layouts with window bounds, `snapshotsession` and `reopenrun` capture and reopen whole runs, `watchtab` observes title, activation and closure events, `findclones`, `searchtabs` and `listaudio` enumerate the surface read only, `badgetab` and `attachmeta` route task state per tab, and `maximizewindow`, `minimizewindow`, `restorewindow`, `focuswindow`, `scratchwindow` and `incognitowindow` command windows with incognito separated from grant inheritance. |
| Navigation mastery | The agent moves anywhere with review: `openlink`, `openprivate`, `reopentab`, `deeplink` and `openclipboard` open reviewed targets in resolved containers, `followlink`, `spanav`, `spawait`, `waitload` and `waiturl` navigate pages and single page app routes, `rewritequery` and `setfragment` edit the current url, `navlist` walks a reviewed url list with per entry progress, `navprofile` applies per site wait profiles, `checksafe` verifies urls before unreviewed origins open, `batchopen` opens curated lists with per url safety states, `navrate` enforces per domain rate limits with user configured windows and ceilings, and the navigation trail, redirect chains and final urls stay recorded for audit. |
| Observation depth | The agent sees the whole page read only: the accessibility tree beside the dom snapshot, reader views, visible text, outlines, selections, open graph and embedded json state, plus detected lists, tables, pagination, infinite scroll, virtualization, lazy images, sticky overlays and scroll locks offered as plan suggestions. |
| Watch vocabulary | `watchmutate`, `watchfocus` and `watchbanner` observe the page across a reviewed lifetime window with batched event records, `waitquiet` waits for network quiet under a reviewed threshold, `diffsnapshots` diffs two stored observation versions into added, removed and changed rows, and `deriveselector` ranks stable selector candidates with stability scores; registrations persist across service worker restarts. |
| Target resolution | Steps address elements through reviewed `targetref` modes: css selector, visible text, aria role and name, accessible name, xpath, clickable map index or viewport point; ambiguous matches are refused with candidate lists and every resolution returns a matched element summary for review. |
| Optional capabilities | `tabs`, `downloads`, `clipboardRead` and `clipboardWrite` are optional permissions; browser kinds check their capability, the review panel can request a grant and every grant is audited. |
| Unlimited by choice | Wait durations, plan size, plan expiry, audit retention, outcome retention, zoom steps, the concurrent task tab ceiling, workflow delay bases and jitter windows, element wait timeouts and poll intervals, the workflow runlog retention, loop and repeat until safety bounds, parallel branch counts, retry attempt counts with backoff bases and jitter windows, per step and per run timeout budgets, trigger cooldown windows, interval periods with jitter windows, the trigger fire record retention, the mcp server frame size, request queue depth and tool call record retention carry no code ceilings; every bound is a user choice. |
| Structured results | Step results carry structured JSON details, rendered in the side panel beside each reviewed step. |
| Session pause | The user can pause and resume the active session; a paused session blocks every execution and preview while keeping the reviewed plan alive. |
| Plan progress | Each reviewed step is tracked with its outcome history, completed steps are marked, plans close automatically once every step has executed, and prior history survives plan replacement. |
| Stop and audit | The user can stop the session at any time. Configuration, proposals, decisions and results remain in local extension storage. |

The project is deliberately **not** a hosted control platform. It does not depend on a provider-specific sandbox, server URL or browser profile. A configured endpoint is optional, has to use HTTPS and receives only the session record and bounded observation required to produce a plan.

## Security boundary

> Devthink never requests broad host access at installation. The user can grant a single HTTPS origin only after entering it in the extension popup, and privileged browser capabilities only as optional permissions requested from the review panel.

The default manifest requests `activeTab`, `storage`, `scripting` and `sidePanel`, plus optional permissions for `tabs`, `downloads`, `clipboardRead` and `clipboardWrite` that stay dormant until the user grants them at runtime. It does not request debugger, cookies, history, proxy control, native messaging, web requests, full-time host permissions or credentials. A service worker cannot be relied on for unattended 24-hour agent computation; any such system must be designed, installed and governed separately. [1] [2]

Browser actions remain blocked if the session is missing, stopped or expired; the tab or origin changed; the plan was not approved; the plan expired; or the tool proposal is not in the local allowlist. The page bridge checks the origin again immediately before it acts.

The transparency page (`transparencypage.html`, embedded in the options page) answers what the extension holds and what it asked for: every granted origin with its grant date, every permission with its consuming surface, every stored data kind with its location and its purge and export links, the active consent sessions with their expiry, the audit trail integrity result and the permdiff of each installed update — running entirely offline with no external request. Since the 1.1.95 security hardening release every release carries a security review: `docs/securityreview.md` records the pentest execution, the content security audit results per surface, the permission diff history and the residual risks, the pentest/cspaudit/permdiff gates run in `pnpm validate:security` and the verify workflow, and the strict content security policy (`script-src 'self'; object-src 'self'; frame-ancestors 'self'`) pins every extension page to the package while refusing framing by remote origins.

Since the 1.1.96 multi agent certification release the coordination layer is certified: the agentcert gate drives thirty coordination scenario entries against the real compiled modules in the deterministic fake clock mode over the fake tabs of every browser kind, and the costcert gate proves the shared accounting reconciles. The certified multi agent topologies are the six scenarios of `docs/agentscenarios.md` — the leader worker scrape, the planner executor critic, the parallel form fill, the monitoring swarm, the competing extraction and the escalation and review flows — each with its topology diagram, its cost characteristics, its consent model and its pool item mapping of 469 through 502. The gates run in `pnpm validate:agents` and the verify workflow beside the security gates, `docs/agentcert.md` documents the certification suite and `docs/costcert.md` the accounting verification method, and the dashboardpage gains the multi agent dashboard panels of `docs/dashdone.md` — the topology overview, the per agent status cards, the shared queue with its lane filters, the message flow, the conflict and arbitration log, the cost per agent panel, the escalation inbox, the kill switch and pause controls, the timeline scrubber and the aggregate report download.

## Install for development

```bash
pnpm install
pnpm validate
```

Then open the Chromium extensions page, enable developer mode, select **Load unpacked**, and choose `extension/dist` after a successful build. The popup has three deliberate steps: grant a user-entered endpoint origin if an endpoint is needed, start a session for the active HTTPS tab, and open the side panel to review a plan.

## Configure an agent endpoint

The endpoint field intentionally has no default URL. Enter a URL such as `https://agent.example/proposal`; Chromium will prompt for that origin only. The endpoint receives:

```json
{
  "version": "2.0.13",
  "objective": "User supplied objective",
  "session": { "id": "uuid", "tabid": 1, "origin": "https://example.com" },
  "observation": { "schemaversion": 3, "url": "https://example.com/path", "interactive": [] },
  "capabilities": { "tabs": false, "downloads": false, "clipboardread": false, "clipboardwrite": false }
}
```

It must return a plan proposal using the same version. Every step needs a human-readable summary and may carry a reviewed JSON `options` field. Navigation is restricted to the active session origin, and any unknown or malformed proposal is rejected locally. The endpoint is a planner, not an authority to control the browser.

## Library use

```ts
import { canexecute, normalizeendpoint, parseproposal, pinnedprotocolversion } from "@wenathlan/extension";

const config = normalizeendpoint("https://agent.example/proposal");
const proposal = parseproposal(agentresponse, "https://example.com");
const decision = canexecute({ session, plan: proposal.plan, step, tabid: 1, origin: "https://example.com" });
```

The 1.1.91 api freeze pins the protocolv2 stability guarantee: the frozen message schemas the build emits under `dist/schemas/`, the capability manifests of every surface the build emits under `dist/caps/` and the freeze gate keep the wire contract additive-only until 2.0.0 — a library consumer pins the wire line of its build through the explicit `pinnedprotocolversion` import, the protocol major negotiation answers two to new clients while version one clients ride the deprecation window that closes at 2.0.0, and a breaking change demands a new major protocol version by written rule (see `docs/stability.md`).

The library has no runtime dependency and exposes pure policy, protocol and local-memory contracts. It can be embedded in a browser agent, test harness, CLI or another JavaScript runtime that supplies compatible storage.

Every consumption mode is first class since 1.1.81: the esm build keeps named exports for tree shaking, the cjs build wraps the same exports behind a stable getter object, the umd build exposes the `window.devthink` global with the full public surface and the consent gates intact, and the per-module entries (`@wenathlan/extension/policy`, `/protocol`, `/memory`, `/progress`) load one module alone. The browser condition of the exports map selects the neutral target that keeps every platform access behind the injected adapter seam (storage, clock, logger and fetch), so the same consent-first library loads from any host.

```js
// esm
import { canexecute, parseproposal } from "@wenathlan/extension";
// cjs
const { canexecute, parseproposal } = require("@wenathlan/extension");
// per module
import { canexecute } from "@wenathlan/extension/policy";
// script tag (the umd bundle)
const { canexecute } = window.devthink;
```

```bash
# bunruntime quick start (bun >= 1.4.0 joins the engines field)
bun run tests/code/bun.ts
# denoruntime quick start (npm specifiers through the deno.json compatibility map)
deno run tests/code/deno.ts
# cjs require smoke in a plain node script
node tests/code/cjs.js
```

The `bundlestamp()` export reports the version, the mode and the target of the running bundle, the deprecation shim keeps the old root import working with a notice, and every bundle embeds the version stamp, the license banner and its sourcemaps beside a minified and an unminified variant.

## Command line

The 1.1.80 family turns the cli into a complete operator surface beside the extension: every command reuses the same policy, protocol, memory and progress modules as the extension, so the consent gates hold everywhere.

| Command | Purpose |
| --- | --- |
| `node dist/cli.js manifest` | Deep manifest check: allowlist keys, permission source lines, csp script hashes against the bundled bytes, reviewed web resources, duplicate permissions, the capability chrome floor and icon dimensions. |
| `node dist/cli.js planlint [path]` | Static validation of a saved plan file: reviewed action kinds, the selector grammar shared with policy, required option fields, origin allowlist misses and a risk summary per plan. |
| `node dist/cli.js runworkflow [path]` | Replays a saved workflow through the library engine with streamed progress, the review gate before sensitive steps, a sealed audit trail file beside the workflow, dry run mode, checkpoint resume and a structured outcome summary. |
| `node dist/cli.js exportdata --scope session\|audit\|extraction --format json\|jsonl\|csv\|markdown [--from ms] [--to ms] [--out path]` | Exports session history as json, the audit trail as json lines and extracted table data as csv or markdown through the shared export serializers; writes to stdout when no output path is given and refuses secret store material in full. |

Global flags: `--config path` reads the configuration file, `--quiet`/`--verbose` set the verbosity and `--json` switches every command to structured json output. The headless runtime `import { openlibraryrun } from "@wenathlan/extension/headless"` runs the plan engine against recorded page state fixtures (the `tests/code` fixture format the build emits under `dist/fixtures`) with the fixture scoped consent gates, the same progress model as live runs and unsupported kind reporting for the kinds a recorded state cannot satisfy.

Exit codes map to documented failure classes: `0` ok, `1` consent refused, `2` step failed, `3` schema error, `4` unsupported, `5` cancelled. An unknown class refuses as a schema error because the mapping itself is contract.

## Model provider gateways

The 1.1.83 family makes the agent reachable from any model provider: the openaicompat, anthropicgateway, geminigateway and ollamalocal adapters speak to the endpoints the user configures through the baseurlconfig (the scheme, host and path shape validate before saving, the remote providers speak https and the ollamalocal adapter defaults to localhost and never to a cloud url), the keys live in the keyvault behind the store, resolve and revoke seams — never in memory files, audit trails or request logs — and every timeout, retry, backoff, jitter and cache window stays a user choice with no engine default. The modellist discovery lists what a provider offers under the user cache window, the capabilityad advertisement serializes the tool catalog into the provider specific schema with the consent metadata and the plan review gate (a model answer never executes a step the human review did not approve), the routing table maps each task kind onto its provider and model with the fallback pairs and the local provider standing in when the gates refuse the remote calls, the budget tracking rides the cost budget gate with the local marker for the calls that never left the machine, and the guardrails cap the parse attempts on every parsed response. The hardcoded provider url scan of the shipped sources and the api key literal scan of the built bundles enforce the posture: no provider endpoint and no key shape ever ships in the code.

## Mcp server mode

The 1.1.84 family exposes the engine as a model context protocol server: `node dist/cli.js serve --stdio` speaks json rpc over stdin and stdout for the local clients the user launches, and `node dist/cli.js serve --http --port 3010` speaks streamable http on a localhost bind (a non localhost bind requires the auth handshake, and both transports can run at the same time). Any mcp client lists the toolcatalog (the browser, workflow, memory and system domains with their json schema inputs, consent metadata and risk classes), reads the resourceexpose surfaces (the page state, the plan, the audit trail and the session record with subscriptions), renders the promptexpose templates and calls the reviewed tools — the sensitive tools block until the human approval gate answers in the sidepanel, the consent requirements refuse the missing grants, the idempotency keys deduplicate the retries, the dry run mode executes without side effects, and every call lands in the audit trail with the caller, the tool and the outcome. The full specification is in docs/16.mcpserver.md and a minimal client script ships in the dist/fixtures/mcp-client.mjs build artifact.

## Site bridge

The static site pairs with the extension through one user configured relay — no platform functions anywhere, and the relay url is always a user setting, never a hardcoded default. The walkthrough: type the relay url (wss) in the extension options, consent to the first socket connection, mint the pairing code with its expiry countdown, then open the static site, type the same url and the code, and pair. The conversation flows over the socket — the site sends the task text, the extension proposes plans as review cards, the site returns the review decisions to the extension review gate — while the site never executes actions: the extension stays the only executor, and the sensitive steps approve only through the extension approval flow. The relay sees metadata only (plan text and statuses); page content never crosses the bridge without the explicit consent flag, the bridge collects no telemetry, the offline queue buffers review requests with replay deduplication while the socket is down, and the revoke button and the kill switch end everything instantly. The wire protocol is specified in docs/14.servercontract.md.

## Native host bridge

The optional native messaging transport reaches desktop processes — and nothing native runs until you install it. The manifest declares the `nativeMessaging` permission in the optional set only (the manifest validator refuses it in the required set), the transport ships deny by default, and every path stays your choice. The walkthrough:

1. Build the companion with the plain node recipe: `pnpm build` compiles `companion.ts` and writes `dist/companion.js` beside the stamped host manifest template — source plus a build command, never a binary blob.
2. Grant the install consent in the options page (Native host bridge section) with your host name and profile directory — the gate explains the scope before any write.
3. Write the host manifest with the reviewed installer: `node dist/cli.js native install --profile <dir> --host <name> --extension-id <id> --companion <path> --consent true` (a system wide install needs the explicit flag).
4. Attach the native port from the options page behind the transport consent; the handshake reports the companion build and protocol, the wsbridge advertises its localhost port and per session token over the native port, and the diagnostics report everything.
5. Stop any time: the kill switch button and the escape hatch key stop every native call in one press, and `node dist/cli.js native uninstall` removes the host manifest and its preferences.

The consent line holds: the read, interaction and sensitive call classes each carry their own grant, the os dialog and notification surfaces carry their own consents on top, the sensitive class routes through the human approval gate, the audit trail records every native call with class and outcome (never a payload), the native host never receives key vault material, a crashed or outdated host degrades with the run alive, and the headless mode keeps the transport disabled unless you configured a host. The full protocol, the token model and the build recipe live in docs/17.nativebridge.md; the install walkthrough lives in docs/native-install.md.

## Build and package

| Command | Purpose |
| --- | --- |
| `pnpm check` | Strict TypeScript validation. |
| `pnpm test` | Unit tests for consent, origins, protocol and local audit state. |
| `pnpm build` | Bundles the library, CLI and unpacked extension. |
| `pnpm validate` | Runs type check, tests, build and manifest gate. |
| `pnpm package` | Builds then previews the npm package content without publishing. |
| `node dist/cli.js manifest` | Rejects a version mismatch, mandatory host permission or disallowed browser capability. |

The workflows keep verification, version synchronization, release assembly and registry publication separated. A package.json version change is mirrored to release metadata by a repository workflow. A matching `vX.Y.Z` tag produces the signed release assets and digest. Registry publication occurs only after a release is published, and npm.js publishing also requires the repository `NPM_TOKEN` secret or compatible trusted-publishing configuration. Release gates, research evidence and known limitations are in `docs/`.

## Research and clean-room policy

The repository includes public listing research, 58 CRX manifest inventories, static API signals and a 50-project open-source comparison sample. Downloaded artifacts were treated as untrusted, inspected without execution and discarded. Devthink is an original implementation: it does not vendor or derive code, visuals, names or proprietary transport details from reviewed products.

## References

[1]: https://developer.chrome.com/docs/extensions/develop/concepts/declare-permissions "Chrome Extensions — Declare permissions"
[2]: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions "MDN — WebExtension permissions"

## Browser coverage

The 1.1.86 family removes the chromium only assumption in packaging. The same consent first library, the same kind catalog, the same policy gates, the same observation schema and the same audit trail format speak on chromium, firefox and safari through the single root `manifest.json` with the per browser overlays embedded under its `browsers` key — never separate hand maintained manifests. The apimap module records every webextension api the codebase touches with its chromium, firefox and safari equivalent; the polyfill layer prefers the `browser` namespace when present and falls back to the `chrome` namespace, wraps the callback style the older engines speak into the promise shape the reviewed vocabulary reads, and ships the sidepanel popup window fallback, the scripting tabs.executeScript fallback, the storage local and session area keys, the tabs and windows normalizers, the notifications, contextmenu, clipboard, downloads and runtime messaging shapes. The firefox overlay (`manifest.json` → `browsers.firefox`) layers the browser specific settings with the generated extension id, the strict min version, the action key mapping, the event page background scripts, the optional permission names that differ, the empty host permissions the deny by default posture keeps, and the web accessible resources firefox pattern syntax; the safari overlay (`manifest.json` → `browsers.safari`) carries the strict min version, the action popup, the empty host permissions, the optional permissions set and the csp overlay. The build emits the firefox xpi through the `xpipack` assembler with the manifest placement at the archive root, the hashed assets beside it and the artifact name that carries the release version, and the addons linter passes the output with zero errors; the safari app extension ships as the xcode project wrapper the `safariskeleton` module generates around the chromium extension payload, declares the app entitlements for the extension distribution and includes the minimal app shell that opens the extension, and the safari build renders the sidepanel surface as a popover equivalent. The cross browser feature flags default to the intersection set across browsers — a feature surface a single browser lacks stays off everywhere by default; the native transport stays chromium first and reports `unsupported` elsewhere. The full coverage is in docs/18.browsercoverage.md.

## Distribution

The 1.1.87 family multiplies the publishing channels around the buildable artifacts, and nothing auto-publishes outside the reviewed release workflow. The npm channel ships `@wenathlan/extension` to npmjs and GitHub Packages with the fixtures, the declarations, the docs examples and every library bundle; the nuget channel ships the `extension` distribution package with the cli, headless and mcp entries as content files, the umd and cjs bundles, the declaration files for ide integration and the sample fixtures; the maven channel ships one module per consumption mode (`extension-library`, `extension-cli`, `extension-headless`, `extension-mcp`) with the bundles as jar resources and the declarations as classifier artifacts; the container channel ships the multi stage image (the builder stage runs the whole validation chain, the runtime stage exposes the static site, the socket relay speaking the servercontract and the loopback mcp listener for self hosting) tagged with the version beside the `stable` alias, with the digest files pinning the exact image; the vscode channel ships the pure zip-based `devthink-vscode-<version>.vsix` the operator installs from the release asset — the manifest declares no telemetry and no network default, and no marketplace url appears anywhere in it; the firefox, safari, chromium, site, declarations and provenance channels ship their artifacts beside the sbom inventory, the attestations record and the artifact manifest that lists the name, size, checksum and channels of every artifact. The release gathers everything into a draft, the verification step downloads every asset and checks the checksums, the registry jobs and the github release require the `release-approval` environment protection, and the version sync step keeps every packaging file (package.json, the root `manifest.json`, the pom, the csproj and every maven module pom) on the same number, while the vsix overlay and the per browser overlays live inside the root manifest and carry no version of their own — no drift between the manifest files is possible. The full channel and artifact map is in docs/19.distribution.md.