[mrgoonie]

Summary

Adds the opt-in connected browser: a Dewee agent can read and act in tabs of the person's own Chrome, only as far as the person allows in the side panel. The extension is an executor, never an agent. It runs a fixed set of bundled actions (tabs, open, navigate, snapshot, click, type, press, scroll, wait, close) sent by the Gateway relay over /ws. It never runs code, CDP methods or selectors from the wire.

Closes #17. Gateway side: nextlevelbuilder/dewee#1221, nextlevelbuilder/dewee#1223 (PR to dev linked below).

What the person controls

• Off by default. It is turned on in Options (self-hosted only). The workspace must also enable it on the Gateway; otherwise the panel explains that it is off.
• Grants. In the panel the person registers this browser, then allows chosen agents on exact origins with Read or Read and act, for a limited time. Chrome host permission is requested per origin (never <all_urls>). A grant is trusted only if this device created it, it matches what the person approved (origins, agents, capabilities), and the exact host permission is present.
• Only owned tabs. An agent drives only tabs it opened under a grant. It sees them as opaque handles (t1, t2) and never sees raw tab ids.
• Approval card. High-risk actions need a per-action confirmation in the panel: submit, publish, delete, pay, type with submit, and press Enter. Denying or closing returns approval_denied.
• Pause / Stop / Revoke work locally and immediately. Pause/Stop is stored per device and survives a Chrome restart. After reconnecting, the extension sends active only if the person's last choice was Resume.
• Redaction. Password, hidden, payment and one-time-code values are never read or typed (sensitive_field). Page content is never stored.

Notable behaviour

• No replay. A command lost after it may have run reports outcome_unknown, never a re-send. This includes an interact result whose page URL cannot be reported.
• Revoked or expired grants. A grant revoked or dropped while a command runs, or waits for approval, cancels the command with grant_revoked; an expired grant gives grant_expired.
• Waits for attach. Grant creation and enrolment wait until browser.device.attach has completed, so a not-yet-attached socket can never make the extension forget its device.
• Contract. docs/connected-browser-relay-contract.md is synced with the Gateway copy.

Docs

• New: docs/browser-control-threat-model.md.
• Updated: docs/architecture.md, docs/api-contract.md, docs/development.md, README.md, and the side-panel exception in AGENTS.md.

Verification

• pnpm lint, pnpm typecheck, pnpm test (688/688) and pnpm build pass.
• The e2e browser-control spec (fake relay) and smoke pass 15/15.
• Live e2e against a real local Gateway built from the backend branch: tests/e2e/live-connected-browser.spec.ts passes 1/1. It runs these scenarios:
  1. With the flag off, the tool refuses.
  2. An agent the person does not own cannot be allowed.
  3. Super Agent opens and reads with the password redacted.
  4. It clicks and types, and the page changes.
  5. Another site is refused.
  6. The approval is denied for a submit.
  7. Revoking a grant gives grant_revoked.
  8. Stop and Resume work.
  9. The CLI device and grant lists are correct, and traces carry browser spans without the typed text.
  10. Revoking the device works.
• The live selfhosted and credentials specs pass. Four live tests (E1 and three resilience tests) also fail on main against a current dev Gateway because of the extension API read rate limit, tracked in fix(chat): reopening the panel fails to load history when the Gateway read limit refuses a burst #21.
• Two isolated code reviews, with the findings fixed in this branch. Follow-ups: fix(chat): reopening the panel fails to load history when the Gateway read limit refuses a burst #21, feat(browser): accept internationalized sites in the connected browser grant form #22, nextlevelbuilder/dewee#1352–#1355.

🤖 Generated with Claude Code