Devthink

Devthink is a consent-first browser-agent bridge distributed as a TypeScript library and a Chromium Manifest V3 extension. It turns a user-provided browser objective into a bounded, reviewable plan. The user must start the active-tab session and approve the plan before any page action reaches the browser.

Version: 2.0.13. License: GPL-3.0-only. The repository is wenathlan/extension; the npm-compatible scoped package identifier is @wenathlan/extension.

Platform release status: 2.0.0 is the closing release of the chain from 1.1.31 — the agentic browser platform with the frozen protocolv2 contract, the deprecation window closed (protocol major two only, with the migrateplan bridge and docs/migrationguide.md carrying version one assets forward), the example gallery of thirty six runnable recipes (docs/gallery.md), the readiness review with the go decision (docs/readiness.md) and every candidate gate green with its evidence in tests/artifacts/. The library ships on five package channels — npm, maven, nuget, the container image and the rubygems gem. The full chain from 1.1.31 to 2.0.0 lives in docs/releasenotes.md.

What it does

| Capability | Behavior in 2.0.13 | | --- | --- | | Active-tab session | The user starts a short-lived session for one HTTPS tab and one origin; the session records its origin grants. | | Page observation | The extension captures the complete semantic inventory: every interactive element, every form control, every select option and the full page text. | | Plan proposal | A local plan can be created immediately; an optional user-configured HTTPS endpoint can return a typed plan proposal of any length. | | Documentation | The kind documentation (docs/kinddocs.md) covers every action kind of the immutable vocabulary with its consent class and a schema valid example, the flow documentation (docs/flowdocs.md) draws every execution flow in the shared mermaid style, and the reference documentation (docs/refdocs.md) mirrors the cli, protocol, audit, configuration, schema, capability, tool, trigger and permission tables the doccheck gate verifies. | | Example gallery | The gallery documentation (docs/gallery.md) is the fastest way to start with the library: 36 runnable recipes (scraping, forms, testing, monitoring and agents) validated against four bundled fixture pages, with the recipe format reference and the authoring guide. | | Surface catalog | Every surface the capability manifests serve — background, sidepanel, popup, pagebridge, cli, library and mcp — speaks the frozen protocolv2 contract with its own capmanifest; the pagebridge content script stays the only injected file. | | Review gate | Every remote proposal starts in pending; it cannot reach the page bridge before explicit approval. | | Browser tools | Reviewed plans cover three hundred thirty four action kinds: pointer paths and coordinate clicks, text, aria, name, xpath, index and point target resolution, timed typing, key holds, sliders, dates, colors, shadow dom piercing, iframe entry, dialog answering, retry rules, a complete read vocabulary with clickable maps and verification reads, page mutation under review, and browser-level tab, window, zoom, snapshot and download commands. | | Forms and data | The agent fills forms with review: fillform fills from a structured record of field matches, kinds and values, filllabel and fillplaceholder match controls by label, placeholder or aria label, detectfields reports the form map with field kinds, generatevalues seeds locale aware values per field kind while real looking card numbers and personal identifiers are refused, saveprofiles stores profiles behind origin grants, asksubmit opens the submission prompt with the values diff, submitform submits only under an approved consent ref, readerrors associates inline validation messages with fields, retryform retries with reviewed backoff windows, runwizard, selectchain, picktypeahead and pickdate drive wizards, dependent selects, typeaheads and calendars, attachfile attaches run store artifacts, fillcard, fillcode and consentpassword handle payment and secret fields behind explicit consent, skiphoneypot skips trap fields, detectlogin and detecttemplate flag login, signup and checkout shapes, and handoffcaptcha pauses the plan and hands control back to the user. | | Media capture | The agent sees the page as evidence: shotview captures the visible viewport in the reviewed format, quality and pixel ratio, shotfullpage stitches viewport tiles on an offscreencanvas with linear overlap blending, fixed header skipping, hidden capture scrollbars and a stitching scroll budget kept inside the reviewed wait window, shotelement crops the pixel ratio scaled element rect with a tiled fallback when the element crosses the viewport edge, shotregion requires the explicit reviewed flag for every reviewed region rectangle and walks scrollable containers in reviewed steps, contactsheet tiles element captures into one labeled grid, annotated captures carry the step number marker, the target outline and a time and url footer, beforeafter capture pairs a before and after shot around every page moving action with the dom snapshot id of the same moment, capture names stamp from run, step, sequence and kind segments with per run counters, and export routing stays consent layered: memory keeps the bytes under the user configured capture retention window while the metadata survives, clipboard export needs clipboardwrite and download export runs through the reviewed download flow. | | Documents and moving media | The agent captures documents and moving media behind the same gates: capturepdf composes a derived pdf report from page segments with reviewed paper size, margins, scale, landscape orientation and break point pagination named with the capture naming rule, recordscreen and captureaudio are sensitive recordings of user activity that need an approved recording consent prompt per start, run inside the user configured recording window and stop cleanly at run end — deriving an ordered frame sequence and an honest manifest from viewport captures instead of encoded screencast bytes because tabCapture stays outside the manifest — captureframe seeks a video to the reviewed timestamp and grabs the still frame, downloadimages matches a reviewed imagefilter, deduplicates urls and downloads through the reviewed flow, shotcanvas reads 2d and webgl canvas buffers, probestream reports webrtc track details read only, readmedia and readassets extract embedded media sources and page assets, timelapse captures an ordered lapse inside the reviewed wait budget, and convertimage and makethumbs transform stored captures between formats and into reviewed thumbnails. | | Network observation | The agent speaks to the network with consent: fetchurl retrieves a reviewed HTTPS url from the extension context behind the origin grants with reviewed timeout, retries, backoff and redirect follow limits kept inside the reviewed wait budget, custom header allowlists need a per origin consent that names them (credential bearing headers always), large bodies stream chunk by chunk inside a user configured byte budget, parsejson extracts named fields from stored bodies through dotted json paths with reviewed defaults and honest miss outcomes, parsehtml runs reviewed selectors over fetched markup through the page bridge domparser, and the sensitive callrest and callgraphql kinds run typed endpoint calls with payload schemas, url templating, reviewed success status classes and graphql data and error unwrapping, with stored api key references attaching secrets only inside their origin scope; header values and body bytes never enter the audit trail. | | Sockets, streams and page apis | The agent listens to the network with consent: opensocket opens a wss websocket channel behind the socket gate with reviewed protocols, reconnect budget and exponential backoff capped at the user configured ceiling, sendmessage publishes a reviewed payload on a named stream of an open channel (sensitive), waitmessage waits on the reviewed stream, json path and match limit filter, subscribesse opens a server sent events stream that resumes from the last event id and cancels on its reviewed path, longpoll walks a reviewed cursor loop that stops on its stop condition, cancellation or plan expiry, watchrequests observes the requests of the run tab derived from the page timing buffers behind the webrequest grant with one correlation id per request and honest error classes, readheaders reads captured headers through a required allowlist and redaction list, capturebodies stores matched bodies inside the reviewed byte ceiling (sensitive when private mime types are listed), mapapi ranks the page api endpoints by frequency, json share and payload stability, and extractapi replays a captured endpoint with reviewed overrides and extraction paths, read only when the replay verb is read; the network view lists every exchange with correlation ids, live channel state, event names and poll cursors, and payload values, header values and body bytes never enter the audit trail. | | Network control | The agent takes the steering wheel with consent: blockrequest registers reviewed block rules with origin patterns and the explicit reviewed flag behind the blockgate, mockresponse serves reviewed fixtures with their full body, rewriteheaders applies set, append and remove header rules with audited provenance, setcookies, readcookies and clearcookies run behind the cookiegate through the page cookie jar of the granted domain, authflow runs a reviewed oauth flow with a consent tab, code capture on the granted redirect origin, token exchange and refresh behind storage ids, saveapikey stores key entries behind explicit consent with last use timestamps, routeproxy applies a run-scoped route with a bypass list behind the proxygate, and postform and postfiles submit rate limited urlencoded forms and streamed multipart uploads of reviewed files; every rule reverts the moment the run ends, fails or is cancelled, and header values, cookie values, key material, token values and file contents never enter the audit trail. | | Run timeline | The agent records what pages say and how they misbehave: watchconsole captures console output at every reviewed level through page-injected console hooks with a required redaction pattern list applied before any text leaves the page bridge, object arguments serialize through a reviewed depth bound, spam detection collapses repeats into counts with flagged thresholds and log rotation moves overflow to the reviewed target store without data loss, watcherrors captures javascript errors with stack frames, unhandled rejections with reasons and resource load failures with element context behind the stack gate, and watchtasks observes longtask entries with attribution names and blocking duration per step window; every watch runs read only behind the timeline gate that scopes capture to the run tab with a reviewed window kept inside the reviewed wait budget, console capture prompts once per origin, watchers cancel on run cancel and the killswitch and detach when the tab navigates or closes, failed requests of the run join the timeline, and the console diff view compares two runs into added, removed and repeated lines while level count summaries survive the retention window. | | Debugger attach | The agent attaches a devtools-style session with consent: attachcdp enables only the reviewed domains of the reviewed domain grammar behind the debuggate and the per origin debugger consent prompt that shows the domain allowlist, every attach carries its reviewed teardown plan of revert steps and resume policy, cdpcmd sends raw reviewed commands of the Domain.method form that serialize per session in send order with duration and error class results (protocol errors fail the step), watchcdp forwards matched domain events into the run timeline for a reviewed lifetime window, setbreakpoint registers reviewed instrumentation hooks with conditions of the reviewed expression grammar behind the user configured breakpoint ceiling, stepcode steps paused probes through stepover, stepinto, stepout and resume while capturing pause states with call frames and the dom snapshot through the page bridge, watchexpr evaluates reviewed expressions at every pause and stores the values with their pause scope, and overridescript applies reviewed page script fixtures on new document evaluation that revert at run end; the debugger permission deliberately stays outside the manifest, so the whole family runs through the page-instrumented harness injected by the scripting api with the honest derivation recorded on every session, every breakpoint and override reverts on run end, failure, cancellation, tab navigation and the user detaching the debugger — which pauses the run for review — and command params, fixture sources and token values never enter any report or the audit trail. | | Profiling | The agent measures what the run is made of with consent: measureflow marks the start and end of every step of the reviewed flow window and measures navigation, paint, largest contentful paint, first input delay, interaction timings and the blocking time summed per step window from the performance buffers, heapshot snapshots the used and limit heap bytes with the dom node count on demand under the user chosen interval only, trackmemory samples the heap beside every following step, computes the growth trend slope and flags the steps above the reviewed slope with timeline warnings, profilecpu ranks the hot functions of the profiled window by accumulated sampled time, watchshifts records layout shift scores with their impacted selectors, traceload records a trace under the reviewed category list that stops at the reviewed window end and exports through the reviewed download flow under the user configured byte ceiling, annotatetrace aligns step ids and labels with the run timeline so exported traces never lose their annotations, replaytrace renders the stored file offline grouped by category and step, and capturesourcemaps fetches and parses the map files of the loaded same origin scripts behind the per origin consent with stack rewriting through a minimal mapping lookup; every profiling kind runs behind the targetgate with the approved debugger grant of the origin, attachcdp accepts reviewed iframe, worker and service worker targets with flattened sub sessions inside the granted origins, the heavy bytes expire after the user configured profile retention while the counts, hot functions, category lists and annotations survive, and the debugger permission deliberately stays outside the manifest — every derivation is recorded on each record and the changelog says so. | | Emulation | The agent wears reviewed masks with consent: emulatedevice applies a user curated device preset of width, height, pixel ratio and the mobile flag to the run tab and reloads only when the reviewed plan asks, emulatenetwork applies latency, download and upload bounds and the offline window of the reviewed plan to the traffic the extension itself initiates, emulatelocate overrides navigator geolocation with the reviewed coordinates behind an explicit per origin location consent whose prompt shows the exact latitude and longitude, setuseragent applies the reviewed user agent string, platform and brand list together scoped to the run tab only, overridepermission answers navigator permission queries of the reviewed browser permission set with the granted, denied or prompt state graded by name while the prior state restores at run end, and blackboxscripts marks third party url patterns as blackboxed in traces and hides their frames from captured stack traces, read only; every emulation kind runs behind the emugate (live session on the run tab, approved plan, the explicit reviewed flag and a reviewed revert plan beside every layer), layers stack only while the reviewed plan lists their steps with the last applied winning conflicts, every layer records the prior page state for the exact revert and the whole stack reverts in reverse order at run end, failure, cancellation, tab navigation and tab drop, the emulation state survives service worker restarts through the run record, the device, network, location and agent preset libraries stay user curated data with versioned import and export files through review, and the reverted prior states expire after the user configured retention while the layer history always survives — the debugger, geolocation and notifications permissions deliberately stay outside the manifest, so every mask is a page-injected derivation recorded honestly on each layer and in the changelog. | | Session memory | Every run becomes survivable with consent: persiststate checkpoints the task state of the run after every completed step with a checksum that detects corruption before any resume and the run resumes from the checkpoint after a service worker or browser restart, capturesession snapshots the full browsing session beyond tabs and windows into per tab scroll positions, non password form state, and the local storage and cookie names of granted origins through the reviewed section toggles, restoresession reopens the saved tabs in their recorded order with the scroll and form state restored behind an explicit restore review that lists every tab, form field and capture first and skips origins whose grants expired with a report, namedsessions files sessions under unique names, folders and tags, diffsessions classifies tab, url, form and storage changes of two saved sessions as read only evidence, searchsessions matches urls, titles, names and captured text inside a reviewed time window, exportsessions packs records into a versioned checksummed session file through the reviewed download flow and importsessions adds records only after the full record review of the known format version — the auto snapshot interval, snapshot count, expiry and retention stay pure user choices with no code ceiling, crash restore prompts stay inside the session consent model, and the manifest permissions stay unchanged. | | Workflow engine | Steps compose into workflows with consent: composeworkflow validates the name, version, granted HTTPS origins, steps and reusable blocks, expands every nested block before review so no step stays hidden, grades the record by its worst step and freezes it, savetemplate shares one reviewed step across workflows, runworkflow executes the expanded list one step at a time behind the live session, approved plan, origin grants and the explicit run review flag with a checkpoint after every completed step that survives service worker restarts, dryrun evaluates every step read only through per kind projections and refuses mutation steps without one, delay sleeps a seeded jitter window with long delays riding the alarms api when the browser exposes it, waitelement polls a selector until appearance, the reviewed timeout or a clean abort on tab navigation, compute evaluates expressions of arithmetic, comparison, logic, text, contains and length operators with operand coercion, and extractvars stores regex named captures as variables with the no match case reported honestly — typed scopes stack per block with shadowing, bindings link earlier outcomes to named variables, ${name} interpolation substitutes scope values into targets, values and options, and 1.1.51 adds the control flow family: condition evaluates a reviewed boolean expression over the extracted values with no page side effect, branch chooses the first matching path by page state (pageurl, pagetitle and pageready) with a mandatory else path so every branch terminates, loop, repeatuntil, whileloop and foreach iterate lists, convergence conditions, bounded while conditions and matched elements rebinding the deep copied item and index variables per iteration inside user configured safety bounds with no code ceiling, parallel runs branches concurrently in isolated scopes that the join merges under the first, last or fail strategy over conflicting writes with cancel or continue on branch failure, and trycatch wraps fragile steps with a catch handler, rerun option, retry policy of user configured attempts over fixed or exponential seeded backoff and the reviewed error classes, and per step and per run timeout budgets whose aborts carry the cancelled error class — composition validates every control payload, collects every nested child step so no construct hides a step and grades the record by its worst child, single step execution runs one chosen step outside the run loop, pause, resume and cancel record their reasons, runlogs keep under the user configured retention with no code ceiling, control decisions persist for audit, and the manifest permissions stay unchanged. | | Triggers and scheduling | Reviewed workflows start themselves with consent: visitrule fires on navigations to reviewed HTTPS origins, urlrule matches glob patterns where * spans one path segment and ** spans across segments with explicit ports honored, menurule binds a context menu entry, keyrule binds a keyboard shortcut command, buttonrule binds the toolbar button, cronrule schedules five field cron expressions with named weekdays and months and optional timezones resolved through the runtime database, intervalrule fires every reviewed period with a seeded jitter spread, urllistrule plans one run per url of a reviewed list, webhookrule verifies a shared secret over the entropy floor and a payload schema in constant time before anything persists, and eventrule subscribes to observed page events of the catalog (mutate, focus, banner, console, error, navigate) — every rule arms behind the explicit arm review that renders its match fields and bound workflow first, grades sensitive, and every launch re-passes the live session, approved plan and origin gates through the same run machinery as a reviewed runworkflow step with the triggering url, title and payload as seed variables; cooldown windows, interval periods with jitter and the fire record retention stay user choices with no code ceiling, the dedupe keeps one pending fire per rule while a run is active, the queue holds fires that arrive while the run is busy or the session is paused and drains in arrival order on resume, the manual run step preview renders every expanded step with its control summaries before confirmation, scheduling persists through chrome.storage and opportunistic wakes with the alarms api riding the browser only when exposed without a declared permission, and the manifest permissions stay unchanged. | | Workflow editor | Reviewed workflows get a visual home with consent: the canvas renders steps as nodes with typed binding sockets and blocks as containers with nested child steps, drag and drop snaps onto the reviewed grid and the nearest block column, the palette lists curated drop blocks across actions, control flow, waits, variables and triggers with search, the step library browses every reviewed kind grouped by category with its option schema, the step inspector edits options, bindings and nested params, the variable inspector lists scopes and values, the mini map projects the full canvas with click navigation and the zoom keeps step labels readable, undo and redo cover every canvas edit, and every save passes the editorsavegate of a live session, an approved plan, unique node ids, forward only edges and the full composeworkflow grammar so no editor artifact bypasses review — breakpoints mark any step for debug runs that pause before it and resume exactly there, version timelines carry change notes with diffs of added, removed and changed steps and rollbacks that grade unreviewed until the rollback review approves them, imports grade unreviewed until the import review approves the expanded step list, exports and share bundles ship as json or yaml with the export content review refusing any secret, token, api key, password or authorization field so secrets never leave the browser, background runs keep executing with the panel closed while every step checkpoints and every worker wake restores them through the same gates, the watchdog recovers stalled runs by the user configured retry, pause or cancel and reaps zombie runs of browser shutdowns with thresholds and windows as pure user choices with no code ceiling, run history keeps outcome, duration and trigger cause under a user configured retention, and per site overrides adjust only the reviewed knobs of loop bounds, step and run timeouts, element wait timeouts and delay bases per https origin pattern or subdomain glob — no new action kinds, the manifest permissions stay unchanged. | | Multi agent swarm | Several agents work at once over one shared context with consent: each agent binds to its own tab with its own role (planner, worker, observer, critic, verifier or any custom role, one agent per tab), the shared task queue carries user configured lanes, priorities, claims and work stealing inside one approved swarm with lane ownership rules, dead agents release their tasks through claim heartbeat expiry and requeue, agent mailboxes route direct, broadcast and role addressed messages, the blackboard holds the goals, facts, findings and scratch sections every agent reads with the consent class of the source extraction, per agent budgets halt at the user configured token, cost and step ceilings, per agent scopes stay inside the session grants, sub agents spawn under a user configured depth limit, and the killswitch halts every agent at once with no configuration barrier — no agent count, lane or ceiling is hardcoded and every agent proposal passes the same human review. | | Multi agent orchestration | The swarm organizes itself under consent: a leader worker topology elects its leader by the user rule (first registration or one named agent) with worker, critic and verifier lanes, the leader slices tasks across workers and scales the worker lane by load under the user configured bound with no engine cap, the planner executor split keeps plan drafting and execution in different agents while the executor reports every step outcome back, critics review agent outputs read only with verdicts and required changes, verifiers mark result claims pass or fail with the method they used, tab handoffs move a task between agents mid run from its packaged state while preserving the original session grants, resource locks keyed by one origin and one selector serialize parallel writes with exclusive and shared kinds and expiry sweeps, conflict scans detect overlapping writes with a suggested ordering, parallel results merge into one report under first, last, preferagent or fail rules with provenance for every merged value, escalations lift stalled decisions to the user who alone decides them, arbitration orders competing lock claims by the user rule, consensus rounds carry at the user configured quorum, verified lessons land on the blackboard, shared cost accounting sums the per agent usage, and the progressboard shows every agent at once with the interleaved timeline and replay — coordination never bypasses the review. | | Fleet control | The 1.1.72 family gives the fleet control and accountability: every agent registers through agentname into a fleet registry of agentrecords with unique lowercase names, roles and home origins (the reserved identities never belong to an agent) while every session, run and step attributes to its agentid, the agentscope narrows the action kinds and origins to the session grants with a read only observer scope, the per agent budget grants from user configuration with no hardcoded cap and spends one unit per executed step with refusal past the ceiling and a remaining report, pauseagent holds one agent without stopping its peers or touching their run records, the engagekillswitch cancels every agent run, clears every queue and stops every record in one user triggered call with one audit event per stopped agent (an agent never triggers it and a pause never shields an agent from the stop), escalations block the raising agent until the human answers with the step context beside the agent question, review records carry one agent output to a peer of the shared origin with the verdict recorded beside the original output forever, every completed agent run captures its runreplay under the user retention and reconstructs from the audit trail when the memory is gone, outputcompare aligns two competing outputs field by field into matching, conflicting and missing, and the consensusvote collects one vote per agent under the user quorum with the dissent kept — outputcompare and consensusvote grade read only and never touch the page, and no fleet path ever bypasses a review. | | Agent work | The 1.1.73 family scales the coordination itself: sub agents spawn on demand under the user configured depth limit with the parent scope copied into the child unless narrowed (a narrowing that widens past the parent refuses and a subset gate re-validates every child scope), parallel results aggregate into one report with per agent sections, run provenance and conflicts resolved by the user configured policy order or sent to the escalation, the interleaved timeline orders the actions of every agent into one merged view with the per agent lanes kept visible for the audit, lessons of finished runs spread across the fleet with origin matched serving, reuse counts, secret refusal, sanitization before storage and user configured decay, resources arbitrate under prioritized lanes (the first requester holds by default, a higher priority lane wins the verdict, the release frees the resource when the holder finishes and the verdict never bypasses the sessionlock or the origin grants), the priority lanes keep sensitive steps in the interactive lane and prevent lane starvation through the round robin fallback, workers scale by site load through the collected load reports with spawn and pause suggestions that never act without the user consent, and the shared cost ledger attributes every unit to its requesting agent while shared costs split equally among their causers — no work path ever bypasses a review. | | Navigation intelligence | The 1.1.74 family moves through the page with prediction and proof: navintent reads the approved plan in step order, weighs every navigation candidate by the urlhistory of the run and ranks the predicted next urls by the combined confidence while navintent and prefetchpage grade read only observations that issue no request of their own, prefetchpage warms only the granted urls through speculative dns with no mutating request ever firing during the warming and drops every stored prediction the moment the plan it came from changes, preconnectorigin opens read only and revocable sockets to the expected origins ahead of the steps under the host grants, deeplinkapp builds the common web app routes (github, youtube, maps, wikipedia, amazon, x beside the user stored patterns) from the reviewed parameters only after the pattern origin grant, every tab removal lands a closedtabrecord under the user retention window and reopentab restores it after the grant recheck (a record whose origin lost its grant refuses and a reopened record never reopens twice), restoretrail rebuilds the navtrail of the run from the urlhistory with duplicates folded and replays it into one fresh tab behind the audit consent, pausenavconsent freezes every navigation kind while a consent prompt is open and queues the pending navigation until the answer, navratelimit counts every navigation per domain inside the user configured sliding window and delays a full window by naming the wait in the response envelope instead of dropping it silently, openclipboardurl opens the clipboard url only behind the explicit user gesture and the origin grant, checksafeurl refuses the weak schemes, embedded credentials, private and raw hosts and the lookalike hosts that imitate a granted origin with the reasons shown before anything opens, and batchopenlinks verifies every url, bounds the batch by the user ceiling only and opens one tab per link across the rate windows — no window, ceiling or retention is ever hardcoded and no navigation path bypasses a review. | | Data pipelines | The 1.1.75 family grows the extraction into full data pipelines: streamdisk streams the large extracts to disk chunk by chunk under the user chosen chunk size with only the active chunk riding the write, the rows and the bytes reported per chunk and the streamcursor checkpointed after every chunk while the streamgate allows the disk writes only through the reviewed download flow, the streamchunkgate bounds the chunk by the user ceiling only and the streamnamespacegate binds every stream file to the runid namespace, resumeextract continues an interrupted pipeline from its streamcursor by skipping the rows the offset and the persisted keys already cover while refusing a finished pipeline, a foreign cursor, another plan or another origin, transformvalues applies the reviewed rules (trim, case, number, date) one value at a time with the raw value always beside the transformed one and an unknown operation refusing without ever dropping a row, deduperows compares the configured key columns under the chosen normalization while the first occurrence stays and the dropped rows report by count and by key, samplerows previews the subset through the first, seeded random and stratified strategies without ever mutating the stored extract, sourcestamp attaches the url, the step and the capture time to every row and every cell while a stamped timestamp never rewrites, gridpreview projects the read only grid with its column kinds inferred from the sampled values, its sorting and filtering and its stamped, transformed and deduplicated marks behind the export confirmation gate, provlog keeps the append only provenance log with one entry per stream, transform, dedupe, sample and resume pass, its secret shaped summaries redacted before any entry lands and its provenance queries answered by row key, the provgate requires the provenance on every exported row, and the background runs the extract steps through the whole pipeline with the sidepanel grid view, the resume controls, the transform editing, the dedupe report and the provlog of a selected row while the popup counts the active pipelines per run — no chunk bound, retention or sample size is ever hardcoded and no pipeline path bypasses a review. | | Web api transports | The 1.1.76 family widens the transport surface to the web api: subevents runs the server sent events lifecycle through a stream open seam with every block parsed into its event, data, id and retry fields, the last event id persisted for the reconnect resume, a clean cancel and channel errors surfaced to the run state machine under the channel origin grant and the user configured subscription ceiling, longpoll issues the request the reviewed cursor builds, retries a timed out request under the user configured backoff and stops on the reviewed stop condition, the cancellation flag, the plan expiry or the reviewed poll ceiling with the timeout and backoff as user choices, graphqlsubscribeframe and parsegraphqlmessage map the graphql-ws subscription grammar (next, error and complete frames) into step results, formpost encodes the reviewed fields with the urlencoded content type and multipartpost streams the fields and files into ordered chunks under one boundary with per chunk upload progress and no whole payload buffering while an unreviewed file or an ungranted origin refuses before any byte moves, correlateids assigns one request id per outbound request of the run and joins the response pairs through the shared correlation id with the per run map exported to the audit trail read only, ratelimitdirectiveof parses the remaining, reset and retry-after facts into one directive per origin that ratelimitrespect sleeps before the next call so a call never crosses a limit the endpoint published, cacheresponse keys the per run entries by the run namespace, method, url and body hash while only read only methods store, credential carrying responses refuse through the cachegate and a mutation on the origin invalidates its entries, cacheserv serves the repeated reads with hit counters and cacheexpiryof derives the expiry from the cache-control, expires and user retention — no timeout, backoff, ceiling or retention is ever hardcoded and no transport path bypasses a review. | | Vision and ocr | The 1.1.77 family teaches the agent to see: imageocr reads the words with their boxes and confidences off a captured image through an ocr read seam and merges the word boxes into lines (the lowest word confidence drags its line down) and paragraphs by their own geometry, regionocr reads one sidepanel drawn ocrregion clamped into the viewport with the word boxes offset to absolute screenshot coordinates under the regionboundsgate, pdfocr reads one scanned pdf one page at a time through the rasterize seam with the streamcursor checkpointing after every page, frameocr refuses the frame of a playing video before any pixel moves and seeks a paused video to its reviewed position inside the user configured wait budget, visionshot carries the reviewed prompt with the image to the configured vision model and returns a visiondescription with labeled regions under the visiongate consent and the sensitive audit grade, cropshot scales the element crop with device pixel ratio awareness, redactshot applies a redactionmask through the mask fill seam before any sharing (the redactgate refuses an unredacted external share while proposeredactionmasks derives the proposals from the sensitive field shapes), groundshot scores the candidate elements by the averaged text and geometry match and returns the ranked selectors while the grounding feeds the observation vision block, pairshot pairs every screenshot with the nearest same viewport dom snapshot under the session boundary and pairquery searches the text of both sides, the visioncache stores every recognition and description by its image hash so repeated reads serve without a model call under the user retention window, and visioncost counts the model calls for the local costshare ledger — no recognition ships inside the extension, every model, endpoint, retention, budget and cache window stays the user's choice, and no vision path bypasses a review. | | Capture forensics | The 1.1.78 family records what a run changed: beforeafter pairs the pre and post captures around every action step through a capture grab seam (the same tabshot and the same redaction pipeline the capture steps ride) while a read only step skips its pre capture because a page a read never changed needs no before state, both captures link to the stepid they wrap and the pair records the heartbeat beat of the run under the forensicscopegate plan scope and the forensicsreadonlygate read only grade, consoletimeline collects the console entries in capture order with the stepid active at each entry and the run wide sequence numbers preserved across page reloads (the page bridge queues the hooked console lines behind the consented debugger capability and flushconsole hands them over on every step completion while the consolemaskgate keeps the masked text only), nettimeline attaches every traced request to the step running at its timestamp and joins the request with its response through the correlateids map of the run under the nettraceorigingate origin grants, diffbase freezes one stored screenshot for one page state under the user threshold with the diffbasegate user confirmation, diffshot compares a new capture against the baseline through the pixel diff seam with the changed regions merged from the changed pixel blocks, the similarity score between zero and one and the regression flag answering the user threshold alone (every sensitive step runs the comparison with the diffscore of the last step riding the proposal requestbody), thumbshot sizes the thumbnails inside the user edge with the aspect held and every thumbnailrecord linking back to its full capture, timelapse captures the changing page on the user interval with the timelapsegate explicit start and no code floor while the lapse stops on the duration end, the plan completion or the user stop and assemblelapse orders the frames for the playback, namecaptures builds the lowercase file names from the plan, step, timestamp and sequence parts of the user naming rule with a counter bump keeping them unique per run, and exportcaptures bundles the captures, the timelines, the diffs, the thumbnails and the lapse frames with the provlog provenance of every capture aboard under the captureexportgate explicit user action, the redactshot masks and the provenance refusal while the captureretentiongrade keeps the retention a user choice pruned only through the explicit cleanup pass — no threshold, interval, edge or retention is ever hardcoded and no forensic path bypasses a review. || Execution environments | Every reviewed step names where it runs with consent: the pagecontext keeps dom actions inside the live page because page events only fire there, the isolatedworld runs evaluate steps through the scripting api with reviewed arguments only while page globals stay unreachable from step code, the offscreenworker moves the six heavy parse families (html snapshots, network json payloads, table row reductions, accessibility tree shaping, complex selector evaluation and screenshot stitching) into an offscreen document worker pool behind the optional user granted offscreen capability with an inline fallback inside the page, and the sandboxframe renders untrusted markup inside a sandboxed page with no extension privileges after stripping scripts and event handlers and answering only per render nonces — the environment grants join the origin grants of the session, a keepalive port holds the service worker alive for the whole run of an approved plan with a heartbeat every user configured interval, the persisted run state resumes exactly the pending step after a service worker restart, zombie runs whose heartbeat fell silent reap past the tolerated intervals, a storage level run lock holds one session against concurrent runs, steps sharing one tab serialize across parallel branches, and every navigation lands a url history entry — no pool size, interval or tolerance is hardcoded and no environment ever bypasses the review. | | Data minimization | The 1.1.79 family keeps the data footprint the smallest it can be: localfirst processes every extraction on the device before any export with the identity fields stripped unless the reviewed plan listed them and the localrule fields of the origin held always because a field the user marked local never leaves the device (the localgate refuses any outbound payload that carries one at every boundary and the outboundpayloadcheck enforces the same refusal at the protocol boundary), the telemetrypolicy type fixes the enabled literal to false so an on state is unrepresentable by construction while every counter keeps living inside the local memory and the requestbody omits every telemetry field by construction, optinsync stays disabled until the user lists every data class and turns each one on with the consent stamp per class recorded for the audit trail, encryptsync derives the key from the user passphrase through the webcrypto seam (the passphrase never persists), encrypts every payload before the transport, stamps the format tag and refuses a sync without the passphrase while the syncgate requires the opt in and the encryptsyncgate refuses plaintext, purgeonrequest deletes the stored families by scope with the typed confirmation demanded for the full scope while the audit hashes survive and every deleted key enters the audit trail, exportall bundles the runs, memory, captures, settings and provenance into one portable file that streams without a size cap, the cookie jar arithmetic assigns one jar per task run with every cookie read and write bound to the active jar under the jargate, the jar sealing at the run completion under the user expiry window, cleanupafterrun clears the task artifacts under the user schedule while the flagged retention stays, and enforcequarantine holds every download in the sandbox folder until the scanner verdict releases or deletes it with the quarantineopengate blocking every open without a clean verdict — no cadence, delay, expiry, scope or timing is ever hardcoded and no minimization path bypasses a review. | | Security foundations | Automation runs behind a per origin allowlist under a denydefault posture that refuses every ungranted origin with exact origin matching and no wildcard expansion while the active tab counts as one explicit single origin grant; per site originprofiles grant and deny single action kinds, consentwindows bind every sensitive grant in time with a user chosen duration and a named boundary that never defaults to unlimited (a window past its boundary suspends the run mid step and renews only through a new explicit prompt), revokerun halts the pending step and every queued step as a terminal session event, sensitive kinds classify into the payment, credential, delete and publish classes refined by their options so each class needs one fresh consent prompt per origin, every decision lands in an append only immutablelog whose loghash chains each entry to its predecessor at append time and whose completion seal writes the final hash while the audit accessor verifies the chain and refuses reads of a broken link, and maskinputs keeps typed values, form values and stored values out of every log, observation and export behind the documented password, token, card and secret shapes the user extends. | | Security hardening | Secrets, messages and money run behind human gates: a secretvault keeps values behind a seam whose persisted records carry labels, scopes, provenance and digests only while the leak scan refuses plaintext secrets in plan texts and step options, redactshots mask sensitive capture regions across viewport, element and stitched captures, schemastrict rejects unknown fields of every registered inbound command with the path and expected shape, origincheck guards every runtime message and port connection while connectallow drops unknown senders from the user managed list that ships empty, ratelimit buckets defer automation commands past their user configured bound until the window resets, confirmpay, confirmdelete and confirmcreds hold payments (amount, payee origin, target), destructive deletions (target, scope, irreversibility) and credential use (label only) until one distinct human action resolves them with no timeout and no batch approval, phishguard blocks login origins whose lookalike distance to a granted origin crosses the user threshold and names the matched origin, safedefaults profile unknown origins as reads only, and the declared transparencypage lists every grant, consent window, sender, permdiff and vault label with a revoke action beside each grant. | | Session interface | The session becomes the primary interface: a sessiongrid lists every live and saved run with its origin set, step count, state, outcome, per tab lock state and seal hash link, historysearch indexes sessions, site notes and run summaries into one corpus with matched term highlighting, emptystate guidance covers every empty surface, errorsurface payloads classify failed step causes as page, network, policy or gate with retry hints that pass only through new reviewed dispatches, sitenotes keep one record per origin with sensitive bodies sealed at rest, the scratchpad holds append only per task entries with step provenance, runsummary distills completed runs inside the user configured window as an offscreen worker task, semanticrecall ranks past extractions by text similarity inside the run scope with run and step provenance, correctionmemory captures plan review edits and rejections, consentmemory keeps every grant, denial, expiry and revocation advisory, and cancelrun rolls only the queued steps back while the executed steps stay untouched in the sealed log. | | Interface surfaces | The interface becomes five surfaces: the popup command surface with the taskinput, the quick run actions and the commandpalette, the sidepanel workspace with plan, run and review tabs, the dashboardpage full page view, the optionspage gathering every setting and the onboarding walkthrough with its single consent scoped event; the commandpalette registers from every module, lists only the capability allowed commands, fuzzy searches ids, labels and keywords and ranks the recent commands first; the taskinput routes through the same proposal flow as the api with the active origin and page outline attached; plancards group by risk class with sensitive classes expanded, stepapprove resolves one step per distinct human action with approve, reject and edit written into the immutable log, diffpreview compares the observed before state with the predicted after state of write class steps with mask verdicts, the stepstimeline derives its nodes from progress with no new state, and the logstream chains live events with mask verdicts, verifies its chain as entries arrive and copies verified ranges as audit excerpts; one command bus routes every surface action through the same policy gates and one broadcast channel carries run state to every surface. | | Ecosystem part one | The 1.1.66 family opens the ecosystem: the flowlibrary browses, installs, forks and shares workflow templates behind schemastrict manifests with their kinds inside the installed capability set, their required grants surfaced as a diff that maps onto originprofiles before any import completes, a fresh consent for sensitive entries, unverified publishers quarantined and present publisher signatures verified against the manifest digest while every install lands as a pending import that still passes the same review; syncbridge hooks move manifests between machines behind an explicit opt in with no default on (the file provider through manual import and export payloads that never carry secrets or logs, the web provider an honest stub) with digest based conflicts surfacing both versions instead of a silent overwrite; the background run queue executes reviewed workflows with the keepalive signal held for their whole duration and its state persisted for restart recovery; the attentionfeed collects every gate wait, phishguard block, deferral and failure with its deep link, deduplicates repeated causes per run, ranks by severity and counts on the statusbadge; the runreplay walks a sealed verified chain step by step with the restored observation and capture of each step and its gate resolutions; and the outputcompare joins two runs that share a task input signature, grades agreement, divergence and duration deltas per step and highlights the first divergence without ever executing a step. | | Interface finishing | The 1.1.65 family completes the surface: the datagrid previews extraction results with inferred column types, local sort and filter and masked csv, json and clipboard exports; quickactions, user editable shortcutkeys and the omniboxtask parser shorten the path to a run behind the same gates; the statusbadge counts waiting gates on the toolbar icon while done and attention notifications carry deep links behind the content consent and the do not disturb respect; the recenttray and the stetoasts keep the user informed without watching; the pickeroverlay with stability scored selectors, the targethalo, the guidedtips, the shotpanel, the compareviewer and the pagechips cover selection and evidence with resolutions in the immutable log; and the siteprofiles, the darklight tokens, the locale bundles with english fallback, the importexport bundles that never carry secrets or unmasked logs, the dropimport detection, the featuretour stops and the localized a11ylabels round out the interface. | | Performance part one | The 1.1.68 family streamlines and caches the hot paths under review: lazymods keep the heavy parsers and the capture, compare and export families out of the startup path behind the same capability checks the eager path runs with a user prewarm set and a startup budget that reports without ever refusing; debouncedom coalesces scroll, input, resize and mutation storms per user configured window while batchquery folds repeated selectors into one offscreen worker pass; incrsnapshot computes deltas against the same run base with region fingerprints and the user cadence while an empty delta skips the recomputation in full; selcache caches selector resolutions per generation, revalidates hits before dispatch and refuses stale generations with a reviewed retry hint; virtlist renders the datagrid, the logstream, the stepstimeline and the compareviewer through a virtualized window with measured height maps; streamparse tokenizes oversized pages chunk by chunk inside the worker pool without ever holding the full text; chunkextract slices big tables into resumable fingerprint verified row windows; the worker queue gains backpressure that defers instead of refusing and cancels abandoned tasks of a halted run; every step records a perf record with duration, queries, cache hits and provenance beside its outcome — every window, depth, cadence and budget stays the user's choice and no performance path bypasses a review. | | Performance part two | The 1.1.69 family paces, measures and bounds the run under review: batch run queues pause their enqueueing past the user backpressure window while every queued step stays queued, every domain runs at most its user concurrency slots with the overflow queued per lane, politedelay spaces batch requests per domain above the siteprofile floors with jitter, adaptivepoll widens and narrows its interval inside the user floor and ceiling, requestcoalesce merges identical pending queries into one dispatch whose result fans out to every waiter, and the snapshot cadence widens under memory pressure and restores when it clears; the runbudget tracker reports the step usage and the memory pressure against the user budgets with budgetalerts that report at the warning threshold and pause the run pending a user choice at the critical threshold, timeoutcancel aborts a slow step at the user bound with its cancel event recorded in the immutable log, and tabsuspend suspends an idle tab only during a wait longer than the user window with the run state preserved across the restore; the runcache serves repeat fetches of one run by digest and clears at the run end unless the user pins the profile cache, stepprefetch warms only the pages and selectors the reviewed plan names, efficientresume checkpoints every step boundary and revalidates the page fingerprint before it resumes, navdedupe skips navigations to the already active url, and sessionreuse attaches an authenticated profile only through its per profile consent prompt with the cookies isolated per task; the durationmeter writes monotonic step samples into the perf records, the selectorprofile flags the selectors above the user latency threshold, steptrace spans nest per step and per worker task and export as one trace file, the startupmeter measures the cold start against the user target, artifactcompress keeps stored bytes deflated at rest with lazy reads, logprune removes whole sealed runs past the user windows only, batteryaware defers non urgent scheduled runs on a low battery, networkaware retries honor the server signals, readparallel groups independent reads into parallel lanes and slowmo replays a recorded run at the user factor with its pauses linked to their steptrace spans — every limit, delay, window and budget stays the user's choice, the pause waits for the user, and no scheduling path ever bypasses a review. | | Resilience | The 1.1.70 family survives every interruption: approved plans open runrecords tracked by the runstatemachine through queued, running, paused, awaitingapproval, completed, failed, cancelled and rolledback, queue offline with monotonic sequences when the endpoint is unreachable and replay in order once connectivity returns while expired plans fail for the audit trail, steps carry idempotencykeys so replays deduplicate, checkpoints capture the completed steps with a page digest and resume only against the matching page, heartbeats time the running runs with the zombiecheck reaping the silent ones, failed runs offer typed rollback compensations that run only behind the explicit user choice inside the approved origin, and cancellations pair with their optional rollback — the heartbeat window, the queue depth and the failed run retention stay user choices and no recovery path bypasses a review. | | State depth | The 1.1.71 family makes the run state observable and safe: every run keeps its own urlhistory of urlvisit records with the final url after redirects and consecutive duplicates folded inside the approved origin, the runtimeline merges the step results, the audit events and the visits into one ordered stream with phase buckets rendered read only, tabisolate namespaces the run memory per tabid, the sessionlock serializes concurrent runs on one session while naming its holder and expiring its abandoned locks under the user window, memory items carry provenance and user configured expiry with the purge behind an explicit confirmation and its summaries kept for the audit trail, encryptrest encrypts the sensitive classes at rest through the webcrypto derived key whose secret entry stays a consent prompt, quotawatch ranks the cleanup candidates and reclaims bytes only behind the per batch approval, and the auditexport streams the whole bundle without a size cap behind the explicit user action — no window, interval or lifetime is ever hardcoded and no state path bypasses a review. | | Any LLM connection | Any model drives the extension with consent: the user connects a gateway, a base url, an api key and any model — nothing is hardcoded, no provider allowlist exists and the openai chat completions, openai responses, anthropic messages and google gemini shapes are protocol styles the user picks; model routes map task kinds to provider and model pairs with user configured fallbacks, a local loopback endpoint keeps sensitive work on the machine, natural language commands parse into intents with entities and confidence, model drafted plans lint against the action grammar and pass the same human review (draft review plus plan review) local plans pass, failed runs replan their tail under a fresh review, executed steps reflect their lessons into the next prompt, cost budgets halt at the user configured token and currency ceilings and ask, the prompt library versions user templates with consent notices, and the guardrails strip code fences, validate model text against the schema, retry and refuse invalid output before anything executes. | | Agent protocol | The browser becomes a tool server with consent: the mcp server of the agent protocol lists every reviewed browser, workflow, memory and system tool over tools/list with its version, json schema inputs, risk grade and full consent metadata, negotiates capabilities and the per client tool floor with any client the user pairs, frames messages in json rpc with newline delimited and http post envelopes, and answers parse, method, params, internal and consentrefused errors with their codes — read only tools run under the dryrun risk class once the session is approved while every tool with side effects executes exactly the approved plan step it names, so no paired client widens what the human approved; the stdio bridge relays frames for local client processes through the native messaging host manifest with restart on demand, the http listener binds localhost by default with any other bind graded sensitive behind the explicit remote review, the server starts only after the user enables it, and the bind, port, transports, frame size, queue depth and call retention all stay user configured with no code ceiling. Since 1.1.55 the stream http transport opens for remote clients behind the full remote gates: one time pairing codes exchanged for session tokens that persist only as sha-256 digests, token scopes per namespace, a client allowlist with grant history, tls required for any non localhost transport with user configured certificate fingerprints, an ordered frame intake where tls terminates before token verification and namespace checks run before consent checks, auth failures that answer with one fixed message leaking no pairing state, a user configured client ceiling, and approval gates that hold every sensitive remote call with its full arguments (secret fields redacted) until the user decides — refusing by default when the configurable window closes. | | Files and downloads | The agent moves bytes with review: batchdownload downloads reviewed url lists in waves under a user configured concurrent window with per file states and sequence suffixes for filename conflicts, pausedownload and resumedownload walk the queue through the downloads api, verifydownload compares state, size and checksum against reviewed expectations, interceptmime arms include, exclude and deny default mime filters that reroute matching downloads into quarantine, exportnetlog exports the step correlated network log with every header value redacted, readclipboard needs an approved single use consent prompt per read and never persists the payload text, writeclipboard writes reviewed text through the page bridge with payload hashes for audit, copyscreen copies the visible tab to the clipboard, quarantinedownload and scanvirus keep files outside the downloads folder until a clean scan verdict releases them, namecaptures stamps task, step and sequence filenames with per task counters, and cleanupartifacts sweeps artifacts by reviewed age and kind rules while keeping open review references. | | Datasets and exports | The agent turns pages into data with audit: scrapetable reads tables into normalized column keys with rowspan and colspan expansion and nested child datasets, paginateextract follows next controls while waiting for fresh rows, mergepages aligns columns across pages, transformvalues applies reviewed expressions with per rule error surfacing, deduperows deduplicates by reviewed keys, stamplerows stamps every row with its source url, timestamp and step ref, previewgrid previews the grid before export, importcsv parses quoted csv with column mappings for fill loops, looprows interpolates {{column}} row variables into the wrapped inner step, exportcsv, exportjson and exportexcel write checksummed artifacts into the task artifact store with provenance records, copytable uses the clipboard under the optional clipboardWrite capability, pushsheets pushes only to a reviewed HTTPS endpoint behind its origin grant and the explicit reviewed flag, streamdisk streams chunk by chunk with backpressure and a persisted resume state, resumeextract continues an interrupted extraction from its stored cursor, and logprovenance logs provenance for audit; exports refuse to leave local memory while the session origin grants do not cover the active origin. | | Tabs and windows command | The agent commands the whole browser surface with review: querytabs resolves reviewed url, title, id and pattern matchers against the live tab set, closepattern closes matching tabs only under the explicit reviewed flag, pintab, mutetab, movetab, movetabwindow, duplicatetab, reloadtabs, discardtab, zoomin, zoomout and switchtab mutate tabs, grouptabs, colorgroup and collapsegroup keep group registries, savelayout and restorelayout save and restore named tab layouts with window bounds, snapshotsession and reopenrun capture and reopen whole runs, watchtab observes title, activation and closure events, findclones, searchtabs and listaudio enumerate the surface read only, badgetab and attachmeta route task state per tab, and maximizewindow, minimizewindow, restorewindow, focuswindow, scratchwindow and incognitowindow command windows with incognito separated from grant inheritance. | | Navigation mastery | The agent moves anywhere with review: openlink, openprivate, reopentab, deeplink and openclipboard open reviewed targets in resolved containers, followlink, spanav, spawait, waitload and waiturl navigate pages and single page app routes, rewritequery and setfragment edit the current url, navlist walks a reviewed url list with per entry progress, navprofile applies per site wait profiles, checksafe verifies urls before unreviewed origins open, batchopen opens curated lists with per url safety states, navrate enforces per domain rate limits with user configured windows and ceilings, and the navigation trail, redirect chains and final urls stay recorded for audit. | | Observation depth | The agent sees the whole page read only: the accessib